Home | History | Annotate | Download | only in libstagefright
      1 /*
      2  * Copyright (C) 2009 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 //#define LOG_NDEBUG 0
     18 #define LOG_TAG "MPEG4Extractor"
     19 
     20 #include <ctype.h>
     21 #include <inttypes.h>
     22 #include <memory>
     23 #include <stdint.h>
     24 #include <stdlib.h>
     25 #include <string.h>
     26 
     27 #include <utils/Log.h>
     28 
     29 #include "include/MPEG4Extractor.h"
     30 #include "include/SampleTable.h"
     31 #include "include/ItemTable.h"
     32 #include "include/ESDS.h"
     33 
     34 #include <media/stagefright/foundation/ABitReader.h>
     35 #include <media/stagefright/foundation/ABuffer.h>
     36 #include <media/stagefright/foundation/ADebug.h>
     37 #include <media/stagefright/foundation/AMessage.h>
     38 #include <media/stagefright/foundation/AUtils.h>
     39 #include <media/stagefright/foundation/ColorUtils.h>
     40 #include <media/stagefright/foundation/hexdump.h>
     41 #include <media/stagefright/MediaBuffer.h>
     42 #include <media/stagefright/MediaBufferGroup.h>
     43 #include <media/stagefright/MediaDefs.h>
     44 #include <media/stagefright/MediaSource.h>
     45 #include <media/stagefright/MetaData.h>
     46 #include <utils/String8.h>
     47 
     48 #include <byteswap.h>
     49 #include "include/ID3.h"
     50 #include "include/avc_utils.h"
     51 
     52 #ifndef UINT32_MAX
     53 #define UINT32_MAX       (4294967295U)
     54 #endif
     55 
     56 namespace android {
     57 
     58 enum {
     59     // max track header chunk to return
     60     kMaxTrackHeaderSize = 32,
     61 
     62     // maximum size of an atom. Some atoms can be bigger according to the spec,
     63     // but we only allow up to this size.
     64     kMaxAtomSize = 64 * 1024 * 1024,
     65 };
     66 
     67 class MPEG4Source : public MediaSource {
     68 public:
     69     // Caller retains ownership of both "dataSource" and "sampleTable".
     70     MPEG4Source(const sp<MPEG4Extractor> &owner,
     71                 const sp<MetaData> &format,
     72                 const sp<DataSource> &dataSource,
     73                 int32_t timeScale,
     74                 const sp<SampleTable> &sampleTable,
     75                 Vector<SidxEntry> &sidx,
     76                 const Trex *trex,
     77                 off64_t firstMoofOffset,
     78                 const sp<ItemTable> &itemTable);
     79     virtual status_t init();
     80 
     81     virtual status_t start(MetaData *params = NULL);
     82     virtual status_t stop();
     83 
     84     virtual sp<MetaData> getFormat();
     85 
     86     virtual status_t read(MediaBuffer **buffer, const ReadOptions *options = NULL);
     87     virtual bool supportNonblockingRead() { return true; }
     88     virtual status_t fragmentedRead(MediaBuffer **buffer, const ReadOptions *options = NULL);
     89 
     90 protected:
     91     virtual ~MPEG4Source();
     92 
     93 private:
     94     Mutex mLock;
     95 
     96     // keep the MPEG4Extractor around, since we're referencing its data
     97     sp<MPEG4Extractor> mOwner;
     98     sp<MetaData> mFormat;
     99     sp<DataSource> mDataSource;
    100     int32_t mTimescale;
    101     sp<SampleTable> mSampleTable;
    102     uint32_t mCurrentSampleIndex;
    103     uint32_t mCurrentFragmentIndex;
    104     Vector<SidxEntry> &mSegments;
    105     const Trex *mTrex;
    106     off64_t mFirstMoofOffset;
    107     off64_t mCurrentMoofOffset;
    108     off64_t mNextMoofOffset;
    109     uint32_t mCurrentTime;
    110     int32_t mLastParsedTrackId;
    111     int32_t mTrackId;
    112 
    113     int32_t mCryptoMode;    // passed in from extractor
    114     int32_t mDefaultIVSize; // passed in from extractor
    115     uint8_t mCryptoKey[16]; // passed in from extractor
    116     uint32_t mCurrentAuxInfoType;
    117     uint32_t mCurrentAuxInfoTypeParameter;
    118     int32_t mCurrentDefaultSampleInfoSize;
    119     uint32_t mCurrentSampleInfoCount;
    120     uint32_t mCurrentSampleInfoAllocSize;
    121     uint8_t* mCurrentSampleInfoSizes;
    122     uint32_t mCurrentSampleInfoOffsetCount;
    123     uint32_t mCurrentSampleInfoOffsetsAllocSize;
    124     uint64_t* mCurrentSampleInfoOffsets;
    125 
    126     bool mIsAVC;
    127     bool mIsHEVC;
    128     size_t mNALLengthSize;
    129 
    130     bool mStarted;
    131 
    132     MediaBufferGroup *mGroup;
    133 
    134     MediaBuffer *mBuffer;
    135 
    136     bool mWantsNALFragments;
    137 
    138     uint8_t *mSrcBuffer;
    139 
    140     bool mIsHEIF;
    141     sp<ItemTable> mItemTable;
    142 
    143     size_t parseNALSize(const uint8_t *data) const;
    144     status_t parseChunk(off64_t *offset);
    145     status_t parseTrackFragmentHeader(off64_t offset, off64_t size);
    146     status_t parseTrackFragmentRun(off64_t offset, off64_t size);
    147     status_t parseSampleAuxiliaryInformationSizes(off64_t offset, off64_t size);
    148     status_t parseSampleAuxiliaryInformationOffsets(off64_t offset, off64_t size);
    149 
    150     struct TrackFragmentHeaderInfo {
    151         enum Flags {
    152             kBaseDataOffsetPresent         = 0x01,
    153             kSampleDescriptionIndexPresent = 0x02,
    154             kDefaultSampleDurationPresent  = 0x08,
    155             kDefaultSampleSizePresent      = 0x10,
    156             kDefaultSampleFlagsPresent     = 0x20,
    157             kDurationIsEmpty               = 0x10000,
    158         };
    159 
    160         uint32_t mTrackID;
    161         uint32_t mFlags;
    162         uint64_t mBaseDataOffset;
    163         uint32_t mSampleDescriptionIndex;
    164         uint32_t mDefaultSampleDuration;
    165         uint32_t mDefaultSampleSize;
    166         uint32_t mDefaultSampleFlags;
    167 
    168         uint64_t mDataOffset;
    169     };
    170     TrackFragmentHeaderInfo mTrackFragmentHeaderInfo;
    171 
    172     struct Sample {
    173         off64_t offset;
    174         size_t size;
    175         uint32_t duration;
    176         int32_t compositionOffset;
    177         uint8_t iv[16];
    178         Vector<size_t> clearsizes;
    179         Vector<size_t> encryptedsizes;
    180     };
    181     Vector<Sample> mCurrentSamples;
    182 
    183     MPEG4Source(const MPEG4Source &);
    184     MPEG4Source &operator=(const MPEG4Source &);
    185 };
    186 
    187 // This custom data source wraps an existing one and satisfies requests
    188 // falling entirely within a cached range from the cache while forwarding
    189 // all remaining requests to the wrapped datasource.
    190 // This is used to cache the full sampletable metadata for a single track,
    191 // possibly wrapping multiple times to cover all tracks, i.e.
    192 // Each MPEG4DataSource caches the sampletable metadata for a single track.
    193 
    194 struct MPEG4DataSource : public DataSource {
    195     explicit MPEG4DataSource(const sp<DataSource> &source);
    196 
    197     virtual status_t initCheck() const;
    198     virtual ssize_t readAt(off64_t offset, void *data, size_t size);
    199     virtual status_t getSize(off64_t *size);
    200     virtual uint32_t flags();
    201 
    202     status_t setCachedRange(off64_t offset, size_t size);
    203 
    204 protected:
    205     virtual ~MPEG4DataSource();
    206 
    207 private:
    208     Mutex mLock;
    209 
    210     sp<DataSource> mSource;
    211     off64_t mCachedOffset;
    212     size_t mCachedSize;
    213     uint8_t *mCache;
    214 
    215     void clearCache();
    216 
    217     MPEG4DataSource(const MPEG4DataSource &);
    218     MPEG4DataSource &operator=(const MPEG4DataSource &);
    219 };
    220 
    221 MPEG4DataSource::MPEG4DataSource(const sp<DataSource> &source)
    222     : mSource(source),
    223       mCachedOffset(0),
    224       mCachedSize(0),
    225       mCache(NULL) {
    226 }
    227 
    228 MPEG4DataSource::~MPEG4DataSource() {
    229     clearCache();
    230 }
    231 
    232 void MPEG4DataSource::clearCache() {
    233     if (mCache) {
    234         free(mCache);
    235         mCache = NULL;
    236     }
    237 
    238     mCachedOffset = 0;
    239     mCachedSize = 0;
    240 }
    241 
    242 status_t MPEG4DataSource::initCheck() const {
    243     return mSource->initCheck();
    244 }
    245 
    246 ssize_t MPEG4DataSource::readAt(off64_t offset, void *data, size_t size) {
    247     Mutex::Autolock autoLock(mLock);
    248 
    249     if (isInRange(mCachedOffset, mCachedSize, offset, size)) {
    250         memcpy(data, &mCache[offset - mCachedOffset], size);
    251         return size;
    252     }
    253 
    254     return mSource->readAt(offset, data, size);
    255 }
    256 
    257 status_t MPEG4DataSource::getSize(off64_t *size) {
    258     return mSource->getSize(size);
    259 }
    260 
    261 uint32_t MPEG4DataSource::flags() {
    262     return mSource->flags();
    263 }
    264 
    265 status_t MPEG4DataSource::setCachedRange(off64_t offset, size_t size) {
    266     Mutex::Autolock autoLock(mLock);
    267 
    268     clearCache();
    269 
    270     mCache = (uint8_t *)malloc(size);
    271 
    272     if (mCache == NULL) {
    273         return -ENOMEM;
    274     }
    275 
    276     mCachedOffset = offset;
    277     mCachedSize = size;
    278 
    279     ssize_t err = mSource->readAt(mCachedOffset, mCache, mCachedSize);
    280 
    281     if (err < (ssize_t)size) {
    282         clearCache();
    283 
    284         return ERROR_IO;
    285     }
    286 
    287     return OK;
    288 }
    289 
    290 ////////////////////////////////////////////////////////////////////////////////
    291 
    292 static const bool kUseHexDump = false;
    293 
    294 static const char *FourCC2MIME(uint32_t fourcc) {
    295     switch (fourcc) {
    296         case FOURCC('m', 'p', '4', 'a'):
    297             return MEDIA_MIMETYPE_AUDIO_AAC;
    298 
    299         case FOURCC('s', 'a', 'm', 'r'):
    300             return MEDIA_MIMETYPE_AUDIO_AMR_NB;
    301 
    302         case FOURCC('s', 'a', 'w', 'b'):
    303             return MEDIA_MIMETYPE_AUDIO_AMR_WB;
    304 
    305         case FOURCC('m', 'p', '4', 'v'):
    306             return MEDIA_MIMETYPE_VIDEO_MPEG4;
    307 
    308         case FOURCC('s', '2', '6', '3'):
    309         case FOURCC('h', '2', '6', '3'):
    310         case FOURCC('H', '2', '6', '3'):
    311             return MEDIA_MIMETYPE_VIDEO_H263;
    312 
    313         case FOURCC('a', 'v', 'c', '1'):
    314             return MEDIA_MIMETYPE_VIDEO_AVC;
    315 
    316         case FOURCC('h', 'v', 'c', '1'):
    317         case FOURCC('h', 'e', 'v', '1'):
    318             return MEDIA_MIMETYPE_VIDEO_HEVC;
    319         default:
    320             CHECK(!"should not be here.");
    321             return NULL;
    322     }
    323 }
    324 
    325 static bool AdjustChannelsAndRate(uint32_t fourcc, uint32_t *channels, uint32_t *rate) {
    326     if (!strcasecmp(MEDIA_MIMETYPE_AUDIO_AMR_NB, FourCC2MIME(fourcc))) {
    327         // AMR NB audio is always mono, 8kHz
    328         *channels = 1;
    329         *rate = 8000;
    330         return true;
    331     } else if (!strcasecmp(MEDIA_MIMETYPE_AUDIO_AMR_WB, FourCC2MIME(fourcc))) {
    332         // AMR WB audio is always mono, 16kHz
    333         *channels = 1;
    334         *rate = 16000;
    335         return true;
    336     }
    337     return false;
    338 }
    339 
    340 MPEG4Extractor::MPEG4Extractor(const sp<DataSource> &source)
    341     : mMoofOffset(0),
    342       mMoofFound(false),
    343       mMdatFound(false),
    344       mDataSource(source),
    345       mInitCheck(NO_INIT),
    346       mHeaderTimescale(0),
    347       mIsQT(false),
    348       mIsHEIF(false),
    349       mFirstTrack(NULL),
    350       mLastTrack(NULL),
    351       mFileMetaData(new MetaData),
    352       mFirstSINF(NULL),
    353       mIsDrm(false) {
    354 }
    355 
    356 MPEG4Extractor::~MPEG4Extractor() {
    357     release();
    358 }
    359 
    360 void MPEG4Extractor::release() {
    361     Track *track = mFirstTrack;
    362     while (track) {
    363         Track *next = track->next;
    364 
    365         delete track;
    366         track = next;
    367     }
    368     mFirstTrack = mLastTrack = NULL;
    369 
    370     SINF *sinf = mFirstSINF;
    371     while (sinf) {
    372         SINF *next = sinf->next;
    373         delete[] sinf->IPMPData;
    374         delete sinf;
    375         sinf = next;
    376     }
    377     mFirstSINF = NULL;
    378 
    379     for (size_t i = 0; i < mPssh.size(); i++) {
    380         delete [] mPssh[i].data;
    381     }
    382     mPssh.clear();
    383 
    384     if (mDataSource != NULL) {
    385         mDataSource->close();
    386         mDataSource.clear();
    387     }
    388 }
    389 
    390 uint32_t MPEG4Extractor::flags() const {
    391     return CAN_PAUSE |
    392             ((mMoofOffset == 0 || mSidxEntries.size() != 0) ?
    393                     (CAN_SEEK_BACKWARD | CAN_SEEK_FORWARD | CAN_SEEK) : 0);
    394 }
    395 
    396 sp<MetaData> MPEG4Extractor::getMetaData() {
    397     status_t err;
    398     if ((err = readMetaData()) != OK) {
    399         return new MetaData;
    400     }
    401 
    402     return mFileMetaData;
    403 }
    404 
    405 size_t MPEG4Extractor::countTracks() {
    406     status_t err;
    407     if ((err = readMetaData()) != OK) {
    408         ALOGV("MPEG4Extractor::countTracks: no tracks");
    409         return 0;
    410     }
    411 
    412     size_t n = 0;
    413     Track *track = mFirstTrack;
    414     while (track) {
    415         ++n;
    416         track = track->next;
    417     }
    418 
    419     ALOGV("MPEG4Extractor::countTracks: %zu tracks", n);
    420     return n;
    421 }
    422 
    423 sp<MetaData> MPEG4Extractor::getTrackMetaData(
    424         size_t index, uint32_t flags) {
    425     status_t err;
    426     if ((err = readMetaData()) != OK) {
    427         return NULL;
    428     }
    429 
    430     Track *track = mFirstTrack;
    431     while (index > 0) {
    432         if (track == NULL) {
    433             return NULL;
    434         }
    435 
    436         track = track->next;
    437         --index;
    438     }
    439 
    440     if (track == NULL) {
    441         return NULL;
    442     }
    443 
    444     if ((flags & kIncludeExtensiveMetaData)
    445             && !track->includes_expensive_metadata) {
    446         track->includes_expensive_metadata = true;
    447 
    448         const char *mime;
    449         CHECK(track->meta->findCString(kKeyMIMEType, &mime));
    450         if (!strncasecmp("video/", mime, 6)) {
    451             // MPEG2 tracks do not provide CSD, so read the stream header
    452             if (!strcmp(mime, MEDIA_MIMETYPE_VIDEO_MPEG2)) {
    453                 off64_t offset;
    454                 size_t size;
    455                 if (track->sampleTable->getMetaDataForSample(
    456                             0 /* sampleIndex */, &offset, &size, NULL /* sampleTime */) == OK) {
    457                     if (size > kMaxTrackHeaderSize) {
    458                         size = kMaxTrackHeaderSize;
    459                     }
    460                     uint8_t header[kMaxTrackHeaderSize];
    461                     if (mDataSource->readAt(offset, &header, size) == (ssize_t)size) {
    462                         track->meta->setData(kKeyStreamHeader, 'mdat', header, size);
    463                     }
    464                 }
    465             }
    466 
    467             if (mMoofOffset > 0) {
    468                 int64_t duration;
    469                 if (track->meta->findInt64(kKeyDuration, &duration)) {
    470                     // nothing fancy, just pick a frame near 1/4th of the duration
    471                     track->meta->setInt64(
    472                             kKeyThumbnailTime, duration / 4);
    473                 }
    474             } else {
    475                 uint32_t sampleIndex;
    476                 uint32_t sampleTime;
    477                 if (track->timescale != 0 &&
    478                         track->sampleTable->findThumbnailSample(&sampleIndex) == OK
    479                         && track->sampleTable->getMetaDataForSample(
    480                             sampleIndex, NULL /* offset */, NULL /* size */,
    481                             &sampleTime) == OK) {
    482                     track->meta->setInt64(
    483                             kKeyThumbnailTime,
    484                             ((int64_t)sampleTime * 1000000) / track->timescale);
    485                 }
    486             }
    487         }
    488     }
    489 
    490     return track->meta;
    491 }
    492 
    493 status_t MPEG4Extractor::readMetaData() {
    494     if (mInitCheck != NO_INIT) {
    495         return mInitCheck;
    496     }
    497 
    498     off64_t offset = 0;
    499     status_t err;
    500     bool sawMoovOrSidx = false;
    501 
    502     while (!((sawMoovOrSidx && (mMdatFound || mMoofFound)) ||
    503             (mIsHEIF && (mItemTable != NULL) && mItemTable->isValid()))) {
    504         off64_t orig_offset = offset;
    505         err = parseChunk(&offset, 0);
    506 
    507         if (err != OK && err != UNKNOWN_ERROR) {
    508             break;
    509         } else if (offset <= orig_offset) {
    510             // only continue parsing if the offset was advanced,
    511             // otherwise we might end up in an infinite loop
    512             ALOGE("did not advance: %lld->%lld", (long long)orig_offset, (long long)offset);
    513             err = ERROR_MALFORMED;
    514             break;
    515         } else if (err == UNKNOWN_ERROR) {
    516             sawMoovOrSidx = true;
    517         }
    518     }
    519 
    520     if (mInitCheck == OK) {
    521         if (findTrackByMimePrefix("video/") != NULL) {
    522             mFileMetaData->setCString(
    523                     kKeyMIMEType, MEDIA_MIMETYPE_CONTAINER_MPEG4);
    524         } else if (findTrackByMimePrefix("audio/") != NULL) {
    525             mFileMetaData->setCString(kKeyMIMEType, "audio/mp4");
    526         } else {
    527             mFileMetaData->setCString(kKeyMIMEType, "application/octet-stream");
    528         }
    529     } else {
    530         mInitCheck = err;
    531     }
    532 
    533     CHECK_NE(err, (status_t)NO_INIT);
    534 
    535     // copy pssh data into file metadata
    536     uint64_t psshsize = 0;
    537     for (size_t i = 0; i < mPssh.size(); i++) {
    538         psshsize += 20 + mPssh[i].datalen;
    539     }
    540     if (psshsize > 0 && psshsize <= UINT32_MAX) {
    541         char *buf = (char*)malloc(psshsize);
    542         if (!buf) {
    543             ALOGE("b/28471206");
    544             return NO_MEMORY;
    545         }
    546         char *ptr = buf;
    547         for (size_t i = 0; i < mPssh.size(); i++) {
    548             memcpy(ptr, mPssh[i].uuid, 20); // uuid + length
    549             memcpy(ptr + 20, mPssh[i].data, mPssh[i].datalen);
    550             ptr += (20 + mPssh[i].datalen);
    551         }
    552         mFileMetaData->setData(kKeyPssh, 'pssh', buf, psshsize);
    553         free(buf);
    554     }
    555 
    556     if (mIsHEIF) {
    557         sp<MetaData> meta = mItemTable->getImageMeta();
    558         if (meta == NULL) {
    559             return ERROR_MALFORMED;
    560         }
    561 
    562         Track *track = mLastTrack;
    563         if (track != NULL) {
    564             ALOGW("track is set before metadata is fully processed");
    565         } else {
    566             track = new Track;
    567             track->next = NULL;
    568             mFirstTrack = mLastTrack = track;
    569         }
    570 
    571         track->meta = meta;
    572         track->meta->setInt32(kKeyTrackID, 0);
    573         track->includes_expensive_metadata = false;
    574         track->skipTrack = false;
    575         track->timescale = 0;
    576     }
    577 
    578     return mInitCheck;
    579 }
    580 
    581 char* MPEG4Extractor::getDrmTrackInfo(size_t trackID, int *len) {
    582     if (mFirstSINF == NULL) {
    583         return NULL;
    584     }
    585 
    586     SINF *sinf = mFirstSINF;
    587     while (sinf && (trackID != sinf->trackID)) {
    588         sinf = sinf->next;
    589     }
    590 
    591     if (sinf == NULL) {
    592         return NULL;
    593     }
    594 
    595     *len = sinf->len;
    596     return sinf->IPMPData;
    597 }
    598 
    599 // Reads an encoded integer 7 bits at a time until it encounters the high bit clear.
