Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is simpler and fixes an out of array read, fixing it with AVBuffers
would be more complex
Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This ensures that captions are written towards the bottom of the screen
when tuning into mid-stream. The row will be reset on the receipt of the
next PAC command. Row 10 was chosen as it corresponds to the value of
"0" in a PAC (see row_map in handle_pac()).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
lavc/utils already rescales avpkt->pts to sub->pts in AV_TIME_BASE_Q
before calling the decode callback. This prevents from rescaling again
into the decoder, and avoid the use of avctx->time_base which will
disappear in the incoming codecpar merge.
This commit also replaces the use of "20 centisecond" (ass time base)
with "200 ms".
control codes in a cc stream can be repeated, and must be ignored.
however, repeated characters must not be ignored. the code attempted to
wipe prev_cmd in handle_char to allow repeated characters to be
processed, but prev_cmd would previously get reset _after_ handle_char()
i also moved the prev_cmd reset out from handle_char() so it can be
re-used for special character sets, which _must_ be ignored when
repeated.
Sometimes rollup captions can move around the screen. This fixes "ghost"
captions from below the current rollup area from continuing to be
captured when a rollup moves higher up on the screen.
This new mode is useful for realtime decoding of closed captions so they
can be display along with mpeg2 frames.
Closed caption streams contain two major types of captions:
- POPON captions, which are buffered off-screen and displayed
only after EOC (end of caption, aka display buffer)
- PAINTON/ROLLUP captions, which are written to the display as soon as
they arrive.
In a typical real-time eia608 decoder, commands like EOC (end of
caption; display buffer), EDM (erase display memory) and EBM (erase
buffered memory) perform their expected functions as soon as the
commands are processed. This is implemented in the real_time branches
added in this commit.
Before this commit, and in the !real_time branches after this commit,
the decoder cleverly implements its own version of the decoder which is
specifically geared towards buffered decoding. It does so by actively
ignoring commands like EBM (erase buffered memory), and then re-using
the non-display buffer to hold the previous caption while the new one is
received. This is the opposite of the real-time decoder, which uses the
non-display buffer to hold the new caption while the display buffer is
still showing the current caption.
In addition to ignoring EBM, the buffered decoder also has custom
implementations for EDM and EOC. An EDM (erase display memory) command
flushes the existing contents before clearing the screen, and EOC
similarly always flushes the active buffer (the previous subtitle)
before flipping buffers.
unlike reap_screen(), capture_screen() can be used to populate buffer
without touching the timestamps. this is useful for upcoming commits
which implement a real time caption stream.
moves the screen_changed bit and the bprint_clear into reap_screen() so
the logic is centralized and callers do not need to touch the bit or the
buffer before calling reap_screen()
Michael Niedermayer