Merge remote-tracking branch 'qatar/master'

* qatar/master: (51 commits)
  cin audio: use sign_extend() instead of casting to int16_t
  cin audio: restructure decoding loop to avoid a separate counter variable
  cin audio: use local variable for delta value
  cin audio: remove unneeded cast from void*
  cin audio: validate the channel count
  cin audio: remove unneeded AVCodecContext pointer from CinAudioContext
  dsicin: fix several audio-related fields in the CIN demuxer
  flacdec: use av_get_bytes_per_sample() to get sample size
  dca: handle errors from dca_decode_block()
  dca: return error if the frame header is invalid
  dca: return proper error codes instead of -1
  utvideo: handle empty Huffman trees
  binkaudio: change short to int16_t
  binkaudio: only decode one block at a time.
  binkaudio: store interleaved overlap samples in BinkAudioContext.
  binkaudio: pre-calculate quantization factors
  binkaudio: add some buffer overread checks.
  atrac3: support float or int16 output using request_sample_fmt
  atrac3: add CODEC_CAP_SUBFRAMES capability
  atrac3: return appropriate error codes instead of -1
  ...

Conflicts:
	libavcodec/atrac1.c
	libavcodec/dca.c
	libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 89 insertions, 28 deletions

diff --git a/libavcodec/binkaudio.c b/libavcodec/binkaudio.c
index 2d06aaa9e9..b1e4de2711 100644
--- a/libavcodec/binkaudio.c
+++ b/libavcodec/binkaudio.c
@@ -39,6 +39,8 @@
 
 extern const uint16_t ff_wma_critical_freqs[25];
 
+static float quant_table[95];
+
 #define MAX_CHANNELS 2
 #define BINK_BLOCK_MAX_SIZE (MAX_CHANNELS << 11)
 
@@ -56,8 +58,11 @@ typedef struct {
     unsigned int *bands;
     float root;
     DECLARE_ALIGNED(32, FFTSample, coeffs)[BINK_BLOCK_MAX_SIZE];
-    DECLARE_ALIGNED(16, short, previous)[BINK_BLOCK_MAX_SIZE / 16];  ///< coeffs from previous audio block
+    DECLARE_ALIGNED(16, int16_t, previous)[BINK_BLOCK_MAX_SIZE / 16];  ///< coeffs from previous audio block
+    DECLARE_ALIGNED(16, int16_t, current)[BINK_BLOCK_MAX_SIZE / 16];
     float *coeffs_ptr[MAX_CHANNELS]; ///< pointers to the coeffs arrays for float_to_int16_interleave
+    float *prev_ptr[MAX_CHANNELS];   ///< pointers to the overlap points in the coeffs array
+    uint8_t *packet_buffer;
     union {
         RDFTContext rdft;
         DCTContext dct;
@@ -107,6 +112,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
     s->block_size    = (s->frame_len - s->overlap_len) * s->channels;
     sample_rate_half = (sample_rate + 1) / 2;
     s->root          = 2.0 / sqrt(s->frame_len);
+    for (i = 0; i < 95; i++) {
+        /* constant is result of 0.066399999/log10(M_E) */
+        quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
+    }
 
     /* calculate number of bands */
     for (s->num_bands = 1; s->num_bands < 25; s->num_bands++)
@@ -126,8 +135,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
     s->first = 1;
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
-    for (i = 0; i < s->channels; i++)
+    for (i = 0; i < s->channels; i++) {
         s->coeffs_ptr[i] = s->coeffs + i * s->frame_len;
+        s->prev_ptr[i]   = s->coeffs_ptr[i] + s->frame_len - s->overlap_len;
+    }
 
     if (CONFIG_BINKAUDIO_RDFT_DECODER && avctx->codec->id == CODEC_ID_BINKAUDIO_RDFT)
         ff_rdft_init(&s->trans.rdft, frame_len_bits, DFT_C2R);
@@ -152,11 +163,18 @@ static const uint8_t rle_length_tab[16] = {
     2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16, 32, 64
 };
 