    600 static int32_t readSize(off64_t offset,
    601         const sp<DataSource> &DataSource, uint8_t *numOfBytes) {
    602     uint32_t size = 0;
    603     uint8_t data;
    604     bool moreData = true;
    605     *numOfBytes = 0;
    606 
    607     while (moreData) {
    608         if (DataSource->readAt(offset, &data, 1) < 1) {
    609             return -1;
    610         }
    611         offset ++;
    612         moreData = (data >= 128) ? true : false;
    613         size = (size << 7) | (data & 0x7f); // Take last 7 bits
    614         (*numOfBytes) ++;
    615     }
    616 
    617     return size;
    618 }
    619 
    620 status_t MPEG4Extractor::parseDrmSINF(
    621         off64_t * /* offset */, off64_t data_offset) {
    622     uint8_t updateIdTag;
    623     if (mDataSource->readAt(data_offset, &updateIdTag, 1) < 1) {
    624         return ERROR_IO;
    625     }
    626     data_offset ++;
    627 
    628     if (0x01/*OBJECT_DESCRIPTOR_UPDATE_ID_TAG*/ != updateIdTag) {
    629         return ERROR_MALFORMED;
    630     }
    631 
    632     uint8_t numOfBytes;
    633     int32_t size = readSize(data_offset, mDataSource, &numOfBytes);
    634     if (size < 0) {
    635         return ERROR_IO;
    636     }
    637     data_offset += numOfBytes;
    638 
    639     while(size >= 11 ) {
    640         uint8_t descriptorTag;
    641         if (mDataSource->readAt(data_offset, &descriptorTag, 1) < 1) {
    642             return ERROR_IO;
    643         }
    644         data_offset ++;
    645 
    646         if (0x11/*OBJECT_DESCRIPTOR_ID_TAG*/ != descriptorTag) {
    647             return ERROR_MALFORMED;
    648         }
    649 
    650         uint8_t buffer[8];
    651         //ObjectDescriptorID and ObjectDescriptor url flag
    652         if (mDataSource->readAt(data_offset, buffer, 2) < 2) {
    653             return ERROR_IO;
    654         }
    655         data_offset += 2;
    656 
    657         if ((buffer[1] >> 5) & 0x0001) { //url flag is set
    658             return ERROR_MALFORMED;
    659         }
    660 
    661         if (mDataSource->readAt(data_offset, buffer, 8) < 8) {
    662             return ERROR_IO;
    663         }
    664         data_offset += 8;
    665 
    666         if ((0x0F/*ES_ID_REF_TAG*/ != buffer[1])
    667                 || ( 0x0A/*IPMP_DESCRIPTOR_POINTER_ID_TAG*/ != buffer[5])) {
    668             return ERROR_MALFORMED;
    669         }
    670 
    671         SINF *sinf = new SINF;
    672         sinf->trackID = U16_AT(&buffer[3]);
    673         sinf->IPMPDescriptorID = buffer[7];
    674         sinf->next = mFirstSINF;
    675         mFirstSINF = sinf;
    676 
    677         size -= (8 + 2 + 1);
    678     }
    679 
    680     if (size != 0) {
    681         return ERROR_MALFORMED;
    682     }
    683 
    684     if (mDataSource->readAt(data_offset, &updateIdTag, 1) < 1) {
    685         return ERROR_IO;
    686     }
    687     data_offset ++;
    688 
    689     if(0x05/*IPMP_DESCRIPTOR_UPDATE_ID_TAG*/ != updateIdTag) {
    690         return ERROR_MALFORMED;
    691     }
    692 
    693     size = readSize(data_offset, mDataSource, &numOfBytes);
    694     if (size < 0) {
    695         return ERROR_IO;
    696     }
    697     data_offset += numOfBytes;
    698 
    699     while (size > 0) {
    700         uint8_t tag;
    701         int32_t dataLen;
    702         if (mDataSource->readAt(data_offset, &tag, 1) < 1) {
    703             return ERROR_IO;
    704         }
    705         data_offset ++;
    706 
    707         if (0x0B/*IPMP_DESCRIPTOR_ID_TAG*/ == tag) {
    708             uint8_t id;
    709             dataLen = readSize(data_offset, mDataSource, &numOfBytes);
    710             if (dataLen < 0) {
    711                 return ERROR_IO;
    712             } else if (dataLen < 4) {
    713                 return ERROR_MALFORMED;
    714             }
    715             data_offset += numOfBytes;
    716 
    717             if (mDataSource->readAt(data_offset, &id, 1) < 1) {
    718                 return ERROR_IO;
    719             }
    720             data_offset ++;
    721 
    722             SINF *sinf = mFirstSINF;
    723             while (sinf && (sinf->IPMPDescriptorID != id)) {
    724                 sinf = sinf->next;
    725             }
    726             if (sinf == NULL) {
    727                 return ERROR_MALFORMED;
    728             }
    729             sinf->len = dataLen - 3;
    730             sinf->IPMPData = new (std::nothrow) char[sinf->len];
    731             if (sinf->IPMPData == NULL) {
    732                 return ERROR_MALFORMED;
    733             }
    734             data_offset += 2;
    735 
    736             if (mDataSource->readAt(data_offset, sinf->IPMPData, sinf->len) < sinf->len) {
    737                 return ERROR_IO;
    738             }
    739             data_offset += sinf->len;
    740 
    741             size -= (dataLen + numOfBytes + 1);
    742         }
    743     }
    744 
    745     if (size != 0) {
    746         return ERROR_MALFORMED;
    747     }
    748 
    749     return UNKNOWN_ERROR;  // Return a dummy error.
    750 }
    751 
    752 struct PathAdder {
    753     PathAdder(Vector<uint32_t> *path, uint32_t chunkType)
    754         : mPath(path) {
    755         mPath->push(chunkType);
    756     }
    757 
    758     ~PathAdder() {
    759         mPath->pop();
    760     }
    761 
    762 private:
    763     Vector<uint32_t> *mPath;
    764 
    765     PathAdder(const PathAdder &);
    766     PathAdder &operator=(const PathAdder &);
    767 };
    768 
    769 static bool underMetaDataPath(const Vector<uint32_t> &path) {
    770     return path.size() >= 5
    771         && path[0] == FOURCC('m', 'o', 'o', 'v')
    772         && path[1] == FOURCC('u', 'd', 't', 'a')
    773         && path[2] == FOURCC('m', 'e', 't', 'a')
    774         && path[3] == FOURCC('i', 'l', 's', 't');
    775 }
    776 
    777 static bool underQTMetaPath(const Vector<uint32_t> &path, int32_t depth) {
    778     return path.size() >= 2
    779             && path[0] == FOURCC('m', 'o', 'o', 'v')
    780             && path[1] == FOURCC('m', 'e', 't', 'a')
    781             && (depth == 2
    782             || (depth == 3
    783                     && (path[2] == FOURCC('h', 'd', 'l', 'r')
    784                     ||  path[2] == FOURCC('i', 'l', 's', 't')
    785                     ||  path[2] == FOURCC('k', 'e', 'y', 's'))));
    786 }
    787 
    788 // Given a time in seconds since Jan 1 1904, produce a human-readable string.
    789 static bool convertTimeToDate(int64_t time_1904, String8 *s) {
    790     // delta between mpeg4 time and unix epoch time
    791     static const int64_t delta = (((66 * 365 + 17) * 24) * 3600);
    792     if (time_1904 < INT64_MIN + delta) {
    793         return false;
    794     }
    795     time_t time_1970 = time_1904 - delta;
    796 
    797     char tmp[32];
    798     struct tm* tm = gmtime(&time_1970);
    799     if (tm != NULL &&
    800             strftime(tmp, sizeof(tmp), "%Y%m%dT%H%M%S.000Z", tm) > 0) {
    801         s->setTo(tmp);
    802         return true;
    803     }
    804     return false;
    805 }
    806 
    807 status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
    808     ALOGV("entering parseChunk %lld/%d", (long long)*offset, depth);
    809 
    810     if (*offset < 0) {
    811         ALOGE("b/23540914");
    812         return ERROR_MALFORMED;
    813     }
    814     if (depth > 100) {
    815         ALOGE("b/27456299");
    816         return ERROR_MALFORMED;
    817     }
    818     uint32_t hdr[2];
    819     if (mDataSource->readAt(*offset, hdr, 8) < 8) {
    820         return ERROR_IO;
    821     }
    822     uint64_t chunk_size = ntohl(hdr[0]);
    823     int32_t chunk_type = ntohl(hdr[1]);
    824     off64_t data_offset = *offset + 8;
    825 
    826     if (chunk_size == 1) {
    827         if (mDataSource->readAt(*offset + 8, &chunk_size, 8) < 8) {
    828             return ERROR_IO;
    829         }
    830         chunk_size = ntoh64(chunk_size);
    831         data_offset += 8;
    832 
    833         if (chunk_size < 16) {
    834             // The smallest valid chunk is 16 bytes long in this case.
    835             return ERROR_MALFORMED;
    836         }
    837     } else if (chunk_size == 0) {
    838         if (depth == 0) {
    839             // atom extends to end of file
    840             off64_t sourceSize;
    841             if (mDataSource->getSize(&sourceSize) == OK) {
    842                 chunk_size = (sourceSize - *offset);
    843             } else {
    844                 // XXX could we just pick a "sufficiently large" value here?
    845                 ALOGE("atom size is 0, and data source has no size");
    846                 return ERROR_MALFORMED;
    847             }
    848         } else {
    849             // not allowed for non-toplevel atoms, skip it
    850             *offset += 4;
    851             return OK;
    852         }
    853     } else if (chunk_size < 8) {
    854         // The smallest valid chunk is 8 bytes long.
    855         ALOGE("invalid chunk size: %" PRIu64, chunk_size);
    856         return ERROR_MALFORMED;
    857     }
    858 
    859     char chunk[5];
    860     MakeFourCCString(chunk_type, chunk);
    861     ALOGV("chunk: %s @ %lld, %d", chunk, (long long)*offset, depth);
    862 
    863     if (kUseHexDump) {
    864         static const char kWhitespace[] = "                                        ";
    865         const char *indent = &kWhitespace[sizeof(kWhitespace) - 1 - 2 * depth];
    866         printf("%sfound chunk '%s' of size %" PRIu64 "\n", indent, chunk, chunk_size);
    867 
    868         char buffer[256];
    869         size_t n = chunk_size;
    870         if (n > sizeof(buffer)) {
    871             n = sizeof(buffer);
    872         }
    873         if (mDataSource->readAt(*offset, buffer, n)
    874                 < (ssize_t)n) {
    875             return ERROR_IO;
    876         }
    877 
    878         hexdump(buffer, n);
    879     }
    880 
    881     PathAdder autoAdder(&mPath, chunk_type);
    882 
    883     // (data_offset - *offset) is either 8 or 16
    884     off64_t chunk_data_size = chunk_size - (data_offset - *offset);
    885     if (chunk_data_size < 0) {
    886         ALOGE("b/23540914");
    887         return ERROR_MALFORMED;
    888     }
    889     if (chunk_type != FOURCC('m', 'd', 'a', 't') && chunk_data_size > kMaxAtomSize) {
    890         char errMsg[100];
    891         sprintf(errMsg, "%s atom has size %" PRId64, chunk, chunk_data_size);
    892         ALOGE("%s (b/28615448)", errMsg);
    893         android_errorWriteWithInfoLog(0x534e4554, "28615448", -1, errMsg, strlen(errMsg));
    894         return ERROR_MALFORMED;
    895     }
    896 
    897     if (chunk_type != FOURCC('c', 'p', 'r', 't')
    898             && chunk_type != FOURCC('c', 'o', 'v', 'r')
    899             && mPath.size() == 5 && underMetaDataPath(mPath)) {
    900         off64_t stop_offset = *offset + chunk_size;
    901         *offset = data_offset;
    902         while (*offset < stop_offset) {
    903             status_t err = parseChunk(offset, depth + 1);
    904             if (err != OK) {
    905                 return err;
    906             }
    907         }
    908 
    909         if (*offset != stop_offset) {
    910             return ERROR_MALFORMED;
    911         }
    912 
    913         return OK;
    914     }
    915 
    916     switch(chunk_type) {
    917         case FOURCC('m', 'o', 'o', 'v'):
    918         case FOURCC('t', 'r', 'a', 'k'):
    919         case FOURCC('m', 'd', 'i', 'a'):
    920         case FOURCC('m', 'i', 'n', 'f'):
    921         case FOURCC('d', 'i', 'n', 'f'):
    922         case FOURCC('s', 't', 'b', 'l'):
    923         case FOURCC('m', 'v', 'e', 'x'):
    924         case FOURCC('m', 'o', 'o', 'f'):
    925         case FOURCC('t', 'r', 'a', 'f'):
    926         case FOURCC('m', 'f', 'r', 'a'):
    927         case FOURCC('u', 'd', 't', 'a'):
    928         case FOURCC('i', 'l', 's', 't'):
    929         case FOURCC('s', 'i', 'n', 'f'):
    930         case FOURCC('s', 'c', 'h', 'i'):
    931         case FOURCC('e', 'd', 't', 's'):
    932         case FOURCC('w', 'a', 'v', 'e'):
    933         {
    934             if (chunk_type == FOURCC('m', 'o', 'o', 'v') && depth != 0) {
    935                 ALOGE("moov: depth %d", depth);
    936                 return ERROR_MALFORMED;
    937             }
    938 
    939             if (chunk_type == FOURCC('m', 'o', 'o', 'v') && mInitCheck == OK) {
    940                 ALOGE("duplicate moov");
    941                 return ERROR_MALFORMED;
    942             }
    943 
    944             if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) {
    945                 // store the offset of the first segment
    946                 mMoofFound = true;
    947                 mMoofOffset = *offset;
    948             }
    949 
    950             if (chunk_type == FOURCC('s', 't', 'b', 'l')) {
    951                 ALOGV("sampleTable chunk is %" PRIu64 " bytes long.", chunk_size);
    952 
    953                 if (mDataSource->flags()
    954                         & (DataSource::kWantsPrefetching
    955                             | DataSource::kIsCachingDataSource)) {
    956                     sp<MPEG4DataSource> cachedSource =
    957                         new MPEG4DataSource(mDataSource);
    958 
    959                     if (cachedSource->setCachedRange(*offset, chunk_size) == OK) {
    960                         mDataSource = cachedSource;
    961                     }
    962                 }
    963 
    964                 if (mLastTrack == NULL) {
    965                     return ERROR_MALFORMED;
    966                 }
    967 
    968                 mLastTrack->sampleTable = new SampleTable(mDataSource);
    969             }
    970 
    971             bool isTrack = false;
    972             if (chunk_type == FOURCC('t', 'r', 'a', 'k')) {
    973                 if (depth != 1) {
    974                     ALOGE("trak: depth %d", depth);
    975                     return ERROR_MALFORMED;
    976                 }
    977                 isTrack = true;
    978 
    979                 Track *track = new Track;
    980                 track->next = NULL;
    981                 if (mLastTrack) {
    982                     mLastTrack->next = track;
    983                 } else {
    984                     mFirstTrack = track;
    985                 }
    986                 mLastTrack = track;
    987 
    988                 track->meta = new MetaData;
    989                 track->includes_expensive_metadata = false;
    990                 track->skipTrack = false;
    991                 track->timescale = 0;
    992                 track->meta->setCString(kKeyMIMEType, "application/octet-stream");
    993             }
    994 
    995             off64_t stop_offset = *offset + chunk_size;
    996             *offset = data_offset;
    997             while (*offset < stop_offset) {
    998                 status_t err = parseChunk(offset, depth + 1);
    999                 if (err != OK) {
   1000                     if (isTrack) {
   1001                         mLastTrack->skipTrack = true;
   1002                         break;
   1003                     }
   1004                     return err;
   1005                 }
   1006             }
   1007 
   1008             if (*offset != stop_offset) {
   1009                 return ERROR_MALFORMED;
   1010             }
   1011 
   1012             if (isTrack) {
   1013                 int32_t trackId;
   1014                 // There must be exact one track header per track.
   1015                 if (!mLastTrack->meta->findInt32(kKeyTrackID, &trackId)) {
   1016                     mLastTrack->skipTrack = true;
   1017                 }
   1018 
   1019                 status_t err = verifyTrack(mLastTrack);
   1020                 if (err != OK) {
   1021                     mLastTrack->skipTrack = true;
   1022                 }
   1023 
   1024                 if (mLastTrack->skipTrack) {
   1025                     Track *cur = mFirstTrack;
   1026 
   1027                     if (cur == mLastTrack) {
   1028                         delete cur;
   1029                         mFirstTrack = mLastTrack = NULL;
   1030                     } else {
   1031                         while (cur && cur->next != mLastTrack) {
   1032                             cur = cur->next;
   1033                         }
   1034                         if (cur) {
   1035                             cur->next = NULL;
   1036                         }
   1037                         delete mLastTrack;
   1038                         mLastTrack = cur;
   1039                     }
   1040 
   1041                     return OK;
   1042                 }
   1043             } else if (chunk_type == FOURCC('m', 'o', 'o', 'v')) {
   1044                 mInitCheck = OK;
   1045 
   1046                 if (!mIsDrm) {
   1047                     return UNKNOWN_ERROR;  // Return a dummy error.
   1048                 } else {
   1049                     return OK;
   1050                 }
   1051             }
   1052             break;
   1053         }
   1054 
   1055         case FOURCC('e', 'l', 's', 't'):
   1056         {
   1057             *offset += chunk_size;
   1058 
   1059             // See 14496-12 8.6.6
   1060             uint8_t version;
   1061             if (mDataSource->readAt(data_offset, &version, 1) < 1) {
   1062                 return ERROR_IO;
   1063             }
   1064 
   1065             uint32_t entry_count;
   1066             if (!mDataSource->getUInt32(data_offset + 4, &entry_count)) {
   1067                 return ERROR_IO;
   1068             }
   1069 
   1070             if (entry_count != 1) {
   1071                 // we only support a single entry at the moment, for gapless playback
   1072                 ALOGW("ignoring edit list with %d entries", entry_count);
   1073             } else if (mHeaderTimescale == 0) {
   1074                 ALOGW("ignoring edit list because timescale is 0");
   1075             } else {
   1076                 off64_t entriesoffset = data_offset + 8;
   1077                 uint64_t segment_duration;
   1078                 int64_t media_time;
   1079 
   1080                 if (version == 1) {
   1081                     if (!mDataSource->getUInt64(entriesoffset, &segment_duration) ||
   1082                             !mDataSource->getUInt64(entriesoffset + 8, (uint64_t*)&media_time)) {
   1083                         return ERROR_IO;
   1084                     }
   1085                 } else if (version == 0) {
   1086                     uint32_t sd;
   1087                     int32_t mt;
   1088                     if (!mDataSource->getUInt32(entriesoffset, &sd) ||
   1089                             !mDataSource->getUInt32(entriesoffset + 4, (uint32_t*)&mt)) {
   1090                         return ERROR_IO;
   1091                     }
   1092                     segment_duration = sd;
   1093                     media_time = mt;
   1094                 } else {
   1095                     return ERROR_IO;
   1096                 }
   1097 
   1098                 uint64_t halfscale = mHeaderTimescale / 2;
   1099                 segment_duration = (segment_duration * 1000000 + halfscale)/ mHeaderTimescale;
   1100                 media_time = (media_time * 1000000 + halfscale) / mHeaderTimescale;
   1101 
   1102                 int64_t duration;
   1103                 int32_t samplerate;
   1104                 if (!mLastTrack) {
   1105                     return ERROR_MALFORMED;
   1106                 }
   1107                 if (mLastTrack->meta->findInt64(kKeyDuration, &duration) &&
   1108                         mLastTrack->meta->findInt32(kKeySampleRate, &samplerate)) {
   1109 
   1110                     int64_t delay = (media_time  * samplerate + 500000) / 1000000;
   1111                     mLastTrack->meta->setInt32(kKeyEncoderDelay, delay);
   1112 
   1113                     int64_t paddingus = duration - (int64_t)(segment_duration + media_time);
   1114                     if (paddingus < 0) {
   1115                         // track duration from media header (which is what kKeyDuration is) might
   1116                         // be slightly shorter than the segment duration, which would make the
   1117                         // padding negative. Clamp to zero.
   1118                         paddingus = 0;
   1119                     }
   1120                     int64_t paddingsamples = (paddingus * samplerate + 500000) / 1000000;
   1121                     mLastTrack->meta->setInt32(kKeyEncoderPadding, paddingsamples);
   1122                 }
   1123             }
   1124             break;
   1125         }
   1126 
   1127         case FOURCC('f', 'r', 'm', 'a'):
   1128         {
   1129             *offset += chunk_size;
   1130 
   1131             uint32_t original_fourcc;
   1132             if (mDataSource->readAt(data_offset, &original_fourcc, 4) < 4) {
   1133                 return ERROR_IO;
   1134             }
   1135             original_fourcc = ntohl(original_fourcc);
   1136             ALOGV("read original format: %d", original_fourcc);
   1137 
   1138             if (mLastTrack == NULL) {
   1139                 return ERROR_MALFORMED;
   1140             }
   1141 
   1142             mLastTrack->meta->setCString(kKeyMIMEType, FourCC2MIME(original_fourcc));
   1143             uint32_t num_channels = 0;
   1144             uint32_t sample_rate = 0;
   1145             if (AdjustChannelsAndRate(original_fourcc, &num_channels, &sample_rate)) {
   1146                 mLastTrack->meta->setInt32(kKeyChannelCount, num_channels);
   1147                 mLastTrack->meta->setInt32(kKeySampleRate, sample_rate);
   1148             }
   1149             break;
   1150         }
   1151 
   1152         case FOURCC('t', 'e', 'n', 'c'):
   1153         {
   1154             *offset += chunk_size;
   1155 
   1156             if (chunk_size < 32) {
   1157                 return ERROR_MALFORMED;
   1158             }
   1159 
   1160             // tenc box contains 1 byte version, 3 byte flags, 3 byte default algorithm id, one byte
   1161             // default IV size, 16 bytes default KeyID
   1162             // (ISO 23001-7)
   1163             char buf[4];
   1164             memset(buf, 0, 4);
   1165             if (mDataSource->readAt(data_offset + 4, buf + 1, 3) < 3) {
   1166                 return ERROR_IO;
   1167             }
   1168             uint32_t defaultAlgorithmId = ntohl(*((int32_t*)buf));
   1169             if (defaultAlgorithmId > 1) {
   1170                 // only 0 (clear) and 1 (AES-128) are valid
   1171                 return ERROR_MALFORMED;
   1172             }
   1173 
   1174             memset(buf, 0, 4);
   1175             if (mDataSource->readAt(data_offset + 7, buf + 3, 1) < 1) {
   1176                 return ERROR_IO;
   1177             }
   1178             uint32_t defaultIVSize = ntohl(*((int32_t*)buf));
   1179 
   1180             if ((defaultAlgorithmId == 0 && defaultIVSize != 0) ||
   1181                     (defaultAlgorithmId != 0 && defaultIVSize == 0)) {
   1182                 // only unencrypted data must have 0 IV size
   1183                 return ERROR_MALFORMED;
   1184             } else if (defaultIVSize != 0 &&
   1185                     defaultIVSize != 8 &&
   1186                     defaultIVSize != 16) {
   1187                 // only supported sizes are 0, 8 and 16
   1188                 return ERROR_MALFORMED;
   1189             }
   1190 
   1191             uint8_t defaultKeyId[16];
   1192 
   1193             if (mDataSource->readAt(data_offset + 8, &defaultKeyId, 16) < 16) {
   1194                 return ERROR_IO;
   1195             }
   1196 
   1197             if (mLastTrack == NULL)
   1198                 return ERROR_MALFORMED;
   1199 
   1200             mLastTrack->meta->setInt32(kKeyCryptoMode, defaultAlgorithmId);
   1201             mLastTrack->meta->setInt32(kKeyCryptoDefaultIVSize, defaultIVSize);
   1202             mLastTrack->meta->setData(kKeyCryptoKey, 'tenc', defaultKeyId, 16);
   1203             break;
   1204         }
   1205 
   1206         case FOURCC('t', 'k', 'h', 'd'):
   1207         {
   1208             *offset += chunk_size;
   1209 
   1210             status_t err;
   1211             if ((err = parseTrackHeader(data_offset, chunk_data_size)) != OK) {
   1212                 return err;
   1213             }
   1214 
   1215             break;
   1216         }
   1217 
   1218         case FOURCC('p', 's', 's', 'h'):
   1219         {
   1220             *offset += chunk_size;
   1221 
   1222             PsshInfo pssh;
   1223 
   1224             if (mDataSource->readAt(data_offset + 4, &pssh.uuid, 16) < 16) {
   1225                 return ERROR_IO;
   1226             }
   1227 
   1228             uint32_t psshdatalen = 0;
   1229             if (mDataSource->readAt(data_offset + 20, &psshdatalen, 4) < 4) {
   1230                 return ERROR_IO;
   1231             }
   1232             pssh.datalen = ntohl(psshdatalen);
   1233             ALOGV("pssh data size: %d", pssh.datalen);
   1234             if (chunk_size < 20 || pssh.datalen > chunk_size - 20) {
   1235                 // pssh data length exceeds size of containing box
   1236                 return ERROR_MALFORMED;
   1237             }
   1238 
   1239             pssh.data = new (std::nothrow) uint8_t[pssh.datalen];
   1240             if (pssh.data == NULL) {
   1241                 return ERROR_MALFORMED;
   1242             }
   1243             ALOGV("allocated pssh @ %p", pssh.data);
   1244             ssize_t requested = (ssize_t) pssh.datalen;
   1245             if (mDataSource->readAt(data_offset + 24, pssh.data, requested) < requested) {
   1246                 delete[] pssh.data;
   1247                 return ERROR_IO;
   1248             }
   1249             mPssh.push_back(pssh);
   1250 
   1251             break;
   1252         }
   1253 
   1254         case FOURCC('m', 'd', 'h', 'd'):
   1255         {
   1256             *offset += chunk_size;
   1257 
   1258             if (chunk_data_size < 4 || mLastTrack == NULL) {
   1259                 return ERROR_MALFORMED;
   1260             }
   1261 
   1262             uint8_t version;
   1263             if (mDataSource->readAt(
   1264                         data_offset, &version, sizeof(version))
   1265                     < (ssize_t)sizeof(version)) {
   1266                 return ERROR_IO;
   1267             }
   1268 
   1269             off64_t timescale_offset;
   1270 
   1271             if (version == 1) {
   1272                 timescale_offset = data_offset + 4 + 16;
   1273             } else if (version == 0) {
   1274                 timescale_offset = data_offset + 4 + 8;
   1275             } else {
   1276                 return ERROR_IO;
   1277             }
   1278 
   1279             uint32_t timescale;
   1280             if (mDataSource->readAt(
   1281                         timescale_offset, &timescale, sizeof(timescale))
   1282                     < (ssize_t)sizeof(timescale)) {
   1283                 return ERROR_IO;
   1284             }
   1285 
   1286             if (!timescale) {
   1287                 ALOGE("timescale should not be ZERO.");
   1288                 return ERROR_MALFORMED;
   1289             }
   1290 
   1291             mLastTrack->timescale = ntohl(timescale);
   1292 
   1293             // 14496-12 says all ones means indeterminate, but some files seem to use
   1294             // 0 instead. We treat both the same.
   1295             int64_t duration = 0;
   1296             if (version == 1) {
   1297                 if (mDataSource->readAt(
   1298                             timescale_offset + 4, &duration, sizeof(duration))
   1299                         < (ssize_t)sizeof(duration)) {
   1300                     return ERROR_IO;
   1301                 }
   1302                 if (duration != -1) {
   1303                     duration = ntoh64(duration);
   1304                 }
   1305             } else {
   1306                 uint32_t duration32;
   1307                 if (mDataSource->readAt(
   1308                             timescale_offset + 4, &duration32, sizeof(duration32))
   1309                         < (ssize_t)sizeof(duration32)) {
   1310                     return ERROR_IO;
   1311                 }
   1312                 if (duration32 != 0xffffffff) {
   1313                     duration = ntohl(duration32);
   1314                 }
   1315             }
   1316             if (duration != 0 && mLastTrack->timescale != 0) {
   1317                 mLastTrack->meta->setInt64(
   1318                         kKeyDuration, (duration * 1000000) / mLastTrack->timescale);
   1319             }
   1320 
   1321             uint8_t lang[2];
   1322             off64_t lang_offset;
   1323             if (version == 1) {
   1324                 lang_offset = timescale_offset + 4 + 8;
   1325             } else if (version == 0) {
   1326                 lang_offset = timescale_offset + 4 + 4;
   1327             } else {
   1328                 return ERROR_IO;
   1329             }
   1330 
   1331             if (mDataSource->readAt(lang_offset, &lang, sizeof(lang))
   1332                     < (ssize_t)sizeof(lang)) {
   1333                 return ERROR_IO;
   1334             }
   1335 
   1336             // To get the ISO-639-2/T three character language code
   1337             // 1 bit pad followed by 3 5-bits characters. Each character
   1338             // is packed as the difference between its ASCII value and 0x60.
   1339             char lang_code[4];
   1340             lang_code[0] = ((lang[0] >> 2) & 0x1f) + 0x60;
   1341             lang_code[1] = ((lang[0] & 0x3) << 3 | (lang[1] >> 5)) + 0x60;
   1342             lang_code[2] = (lang[1] & 0x1f) + 0x60;
   1343             lang_code[3] = '\0';
   1344 
   1345             mLastTrack->meta->setCString(
   1346                     kKeyMediaLanguage, lang_code);
   1347 
   1348             break;
   1349         }
   1350 
   1351         case FOURCC('s', 't', 's', 'd'):
   1352         {
   1353             uint8_t buffer[8];
   1354             if (chunk_data_size < (off64_t)sizeof(buffer)) {
   1355                 return ERROR_MALFORMED;
   1356             }
   1357 
   1358             if (mDataSource->readAt(
   1359                         data_offset, buffer, 8) < 8) {
   1360                 return ERROR_IO;
   1361             }
   1362 
   1363             if (U32_AT(buffer) != 0) {
   1364                 // Should be version 0, flags 0.
   1365                 return ERROR_MALFORMED;
   1366             }
   1367 
   1368             uint32_t entry_count = U32_AT(&buffer[4]);
   1369 
   1370             if (entry_count > 1) {
   1371                 // For 3GPP timed text, there could be multiple tx3g boxes contain
   1372                 // multiple text display formats. These formats will be used to
   1373                 // display the timed text.
   1374                 // For encrypted files, there may also be more than one entry.
   1375                 const char *mime;
   1376 
   1377                 if (mLastTrack == NULL)
   1378                     return ERROR_MALFORMED;
   1379 
   1380                 CHECK(mLastTrack->meta->findCString(kKeyMIMEType, &mime));
   1381                 if (strcasecmp(mime, MEDIA_MIMETYPE_TEXT_3GPP) &&
   1382                         strcasecmp(mime, "application/octet-stream")) {
   1383                     // For now we only support a single type of media per track.
   1384                     mLastTrack->skipTrack = true;
   1385                     *offset += chunk_size;
   1386                     break;
   1387                 }
   1388             }
   1389             off64_t stop_offset = *offset + chunk_size;
   1390             *offset = data_offset + 8;
   1391             for (uint32_t i = 0; i < entry_count; ++i) {
   1392                 status_t err = parseChunk(offset, depth + 1);
   1393                 if (err != OK) {
   1394                     return err;
   1395                 }
   1396             }
   1397 
   1398             if (*offset != stop_offset) {
   1399                 return ERROR_MALFORMED;
   1400             }
   1401             break;
   1402         }
   1403         case FOURCC('m', 'e', 't', 't'):
   1404         {
   1405             *offset += chunk_size;
   1406 
   1407             if (mLastTrack == NULL)
   1408                 return ERROR_MALFORMED;
   1409 
   1410             sp<ABuffer> buffer = new ABuffer(chunk_data_size);
   1411             if (buffer->data() == NULL) {
   1412                 return NO_MEMORY;
   1413             }
   1414 
   1415             if (mDataSource->readAt(
   1416                         data_offset, buffer->data(), chunk_data_size) < chunk_data_size) {
   1417                 return ERROR_IO;
   1418             }
   1419 
   1420             String8 mimeFormat((const char *)(buffer->data()), chunk_data_size);
   1421             mLastTrack->meta->setCString(kKeyMIMEType, mimeFormat.string());
   1422 
   1423             break;
   1424         }
   1425 
   1426         case FOURCC('m', 'p', '4', 'a'):
   1427         case FOURCC('e', 'n', 'c', 'a'):
   1428         case FOURCC('s', 'a', 'm', 'r'):
   1429         case FOURCC('s', 'a', 'w', 'b'):
   1430         {
   1431             if (mIsQT && chunk_type == FOURCC('m', 'p', '4', 'a')
   1432                     && depth >= 1 && mPath[depth - 1] == FOURCC('w', 'a', 'v', 'e')) {
   1433                 // Ignore mp4a embedded in QT wave atom
   1434                 *offset += chunk_size;
   1435                 break;
   1436             }
   1437 
   1438             uint8_t buffer[8 + 20];
   1439             if (chunk_data_size < (ssize_t)sizeof(buffer)) {
   1440                 // Basic AudioSampleEntry size.
   1441                 return ERROR_MALFORMED;
   1442             }
   1443 
   1444             if (mDataSource->readAt(
   1445                         data_offset, buffer, sizeof(buffer)) < (ssize_t)sizeof(buffer)) {
   1446                 return ERROR_IO;
   1447             }
   1448 
   1449             uint16_t data_ref_index __unused = U16_AT(&buffer[6]);
   1450             uint16_t version = U16_AT(&buffer[8]);
   1451             uint32_t num_channels = U16_AT(&buffer[16]);
   1452 
   1453             uint16_t sample_size = U16_AT(&buffer[18]);
   1454             uint32_t sample_rate = U32_AT(&buffer[24]) >> 16;
   1455 
   1456             if (mLastTrack == NULL)
   1457                 return ERROR_MALFORMED;
   1458 
   1459             off64_t stop_offset = *offset + chunk_size;
   1460             *offset = data_offset + sizeof(buffer);
   1461 
   1462             if (mIsQT && chunk_type == FOURCC('m', 'p', '4', 'a')) {
   1463                 if (version == 1) {
   1464                     if (mDataSource->readAt(*offset, buffer, 16) < 16) {
   1465                         return ERROR_IO;
   1466                     }
   1467 
   1468 #if 0
   1469                     U32_AT(buffer);  // samples per packet
   1470                     U32_AT(&buffer[4]);  // bytes per packet
   1471                     U32_AT(&buffer[8]);  // bytes per frame
   1472                     U32_AT(&buffer[12]);  // bytes per sample
   1473 #endif
   1474                     *offset += 16;
   1475                 } else if (version == 2) {
   1476                     uint8_t v2buffer[36];
   1477                     if (mDataSource->readAt(*offset, v2buffer, 36) < 36) {
   1478                         return ERROR_IO;
   1479                     }
   1480 
   1481 #if 0
   1482                     U32_AT(v2buffer);  // size of struct only
   1483                     sample_rate = (uint32_t)U64_AT(&v2buffer[4]);  // audio sample rate
   1484                     num_channels = U32_AT(&v2buffer[12]);  // num audio channels
   1485                     U32_AT(&v2buffer[16]);  // always 0x7f000000
   1486                     sample_size = (uint16_t)U32_AT(&v2buffer[20]);  // const bits per channel
   1487                     U32_AT(&v2buffer[24]);  // format specifc flags
   1488                     U32_AT(&v2buffer[28]);  // const bytes per audio packet
   1489                     U32_AT(&v2buffer[32]);  // const LPCM frames per audio packet
   1490 #endif
   1491                     *offset += 36;
   1492                 }
   1493             }
   1494 
   1495             if (chunk_type != FOURCC('e', 'n', 'c', 'a')) {
   1496                 // if the chunk type is enca, we'll get the type from the sinf/frma box later
   1497                 mLastTrack->meta->setCString(kKeyMIMEType, FourCC2MIME(chunk_type));
   1498                 AdjustChannelsAndRate(chunk_type, &num_channels, &sample_rate);
   1499             }
   1500             ALOGV("*** coding='%s' %d channels, size %d, rate %d\n",
   1501                    chunk, num_channels, sample_size, sample_rate);
   1502             mLastTrack->meta->setInt32(kKeyChannelCount, num_channels);
   1503             mLastTrack->meta->setInt32(kKeySampleRate, sample_rate);
   1504 
   1505             while (*offset < stop_offset) {
   1506                 status_t err = parseChunk(offset, depth + 1);
   1507                 if (err != OK) {
   1508                     return err;
   1509                 }
   1510             }
   1511 
   1512             if (*offset != stop_offset) {
   1513                 return ERROR_MALFORMED;
   1514             }
   1515             break;
   1516         }
   1517 
   1518         case FOURCC('m', 'p', '4', 'v'):
   1519         case FOURCC('e', 'n', 'c', 'v'):
   1520         case FOURCC('s', '2', '6', '3'):
   1521         case FOURCC('H', '2', '6', '3'):
   1522         case FOURCC('h', '2', '6', '3'):
   1523         case FOURCC('a', 'v', 'c', '1'):
   1524         case FOURCC('h', 'v', 'c', '1'):
   1525         case FOURCC('h', 'e', 'v', '1'):
   1526         {
   1527             uint8_t buffer[78];
   1528             if (chunk_data_size < (ssize_t)sizeof(buffer)) {
   1529                 // Basic VideoSampleEntry size.
   1530                 return ERROR_MALFORMED;
   1531             }
   1532 
   1533             if (mDataSource->readAt(
   1534                         data_offset, buffer, sizeof(buffer)) < (ssize_t)sizeof(buffer)) {
   1535                 return ERROR_IO;
   1536             }
   1537 
   1538             uint16_t data_ref_index __unused = U16_AT(&buffer[6]);
   1539             uint16_t width = U16_AT(&buffer[6 + 18]);
   1540             uint16_t height = U16_AT(&buffer[6 + 20]);
   1541 
   1542             // The video sample is not standard-compliant if it has invalid dimension.
   1543             // Use some default width and height value, and
   1544             // let the decoder figure out the actual width and height (and thus
   1545             // be prepared for INFO_FOMRAT_CHANGED event).
   1546             if (width == 0)  width  = 352;
   1547             if (height == 0) height = 288;
   1548 
   1549             // printf("*** coding='%s' width=%d height=%d\n",
   1550             //        chunk, width, height);
   1551 
   1552             if (mLastTrack == NULL)
   1553                 return ERROR_MALFORMED;
   1554 
   1555             if (chunk_type != FOURCC('e', 'n', 'c', 'v')) {
   1556                 // if the chunk type is encv, we'll get the type from the sinf/frma box later
   1557                 mLastTrack->meta->setCString(kKeyMIMEType, FourCC2MIME(chunk_type));
   1558             }
   1559             mLastTrack->meta->setInt32(kKeyWidth, width);
   1560             mLastTrack->meta->setInt32(kKeyHeight, height);
   1561 
   1562             off64_t stop_offset = *offset + chunk_size;
   1563             *offset = data_offset + sizeof(buffer);
   1564             while (*offset < stop_offset) {
   1565                 status_t err = parseChunk(offset, depth + 1);
   1566                 if (err != OK) {
   1567                     return err;
   1568                 }
   1569             }
   1570 
   1571             if (*offset != stop_offset) {
   1572                 return ERROR_MALFORMED;
   1573             }
   1574             break;
   1575         }
   1576 
   1577         case FOURCC('s', 't', 'c', 'o'):
   1578         case FOURCC('c', 'o', '6', '4'):
   1579         {
   1580             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL)) {
   1581                 return ERROR_MALFORMED;
   1582             }
   1583 
   1584             status_t err =
   1585                 mLastTrack->sampleTable->setChunkOffsetParams(
   1586                         chunk_type, data_offset, chunk_data_size);
   1587 
   1588             *offset += chunk_size;
   1589 
   1590             if (err != OK) {
   1591                 return err;
   1592             }
   1593 
   1594             break;
   1595         }
   1596 
   1597         case FOURCC('s', 't', 's', 'c'):
   1598         {
   1599             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL))
   1600                 return ERROR_MALFORMED;
   1601 
   1602             status_t err =
   1603                 mLastTrack->sampleTable->setSampleToChunkParams(
   1604                         data_offset, chunk_data_size);
   1605 
   1606             *offset += chunk_size;
   1607 
   1608             if (err != OK) {
   1609                 return err;
   1610             }
   1611 
   1612             break;
   1613         }
   1614 
   1615         case FOURCC('s', 't', 's', 'z'):
   1616         case FOURCC('s', 't', 'z', '2'):
   1617         {
   1618             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL)) {
   1619                 return ERROR_MALFORMED;
   1620             }
   1621 
   1622             status_t err =
   1623                 mLastTrack->sampleTable->setSampleSizeParams(
   1624                         chunk_type, data_offset, chunk_data_size);
   1625 
   1626             *offset += chunk_size;
   1627 
   1628             if (err != OK) {
   1629                 return err;
   1630             }
   1631 
   1632             size_t max_size;
   1633             err = mLastTrack->sampleTable->getMaxSampleSize(&max_size);
   1634 
   1635             if (err != OK) {
   1636                 return err;
   1637             }
   1638 
   1639             if (max_size != 0) {
   1640                 // Assume that a given buffer only contains at most 10 chunks,
   1641                 // each chunk originally prefixed with a 2 byte length will
   1642                 // have a 4 byte header (0x00 0x00 0x00 0x01) after conversion,
   1643                 // and thus will grow by 2 bytes per chunk.
   1644                 if (max_size > SIZE_MAX - 10 * 2) {
   1645                     ALOGE("max sample size too big: %zu", max_size);
   1646                     return ERROR_MALFORMED;
   1647                 }
   1648                 mLastTrack->meta->setInt32(kKeyMaxInputSize, max_size + 10 * 2);
   1649             } else {
   1650                 // No size was specified. Pick a conservatively large size.
   1651                 uint32_t width, height;
   1652                 if (!mLastTrack->meta->findInt32(kKeyWidth, (int32_t*)&width) ||
   1653                     !mLastTrack->meta->findInt32(kKeyHeight,(int32_t*) &height)) {
   1654                     ALOGE("No width or height, assuming worst case 1080p");
   1655                     width = 1920;
   1656                     height = 1080;
   1657                 } else {
   1658                     // A resolution was specified, check that it's not too big. The values below
   1659                     // were chosen so that the calculations below don't cause overflows, they're
   1660                     // not indicating that resolutions up to 32kx32k are actually supported.
   1661                     if (width > 32768 || height > 32768) {
   1662                         ALOGE("can't support %u x %u video", width, height);
   1663                         return ERROR_MALFORMED;
   1664                     }
   1665                 }
   1666 
   1667                 const char *mime;
   1668                 CHECK(mLastTrack->meta->findCString(kKeyMIMEType, &mime));
   1669                 if (!strcmp(mime, MEDIA_MIMETYPE_VIDEO_AVC)
   1670                         || !strcmp(mime, MEDIA_MIMETYPE_VIDEO_HEVC)) {
   1671                     // AVC & HEVC requires compression ratio of at least 2, and uses
   1672                     // macroblocks
   1673                     max_size = ((width + 15) / 16) * ((height + 15) / 16) * 192;
   1674                 } else {
   1675                     // For all other formats there is no minimum compression
   1676                     // ratio. Use compression ratio of 1.
   1677                     max_size = width * height * 3 / 2;
   1678                 }
   1679                 // HACK: allow 10% overhead
   1680                 // TODO: read sample size from traf atom for fragmented MPEG4.
   1681                 max_size += max_size / 10;
   1682                 mLastTrack->meta->setInt32(kKeyMaxInputSize, max_size);
   1683             }
   1684 
   1685             // NOTE: setting another piece of metadata invalidates any pointers (such as the
   1686             // mimetype) previously obtained, so don't cache them.
   1687             const char *mime;
   1688             CHECK(mLastTrack->meta->findCString(kKeyMIMEType, &mime));
   1689             // Calculate average frame rate.
   1690             if (!strncasecmp("video/", mime, 6)) {
   1691                 size_t nSamples = mLastTrack->sampleTable->countSamples();
   1692                 if (nSamples == 0) {
   1693                     int32_t trackId;
   1694                     if (mLastTrack->meta->findInt32(kKeyTrackID, &trackId)) {
   1695                         for (size_t i = 0; i < mTrex.size(); i++) {
   1696                             Trex *t = &mTrex.editItemAt(i);
   1697                             if (t->track_ID == (uint32_t) trackId) {
   1698                                 if (t->default_sample_duration > 0) {
   1699                                     int32_t frameRate =
   1700                                             mLastTrack->timescale / t->default_sample_duration;
   1701                                     mLastTrack->meta->setInt32(kKeyFrameRate, frameRate);
   1702                                 }
   1703                                 break;
   1704                             }
   1705                         }
   1706                     }
   1707                 } else {
   1708                     int64_t durationUs;
   1709                     if (mLastTrack->meta->findInt64(kKeyDuration, &durationUs)) {
   1710                         if (durationUs > 0) {
   1711                             int32_t frameRate = (nSamples * 1000000LL +
   1712                                         (durationUs >> 1)) / durationUs;
   1713                             mLastTrack->meta->setInt32(kKeyFrameRate, frameRate);
   1714                         }
   1715                     }
   1716                 }
   1717             }
   1718 
   1719             break;
   1720         }
   1721 
   1722         case FOURCC('s', 't', 't', 's'):
   1723         {
   1724             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL))
   1725                 return ERROR_MALFORMED;
   1726 
   1727             *offset += chunk_size;
   1728 
   1729             status_t err =
   1730                 mLastTrack->sampleTable->setTimeToSampleParams(
   1731                         data_offset, chunk_data_size);
   1732 
   1733             if (err != OK) {
   1734                 return err;
   1735             }
   1736 
   1737             break;
   1738         }
   1739 
   1740         case FOURCC('c', 't', 't', 's'):
   1741         {
   1742             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL))
   1743                 return ERROR_MALFORMED;
   1744 
   1745             *offset += chunk_size;
   1746 
   1747             status_t err =
   1748                 mLastTrack->sampleTable->setCompositionTimeToSampleParams(
   1749                         data_offset, chunk_data_size);
   1750 
   1751             if (err != OK) {
   1752                 return err;
   1753             }
   1754 
   1755             break;
   1756         }
   1757 
   1758         case FOURCC('s', 't', 's', 's'):
   1759         {
   1760             if ((mLastTrack == NULL) || (mLastTrack->sampleTable == NULL))
   1761                 return ERROR_MALFORMED;
   1762 
   1763             *offset += chunk_size;
   1764 
   1765             status_t err =
   1766                 mLastTrack->sampleTable->setSyncSampleParams(
   1767                         data_offset, chunk_data_size);
   1768 
   1769             if (err != OK) {
   1770                 return err;
   1771             }
   1772 
   1773             break;
   1774         }
   1775 
   1776         // \xA9xyz
   1777         case FOURCC(0xA9, 'x', 'y', 'z'):
   1778         {
   1779             *offset += chunk_size;
   1780 
   1781             // Best case the total data length inside "\xA9xyz" box would
   1782             // be 9, for instance "\xA9xyz" + "\x00\x05\x15\xc7" + "+0+0/",
   1783             // where "\x00\x05" is the text string length with value = 5,
   1784             // "\0x15\xc7" is the language code = en, and "+0+0/" is a
   1785             // location (string) value with longitude = 0 and latitude = 0.