+#define GET_BITS_SAFE(out, nbits) do {  \
+    if (get_bits_left(gb) < nbits)      \
+        return AVERROR_INVALIDDATA;     \
+    out = get_bits(gb, nbits);          \
+} while (0)
+
 /**
  * Decode Bink Audio block
  * @param[out] out Output buffer (must contain s->block_size elements)
+ * @return 0 on success, negative error code on failure
  */
-static void decode_block(BinkAudioContext *s, short *out, int use_dct)
+static int decode_block(BinkAudioContext *s, int16_t *out, int use_dct)
 {
     int ch, i, j, k;
     float q, quant[25];
@@ -169,17 +187,22 @@ static void decode_block(BinkAudioContext *s, short *out, int use_dct)
     for (ch = 0; ch < s->channels; ch++) {
         FFTSample *coeffs = s->coeffs_ptr[ch];
         if (s->version_b) {
+            if (get_bits_left(gb) < 64)
+                return AVERROR_INVALIDDATA;
             coeffs[0] = av_int2flt(get_bits(gb, 32)) * s->root;
             coeffs[1] = av_int2flt(get_bits(gb, 32)) * s->root;
         } else {
+            if (get_bits_left(gb) < 58)
+                return AVERROR_INVALIDDATA;
             coeffs[0] = get_float(gb) * s->root;
             coeffs[1] = get_float(gb) * s->root;
         }
 
+        if (get_bits_left(gb) < s->num_bands * 8)
+            return AVERROR_INVALIDDATA;
         for (i = 0; i < s->num_bands; i++) {
-            /* constant is result of 0.066399999/log10(M_E) */
             int value = get_bits(gb, 8);
-            quant[i] = expf(FFMIN(value, 95) * 0.15289164787221953823f) * s->root;
+            quant[i]  = quant_table[FFMIN(value, 95)];
         }
 
         k = 0;
@@ -190,15 +213,20 @@ static void decode_block(BinkAudioContext *s, short *out, int use_dct)
         while (i < s->frame_len) {
             if (s->version_b) {
                 j = i + 16;
-            } else if (get_bits1(gb)) {
-                j = i + rle_length_tab[get_bits(gb, 4)] * 8;
             } else {
-                j = i + 8;
+                int v;
+                GET_BITS_SAFE(v, 1);
+                if (v) {
+                    GET_BITS_SAFE(v, 4);
+                    j = i + rle_length_tab[v] * 8;
+                } else {
+                    j = i + 8;
+                }
             }
 
             j = FFMIN(j, s->frame_len);
 
-            width = get_bits(gb, 4);
+            GET_BITS_SAFE(width, 4);
             if (width == 0) {
                 memset(coeffs + i, 0, (j - i) * sizeof(*coeffs));
                 i = j;
@@ -208,9 +236,11 @@ static void decode_block(BinkAudioContext *s, short *out, int use_dct)
                 while (i < j) {
                     if (s->bands[k] == i)
                         q = quant[k++];
-                    coeff = get_bits(gb, width);
+                    GET_BITS_SAFE(coeff, width);
                     if (coeff) {
-                        if (get_bits1(gb))
+                        int v;
+                        GET_BITS_SAFE(v, 1);
+                        if (v)
                             coeffs[i] = -q * coeff;
                         else
                             coeffs[i] =  q * coeff;
@@ -231,8 +261,12 @@ static void decode_block(BinkAudioContext *s, short *out, int use_dct)
             s->trans.rdft.rdft_calc(&s->trans.rdft, coeffs);
     }
 
+    s->fmt_conv.float_to_int16_interleave(s->current,
+                                          (const float **)s->prev_ptr,
+                                          s->overlap_len, s->channels);
     s->fmt_conv.float_to_int16_interleave(out, (const float **)s->coeffs_ptr,
-                                          s->frame_len, s->channels);
+                                          s->frame_len - s->overlap_len,
+                                          s->channels);
 
     if (!s->first) {
         int count = s->overlap_len * s->channels;
@@ -242,16 +276,19 @@ static void decode_block(BinkAudioContext *s, short *out, int use_dct)
         }
     }
 