   1786             // Since some devices encountered in the wild omit the trailing
   1787             // slash, we'll allow that.
   1788             if (chunk_data_size < 8) { // 8 instead of 9 to allow for missing /
   1789                 return ERROR_MALFORMED;
   1790             }
   1791 
   1792             uint16_t len;
   1793             if (!mDataSource->getUInt16(data_offset, &len)) {
   1794                 return ERROR_IO;
   1795             }
   1796 
   1797             // allow "+0+0" without trailing slash
   1798             if (len < 4 || len > chunk_data_size - 4) {
   1799                 return ERROR_MALFORMED;
   1800             }
   1801             // The location string following the language code is formatted
   1802             // according to ISO 6709:2008 (https://en.wikipedia.org/wiki/ISO_6709).
   1803             // Allocate 2 extra bytes, in case we need to add a trailing slash,
   1804             // and to add a terminating 0.
   1805             std::unique_ptr<char[]> buffer(new (std::nothrow) char[len+2]());
   1806             if (!buffer) {
   1807                 return NO_MEMORY;
   1808             }
   1809 
   1810             if (mDataSource->readAt(
   1811                         data_offset + 4, &buffer[0], len) < len) {
   1812                 return ERROR_IO;
   1813             }
   1814 
   1815             len = strlen(&buffer[0]);
   1816             if (len < 4) {
   1817                 return ERROR_MALFORMED;
   1818             }
   1819             // Add a trailing slash if there wasn't one.
   1820             if (buffer[len - 1] != '/') {
   1821                 buffer[len] = '/';
   1822             }
   1823             mFileMetaData->setCString(kKeyLocation, &buffer[0]);
   1824             break;
   1825         }
   1826 
   1827         case FOURCC('e', 's', 'd', 's'):
   1828         {
   1829             *offset += chunk_size;
   1830 
   1831             if (chunk_data_size < 4) {
   1832                 return ERROR_MALFORMED;
   1833             }
   1834 
   1835             uint8_t buffer[256];
   1836             if (chunk_data_size > (off64_t)sizeof(buffer)) {
   1837                 return ERROR_BUFFER_TOO_SMALL;
   1838             }
   1839 
   1840             if (mDataSource->readAt(
   1841                         data_offset, buffer, chunk_data_size) < chunk_data_size) {
   1842                 return ERROR_IO;
   1843             }
   1844 
   1845             if (U32_AT(buffer) != 0) {
   1846                 // Should be version 0, flags 0.
   1847                 return ERROR_MALFORMED;
   1848             }
   1849 
   1850             if (mLastTrack == NULL)
   1851                 return ERROR_MALFORMED;
   1852 
   1853             mLastTrack->meta->setData(
   1854                     kKeyESDS, kTypeESDS, &buffer[4], chunk_data_size - 4);
   1855 
   1856             if (mPath.size() >= 2
   1857                     && mPath[mPath.size() - 2] == FOURCC('m', 'p', '4', 'a')) {
   1858                 // Information from the ESDS must be relied on for proper
   1859                 // setup of sample rate and channel count for MPEG4 Audio.
   1860                 // The generic header appears to only contain generic
   1861                 // information...
   1862 
   1863                 status_t err = updateAudioTrackInfoFromESDS_MPEG4Audio(
   1864                         &buffer[4], chunk_data_size - 4);
   1865 
   1866                 if (err != OK) {
   1867                     return err;
   1868                 }
   1869             }
   1870             if (mPath.size() >= 2
   1871                     && mPath[mPath.size() - 2] == FOURCC('m', 'p', '4', 'v')) {
   1872                 // Check if the video is MPEG2
   1873                 ESDS esds(&buffer[4], chunk_data_size - 4);
   1874 
   1875                 uint8_t objectTypeIndication;
   1876                 if (esds.getObjectTypeIndication(&objectTypeIndication) == OK) {
   1877                     if (objectTypeIndication >= 0x60 && objectTypeIndication <= 0x65) {
   1878                         mLastTrack->meta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG2);
   1879                     }
   1880                 }
   1881             }
   1882             break;
   1883         }
   1884 
   1885         case FOURCC('b', 't', 'r', 't'):
   1886         {
   1887             *offset += chunk_size;
   1888             if (mLastTrack == NULL) {
   1889                 return ERROR_MALFORMED;
   1890             }
   1891 
   1892             uint8_t buffer[12];
   1893             if (chunk_data_size != sizeof(buffer)) {
   1894                 return ERROR_MALFORMED;
   1895             }
   1896 
   1897             if (mDataSource->readAt(
   1898                     data_offset, buffer, chunk_data_size) < chunk_data_size) {
   1899                 return ERROR_IO;
   1900             }
   1901 
   1902             uint32_t maxBitrate = U32_AT(&buffer[4]);
   1903             uint32_t avgBitrate = U32_AT(&buffer[8]);
   1904             if (maxBitrate > 0 && maxBitrate < INT32_MAX) {
   1905                 mLastTrack->meta->setInt32(kKeyMaxBitRate, (int32_t)maxBitrate);
   1906             }
   1907             if (avgBitrate > 0 && avgBitrate < INT32_MAX) {
   1908                 mLastTrack->meta->setInt32(kKeyBitRate, (int32_t)avgBitrate);
   1909             }
   1910             break;
   1911         }
   1912 
   1913         case FOURCC('a', 'v', 'c', 'C'):
   1914         {
   1915             *offset += chunk_size;
   1916 
   1917             sp<ABuffer> buffer = new ABuffer(chunk_data_size);
   1918 
   1919             if (buffer->data() == NULL) {
   1920                 ALOGE("b/28471206");
   1921                 return NO_MEMORY;
   1922             }
   1923 
   1924             if (mDataSource->readAt(
   1925                         data_offset, buffer->data(), chunk_data_size) < chunk_data_size) {
   1926                 return ERROR_IO;
   1927             }
   1928 
   1929             if (mLastTrack == NULL)
   1930                 return ERROR_MALFORMED;
   1931 
   1932             mLastTrack->meta->setData(
   1933                     kKeyAVCC, kTypeAVCC, buffer->data(), chunk_data_size);
   1934 
   1935             break;
   1936         }
   1937         case FOURCC('h', 'v', 'c', 'C'):
   1938         {
   1939             sp<ABuffer> buffer = new ABuffer(chunk_data_size);
   1940 
   1941             if (buffer->data() == NULL) {
   1942                 ALOGE("b/28471206");
   1943                 return NO_MEMORY;
   1944             }
   1945 
   1946             if (mDataSource->readAt(
   1947                         data_offset, buffer->data(), chunk_data_size) < chunk_data_size) {
   1948                 return ERROR_IO;
   1949             }
   1950 
   1951             if (mLastTrack == NULL)
   1952                 return ERROR_MALFORMED;
   1953 
   1954             mLastTrack->meta->setData(
   1955                     kKeyHVCC, kTypeHVCC, buffer->data(), chunk_data_size);
   1956 
   1957             *offset += chunk_size;
   1958             break;
   1959         }
   1960 
   1961         case FOURCC('d', '2', '6', '3'):
   1962         {
   1963             *offset += chunk_size;
   1964             /*
   1965              * d263 contains a fixed 7 bytes part:
   1966              *   vendor - 4 bytes
   1967              *   version - 1 byte
   1968              *   level - 1 byte
   1969              *   profile - 1 byte
   1970              * optionally, "d263" box itself may contain a 16-byte
   1971              * bit rate box (bitr)
   1972              *   average bit rate - 4 bytes
   1973              *   max bit rate - 4 bytes
   1974              */
   1975             char buffer[23];
   1976             if (chunk_data_size != 7 &&
   1977                 chunk_data_size != 23) {
   1978                 ALOGE("Incorrect D263 box size %lld", (long long)chunk_data_size);
   1979                 return ERROR_MALFORMED;
   1980             }
   1981 
   1982             if (mDataSource->readAt(
   1983                     data_offset, buffer, chunk_data_size) < chunk_data_size) {
   1984                 return ERROR_IO;
   1985             }
   1986 
   1987             if (mLastTrack == NULL)
   1988                 return ERROR_MALFORMED;
   1989 
   1990             mLastTrack->meta->setData(kKeyD263, kTypeD263, buffer, chunk_data_size);
   1991 
   1992             break;
   1993         }
   1994 
   1995         case FOURCC('m', 'e', 't', 'a'):
   1996         {
   1997             off64_t stop_offset = *offset + chunk_size;
   1998             *offset = data_offset;
   1999             bool isParsingMetaKeys = underQTMetaPath(mPath, 2);
   2000             if (!isParsingMetaKeys) {
   2001                 uint8_t buffer[4];
   2002                 if (chunk_data_size < (off64_t)sizeof(buffer)) {
   2003                     *offset = stop_offset;
   2004                     return ERROR_MALFORMED;
   2005                 }
   2006 
   2007                 if (mDataSource->readAt(
   2008                             data_offset, buffer, 4) < 4) {
   2009                     *offset = stop_offset;
   2010                     return ERROR_IO;
   2011                 }
   2012 
   2013                 if (U32_AT(buffer) != 0) {
   2014                     // Should be version 0, flags 0.
   2015 
   2016                     // If it's not, let's assume this is one of those
   2017                     // apparently malformed chunks that don't have flags
   2018                     // and completely different semantics than what's
   2019                     // in the MPEG4 specs and skip it.
   2020                     *offset = stop_offset;
   2021                     return OK;
   2022                 }
   2023                 *offset +=  sizeof(buffer);
   2024             }
   2025 
   2026             while (*offset < stop_offset) {
   2027                 status_t err = parseChunk(offset, depth + 1);
   2028                 if (err != OK) {
   2029                     return err;
   2030                 }
   2031             }
   2032 
   2033             if (*offset != stop_offset) {
   2034                 return ERROR_MALFORMED;
   2035             }
   2036             break;
   2037         }
   2038 
   2039         case FOURCC('i', 'l', 'o', 'c'):
   2040         case FOURCC('i', 'i', 'n', 'f'):
   2041         case FOURCC('i', 'p', 'r', 'p'):
   2042         case FOURCC('p', 'i', 't', 'm'):
   2043         case FOURCC('i', 'd', 'a', 't'):
   2044         case FOURCC('i', 'r', 'e', 'f'):
   2045         case FOURCC('i', 'p', 'r', 'o'):
   2046         {
   2047             if (mIsHEIF) {
   2048                 if (mItemTable == NULL) {
   2049                     mItemTable = new ItemTable(mDataSource);
   2050                 }
   2051                 status_t err = mItemTable->parse(
   2052                         chunk_type, data_offset, chunk_data_size);
   2053                 if (err != OK) {
   2054                     return err;
   2055                 }
   2056             }
   2057             *offset += chunk_size;
   2058             break;
   2059         }
   2060 
   2061         case FOURCC('m', 'e', 'a', 'n'):
   2062         case FOURCC('n', 'a', 'm', 'e'):
   2063         case FOURCC('d', 'a', 't', 'a'):
   2064         {
   2065             *offset += chunk_size;
   2066 
   2067             if (mPath.size() == 6 && underMetaDataPath(mPath)) {
   2068                 status_t err = parseITunesMetaData(data_offset, chunk_data_size);
   2069 
   2070                 if (err != OK) {
   2071                     return err;
   2072                 }
   2073             }
   2074 
   2075             break;
   2076         }
   2077 
   2078         case FOURCC('m', 'v', 'h', 'd'):
   2079         {
   2080             *offset += chunk_size;
   2081 
   2082             if (depth != 1) {
   2083                 ALOGE("mvhd: depth %d", depth);
   2084                 return ERROR_MALFORMED;
   2085             }
   2086             if (chunk_data_size < 32) {
   2087                 return ERROR_MALFORMED;
   2088             }
   2089 
   2090             uint8_t header[32];
   2091             if (mDataSource->readAt(
   2092                         data_offset, header, sizeof(header))
   2093                     < (ssize_t)sizeof(header)) {
   2094                 return ERROR_IO;
   2095             }
   2096 
   2097             uint64_t creationTime;
   2098             uint64_t duration = 0;
   2099             if (header[0] == 1) {
   2100                 creationTime = U64_AT(&header[4]);
   2101                 mHeaderTimescale = U32_AT(&header[20]);
   2102                 duration = U64_AT(&header[24]);
   2103                 if (duration == 0xffffffffffffffff) {
   2104                     duration = 0;
   2105                 }
   2106             } else if (header[0] != 0) {
   2107                 return ERROR_MALFORMED;
   2108             } else {
   2109                 creationTime = U32_AT(&header[4]);
   2110                 mHeaderTimescale = U32_AT(&header[12]);
   2111                 uint32_t d32 = U32_AT(&header[16]);
   2112                 if (d32 == 0xffffffff) {
   2113                     d32 = 0;
   2114                 }
   2115                 duration = d32;
   2116             }
   2117             if (duration != 0 && mHeaderTimescale != 0 && duration < UINT64_MAX / 1000000) {
   2118                 mFileMetaData->setInt64(kKeyDuration, duration * 1000000 / mHeaderTimescale);
   2119             }
   2120 
   2121             String8 s;
   2122             if (convertTimeToDate(creationTime, &s)) {
   2123                 mFileMetaData->setCString(kKeyDate, s.string());
   2124             }
   2125 
   2126 
   2127             break;
   2128         }
   2129 
   2130         case FOURCC('m', 'e', 'h', 'd'):
   2131         {
   2132             *offset += chunk_size;
   2133 
   2134             if (chunk_data_size < 8) {
   2135                 return ERROR_MALFORMED;
   2136             }
   2137 
   2138             uint8_t flags[4];
   2139             if (mDataSource->readAt(
   2140                         data_offset, flags, sizeof(flags))
   2141                     < (ssize_t)sizeof(flags)) {
   2142                 return ERROR_IO;
   2143             }
   2144 
   2145             uint64_t duration = 0;
   2146             if (flags[0] == 1) {
   2147                 // 64 bit
   2148                 if (chunk_data_size < 12) {
   2149                     return ERROR_MALFORMED;
   2150                 }
   2151                 mDataSource->getUInt64(data_offset + 4, &duration);
   2152                 if (duration == 0xffffffffffffffff) {
   2153                     duration = 0;
   2154                 }
   2155             } else if (flags[0] == 0) {
   2156                 // 32 bit
   2157                 uint32_t d32;
   2158                 mDataSource->getUInt32(data_offset + 4, &d32);
   2159                 if (d32 == 0xffffffff) {
   2160                     d32 = 0;
   2161                 }
   2162                 duration = d32;
   2163             } else {
   2164                 return ERROR_MALFORMED;
   2165             }
   2166 
   2167             if (duration != 0 && mHeaderTimescale != 0) {
   2168                 mFileMetaData->setInt64(kKeyDuration, duration * 1000000 / mHeaderTimescale);
   2169             }
   2170 
   2171             break;
   2172         }
   2173 
   2174         case FOURCC('m', 'd', 'a', 't'):
   2175         {
   2176             ALOGV("mdat chunk, drm: %d", mIsDrm);
   2177 
   2178             mMdatFound = true;
   2179 
   2180             if (!mIsDrm) {
   2181                 *offset += chunk_size;
   2182                 break;
   2183             }
   2184 
   2185             if (chunk_size < 8) {
   2186                 return ERROR_MALFORMED;
   2187             }
   2188 
   2189             return parseDrmSINF(offset, data_offset);
   2190         }
   2191 
   2192         case FOURCC('h', 'd', 'l', 'r'):
   2193         {
   2194             *offset += chunk_size;
   2195 
   2196             if (underQTMetaPath(mPath, 3)) {
   2197                 break;
   2198             }
   2199 
   2200             uint32_t buffer;
   2201             if (mDataSource->readAt(
   2202                         data_offset + 8, &buffer, 4) < 4) {
   2203                 return ERROR_IO;
   2204             }
   2205 
   2206             uint32_t type = ntohl(buffer);
   2207             // For the 3GPP file format, the handler-type within the 'hdlr' box
   2208             // shall be 'text'. We also want to support 'sbtl' handler type
   2209             // for a practical reason as various MPEG4 containers use it.
   2210             if (type == FOURCC('t', 'e', 'x', 't') || type == FOURCC('s', 'b', 't', 'l')) {
   2211                 if (mLastTrack != NULL) {
   2212                     mLastTrack->meta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_TEXT_3GPP);
   2213                 }
   2214             }
   2215 
   2216             break;
   2217         }
   2218 
   2219         case FOURCC('k', 'e', 'y', 's'):
   2220         {
   2221             *offset += chunk_size;
   2222 
   2223             if (underQTMetaPath(mPath, 3)) {
   2224                 status_t err = parseQTMetaKey(data_offset, chunk_data_size);
   2225                 if (err != OK) {
   2226                     return err;
   2227                 }
   2228             }
   2229             break;
   2230         }
   2231 
   2232         case FOURCC('t', 'r', 'e', 'x'):
   2233         {
   2234             *offset += chunk_size;
   2235 
   2236             if (chunk_data_size < 24) {
   2237                 return ERROR_IO;
   2238             }
   2239             Trex trex;
   2240             if (!mDataSource->getUInt32(data_offset + 4, &trex.track_ID) ||
   2241                 !mDataSource->getUInt32(data_offset + 8, &trex.default_sample_description_index) ||
   2242                 !mDataSource->getUInt32(data_offset + 12, &trex.default_sample_duration) ||
   2243                 !mDataSource->getUInt32(data_offset + 16, &trex.default_sample_size) ||
   2244                 !mDataSource->getUInt32(data_offset + 20, &trex.default_sample_flags)) {
   2245                 return ERROR_IO;
   2246             }
   2247             mTrex.add(trex);
   2248             break;
   2249         }
   2250 
   2251         case FOURCC('t', 'x', '3', 'g'):
   2252         {
   2253             if (mLastTrack == NULL)
   2254                 return ERROR_MALFORMED;
   2255 
   2256             uint32_t type;
   2257             const void *data;
   2258             size_t size = 0;
   2259             if (!mLastTrack->meta->findData(
   2260                     kKeyTextFormatData, &type, &data, &size)) {
   2261                 size = 0;
   2262             }
   2263 
   2264             if ((chunk_size > SIZE_MAX) || (SIZE_MAX - chunk_size <= size)) {
   2265                 return ERROR_MALFORMED;
   2266             }
   2267 
   2268             uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];
   2269             if (buffer == NULL) {
   2270                 return ERROR_MALFORMED;
   2271             }
   2272 
   2273             if (size > 0) {
   2274                 memcpy(buffer, data, size);
   2275             }
   2276 
   2277             if ((size_t)(mDataSource->readAt(*offset, buffer + size, chunk_size))
   2278                     < chunk_size) {
   2279                 delete[] buffer;
   2280                 buffer = NULL;
   2281 
   2282                 // advance read pointer so we don't end up reading this again
   2283                 *offset += chunk_size;
   2284                 return ERROR_IO;
   2285             }
   2286 
   2287             mLastTrack->meta->setData(
   2288                     kKeyTextFormatData, 0, buffer, size + chunk_size);
   2289 
   2290             delete[] buffer;
   2291 
   2292             *offset += chunk_size;
   2293             break;
   2294         }
   2295 
   2296         case FOURCC('c', 'o', 'v', 'r'):
   2297         {
   2298             *offset += chunk_size;
   2299 
   2300             if (mFileMetaData != NULL) {
   2301                 ALOGV("chunk_data_size = %" PRId64 " and data_offset = %" PRId64,
   2302                       chunk_data_size, data_offset);
   2303 
   2304                 if (chunk_data_size < 0 || static_cast<uint64_t>(chunk_data_size) >= SIZE_MAX - 1) {
   2305                     return ERROR_MALFORMED;
   2306                 }
   2307                 sp<ABuffer> buffer = new ABuffer(chunk_data_size + 1);
   2308                 if (buffer->data() == NULL) {
   2309                     ALOGE("b/28471206");
   2310                     return NO_MEMORY;
   2311                 }
   2312                 if (mDataSource->readAt(
   2313                     data_offset, buffer->data(), chunk_data_size) != (ssize_t)chunk_data_size) {
   2314                     return ERROR_IO;
   2315                 }
   2316                 const int kSkipBytesOfDataBox = 16;
   2317                 if (chunk_data_size <= kSkipBytesOfDataBox) {
   2318                     return ERROR_MALFORMED;
   2319                 }
   2320 
   2321                 mFileMetaData->setData(
   2322                     kKeyAlbumArt, MetaData::TYPE_NONE,
   2323                     buffer->data() + kSkipBytesOfDataBox, chunk_data_size - kSkipBytesOfDataBox);
   2324             }
   2325 
   2326             break;
   2327         }
   2328 
   2329         case FOURCC('c', 'o', 'l', 'r'):
   2330         {
   2331             *offset += chunk_size;
   2332             // this must be in a VisualSampleEntry box under the Sample Description Box ('stsd')
   2333             // ignore otherwise
   2334             if (depth >= 2 && mPath[depth - 2] == FOURCC('s', 't', 's', 'd')) {
   2335                 status_t err = parseColorInfo(data_offset, chunk_data_size);
   2336                 if (err != OK) {
   2337                     return err;
   2338                 }
   2339             }
   2340 
   2341             break;
   2342         }
   2343 
   2344         case FOURCC('t', 'i', 't', 'l'):
   2345         case FOURCC('p', 'e', 'r', 'f'):
   2346         case FOURCC('a', 'u', 't', 'h'):
   2347         case FOURCC('g', 'n', 'r', 'e'):
   2348         case FOURCC('a', 'l', 'b', 'm'):
   2349         case FOURCC('y', 'r', 'r', 'c'):
   2350         {
   2351             *offset += chunk_size;
   2352 
   2353             status_t err = parse3GPPMetaData(data_offset, chunk_data_size, depth);
   2354 
   2355             if (err != OK) {
   2356                 return err;
   2357             }
   2358 
   2359             break;
   2360         }
   2361 
   2362         case FOURCC('I', 'D', '3', '2'):
   2363         {
   2364             *offset += chunk_size;
   2365 
   2366             if (chunk_data_size < 6) {
   2367                 return ERROR_MALFORMED;
   2368             }
   2369 
   2370             parseID3v2MetaData(data_offset + 6);
   2371 
   2372             break;
   2373         }
   2374 
   2375         case FOURCC('-', '-', '-', '-'):
   2376         {
   2377             mLastCommentMean.clear();
   2378             mLastCommentName.clear();
   2379             mLastCommentData.clear();
   2380             *offset += chunk_size;
   2381             break;
   2382         }
   2383 
   2384         case FOURCC('s', 'i', 'd', 'x'):
   2385         {
   2386             status_t err = parseSegmentIndex(data_offset, chunk_data_size);
   2387             if (err != OK) {
   2388                 return err;
   2389             }
   2390             *offset += chunk_size;
   2391             return UNKNOWN_ERROR; // stop parsing after sidx
   2392         }
   2393 
   2394         case FOURCC('a', 'c', '-', '3'):
   2395         {
   2396             *offset += chunk_size;
   2397             return parseAC3SampleEntry(data_offset);
   2398         }
   2399 
   2400         case FOURCC('f', 't', 'y', 'p'):
   2401         {
   2402             if (chunk_data_size < 8 || depth != 0) {
   2403                 return ERROR_MALFORMED;
   2404             }
   2405 
   2406             off64_t stop_offset = *offset + chunk_size;
   2407             uint32_t numCompatibleBrands = (chunk_data_size - 8) / 4;
   2408             std::set<uint32_t> brandSet;
   2409             for (size_t i = 0; i < numCompatibleBrands + 2; ++i) {
   2410                 if (i == 1) {
   2411                     // Skip this index, it refers to the minorVersion,
   2412                     // not a brand.