-    memcpy(s->previous, out + s->block_size,
-           s->overlap_len * s->channels * sizeof(*out));
+    memcpy(s->previous, s->current,
+           s->overlap_len * s->channels * sizeof(*s->previous));
 
     s->first = 0;
+
+    return 0;
 }
 
 static av_cold int decode_end(AVCodecContext *avctx)
 {
     BinkAudioContext * s = avctx->priv_data;
     av_freep(&s->bands);
+    av_freep(&s->packet_buffer);
     if (CONFIG_BINKAUDIO_RDFT_DECODER && avctx->codec->id == CODEC_ID_BINKAUDIO_RDFT)
         ff_rdft_end(&s->trans.rdft);
     else if (CONFIG_BINKAUDIO_DCT_DECODER)
@@ -270,25 +307,47 @@ static int decode_frame(AVCodecContext *avctx,
                         AVPacket *avpkt)
 {
     BinkAudioContext *s = avctx->priv_data;
-    const uint8_t *buf  = avpkt->data;
-    int buf_size        = avpkt->size;
-    short *samples      = data;
-    short *samples_end  = (short*)((uint8_t*)data + *data_size);
-    int reported_size;
+    int16_t *samples      = data;
     GetBitContext *gb = &s->gb;
+    int out_size, consumed = 0;
+
+    if (!get_bits_left(gb)) {
+        uint8_t *buf;
+        /* handle end-of-stream */
+        if (!avpkt->size) {
+            *data_size = 0;
+            return 0;
+        }
+        if (avpkt->size < 4) {
+            av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+            return AVERROR_INVALIDDATA;
+        }
+        buf = av_realloc(s->packet_buffer, avpkt->size + FF_INPUT_BUFFER_PADDING_SIZE);
+        if (!buf)
+            return AVERROR(ENOMEM);
+        s->packet_buffer = buf;
+        memcpy(s->packet_buffer, avpkt->data, avpkt->size);
+        init_get_bits(gb, s->packet_buffer, avpkt->size * 8);
+        consumed = avpkt->size;
+
+        /* skip reported size */
+        skip_bits_long(gb, 32);
+    }
 
-    init_get_bits(gb, buf, buf_size * 8);
+    out_size = s->block_size * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
-    reported_size = get_bits_long(gb, 32);
-    while (get_bits_count(gb) / 8 < buf_size &&
-           samples + s->block_size <= samples_end) {
-        decode_block(s, samples, avctx->codec->id == CODEC_ID_BINKAUDIO_DCT);
-        samples += s->block_size;
-        get_bits_align32(gb);
+    if (decode_block(s, samples, avctx->codec->id == CODEC_ID_BINKAUDIO_DCT)) {
+        av_log(avctx, AV_LOG_ERROR, "Incomplete packet\n");
+        return AVERROR_INVALIDDATA;
     }
+    get_bits_align32(gb);
 
-    *data_size = FFMIN(reported_size, (uint8_t*)samples - (uint8_t*)data);
-    return buf_size;
+    *data_size = out_size;
+    return consumed;
 }
 
 AVCodec ff_binkaudio_rdft_decoder = {
@@ -299,6 +358,7 @@ AVCodec ff_binkaudio_rdft_decoder = {
     .init           = decode_init,
     .close          = decode_end,
     .decode         = decode_frame,
+    .capabilities   = CODEC_CAP_DELAY,
     .long_name = NULL_IF_CONFIG_SMALL("Bink Audio (RDFT)")
 };
 
@@ -310,5 +370,6 @@ AVCodec ff_binkaudio_dct_decoder = {
     .init           = decode_init,
     .close          = decode_end,
     .decode         = decode_frame,
+    .capabilities   = CODEC_CAP_DELAY,
     .long_name = NULL_IF_CONFIG_SMALL("Bink Audio (DCT)")
 };