   2413                     continue;
   2414                 }
   2415 
   2416                 uint32_t brand;
   2417                 if (mDataSource->readAt(data_offset + 4 * i, &brand, 4) < 4) {
   2418                     return ERROR_MALFORMED;
   2419                 }
   2420 
   2421                 brand = ntohl(brand);
   2422                 brandSet.insert(brand);
   2423             }
   2424 
   2425             if (brandSet.count(FOURCC('q', 't', ' ', ' ')) > 0) {
   2426                 mIsQT = true;
   2427             } else if (brandSet.count(FOURCC('m', 'i', 'f', '1')) > 0
   2428                     && brandSet.count(FOURCC('h', 'e', 'i', 'c')) > 0) {
   2429                 mIsHEIF = true;
   2430                 ALOGV("identified HEIF image");
   2431             }
   2432 
   2433             *offset = stop_offset;
   2434 
   2435             break;
   2436         }
   2437 
   2438         default:
   2439         {
   2440             // check if we're parsing 'ilst' for meta keys
   2441             // if so, treat type as a number (key-id).
   2442             if (underQTMetaPath(mPath, 3)) {
   2443                 status_t err = parseQTMetaVal(chunk_type, data_offset, chunk_data_size);
   2444                 if (err != OK) {
   2445                     return err;
   2446                 }
   2447             }
   2448 
   2449             *offset += chunk_size;
   2450             break;
   2451         }
   2452     }
   2453 
   2454     return OK;
   2455 }
   2456 
   2457 status_t MPEG4Extractor::parseAC3SampleEntry(off64_t offset) {
   2458     // skip 16 bytes:
   2459     //  + 6-byte reserved,
   2460     //  + 2-byte data reference index,
   2461     //  + 8-byte reserved
   2462     offset += 16;
   2463     uint16_t channelCount;
   2464     if (!mDataSource->getUInt16(offset, &channelCount)) {
   2465         return ERROR_MALFORMED;
   2466     }
   2467     // skip 8 bytes:
   2468     //  + 2-byte channelCount,
   2469     //  + 2-byte sample size,
   2470     //  + 4-byte reserved
   2471     offset += 8;
   2472     uint16_t sampleRate;
   2473     if (!mDataSource->getUInt16(offset, &sampleRate)) {
   2474         ALOGE("MPEG4Extractor: error while reading ac-3 block: cannot read sample rate");
   2475         return ERROR_MALFORMED;
   2476     }
   2477 
   2478     // skip 4 bytes:
   2479     //  + 2-byte sampleRate,
   2480     //  + 2-byte reserved
   2481     offset += 4;
   2482     return parseAC3SpecificBox(offset, sampleRate);
   2483 }
   2484 
   2485 status_t MPEG4Extractor::parseAC3SpecificBox(
   2486         off64_t offset, uint16_t sampleRate) {
   2487     uint32_t size;
   2488     // + 4-byte size
   2489     // + 4-byte type
   2490     // + 3-byte payload
   2491     const uint32_t kAC3SpecificBoxSize = 11;
   2492     if (!mDataSource->getUInt32(offset, &size) || size < kAC3SpecificBoxSize) {
   2493         ALOGE("MPEG4Extractor: error while reading ac-3 block: cannot read specific box size");
   2494         return ERROR_MALFORMED;
   2495     }
   2496 
   2497     offset += 4;
   2498     uint32_t type;
   2499     if (!mDataSource->getUInt32(offset, &type) || type != FOURCC('d', 'a', 'c', '3')) {
   2500         ALOGE("MPEG4Extractor: error while reading ac-3 specific block: header not dac3");
   2501         return ERROR_MALFORMED;
   2502     }
   2503 
   2504     offset += 4;
   2505     const uint32_t kAC3SpecificBoxPayloadSize = 3;
   2506     uint8_t chunk[kAC3SpecificBoxPayloadSize];
   2507     if (mDataSource->readAt(offset, chunk, sizeof(chunk)) != sizeof(chunk)) {
   2508         ALOGE("MPEG4Extractor: error while reading ac-3 specific block: bitstream fields");
   2509         return ERROR_MALFORMED;
   2510     }
   2511 
   2512     ABitReader br(chunk, sizeof(chunk));
   2513     static const unsigned channelCountTable[] = {2, 1, 2, 3, 3, 4, 4, 5};
   2514     static const unsigned sampleRateTable[] = {48000, 44100, 32000};
   2515 
   2516     unsigned fscod = br.getBits(2);
   2517     if (fscod == 3) {
   2518         ALOGE("Incorrect fscod (3) in AC3 header");
   2519         return ERROR_MALFORMED;
   2520     }
   2521     unsigned boxSampleRate = sampleRateTable[fscod];
   2522     if (boxSampleRate != sampleRate) {
   2523         ALOGE("sample rate mismatch: boxSampleRate = %d, sampleRate = %d",
   2524             boxSampleRate, sampleRate);
   2525         return ERROR_MALFORMED;
   2526     }
   2527 
   2528     unsigned bsid = br.getBits(5);
   2529     if (bsid > 8) {
   2530         ALOGW("Incorrect bsid in AC3 header. Possibly E-AC-3?");
   2531         return ERROR_MALFORMED;
   2532     }
   2533 
   2534     // skip
   2535     unsigned bsmod __unused = br.getBits(3);
   2536 
   2537     unsigned acmod = br.getBits(3);
   2538     unsigned lfeon = br.getBits(1);
   2539     unsigned channelCount = channelCountTable[acmod] + lfeon;
   2540 
   2541     if (mLastTrack == NULL) {
   2542         return ERROR_MALFORMED;
   2543     }
   2544     mLastTrack->meta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_AC3);
   2545     mLastTrack->meta->setInt32(kKeyChannelCount, channelCount);
   2546     mLastTrack->meta->setInt32(kKeySampleRate, sampleRate);
   2547     return OK;
   2548 }
   2549 
   2550 status_t MPEG4Extractor::parseSegmentIndex(off64_t offset, size_t size) {
   2551   ALOGV("MPEG4Extractor::parseSegmentIndex");
   2552 
   2553     if (size < 12) {
   2554       return -EINVAL;
   2555     }
   2556 
   2557     uint32_t flags;
   2558     if (!mDataSource->getUInt32(offset, &flags)) {
   2559         return ERROR_MALFORMED;
   2560     }
   2561 
   2562     uint32_t version = flags >> 24;
   2563     flags &= 0xffffff;
   2564 
   2565     ALOGV("sidx version %d", version);
   2566 
   2567     uint32_t referenceId;
   2568     if (!mDataSource->getUInt32(offset + 4, &referenceId)) {
   2569         return ERROR_MALFORMED;
   2570     }
   2571 
   2572     uint32_t timeScale;
   2573     if (!mDataSource->getUInt32(offset + 8, &timeScale)) {
   2574         return ERROR_MALFORMED;
   2575     }
   2576     ALOGV("sidx refid/timescale: %d/%d", referenceId, timeScale);
   2577     if (timeScale == 0)
   2578         return ERROR_MALFORMED;
   2579 
   2580     uint64_t earliestPresentationTime;
   2581     uint64_t firstOffset;
   2582 
   2583     offset += 12;
   2584     size -= 12;
   2585 
   2586     if (version == 0) {
   2587         if (size < 8) {
   2588             return -EINVAL;
   2589         }
   2590         uint32_t tmp;
   2591         if (!mDataSource->getUInt32(offset, &tmp)) {
   2592             return ERROR_MALFORMED;
   2593         }
   2594         earliestPresentationTime = tmp;
   2595         if (!mDataSource->getUInt32(offset + 4, &tmp)) {
   2596             return ERROR_MALFORMED;
   2597         }
   2598         firstOffset = tmp;
   2599         offset += 8;
   2600         size -= 8;
   2601     } else {
   2602         if (size < 16) {
   2603             return -EINVAL;
   2604         }
   2605         if (!mDataSource->getUInt64(offset, &earliestPresentationTime)) {
   2606             return ERROR_MALFORMED;
   2607         }
   2608         if (!mDataSource->getUInt64(offset + 8, &firstOffset)) {
   2609             return ERROR_MALFORMED;
   2610         }
   2611         offset += 16;
   2612         size -= 16;
   2613     }
   2614     ALOGV("sidx pres/off: %" PRIu64 "/%" PRIu64, earliestPresentationTime, firstOffset);
   2615 
   2616     if (size < 4) {
   2617         return -EINVAL;
   2618     }
   2619 
   2620     uint16_t referenceCount;
   2621     if (!mDataSource->getUInt16(offset + 2, &referenceCount)) {
   2622         return ERROR_MALFORMED;
   2623     }
   2624     offset += 4;
   2625     size -= 4;
   2626     ALOGV("refcount: %d", referenceCount);
   2627 
   2628     if (size < referenceCount * 12) {
   2629         return -EINVAL;
   2630     }
   2631 
   2632     uint64_t total_duration = 0;
   2633     for (unsigned int i = 0; i < referenceCount; i++) {
   2634         uint32_t d1, d2, d3;
   2635 
   2636         if (!mDataSource->getUInt32(offset, &d1) ||     // size
   2637             !mDataSource->getUInt32(offset + 4, &d2) || // duration
   2638             !mDataSource->getUInt32(offset + 8, &d3)) { // flags
   2639             return ERROR_MALFORMED;
   2640         }
   2641 
   2642         if (d1 & 0x80000000) {
   2643             ALOGW("sub-sidx boxes not supported yet");
   2644         }
   2645         bool sap = d3 & 0x80000000;
   2646         uint32_t saptype = (d3 >> 28) & 7;
   2647         if (!sap || (saptype != 1 && saptype != 2)) {
   2648             // type 1 and 2 are sync samples
   2649             ALOGW("not a stream access point, or unsupported type: %08x", d3);
   2650         }
   2651         total_duration += d2;
   2652         offset += 12;
   2653         ALOGV(" item %d, %08x %08x %08x", i, d1, d2, d3);
   2654         SidxEntry se;
   2655         se.mSize = d1 & 0x7fffffff;
   2656         se.mDurationUs = 1000000LL * d2 / timeScale;
   2657         mSidxEntries.add(se);
   2658     }
   2659 
   2660     uint64_t sidxDuration = total_duration * 1000000 / timeScale;
   2661 
   2662     if (mLastTrack == NULL)
   2663         return ERROR_MALFORMED;
   2664 
   2665     int64_t metaDuration;
   2666     if (!mLastTrack->meta->findInt64(kKeyDuration, &metaDuration) || metaDuration == 0) {
   2667         mLastTrack->meta->setInt64(kKeyDuration, sidxDuration);
   2668     }
   2669     return OK;
   2670 }
   2671 
   2672 status_t MPEG4Extractor::parseQTMetaKey(off64_t offset, size_t size) {
   2673     if (size < 8) {
   2674         return ERROR_MALFORMED;
   2675     }
   2676 
   2677     uint32_t count;
   2678     if (!mDataSource->getUInt32(offset + 4, &count)) {
   2679         return ERROR_MALFORMED;
   2680     }
   2681 
   2682     if (mMetaKeyMap.size() > 0) {
   2683         ALOGW("'keys' atom seen again, discarding existing entries");
   2684         mMetaKeyMap.clear();
   2685     }
   2686 
   2687     off64_t keyOffset = offset + 8;
   2688     off64_t stopOffset = offset + size;
   2689     for (size_t i = 1; i <= count; i++) {
   2690         if (keyOffset + 8 > stopOffset) {
   2691             return ERROR_MALFORMED;
   2692         }
   2693 
   2694         uint32_t keySize;
   2695         if (!mDataSource->getUInt32(keyOffset, &keySize)
   2696                 || keySize < 8
   2697                 || keyOffset + keySize > stopOffset) {
   2698             return ERROR_MALFORMED;
   2699         }
   2700 
   2701         uint32_t type;
   2702         if (!mDataSource->getUInt32(keyOffset + 4, &type)
   2703                 || type != FOURCC('m', 'd', 't', 'a')) {
   2704             return ERROR_MALFORMED;
   2705         }
   2706 
   2707         keySize -= 8;
   2708         keyOffset += 8;
   2709 
   2710         sp<ABuffer> keyData = new ABuffer(keySize);
   2711         if (keyData->data() == NULL) {
   2712             return ERROR_MALFORMED;
   2713         }
   2714         if (mDataSource->readAt(
   2715                 keyOffset, keyData->data(), keySize) < (ssize_t) keySize) {
   2716             return ERROR_MALFORMED;
   2717         }
   2718 
   2719         AString key((const char *)keyData->data(), keySize);
   2720         mMetaKeyMap.add(i, key);
   2721 
   2722         keyOffset += keySize;
   2723     }
   2724     return OK;
   2725 }
   2726 
   2727 status_t MPEG4Extractor::parseQTMetaVal(
   2728         int32_t keyId, off64_t offset, size_t size) {
   2729     ssize_t index = mMetaKeyMap.indexOfKey(keyId);
   2730     if (index < 0) {
   2731         // corresponding key is not present, ignore
   2732         return ERROR_MALFORMED;
   2733     }
   2734 
   2735     if (size <= 16) {
   2736         return ERROR_MALFORMED;
   2737     }
   2738     uint32_t dataSize;
   2739     if (!mDataSource->getUInt32(offset, &dataSize)
   2740             || dataSize > size || dataSize <= 16) {
   2741         return ERROR_MALFORMED;
   2742     }
   2743     uint32_t atomFourCC;
   2744     if (!mDataSource->getUInt32(offset + 4, &atomFourCC)
   2745             || atomFourCC != FOURCC('d', 'a', 't', 'a')) {
   2746         return ERROR_MALFORMED;
   2747     }
   2748     uint32_t dataType;
   2749     if (!mDataSource->getUInt32(offset + 8, &dataType)
   2750             || ((dataType & 0xff000000) != 0)) {
   2751         // not well-known type
   2752         return ERROR_MALFORMED;
   2753     }
   2754 
   2755     dataSize -= 16;
   2756     offset += 16;
   2757 
   2758     if (dataType == 23 && dataSize >= 4) {
   2759         // BE Float32
   2760         uint32_t val;
   2761         if (!mDataSource->getUInt32(offset, &val)) {
   2762             return ERROR_MALFORMED;
   2763         }
   2764         if (!strcasecmp(mMetaKeyMap[index].c_str(), "com.android.capture.fps")) {
   2765             mFileMetaData->setFloat(kKeyCaptureFramerate, *(float *)&val);
   2766         }
   2767     } else if (dataType == 67 && dataSize >= 4) {
   2768         // BE signed int32
   2769         uint32_t val;
   2770         if (!mDataSource->getUInt32(offset, &val)) {
   2771             return ERROR_MALFORMED;
   2772         }
   2773         if (!strcasecmp(mMetaKeyMap[index].c_str(), "com.android.video.temporal_layers_count")) {
   2774             mFileMetaData->setInt32(kKeyTemporalLayerCount, val);
   2775         }
   2776     } else {
   2777         // add more keys if needed
   2778         ALOGV("ignoring key: type %d, size %d", dataType, dataSize);
   2779     }
   2780 
   2781     return OK;
   2782 }
   2783 
   2784 status_t MPEG4Extractor::parseTrackHeader(
   2785         off64_t data_offset, off64_t data_size) {
   2786     if (data_size < 4) {
   2787         return ERROR_MALFORMED;
   2788     }
   2789 
   2790     uint8_t version;
   2791     if (mDataSource->readAt(data_offset, &version, 1) < 1) {
   2792         return ERROR_IO;
   2793     }
   2794 
   2795     size_t dynSize = (version == 1) ? 36 : 24;
   2796 
   2797     uint8_t buffer[36 + 60];
   2798 
   2799     if (data_size != (off64_t)dynSize + 60) {
   2800         return ERROR_MALFORMED;
   2801     }
   2802 
   2803     if (mDataSource->readAt(
   2804                 data_offset, buffer, data_size) < (ssize_t)data_size) {
   2805         return ERROR_IO;
   2806     }
   2807 
   2808     uint64_t ctime __unused, mtime __unused, duration __unused;
   2809     int32_t id;
   2810 
   2811     if (version == 1) {
   2812         ctime = U64_AT(&buffer[4]);
   2813         mtime = U64_AT(&buffer[12]);
   2814         id = U32_AT(&buffer[20]);
   2815         duration = U64_AT(&buffer[28]);
   2816     } else if (version == 0) {
   2817         ctime = U32_AT(&buffer[4]);
   2818         mtime = U32_AT(&buffer[8]);
   2819         id = U32_AT(&buffer[12]);
   2820         duration = U32_AT(&buffer[20]);
   2821     } else {
   2822         return ERROR_UNSUPPORTED;
   2823     }
   2824 
   2825     if (mLastTrack == NULL)
   2826         return ERROR_MALFORMED;
   2827 
   2828     mLastTrack->meta->setInt32(kKeyTrackID, id);
   2829 
   2830     size_t matrixOffset = dynSize + 16;
   2831     int32_t a00 = U32_AT(&buffer[matrixOffset]);
   2832     int32_t a01 = U32_AT(&buffer[matrixOffset + 4]);
   2833     int32_t a10 = U32_AT(&buffer[matrixOffset + 12]);
   2834     int32_t a11 = U32_AT(&buffer[matrixOffset + 16]);
   2835 
   2836 #if 0
   2837     int32_t dx = U32_AT(&buffer[matrixOffset + 8]);
   2838     int32_t dy = U32_AT(&buffer[matrixOffset + 20]);
   2839 
   2840     ALOGI("x' = %.2f * x + %.2f * y + %.2f",
   2841          a00 / 65536.0f, a01 / 65536.0f, dx / 65536.0f);
   2842     ALOGI("y' = %.2f * x + %.2f * y + %.2f",
   2843          a10 / 65536.0f, a11 / 65536.0f, dy / 65536.0f);
   2844 #endif
   2845 
   2846     uint32_t rotationDegrees;
   2847 
   2848     static const int32_t kFixedOne = 0x10000;
   2849     if (a00 == kFixedOne && a01 == 0 && a10 == 0 && a11 == kFixedOne) {
   2850         // Identity, no rotation
   2851         rotationDegrees = 0;
   2852     } else if (a00 == 0 && a01 == kFixedOne && a10 == -kFixedOne && a11 == 0) {
   2853         rotationDegrees = 90;
   2854     } else if (a00 == 0 && a01 == -kFixedOne && a10 == kFixedOne && a11 == 0) {
   2855         rotationDegrees = 270;
   2856     } else if (a00 == -kFixedOne && a01 == 0 && a10 == 0 && a11 == -kFixedOne) {
   2857         rotationDegrees = 180;
   2858     } else {
   2859         ALOGW("We only support 0,90,180,270 degree rotation matrices");
   2860         rotationDegrees = 0;
   2861     }
   2862 
   2863     if (rotationDegrees != 0) {
   2864         mLastTrack->meta->setInt32(kKeyRotation, rotationDegrees);
   2865     }
   2866 
   2867     // Handle presentation display size, which could be different
   2868     // from the image size indicated by kKeyWidth and kKeyHeight.
   2869     uint32_t width = U32_AT(&buffer[dynSize + 52]);
   2870     uint32_t height = U32_AT(&buffer[dynSize + 56]);
   2871     mLastTrack->meta->setInt32(kKeyDisplayWidth, width >> 16);
   2872     mLastTrack->meta->setInt32(kKeyDisplayHeight, height >> 16);
   2873 
   2874     return OK;
   2875 }
   2876 
   2877 status_t MPEG4Extractor::parseITunesMetaData(off64_t offset, size_t size) {
   2878     if (size == 0) {
   2879         return OK;
   2880     }
   2881 
   2882     if (size < 4 || size == SIZE_MAX) {
   2883         return ERROR_MALFORMED;
   2884     }
   2885 
   2886     uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
   2887     if (buffer == NULL) {
   2888         return ERROR_MALFORMED;
   2889     }
   2890     if (mDataSource->readAt(
   2891                 offset, buffer, size) != (ssize_t)size) {
   2892         delete[] buffer;
   2893         buffer = NULL;
   2894 
   2895         return ERROR_IO;
   2896     }
   2897 
   2898     uint32_t flags = U32_AT(buffer);
   2899 
   2900     uint32_t metadataKey = 0;
   2901     char chunk[5];
   2902     MakeFourCCString(mPath[4], chunk);
   2903     ALOGV("meta: %s @ %lld", chunk, (long long)offset);
   2904     switch ((int32_t)mPath[4]) {
   2905         case FOURCC(0xa9, 'a', 'l', 'b'):
   2906         {
   2907             metadataKey = kKeyAlbum;
   2908             break;
   2909         }
   2910         case FOURCC(0xa9, 'A', 'R', 'T'):
   2911         {
   2912             metadataKey = kKeyArtist;
   2913             break;
   2914         }
   2915         case FOURCC('a', 'A', 'R', 'T'):
   2916         {
   2917             metadataKey = kKeyAlbumArtist;
   2918             break;
   2919         }
   2920         case FOURCC(0xa9, 'd', 'a', 'y'):
   2921         {
   2922             metadataKey = kKeyYear;
   2923             break;
   2924         }
   2925         case FOURCC(0xa9, 'n', 'a', 'm'):
   2926         {
   2927             metadataKey = kKeyTitle;
   2928             break;
   2929         }
   2930         case FOURCC(0xa9, 'w', 'r', 't'):
   2931         {
   2932             metadataKey = kKeyWriter;
   2933             break;
   2934         }
   2935         case FOURCC('c', 'o', 'v', 'r'):
   2936         {
   2937             metadataKey = kKeyAlbumArt;
   2938             break;
   2939         }
   2940         case FOURCC('g', 'n', 'r', 'e'):
   2941         {
   2942             metadataKey = kKeyGenre;
   2943             break;
   2944         }
   2945         case FOURCC(0xa9, 'g', 'e', 'n'):
   2946         {
   2947             metadataKey = kKeyGenre;
   2948             break;
   2949         }
   2950         case FOURCC('c', 'p', 'i', 'l'):
   2951         {
   2952             if (size == 9 && flags == 21) {
   2953                 char tmp[16];
   2954                 sprintf(tmp, "%d",
   2955                         (int)buffer[size - 1]);
   2956 
   2957                 mFileMetaData->setCString(kKeyCompilation, tmp);
   2958             }
   2959             break;
   2960         }
   2961         case FOURCC('t', 'r', 'k', 'n'):
   2962         {
   2963             if (size == 16 && flags == 0) {
   2964                 char tmp[16];
   2965                 uint16_t* pTrack = (uint16_t*)&buffer[10];
   2966                 uint16_t* pTotalTracks = (uint16_t*)&buffer[12];
   2967                 sprintf(tmp, "%d/%d", ntohs(*pTrack), ntohs(*pTotalTracks));
   2968 
   2969                 mFileMetaData->setCString(kKeyCDTrackNumber, tmp);
   2970             }
   2971             break;
   2972         }
   2973         case FOURCC('d', 'i', 's', 'k'):
   2974         {
   2975             if ((size == 14 || size == 16) && flags == 0) {
   2976                 char tmp[16];
   2977                 uint16_t* pDisc = (uint16_t*)&buffer[10];
   2978                 uint16_t* pTotalDiscs = (uint16_t*)&buffer[12];
   2979                 sprintf(tmp, "%d/%d", ntohs(*pDisc), ntohs(*pTotalDiscs));
   2980 
   2981                 mFileMetaData->setCString(kKeyDiscNumber, tmp);
   2982             }
   2983             break;
   2984         }
   2985         case FOURCC('-', '-', '-', '-'):
   2986         {
   2987             buffer[size] = '\0';
   2988             switch (mPath[5]) {
   2989                 case FOURCC('m', 'e', 'a', 'n'):
   2990                     mLastCommentMean.setTo((const char *)buffer + 4);
   2991                     break;
   2992                 case FOURCC('n', 'a', 'm', 'e'):
   2993                     mLastCommentName.setTo((const char *)buffer + 4);
   2994                     break;
   2995                 case FOURCC('d', 'a', 't', 'a'):
   2996                     if (size < 8) {
   2997                         delete[] buffer;
   2998                         buffer = NULL;
   2999                         ALOGE("b/24346430");
   3000                         return ERROR_MALFORMED;
   3001                     }
   3002                     mLastCommentData.setTo((const char *)buffer + 8);
   3003                     break;
   3004             }
   3005 
   3006             // Once we have a set of mean/name/data info, go ahead and process
   3007             // it to see if its something we are interested in.  Whether or not
   3008             // were are interested in the specific tag, make sure to clear out
   3009             // the set so we can be ready to process another tuple should one
   3010             // show up later in the file.
   3011             if ((mLastCommentMean.length() != 0) &&
   3012                 (mLastCommentName.length() != 0) &&
   3013                 (mLastCommentData.length() != 0)) {
   3014 
   3015                 if (mLastCommentMean == "com.apple.iTunes"
   3016                         && mLastCommentName == "iTunSMPB") {
   3017                     int32_t delay, padding;
   3018                     if (sscanf(mLastCommentData,
   3019                                " %*x %x %x %*x", &delay, &padding) == 2) {
   3020                         if (mLastTrack == NULL) {
   3021                             delete[] buffer;
   3022                             return ERROR_MALFORMED;
   3023                         }
   3024 
   3025                         mLastTrack->meta->setInt32(kKeyEncoderDelay, delay);
   3026                         mLastTrack->meta->setInt32(kKeyEncoderPadding, padding);
   3027                     }
   3028                 }
   3029 
   3030                 mLastCommentMean.clear();
   3031                 mLastCommentName.clear();
   3032                 mLastCommentData.clear();
   3033             }
   3034             break;
   3035         }
   3036 
   3037         default:
   3038             break;
   3039     }
   3040 
   3041     if (size >= 8 && metadataKey && !mFileMetaData->hasData(metadataKey)) {
   3042         if (metadataKey == kKeyAlbumArt) {
   3043             mFileMetaData->setData(
   3044                     kKeyAlbumArt, MetaData::TYPE_NONE,
   3045                     buffer + 8, size - 8);
   3046         } else if (metadataKey == kKeyGenre) {
   3047             if (flags == 0) {
   3048                 // uint8_t genre code, iTunes genre codes are
   3049                 // the standard id3 codes, except they start
   3050                 // at 1 instead of 0 (e.g. Pop is 14, not 13)
   3051                 // We use standard id3 numbering, so subtract 1.
   3052                 int genrecode = (int)buffer[size - 1];
   3053                 genrecode--;
   3054                 if (genrecode < 0) {
   3055                     genrecode = 255; // reserved for 'unknown genre'
   3056                 }
   3057                 char genre[10];
   3058                 sprintf(genre, "%d", genrecode);
   3059 
   3060                 mFileMetaData->setCString(metadataKey, genre);
   3061             } else if (flags == 1) {
   3062                 // custom genre string
   3063                 buffer[size] = '\0';
   3064 
   3065                 mFileMetaData->setCString(
   3066                         metadataKey, (const char *)buffer + 8);
   3067             }
   3068         } else {
   3069             buffer[size] = '\0';
   3070 
   3071             mFileMetaData->setCString(
   3072                     metadataKey, (const char *)buffer + 8);
   3073         }
   3074     }
   3075 
   3076     delete[] buffer;
   3077     buffer = NULL;
   3078 
   3079     return OK;
   3080 }
   3081 
   3082 status_t MPEG4Extractor::parseColorInfo(off64_t offset, size_t size) {
   3083     if (size < 4 || size == SIZE_MAX || mLastTrack == NULL) {
   3084         return ERROR_MALFORMED;
   3085     }
   3086 
   3087     uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
   3088     if (buffer == NULL) {
   3089         return ERROR_MALFORMED;
   3090     }
   3091     if (mDataSource->readAt(offset, buffer, size) != (ssize_t)size) {
   3092         delete[] buffer;
   3093         buffer = NULL;
   3094 
   3095         return ERROR_IO;
   3096     }
   3097 
   3098     int32_t type = U32_AT(&buffer[0]);
   3099     if ((type == FOURCC('n', 'c', 'l', 'x') && size >= 11)
   3100             || (type == FOURCC('n', 'c', 'l', 'c') && size >= 10)) {
   3101         int32_t primaries = U16_AT(&buffer[4]);
   3102         int32_t transfer = U16_AT(&buffer[6]);
   3103         int32_t coeffs = U16_AT(&buffer[8]);
   3104         bool fullRange = (type == FOURCC('n', 'c', 'l', 'x')) && (buffer[10] & 128);
   3105 
   3106         ColorAspects aspects;
   3107         ColorUtils::convertIsoColorAspectsToCodecAspects(
   3108                 primaries, transfer, coeffs, fullRange, aspects);
   3109 
   3110         // only store the first color specification
   3111         if (!mLastTrack->meta->hasData(kKeyColorPrimaries)) {
   3112             mLastTrack->meta->setInt32(kKeyColorPrimaries, aspects.mPrimaries);
   3113             mLastTrack->meta->setInt32(kKeyTransferFunction, aspects.mTransfer);
   3114             mLastTrack->meta->setInt32(kKeyColorMatrix, aspects.mMatrixCoeffs);
   3115             mLastTrack->meta->setInt32(kKeyColorRange, aspects.mRange);
   3116         }
   3117     }
   3118 
   3119     delete[] buffer;
   3120     buffer = NULL;
   3121 
   3122     return OK;
   3123 }
   3124 
   3125 status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int depth) {
   3126     if (size < 4 || size == SIZE_MAX) {
   3127         return ERROR_MALFORMED;
   3128     }
   3129 
   3130     uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
   3131     if (buffer == NULL) {
   3132         return ERROR_MALFORMED;
   3133     }
   3134     if (mDataSource->readAt(
   3135                 offset, buffer, size) != (ssize_t)size) {
   3136         delete[] buffer;
   3137         buffer = NULL;
   3138 
   3139         return ERROR_IO;
   3140     }
   3141 
   3142     uint32_t metadataKey = 0;
   3143     switch (mPath[depth]) {
   3144         case FOURCC('t', 'i', 't', 'l'):
   3145         {
   3146             metadataKey = kKeyTitle;
   3147             break;
   3148         }
   3149         case FOURCC('p', 'e', 'r', 'f'):
   3150         {
   3151             metadataKey = kKeyArtist;
   3152             break;
   3153         }
   3154         case FOURCC('a', 'u', 't', 'h'):
   3155         {
   3156             metadataKey = kKeyWriter;
   3157             break;
   3158         }
   3159         case FOURCC('g', 'n', 'r', 'e'):
   3160         {
   3161             metadataKey = kKeyGenre;
   3162             break;
   3163         }
   3164         case FOURCC('a', 'l', 'b', 'm'):
   3165         {
   3166             if (buffer[size - 1] != '\0') {
   3167               char tmp[4];
   3168               sprintf(tmp, "%u", buffer[size - 1]);
   3169 
   3170               mFileMetaData->setCString(kKeyCDTrackNumber, tmp);
   3171             }
   3172 
   3173             metadataKey = kKeyAlbum;
   3174             break;
   3175         }
   3176         case FOURCC('y', 'r', 'r', 'c'):
   3177         {
   3178             if (size < 6) {
   3179                 delete[] buffer;
   3180                 buffer = NULL;
   3181                 ALOGE("b/62133227");
   3182                 android_errorWriteLog(0x534e4554, "62133227");
   3183                 return ERROR_MALFORMED;
   3184             }
   3185             char tmp[5];
   3186             uint16_t year = U16_AT(&buffer[4]);
   3187 
   3188             if (year < 10000) {
   3189                 sprintf(tmp, "%u", year);
   3190 
   3191                 mFileMetaData->setCString(kKeyYear, tmp);
   3192             }
   3193             break;
   3194         }
   3195 
   3196         default:
   3197             break;
   3198     }
   3199 
   3200     if (metadataKey > 0) {
   3201         bool isUTF8 = true; // Common case
   3202         char16_t *framedata = NULL;
   3203         int len16 = 0; // Number of UTF-16 characters
   3204 
   3205         // smallest possible valid UTF-16 string w BOM: 0xfe 0xff 0x00 0x00
   3206         if (size < 6) {
   3207             delete[] buffer;
   3208             buffer = NULL;
   3209             return ERROR_MALFORMED;
   3210         }
   3211 
   3212         if (size - 6 >= 4) {
   3213             len16 = ((size - 6) / 2) - 1; // don't include 0x0000 terminator
   3214             framedata = (char16_t *)(buffer + 6);
   3215             if (0xfffe == *framedata) {
   3216                 // endianness marker (BOM) doesn't match host endianness
   3217                 for (int i = 0; i < len16; i++) {
   3218                     framedata[i] = bswap_16(framedata[i]);
   3219                 }
   3220                 // BOM is now swapped to 0xfeff, we will execute next block too
   3221             }
   3222 
   3223             if (0xfeff == *framedata) {
   3224                 // Remove the BOM
   3225                 framedata++;
   3226                 len16--;
   3227                 isUTF8 = false;
   3228             }
   3229             // else normal non-zero-length UTF-8 string
   3230             // we can't handle UTF-16 without BOM as there is no other
   3231             // indication of encoding.
   3232         }
   3233 
   3234         if (isUTF8) {
   3235             buffer[size] = 0;
   3236             mFileMetaData->setCString(metadataKey, (const char *)buffer + 6);
   3237         } else {
   3238             // Convert from UTF-16 string to UTF-8 string.
   3239             String8 tmpUTF8str(framedata, len16);
   3240             mFileMetaData->setCString(metadataKey, tmpUTF8str.string());
   3241         }
   3242     }
   3243 
   3244     delete[] buffer;
   3245     buffer = NULL;
   3246 
   3247     return OK;
   3248 }
   3249 
   3250 void MPEG4Extractor::parseID3v2MetaData(off64_t offset) {
   3251     ID3 id3(mDataSource, true /* ignorev1 */, offset);
   3252 
   3253     if (id3.isValid()) {
   3254         struct Map {
   3255             int key;
   3256             const char *tag1;
   3257             const char *tag2;
   3258         };
   3259         static const Map kMap[] = {
   3260             { kKeyAlbum, "TALB", "TAL" },
   3261             { kKeyArtist, "TPE1", "TP1" },
   3262             { kKeyAlbumArtist, "TPE2", "TP2" },
   3263             { kKeyComposer, "TCOM", "TCM" },
   3264             { kKeyGenre, "TCON", "TCO" },
   3265             { kKeyTitle, "TIT2", "TT2" },
   3266             { kKeyYear, "TYE", "TYER" },
   3267             { kKeyAuthor, "TXT", "TEXT" },
   3268             { kKeyCDTrackNumber, "TRK", "TRCK" },
   3269             { kKeyDiscNumber, "TPA", "TPOS" },
   3270             { kKeyCompilation, "TCP", "TCMP" },
   3271         };
   3272         static const size_t kNumMapEntries = sizeof(kMap) / sizeof(kMap[0]);
   3273 
   3274         for (size_t i = 0; i < kNumMapEntries; ++i) {
   3275             if (!mFileMetaData->hasData(kMap[i].key)) {
   3276                 ID3::Iterator *it = new ID3::Iterator(id3, kMap[i].tag1);
   3277                 if (it->done()) {
   3278                     delete it;
   3279                     it = new ID3::Iterator(id3, kMap[i].tag2);
   3280                 }
   3281 
   3282                 if (it->done()) {
   3283                     delete it;
   3284                     continue;
   3285                 }
   3286 
   3287                 String8 s;
   3288                 it->getString(&s);
   3289                 delete it;
   3290 
   3291                 mFileMetaData->setCString(kMap[i].key, s);
   3292             }
   3293         }
   3294 
   3295         size_t dataSize;
   3296         String8 mime;
   3297         const void *data = id3.getAlbumArt(&dataSize, &mime);
   3298 
   3299         if (data) {
   3300             mFileMetaData->setData(kKeyAlbumArt, MetaData::TYPE_NONE, data, dataSize);
   3301             mFileMetaData->setCString(kKeyAlbumArtMIME, mime.string());
   3302         }
   3303     }
   3304 }
   3305 
   3306 sp<IMediaSource> MPEG4Extractor::getTrack(size_t index) {
   3307     status_t err;
   3308     if ((err = readMetaData()) != OK) {
   3309         return NULL;
   3310     }
   3311 
   3312     Track *track = mFirstTrack;
   3313     while (index > 0) {
   3314         if (track == NULL) {
   3315             return NULL;
   3316         }
   3317 
   3318         track = track->next;
   3319         --index;
   3320     }
   3321 
   3322     if (track == NULL) {
   3323         return NULL;
   3324     }
   3325 
   3326 
   3327     Trex *trex = NULL;
   3328     int32_t trackId;
   3329     if (track->meta->findInt32(kKeyTrackID, &trackId)) {
   3330         for (size_t i = 0; i < mTrex.size(); i++) {
   3331             Trex *t = &mTrex.editItemAt(i);
   3332             if (t->track_ID == (uint32_t) trackId) {
   3333                 trex = t;
   3334                 break;
   3335             }
   3336         }
   3337     } else {
   3338         ALOGE("b/21657957");
   3339         return NULL;
   3340     }
   3341 
   3342     ALOGV("getTrack called, pssh: %zu", mPssh.size());
   3343 
   3344     const char *mime;
   3345     if (!track->meta->findCString(kKeyMIMEType, &mime)) {
   3346         return NULL;
   3347     }
   3348 
   3349     if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_AVC)) {
   3350         uint32_t type;
   3351         const void *data;
   3352         size_t size;
   3353         if (!track->meta->findData(kKeyAVCC, &type, &data, &size)) {
   3354             return NULL;
   3355         }
   3356 
   3357         const uint8_t *ptr = (const uint8_t *)data;
   3358 
   3359         if (size < 7 || ptr[0] != 1) {  // configurationVersion == 1
   3360             return NULL;
   3361         }
   3362     } else if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_HEVC)) {
   3363         uint32_t type;
   3364         const void *data;
   3365         size_t size;
   3366         if (!track->meta->findData(kKeyHVCC, &type, &data, &size)) {
   3367             return NULL;
   3368         }
   3369 
   3370         const uint8_t *ptr = (const uint8_t *)data;
   3371 
   3372         if (size < 22 || ptr[0] != 1) {  // configurationVersion == 1
   3373             return NULL;
   3374         }
   3375     }
   3376 
   3377     sp<MPEG4Source> source =  new MPEG4Source(this,
   3378             track->meta, mDataSource, track->timescale, track->sampleTable,
   3379             mSidxEntries, trex, mMoofOffset, mItemTable);
   3380     if (source->init() != OK) {
   3381         return NULL;
   3382     }
   3383     return source;
   3384 }
   3385 
   3386 // static
   3387 status_t MPEG4Extractor::verifyTrack(Track *track) {
   3388     const char *mime;
   3389     CHECK(track->meta->findCString(kKeyMIMEType, &mime));
   3390 
   3391     uint32_t type;
   3392     const void *data;
   3393     size_t size;
   3394     if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_AVC)) {
   3395         if (!track->meta->findData(kKeyAVCC, &type, &data, &size)
   3396                 || type != kTypeAVCC) {
   3397             return ERROR_MALFORMED;
   3398         }
   3399     } else if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_HEVC)) {
   3400         if (!track->meta->findData(kKeyHVCC, &type, &data, &size)
   3401                     || type != kTypeHVCC) {
   3402             return ERROR_MALFORMED;
   3403         }
   3404     } else if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_MPEG4)
   3405             || !strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_MPEG2)
   3406             || !strcasecmp(mime, MEDIA_MIMETYPE_AUDIO_AAC)) {
   3407         if (!track->meta->findData(kKeyESDS, &type, &data, &size)
   3408                 || type != kTypeESDS) {
   3409             return ERROR_MALFORMED;
   3410         }
   3411     }
   3412 
   3413     if (track->sampleTable == NULL || !track->sampleTable->isValid()) {
   3414         // Make sure we have all the metadata we need.
   3415         ALOGE("stbl atom missing/invalid.");
   3416         return ERROR_MALFORMED;
   3417     }
   3418 
   3419     if (track->timescale == 0) {
   3420         ALOGE("timescale invalid.");
   3421         return ERROR_MALFORMED;
   3422     }
   3423 
   3424     return OK;
   3425 }
   3426 
   3427 typedef enum {
   3428     //AOT_NONE             = -1,
   3429     //AOT_NULL_OBJECT      = 0,
   3430     //AOT_AAC_MAIN         = 1, /**< Main profile                              */
   3431     AOT_AAC_LC           = 2,   /**< Low Complexity object                     */
   3432     //AOT_AAC_SSR          = 3,
   3433     //AOT_AAC_LTP          = 4,
   3434     AOT_SBR              = 5,
   3435     //AOT_AAC_SCAL         = 6,
   3436     //AOT_TWIN_VQ          = 7,
   3437     //AOT_CELP             = 8,
   3438     //AOT_HVXC             = 9,
   3439     //AOT_RSVD_10          = 10, /**< (reserved)                                */
   3440     //AOT_RSVD_11          = 11, /**< (reserved)                                */
   3441     //AOT_TTSI             = 12, /**< TTSI Object                               */
   3442     //AOT_MAIN_SYNTH       = 13, /**< Main Synthetic object                     */
   3443     //AOT_WAV_TAB_SYNTH    = 14, /**< Wavetable Synthesis object                */
   3444     //AOT_GEN_MIDI         = 15, /**< General MIDI object                       */
   3445     //AOT_ALG_SYNTH_AUD_FX = 16, /**< Algorithmic Synthesis and Audio FX object */
   3446     AOT_ER_AAC_LC        = 17,   /**< Error Resilient(ER) AAC Low Complexity    */
   3447     //AOT_RSVD_18          = 18, /**< (reserved)                                */
   3448     //AOT_ER_AAC_LTP       = 19, /**< Error Resilient(ER) AAC LTP object        */
   3449     AOT_ER_AAC_SCAL      = 20,   /**< Error Resilient(ER) AAC Scalable object   */
   3450     //AOT_ER_TWIN_VQ       = 21, /**< Error Resilient(ER) TwinVQ object         */
   3451     AOT_ER_BSAC          = 22,   /**< Error Resilient(ER) BSAC object           */
   3452     AOT_ER_AAC_LD        = 23,   /**< Error Resilient(ER) AAC LowDelay object   */
   3453     //AOT_ER_CELP          = 24, /**< Error Resilient(ER) CELP object           */
   3454     //AOT_ER_HVXC          = 25, /**< Error Resilient(ER) HVXC object           */
   3455     //AOT_ER_HILN          = 26, /**< Error Resilient(ER) HILN object           */
   3456     //AOT_ER_PARA          = 27, /**< Error Resilient(ER) Parametric object     */
   3457     //AOT_RSVD_28          = 28, /**< might become SSC                          */
   3458     AOT_PS               = 29,   /**< PS, Parametric Stereo (includes SBR)      */
   3459     //AOT_MPEGS            = 30, /**< MPEG Surround                             */
   3460 
   3461     AOT_ESCAPE           = 31,   /**< Signal AOT uses more than 5 bits          */
   3462 
   3463     //AOT_MP3ONMP4_L1      = 32, /**< MPEG-Layer1 in mp4                        */
   3464     //AOT_MP3ONMP4_L2      = 33, /**< MPEG-Layer2 in mp4                        */
   3465     //AOT_MP3ONMP4_L3      = 34, /**< MPEG-Layer3 in mp4                        */
   3466     //AOT_RSVD_35          = 35, /**< might become DST                          */
   3467     //AOT_RSVD_36          = 36, /**< might become ALS                          */
   3468     //AOT_AAC_SLS          = 37, /**< AAC + SLS                                 */
   3469     //AOT_SLS              = 38, /**< SLS                                       */
   3470     //AOT_ER_AAC_ELD       = 39, /**< AAC Enhanced Low Delay                    */
   3471 
   3472     //AOT_USAC             = 42, /**< USAC                                      */
   3473     //AOT_SAOC             = 43, /**< SAOC                                      */
   3474     //AOT_LD_MPEGS         = 44, /**< Low Delay MPEG Surround                   */
   3475 
   3476     //AOT_RSVD50           = 50,  /**< Interim AOT for Rsvd50                   */
   3477 } AUDIO_OBJECT_TYPE;
   3478 
   3479 status_t MPEG4Extractor::updateAudioTrackInfoFromESDS_MPEG4Audio(
   3480         const void *esds_data, size_t esds_size) {
   3481     ESDS esds(esds_data, esds_size);
   3482 
   3483     uint8_t objectTypeIndication;
   3484     if (esds.getObjectTypeIndication(&objectTypeIndication) != OK) {
   3485         return ERROR_MALFORMED;
   3486     }
   3487 
   3488     if (objectTypeIndication == 0xe1) {
   3489         // This isn't MPEG4 audio at all, it's QCELP 14k...
   3490         if (mLastTrack == NULL)
   3491             return ERROR_MALFORMED;
   3492 
   3493         mLastTrack->meta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_QCELP);
   3494         return OK;
   3495     }
   3496 
   3497     if (objectTypeIndication  == 0x6b) {
   3498         // The media subtype is MP3 audio
   3499         // Our software MP3 audio decoder may not be able to handle
   3500         // packetized MP3 audio; for now, lets just return ERROR_UNSUPPORTED
   3501         ALOGE("MP3 track in MP4/3GPP file is not supported");
   3502         return ERROR_UNSUPPORTED;
   3503     }
   3504 
   3505     const uint8_t *csd;
   3506     size_t csd_size;
   3507     if (esds.getCodecSpecificInfo(
   3508                 (const void **)&csd, &csd_size) != OK) {
   3509         return ERROR_MALFORMED;
   3510     }
   3511 
   3512     if (kUseHexDump) {
   3513         printf("ESD of size %zu\n", csd_size);
   3514         hexdump(csd, csd_size);
   3515     }
   3516 
   3517     if (csd_size == 0) {
   3518         // There's no further information, i.e. no codec specific data
   3519         // Let's assume that the information provided in the mpeg4 headers
   3520         // is accurate and hope for the best.
   3521 
   3522         return OK;
   3523     }
   3524 
   3525     if (csd_size < 2) {
   3526         return ERROR_MALFORMED;
   3527     }
   3528 
   3529     static uint32_t kSamplingRate[] = {
   3530         96000, 88200, 64000, 48000, 44100, 32000, 24000, 22050,
   3531         16000, 12000, 11025, 8000, 7350
   3532     };
   3533 
   3534     ABitReader br(csd, csd_size);
   3535     uint32_t objectType = br.getBits(5);
   3536 
   3537     if (objectType == 31) {  // AAC-ELD => additional 6 bits
   3538         objectType = 32 + br.getBits(6);
   3539     }
   3540 
   3541     if (mLastTrack == NULL)
   3542         return ERROR_MALFORMED;
   3543 
   3544     //keep AOT type
   3545     mLastTrack->meta->setInt32(kKeyAACAOT, objectType);
   3546 
   3547     uint32_t freqIndex = br.getBits(4);
   3548 
   3549     int32_t sampleRate = 0;
   3550     int32_t numChannels = 0;
   3551     if (freqIndex == 15) {
   3552         if (br.numBitsLeft() < 28) return ERROR_MALFORMED;
   3553         sampleRate = br.getBits(24);
   3554         numChannels = br.getBits(4);
   3555     } else {
   3556         if (br.numBitsLeft() < 4) return ERROR_MALFORMED;
   3557         numChannels = br.getBits(4);
   3558 
   3559         if (freqIndex == 13 || freqIndex == 14) {
   3560             return ERROR_MALFORMED;
   3561         }
   3562 
   3563         sampleRate = kSamplingRate[freqIndex];
   3564     }
   3565 
   3566     if (objectType == AOT_SBR || objectType == AOT_PS) {//SBR specific config per 14496-3 table 1.13
   3567         if (br.numBitsLeft() < 4) return ERROR_MALFORMED;
   3568         uint32_t extFreqIndex = br.getBits(4);
   3569         int32_t extSampleRate __unused;
   3570         if (extFreqIndex == 15) {
   3571             if (csd_size < 8) {
   3572                 return ERROR_MALFORMED;
   3573             }
   3574             if (br.numBitsLeft() < 24) return ERROR_MALFORMED;
   3575             extSampleRate = br.getBits(24);
   3576         } else {
   3577             if (extFreqIndex == 13 || extFreqIndex == 14) {
   3578                 return ERROR_MALFORMED;
   3579             }
   3580             extSampleRate = kSamplingRate[extFreqIndex];
   3581         }
   3582         //TODO: save the extension sampling rate value in meta data =>
   3583         //      mLastTrack->meta->setInt32(kKeyExtSampleRate, extSampleRate);
   3584     }
   3585 
   3586     switch (numChannels) {
   3587         // values defined in 14496-3_2009 amendment-4 Table 1.19 - Channel Configuration
   3588         case 0:
   3589         case 1:// FC
   3590         case 2:// FL FR
   3591         case 3:// FC, FL FR
   3592         case 4:// FC, FL FR, RC
   3593         case 5:// FC, FL FR, SL SR
   3594         case 6:// FC, FL FR, SL SR, LFE
   3595             //numChannels already contains the right value
   3596             break;
   3597         case 11:// FC, FL FR, SL SR, RC, LFE
   3598             numChannels = 7;
   3599             break;
   3600         case 7: // FC, FCL FCR, FL FR, SL SR, LFE
   3601         case 12:// FC, FL  FR,  SL SR, RL RR, LFE
   3602         case 14:// FC, FL  FR,  SL SR, LFE, FHL FHR
   3603             numChannels = 8;
   3604             break;
   3605         default:
   3606             return ERROR_UNSUPPORTED;
   3607     }
   3608 
   3609     {
   3610         if (objectType == AOT_SBR || objectType == AOT_PS) {
   3611             if (br.numBitsLeft() < 5) return ERROR_MALFORMED;
   3612             objectType = br.getBits(5);
   3613 
   3614             if (objectType == AOT_ESCAPE) {
   3615                 if (br.numBitsLeft() < 6) return ERROR_MALFORMED;
   3616                 objectType = 32 + br.getBits(6);
   3617             }
   3618         }
   3619         if (objectType == AOT_AAC_LC || objectType == AOT_ER_AAC_LC ||
   3620                 objectType == AOT_ER_AAC_LD || objectType == AOT_ER_AAC_SCAL ||
   3621                 objectType == AOT_ER_BSAC) {
   3622             if (br.numBitsLeft() < 2) return ERROR_MALFORMED;
   3623             const int32_t frameLengthFlag __unused = br.getBits(1);
   3624 
   3625             const int32_t dependsOnCoreCoder = br.getBits(1);
   3626 
   3627             if (dependsOnCoreCoder ) {
   3628                 if (br.numBitsLeft() < 14) return ERROR_MALFORMED;
   3629                 const int32_t coreCoderDelay __unused = br.getBits(14);
   3630             }
   3631 
   3632             int32_t extensionFlag = -1;
   3633             if (br.numBitsLeft() > 0) {
   3634                 extensionFlag = br.getBits(1);
   3635             } else {
   3636                 switch (objectType) {
   3637                 // 14496-3 4.5.1.1 extensionFlag
   3638                 case AOT_AAC_LC:
   3639                     extensionFlag = 0;
   3640                     break;
   3641                 case AOT_ER_AAC_LC:
   3642                 case AOT_ER_AAC_SCAL:
   3643                 case AOT_ER_BSAC:
   3644                 case AOT_ER_AAC_LD:
   3645                     extensionFlag = 1;
   3646                     break;
   3647                 default:
   3648                     return ERROR_MALFORMED;
   3649                     break;
   3650                 }
   3651                 ALOGW("csd missing extension flag; assuming %d for object type %u.",
   3652                         extensionFlag, objectType);
   3653             }
   3654 
   3655             if (numChannels == 0) {
   3656                 int32_t channelsEffectiveNum = 0;
   3657                 int32_t channelsNum = 0;
   3658                 if (br.numBitsLeft() < 32) {
   3659                     return ERROR_MALFORMED;
   3660                 }
   3661                 const int32_t ElementInstanceTag __unused = br.getBits(4);
   3662                 const int32_t Profile __unused = br.getBits(2);
   3663                 const int32_t SamplingFrequencyIndex __unused = br.getBits(4);
   3664                 const int32_t NumFrontChannelElements = br.getBits(4);
   3665                 const int32_t NumSideChannelElements = br.getBits(4);
   3666                 const int32_t NumBackChannelElements = br.getBits(4);
   3667                 const int32_t NumLfeChannelElements = br.getBits(2);
   3668                 const int32_t NumAssocDataElements __unused = br.getBits(3);
   3669                 const int32_t NumValidCcElements __unused = br.getBits(4);
   3670 
   3671                 const int32_t MonoMixdownPresent = br.getBits(1);
   3672 
   3673                 if (MonoMixdownPresent != 0) {
   3674                     if (br.numBitsLeft() < 4) return ERROR_MALFORMED;
   3675                     const int32_t MonoMixdownElementNumber __unused = br.getBits(4);
   3676                 }
   3677 
   3678                 if (br.numBitsLeft() < 1) return ERROR_MALFORMED;
   3679                 const int32_t StereoMixdownPresent = br.getBits(1);
   3680                 if (StereoMixdownPresent != 0) {
   3681                     if (br.numBitsLeft() < 4) return ERROR_MALFORMED;
   3682                     const int32_t StereoMixdownElementNumber __unused = br.getBits(4);
   3683                 }
   3684 
   3685                 if (br.numBitsLeft() < 1) return ERROR_MALFORMED;
   3686                 const int32_t MatrixMixdownIndexPresent = br.getBits(1);
   3687                 if (MatrixMixdownIndexPresent != 0) {
   3688                     if (br.numBitsLeft() < 3) return ERROR_MALFORMED;
   3689                     const int32_t MatrixMixdownIndex __unused = br.getBits(2);
   3690                     const int32_t PseudoSurroundEnable __unused = br.getBits(1);
   3691                 }
   3692 
   3693                 int i;
   3694                 for (i=0; i < NumFrontChannelElements; i++) {
   3695                     if (br.numBitsLeft() < 5) return ERROR_MALFORMED;
   3696                     const int32_t FrontElementIsCpe = br.getBits(1);
   3697                     const int32_t FrontElementTagSelect __unused = br.getBits(4);
   3698                     channelsNum += FrontElementIsCpe ? 2 : 1;
   3699                 }
   3700 
   3701                 for (i=0; i < NumSideChannelElements; i++) {
   3702                     if (br.numBitsLeft() < 5) return ERROR_MALFORMED;
   3703                     const int32_t SideElementIsCpe = br.getBits(1);
   3704                     const int32_t SideElementTagSelect __unused = br.getBits(4);
   3705                     channelsNum += SideElementIsCpe ? 2 : 1;
   3706                 }
   3707 
   3708                 for (i=0; i < NumBackChannelElements; i++) {
   3709                     if (br.numBitsLeft() < 5) return ERROR_MALFORMED;
   3710                     const int32_t BackElementIsCpe = br.getBits(1);
   3711                     const int32_t BackElementTagSelect __unused = br.getBits(4);
   3712                     channelsNum += BackElementIsCpe ? 2 : 1;
   3713                 }
   3714                 channelsEffectiveNum = channelsNum;
   3715 
   3716                 for (i=0; i < NumLfeChannelElements; i++) {
   3717                     if (br.numBitsLeft() < 4) return ERROR_MALFORMED;
   3718                     const int32_t LfeElementTagSelect __unused = br.getBits(4);
   3719                     channelsNum += 1;
   3720                 }
   3721                 ALOGV("mpeg4 audio channelsNum = %d", channelsNum);
   3722                 ALOGV("mpeg4 audio channelsEffectiveNum = %d", channelsEffectiveNum);
   3723                 numChannels = channelsNum;
   3724             }
   3725         }
   3726     }
   3727 
   3728     if (numChannels == 0) {
   3729         return ERROR_UNSUPPORTED;
   3730     }
   3731 
   3732     if (mLastTrack == NULL)
   3733         return ERROR_MALFORMED;
   3734 
   3735     int32_t prevSampleRate;
   3736     CHECK(mLastTrack->meta->findInt32(kKeySampleRate, &prevSampleRate));
   3737 
   3738     if (prevSampleRate != sampleRate) {
   3739         ALOGV("mpeg4 audio sample rate different from previous setting. "
   3740              "was: %d, now: %d", prevSampleRate, sampleRate);
   3741     }
   3742 
   3743     mLastTrack->meta->setInt32(kKeySampleRate, sampleRate);
   3744 
   3745     int32_t prevChannelCount;
   3746     CHECK(mLastTrack->meta->findInt32(kKeyChannelCount, &prevChannelCount));
   3747 
   3748     if (prevChannelCount != numChannels) {
   3749         ALOGV("mpeg4 audio channel count different from previous setting. "
   3750              "was: %d, now: %d", prevChannelCount, numChannels);
   3751     }
   3752 
   3753     mLastTrack->meta->setInt32(kKeyChannelCount, numChannels);
   3754 
   3755     return OK;
   3756 }
   3757 
   3758 ////////////////////////////////////////////////////////////////////////////////
   3759 
   3760 MPEG4Source::MPEG4Source(
   3761         const sp<MPEG4Extractor> &owner,
   3762         const sp<MetaData> &format,
   3763         const sp<DataSource> &dataSource,
   3764         int32_t timeScale,
   3765         const sp<SampleTable> &sampleTable,
   3766         Vector<SidxEntry> &sidx,
   3767         const Trex *trex,
   3768         off64_t firstMoofOffset,
   3769         const sp<ItemTable> &itemTable)
   3770     : mOwner(owner),
   3771       mFormat(format),
   3772       mDataSource(dataSource),
   3773       mTimescale(timeScale),
   3774       mSampleTable(sampleTable),
   3775       mCurrentSampleIndex(0),
   3776       mCurrentFragmentIndex(0),
   3777       mSegments(sidx),
   3778       mTrex(trex),
   3779       mFirstMoofOffset(firstMoofOffset),
   3780       mCurrentMoofOffset(firstMoofOffset),
   3781       mNextMoofOffset(-1),
   3782       mCurrentTime(0),
   3783       mCurrentSampleInfoAllocSize(0),
   3784       mCurrentSampleInfoSizes(NULL),
   3785       mCurrentSampleInfoOffsetsAllocSize(0),
   3786       mCurrentSampleInfoOffsets(NULL),
   3787       mIsAVC(false),
   3788       mIsHEVC(false),
   3789       mNALLengthSize(0),
   3790       mStarted(false),
   3791       mGroup(NULL),
   3792       mBuffer(NULL),
   3793       mWantsNALFragments(false),
   3794       mSrcBuffer(NULL),
   3795       mIsHEIF(itemTable != NULL),
   3796       mItemTable(itemTable) {
   3797 
   3798     memset(&mTrackFragmentHeaderInfo, 0, sizeof(mTrackFragmentHeaderInfo));
   3799 
   3800     mFormat->findInt32(kKeyCryptoMode, &mCryptoMode);
   3801     mDefaultIVSize = 0;
   3802     mFormat->findInt32(kKeyCryptoDefaultIVSize, &mDefaultIVSize);
   3803     uint32_t keytype;
   3804     const void *key;
   3805     size_t keysize;
   3806     if (mFormat->findData(kKeyCryptoKey, &keytype, &key, &keysize)) {
   3807         CHECK(keysize <= 16);
   3808         memset(mCryptoKey, 0, 16);
   3809         memcpy(mCryptoKey, key, keysize);
   3810     }
   3811 
   3812     const char *mime;
   3813     bool success = mFormat->findCString(kKeyMIMEType, &mime);
   3814     CHECK(success);
   3815 
   3816     mIsAVC = !strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_AVC);
   3817     mIsHEVC = !strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_HEVC);
   3818 
   3819     if (mIsAVC) {
   3820         uint32_t type;
   3821         const void *data;
   3822         size_t size;
   3823         CHECK(format->findData(kKeyAVCC, &type, &data, &size));
   3824 
   3825         const uint8_t *ptr = (const uint8_t *)data;
   3826 
   3827         CHECK(size >= 7);
   3828         CHECK_EQ((unsigned)ptr[0], 1u);  // configurationVersion == 1
   3829 
   3830         // The number of bytes used to encode the length of a NAL unit.
   3831         mNALLengthSize = 1 + (ptr[4] & 3);
   3832     } else if (mIsHEVC) {
   3833         uint32_t type;
   3834         const void *data;
   3835         size_t size;
   3836         CHECK(format->findData(kKeyHVCC, &type, &data, &size));
   3837 
   3838         const uint8_t *ptr = (const uint8_t *)data;
   3839 
   3840         CHECK(size >= 22);
   3841         CHECK_EQ((unsigned)ptr[0], 1u);  // configurationVersion == 1
   3842 
   3843         mNALLengthSize = 1 + (ptr[14 + 7] & 3);
   3844     }
   3845 
   3846     CHECK(format->findInt32(kKeyTrackID, &mTrackId));
   3847 
   3848 }
   3849 
   3850 status_t MPEG4Source::init() {
   3851     if (mFirstMoofOffset != 0) {
   3852         off64_t offset = mFirstMoofOffset;
   3853         return parseChunk(&offset);
   3854     }
   3855     return OK;
   3856 }
   3857 
   3858 MPEG4Source::~MPEG4Source() {
   3859     if (mStarted) {
   3860         stop();
   3861     }
   3862     free(mCurrentSampleInfoSizes);
   3863     free(mCurrentSampleInfoOffsets);
   3864 }
   3865 
   3866 status_t MPEG4Source::start(MetaData *params) {
   3867     Mutex::Autolock autoLock(mLock);
   3868 
   3869     CHECK(!mStarted);
   3870 
   3871     int32_t val;
   3872     if (params && params->findInt32(kKeyWantsNALFragments, &val)
   3873         && val != 0) {
   3874         mWantsNALFragments = true;
   3875     } else {
   3876         mWantsNALFragments = false;
   3877     }
   3878 
   3879     int32_t tmp;
   3880     CHECK(mFormat->findInt32(kKeyMaxInputSize, &tmp));
   3881     size_t max_size = tmp;
   3882 
   3883     // A somewhat arbitrary limit that should be sufficient for 8k video frames
   3884     // If you see the message below for a valid input stream: increase the limit
   3885     const size_t kMaxBufferSize = 64 * 1024 * 1024;
   3886     if (max_size > kMaxBufferSize) {
   3887         ALOGE("bogus max input size: %zu > %zu", max_size, kMaxBufferSize);
   3888         return ERROR_MALFORMED;
   3889     }
   3890     if (max_size == 0) {
   3891         ALOGE("zero max input size");
   3892         return ERROR_MALFORMED;
   3893     }
   3894 
   3895     // Allow up to kMaxBuffers, but not if the total exceeds kMaxBufferSize.
   3896     const size_t kMaxBuffers = 8;
   3897     const size_t buffers = min(kMaxBufferSize / max_size, kMaxBuffers);
   3898     mGroup = new MediaBufferGroup(buffers, max_size);
   3899     mSrcBuffer = new (std::nothrow) uint8_t[max_size];
   3900     if (mSrcBuffer == NULL) {
   3901         // file probably specified a bad max size
   3902         delete mGroup;
   3903         mGroup = NULL;
   3904         return ERROR_MALFORMED;
   3905     }
   3906 
   3907     mStarted = true;
   3908 
   3909     return OK;
   3910 }
   3911 
   3912 status_t MPEG4Source::stop() {
   3913     Mutex::Autolock autoLock(mLock);
   3914 
   3915     CHECK(mStarted);
   3916 
   3917     if (mBuffer != NULL) {
   3918         mBuffer->release();
   3919         mBuffer = NULL;
   3920     }
   3921 
   3922     delete[] mSrcBuffer;
   3923     mSrcBuffer = NULL;
   3924 
   3925     delete mGroup;
   3926     mGroup = NULL;
   3927 
   3928     mStarted = false;
   3929     mCurrentSampleIndex = 0;
   3930 
   3931     return OK;
   3932 }
   3933 
   3934 status_t MPEG4Source::parseChunk(off64_t *offset) {
   3935     uint32_t hdr[2];
   3936     if (mDataSource->readAt(*offset, hdr, 8) < 8) {
   3937         return ERROR_IO;
   3938     }
   3939     uint64_t chunk_size = ntohl(hdr[0]);
   3940     uint32_t chunk_type = ntohl(hdr[1]);
   3941     off64_t data_offset = *offset + 8;
   3942 
   3943     if (chunk_size == 1) {
   3944         if (mDataSource->readAt(*offset + 8, &chunk_size, 8) < 8) {
   3945             return ERROR_IO;
   3946         }
   3947         chunk_size = ntoh64(chunk_size);
   3948         data_offset += 8;
   3949 
   3950         if (chunk_size < 16) {
   3951             // The smallest valid chunk is 16 bytes long in this case.
   3952             return ERROR_MALFORMED;
   3953         }
   3954     } else if (chunk_size < 8) {
   3955         // The smallest valid chunk is 8 bytes long.
   3956         return ERROR_MALFORMED;
   3957     }
   3958 
   3959     char chunk[5];
   3960     MakeFourCCString(chunk_type, chunk);
   3961     ALOGV("MPEG4Source chunk %s @ %#llx", chunk, (long long)*offset);
   3962 
   3963     off64_t chunk_data_size = *offset + chunk_size - data_offset;
   3964 
   3965     switch(chunk_type) {
   3966 
   3967         case FOURCC('t', 'r', 'a', 'f'):
   3968         case FOURCC('m', 'o', 'o', 'f'): {
   3969             off64_t stop_offset = *offset + chunk_size;
   3970             *offset = data_offset;
   3971             while (*offset < stop_offset) {
   3972                 status_t err = parseChunk(offset);
   3973                 if (err != OK) {
   3974                     return err;
   3975                 }
   3976             }
   3977             if (chunk_type == FOURCC('m', 'o', 'o', 'f')) {
   3978                 // *offset points to the box following this moof. Find the next moof from there.
   3979 
   3980                 while (true) {
   3981                     if (mDataSource->readAt(*offset, hdr, 8) < 8) {
   3982                         // no more box to the end of file.
   3983                         break;
   3984                     }
   3985                     chunk_size = ntohl(hdr[0]);
   3986                     chunk_type = ntohl(hdr[1]);
   3987                     if (chunk_size == 1) {
   3988                         // ISO/IEC 14496-12:2012, 8.8.4 Movie Fragment Box, moof is a Box
   3989                         // which is defined in 4.2 Object Structure.
   3990                         // When chunk_size==1, 8 bytes follows as "largesize".
   3991                         if (mDataSource->readAt(*offset + 8, &chunk_size, 8) < 8) {
   3992                             return ERROR_IO;
   3993                         }
   3994                         chunk_size = ntoh64(chunk_size);
   3995                         if (chunk_size < 16) {
   3996                             // The smallest valid chunk is 16 bytes long in this case.
   3997                             return ERROR_MALFORMED;
   3998                         }
   3999                     } else if (chunk_size == 0) {
   4000                         // next box extends to end of file.
   4001                     } else if (chunk_size < 8) {
   4002                         // The smallest valid chunk is 8 bytes long in this case.
   4003                         return ERROR_MALFORMED;
   4004                     }
   4005 
   4006                     if (chunk_type == FOURCC('m', 'o', 'o', 'f')) {
   4007                         mNextMoofOffset = *offset;
   4008                         break;
   4009                     } else if (chunk_size == 0) {
   4010                         break;
   4011                     }
   4012                     *offset += chunk_size;
   4013                 }
   4014             }
   4015             break;
   4016         }
   4017 
   4018         case FOURCC('t', 'f', 'h', 'd'): {
   4019                 status_t err;
   4020                 if ((err = parseTrackFragmentHeader(data_offset, chunk_data_size)) != OK) {
   4021                     return err;
   4022                 }
   4023                 *offset += chunk_size;
   4024                 break;
   4025         }
   4026 
   4027         case FOURCC('t', 'r', 'u', 'n'): {
   4028                 status_t err;
   4029                 if (mLastParsedTrackId == mTrackId) {
   4030                     if ((err = parseTrackFragmentRun(data_offset, chunk_data_size)) != OK) {
   4031                         return err;
   4032                     }
   4033                 }
   4034 
   4035                 *offset += chunk_size;
   4036                 break;
   4037         }
   4038 
   4039         case FOURCC('s', 'a', 'i', 'z'): {
   4040             status_t err;
   4041             if ((err = parseSampleAuxiliaryInformationSizes(data_offset, chunk_data_size)) != OK) {
   4042                 return err;
   4043             }
   4044             *offset += chunk_size;
   4045             break;
   4046         }
   4047         case FOURCC('s', 'a', 'i', 'o'): {
   4048             status_t err;
   4049             if ((err = parseSampleAuxiliaryInformationOffsets(data_offset, chunk_data_size)) != OK) {
   4050                 return err;
   4051             }
   4052             *offset += chunk_size;
   4053             break;
   4054         }
   4055 
   4056         case FOURCC('m', 'd', 'a', 't'): {
   4057             // parse DRM info if present
   4058             ALOGV("MPEG4Source::parseChunk mdat");
   4059             // if saiz/saoi was previously observed, do something with the sampleinfos
   4060             *offset += chunk_size;
   4061             break;
   4062         }
   4063 
   4064         default: {
   4065             *offset += chunk_size;
   4066             break;
   4067         }
   4068     }
   4069     return OK;
   4070 }
   4071 
   4072 status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
   4073         off64_t offset, off64_t /* size */) {
   4074     ALOGV("parseSampleAuxiliaryInformationSizes");
   4075     // 14496-12 8.7.12
   4076     uint8_t version;
   4077     if (mDataSource->readAt(
   4078             offset, &version, sizeof(version))
   4079             < (ssize_t)sizeof(version)) {
   4080         return ERROR_IO;
   4081     }
   4082 
   4083     if (version != 0) {
   4084         return ERROR_UNSUPPORTED;
   4085     }
   4086     offset++;
   4087 
   4088     uint32_t flags;
   4089     if (!mDataSource->getUInt24(offset, &flags)) {
   4090         return ERROR_IO;
   4091     }
   4092     offset += 3;
   4093 
   4094     if (flags & 1) {
   4095         uint32_t tmp;
   4096         if (!mDataSource->getUInt32(offset, &tmp)) {
   4097             return ERROR_MALFORMED;
   4098         }
   4099         mCurrentAuxInfoType = tmp;
   4100         offset += 4;
   4101         if (!mDataSource->getUInt32(offset, &tmp)) {
   4102             return ERROR_MALFORMED;
   4103         }
   4104         mCurrentAuxInfoTypeParameter = tmp;
   4105         offset += 4;
   4106     }
   4107 
   4108     uint8_t defsize;
   4109     if (mDataSource->readAt(offset, &defsize, 1) != 1) {
   4110         return ERROR_MALFORMED;
   4111     }
   4112     mCurrentDefaultSampleInfoSize = defsize;
   4113     offset++;
   4114 
   4115     uint32_t smplcnt;
   4116     if (!mDataSource->getUInt32(offset, &smplcnt)) {
   4117         return ERROR_MALFORMED;
   4118     }
   4119     mCurrentSampleInfoCount = smplcnt;
   4120     offset += 4;
   4121 
   4122     if (mCurrentDefaultSampleInfoSize != 0) {
   4123         ALOGV("@@@@ using default sample info size of %d", mCurrentDefaultSampleInfoSize);
   4124         return OK;
   4125     }
   4126     if (smplcnt > mCurrentSampleInfoAllocSize) {
   4127         uint8_t * newPtr =  (uint8_t*) realloc(mCurrentSampleInfoSizes, smplcnt);
   4128         if (newPtr == NULL) {
   4129             ALOGE("failed to realloc %u -> %u", mCurrentSampleInfoAllocSize, smplcnt);
   4130             return NO_MEMORY;
   4131         }
   4132         mCurrentSampleInfoSizes = newPtr;
   4133         mCurrentSampleInfoAllocSize = smplcnt;
   4134     }
   4135 
   4136     mDataSource->readAt(offset, mCurrentSampleInfoSizes, smplcnt);
   4137     return OK;
   4138 }
   4139 
   4140 status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
   4141         off64_t offset, off64_t /* size */) {
   4142     ALOGV("parseSampleAuxiliaryInformationOffsets");
   4143     // 14496-12 8.7.13
   4144     uint8_t version;
   4145     if (mDataSource->readAt(offset, &version, sizeof(version)) != 1) {
   4146         return ERROR_IO;
   4147     }
   4148     offset++;
   4149 
   4150     uint32_t flags;
   4151     if (!mDataSource->getUInt24(offset, &flags)) {
   4152         return ERROR_IO;
   4153     }
   4154     offset += 3;
   4155 
   4156     uint32_t entrycount;
   4157     if (!mDataSource->getUInt32(offset, &entrycount)) {
   4158         return ERROR_IO;
   4159     }
   4160     offset += 4;
   4161     if (entrycount == 0) {
   4162         return OK;
   4163     }
   4164     if (entrycount > UINT32_MAX / 8) {
   4165         return ERROR_MALFORMED;
   4166     }
   4167 
   4168     if (entrycount > mCurrentSampleInfoOffsetsAllocSize) {
   4169         uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8);
   4170         if (newPtr == NULL) {
   4171             ALOGE("failed to realloc %u -> %u", mCurrentSampleInfoOffsetsAllocSize, entrycount * 8);
   4172             return NO_MEMORY;
   4173         }
   4174         mCurrentSampleInfoOffsets = newPtr;
   4175         mCurrentSampleInfoOffsetsAllocSize = entrycount;
   4176     }
   4177     mCurrentSampleInfoOffsetCount = entrycount;
   4178 
   4179     if (mCurrentSampleInfoOffsets == NULL) {
   4180         return OK;
   4181     }
   4182 
   4183     for (size_t i = 0; i < entrycount; i++) {
   4184         if (version == 0) {
   4185             uint32_t tmp;
   4186             if (!mDataSource->getUInt32(offset, &tmp)) {
   4187                 return ERROR_IO;
   4188             }
   4189             mCurrentSampleInfoOffsets[i] = tmp;
   4190             offset += 4;
   4191         } else {
   4192             uint64_t tmp;
   4193             if (!mDataSource->getUInt64(offset, &tmp)) {
   4194                 return ERROR_IO;
   4195             }
   4196             mCurrentSampleInfoOffsets[i] = tmp;
   4197             offset += 8;
   4198         }
   4199     }
   4200 
   4201     // parse clear/encrypted data
   4202 
   4203     off64_t drmoffset = mCurrentSampleInfoOffsets[0]; // from moof
   4204 
   4205     drmoffset += mCurrentMoofOffset;
   4206     int ivlength;
   4207     CHECK(mFormat->findInt32(kKeyCryptoDefaultIVSize, &ivlength));
   4208 
   4209     // only 0, 8 and 16 byte initialization vectors are supported
   4210     if (ivlength != 0 && ivlength != 8 && ivlength != 16) {
   4211         ALOGW("unsupported IV length: %d", ivlength);
   4212         return ERROR_MALFORMED;
   4213     }
   4214     // read CencSampleAuxiliaryDataFormats
   4215     for (size_t i = 0; i < mCurrentSampleInfoCount; i++) {
   4216         if (i >= mCurrentSamples.size()) {
   4217             ALOGW("too few samples");
   4218             break;
   4219         }
   4220         Sample *smpl = &mCurrentSamples.editItemAt(i);
   4221 
   4222         memset(smpl->iv, 0, 16);
   4223         if (mDataSource->readAt(drmoffset, smpl->iv, ivlength) != ivlength) {
   4224             return ERROR_IO;
   4225         }
   4226 
   4227         drmoffset += ivlength;
   4228 
   4229         int32_t smplinfosize = mCurrentDefaultSampleInfoSize;
   4230         if (smplinfosize == 0) {
   4231             smplinfosize = mCurrentSampleInfoSizes[i];
   4232         }
   4233         if (smplinfosize > ivlength) {
   4234             uint16_t numsubsamples;
   4235             if (!mDataSource->getUInt16(drmoffset, &numsubsamples)) {
   4236                 return ERROR_IO;
   4237             }
   4238             drmoffset += 2;
   4239             for (size_t j = 0; j < numsubsamples; j++) {
   4240                 uint16_t numclear;
   4241                 uint32_t numencrypted;
   4242                 if (!mDataSource->getUInt16(drmoffset, &numclear)) {
   4243                     return ERROR_IO;
   4244                 }
   4245                 drmoffset += 2;
   4246                 if (!mDataSource->getUInt32(drmoffset, &numencrypted)) {
   4247                     return ERROR_IO;
   4248                 }
   4249                 drmoffset += 4;
   4250                 smpl->clearsizes.add(numclear);
   4251                 smpl->encryptedsizes.add(numencrypted);
   4252             }
   4253         } else {
   4254             smpl->clearsizes.add(0);
   4255             smpl->encryptedsizes.add(smpl->size);
   4256         }
   4257     }
   4258 
   4259 
   4260     return OK;
   4261 }
   4262 
   4263 status_t MPEG4Source::parseTrackFragmentHeader(off64_t offset, off64_t size) {
   4264 
   4265     if (size < 8) {
   4266         return -EINVAL;
   4267     }
   4268 
   4269     uint32_t flags;
   4270     if (!mDataSource->getUInt32(offset, &flags)) { // actually version + flags
   4271         return ERROR_MALFORMED;
   4272     }
   4273 
   4274     if (flags & 0xff000000) {
   4275         return -EINVAL;
   4276     }
   4277 
   4278     if (!mDataSource->getUInt32(offset + 4, (uint32_t*)&mLastParsedTrackId)) {
   4279         return ERROR_MALFORMED;
   4280     }
   4281 
   4282     if (mLastParsedTrackId != mTrackId) {
   4283         // this is not the right track, skip it
   4284         return OK;
   4285     }
   4286 
   4287     mTrackFragmentHeaderInfo.mFlags = flags;
   4288     mTrackFragmentHeaderInfo.mTrackID = mLastParsedTrackId;
   4289     offset += 8;
   4290     size -= 8;
   4291 
   4292     ALOGV("fragment header: %08x %08x", flags, mTrackFragmentHeaderInfo.mTrackID);
   4293 
   4294     if (flags & TrackFragmentHeaderInfo::kBaseDataOffsetPresent) {
   4295         if (size < 8) {
   4296             return -EINVAL;
   4297         }
   4298 
   4299         if (!mDataSource->getUInt64(offset, &mTrackFragmentHeaderInfo.mBaseDataOffset)) {
   4300             return ERROR_MALFORMED;
   4301         }
   4302         offset += 8;
   4303         size -= 8;
   4304     }
   4305 
   4306     if (flags & TrackFragmentHeaderInfo::kSampleDescriptionIndexPresent) {
   4307         if (size < 4) {
   4308             return -EINVAL;
   4309         }
   4310 
   4311         if (!mDataSource->getUInt32(offset, &mTrackFragmentHeaderInfo.mSampleDescriptionIndex)) {
   4312             return ERROR_MALFORMED;
   4313         }
   4314         offset += 4;
   4315         size -= 4;
   4316     }
   4317 
   4318     if (flags & TrackFragmentHeaderInfo::kDefaultSampleDurationPresent) {
   4319         if (size < 4) {
   4320             return -EINVAL;
   4321         }
   4322 
   4323         if (!mDataSource->getUInt32(offset, &mTrackFragmentHeaderInfo.mDefaultSampleDuration)) {
   4324             return ERROR_MALFORMED;
   4325         }
   4326         offset += 4;
   4327         size -= 4;
   4328     }
   4329 
   4330     if (flags & TrackFragmentHeaderInfo::kDefaultSampleSizePresent) {
   4331         if (size < 4) {
   4332             return -EINVAL;
   4333         }
   4334 
   4335         if (!mDataSource->getUInt32(offset, &mTrackFragmentHeaderInfo.mDefaultSampleSize)) {
   4336             return ERROR_MALFORMED;
   4337         }
   4338         offset += 4;
   4339         size -= 4;
   4340     }
   4341 
   4342     if (flags & TrackFragmentHeaderInfo::kDefaultSampleFlagsPresent) {
   4343         if (size < 4) {
   4344             return -EINVAL;
   4345         }
   4346 
   4347         if (!mDataSource->getUInt32(offset, &mTrackFragmentHeaderInfo.mDefaultSampleFlags)) {
   4348             return ERROR_MALFORMED;
   4349         }
   4350         offset += 4;
   4351         size -= 4;
   4352     }
   4353 
   4354     if (!(flags & TrackFragmentHeaderInfo::kBaseDataOffsetPresent)) {
   4355         mTrackFragmentHeaderInfo.mBaseDataOffset = mCurrentMoofOffset;
   4356     }
   4357 
   4358     mTrackFragmentHeaderInfo.mDataOffset = 0;
   4359     return OK;
   4360 }
   4361 
   4362 status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) {
   4363 
   4364     ALOGV("MPEG4Extractor::parseTrackFragmentRun");
   4365     if (size < 8) {
   4366         return -EINVAL;
   4367     }
   4368 
   4369     enum {
   4370         kDataOffsetPresent                  = 0x01,
   4371         kFirstSampleFlagsPresent            = 0x04,
   4372         kSampleDurationPresent              = 0x100,
   4373         kSampleSizePresent                  = 0x200,
   4374         kSampleFlagsPresent                 = 0x400,
   4375         kSampleCompositionTimeOffsetPresent = 0x800,
   4376     };
   4377 
   4378     uint32_t flags;
   4379     if (!mDataSource->getUInt32(offset, &flags)) {
   4380         return ERROR_MALFORMED;
   4381     }
   4382     // |version| only affects SampleCompositionTimeOffset field.
   4383     // If version == 0, SampleCompositionTimeOffset is uint32_t;
   4384     // Otherwise, SampleCompositionTimeOffset is int32_t.
   4385     // Sample.compositionOffset is defined as int32_t.
   4386     uint8_t version = flags >> 24;
   4387     flags &= 0xffffff;
   4388     ALOGV("fragment run version: 0x%02x, flags: 0x%06x", version, flags);
   4389 
   4390     if ((flags & kFirstSampleFlagsPresent) && (flags & kSampleFlagsPresent)) {
   4391         // These two shall not be used together.
   4392         return -EINVAL;
   4393     }
   4394 
   4395     uint32_t sampleCount;
   4396     if (!mDataSource->getUInt32(offset + 4, &sampleCount)) {
   4397         return ERROR_MALFORMED;
   4398     }
   4399     offset += 8;
   4400     size -= 8;
   4401 
   4402     uint64_t dataOffset = mTrackFragmentHeaderInfo.mDataOffset;
   4403 
   4404     uint32_t firstSampleFlags = 0;
   4405 
   4406     if (flags & kDataOffsetPresent) {
   4407         if (size < 4) {
   4408             return -EINVAL;
   4409         }
   4410 
   4411         int32_t dataOffsetDelta;
   4412         if (!mDataSource->getUInt32(offset, (uint32_t*)&dataOffsetDelta)) {
   4413             return ERROR_MALFORMED;
   4414         }
   4415 
   4416         dataOffset = mTrackFragmentHeaderInfo.mBaseDataOffset + dataOffsetDelta;
   4417 
   4418         offset += 4;
   4419         size -= 4;
   4420     }
   4421 
   4422     if (flags & kFirstSampleFlagsPresent) {
   4423         if (size < 4) {
   4424             return -EINVAL;
   4425         }
   4426 
   4427         if (!mDataSource->getUInt32(offset, &firstSampleFlags)) {
   4428             return ERROR_MALFORMED;
   4429         }
   4430         offset += 4;
   4431         size -= 4;
   4432     }
   4433 
   4434     uint32_t sampleDuration = 0, sampleSize = 0, sampleFlags = 0,
   4435              sampleCtsOffset = 0;
   4436 
   4437     size_t bytesPerSample = 0;
   4438     if (flags & kSampleDurationPresent) {
   4439         bytesPerSample += 4;
   4440     } else if (mTrackFragmentHeaderInfo.mFlags
   4441             & TrackFragmentHeaderInfo::kDefaultSampleDurationPresent) {
   4442         sampleDuration = mTrackFragmentHeaderInfo.mDefaultSampleDuration;
   4443     } else if (mTrex) {
   4444         sampleDuration = mTrex->default_sample_duration;
   4445     }
   4446 
   4447     if (flags & kSampleSizePresent) {
   4448         bytesPerSample += 4;
   4449     } else if (mTrackFragmentHeaderInfo.mFlags
   4450             & TrackFragmentHeaderInfo::kDefaultSampleSizePresent) {
   4451         sampleSize = mTrackFragmentHeaderInfo.mDefaultSampleSize;
   4452     } else {
   4453         sampleSize = mTrackFragmentHeaderInfo.mDefaultSampleSize;
   4454     }
   4455 
   4456     if (flags & kSampleFlagsPresent) {
   4457         bytesPerSample += 4;
   4458     } else if (mTrackFragmentHeaderInfo.mFlags
   4459             & TrackFragmentHeaderInfo::kDefaultSampleFlagsPresent) {
   4460         sampleFlags = mTrackFragmentHeaderInfo.mDefaultSampleFlags;
   4461     } else {
   4462         sampleFlags = mTrackFragmentHeaderInfo.mDefaultSampleFlags;
   4463     }
   4464 
   4465     if (flags & kSampleCompositionTimeOffsetPresent) {
   4466         bytesPerSample += 4;
   4467     } else {
   4468         sampleCtsOffset = 0;
   4469     }
   4470 
   4471     if (size < (off64_t)(sampleCount * bytesPerSample)) {
   4472         return -EINVAL;
   4473     }
   4474 
   4475     Sample tmp;
   4476     for (uint32_t i = 0; i < sampleCount; ++i) {
   4477         if (flags & kSampleDurationPresent) {
   4478             if (!mDataSource->getUInt32(offset, &sampleDuration)) {
   4479                 return ERROR_MALFORMED;
   4480             }
   4481             offset += 4;
   4482         }
   4483 
   4484         if (flags & kSampleSizePresent) {
   4485             if (!mDataSource->getUInt32(offset, &sampleSize)) {
   4486                 return ERROR_MALFORMED;
   4487             }
   4488             offset += 4;
   4489         }
   4490 
   4491         if (flags & kSampleFlagsPresent) {
   4492             if (!mDataSource->getUInt32(offset, &sampleFlags)) {
   4493                 return ERROR_MALFORMED;
   4494             }
   4495             offset += 4;
   4496         }
   4497 
   4498         if (flags & kSampleCompositionTimeOffsetPresent) {
   4499             if (!mDataSource->getUInt32(offset, &sampleCtsOffset)) {
   4500                 return ERROR_MALFORMED;
   4501             }
   4502             offset += 4;
   4503         }
   4504 
   4505         ALOGV("adding sample %d at offset 0x%08" PRIx64 ", size %u, duration %u, "
   4506               " flags 0x%08x", i + 1,
   4507                 dataOffset, sampleSize, sampleDuration,
   4508                 (flags & kFirstSampleFlagsPresent) && i == 0
   4509                     ? firstSampleFlags : sampleFlags);
   4510         tmp.offset = dataOffset;
   4511         tmp.size = sampleSize;
   4512         tmp.duration = sampleDuration;
   4513         tmp.compositionOffset = sampleCtsOffset;
   4514         mCurrentSamples.add(tmp);
   4515 
   4516         dataOffset += sampleSize;
   4517     }
   4518 
   4519     mTrackFragmentHeaderInfo.mDataOffset = dataOffset;
   4520 
   4521     return OK;
   4522 }
   4523 
   4524 sp<MetaData> MPEG4Source::getFormat() {
   4525     Mutex::Autolock autoLock(mLock);
   4526 
   4527     return mFormat;
   4528 }
   4529 
   4530 size_t MPEG4Source::parseNALSize(const uint8_t *data) const {
   4531     switch (mNALLengthSize) {
   4532         case 1:
   4533             return *data;
   4534         case 2:
   4535             return U16_AT(data);
   4536         case 3:
   4537             return ((size_t)data[0] << 16) | U16_AT(&data[1]);
   4538         case 4:
   4539             return U32_AT(data);
   4540     }
   4541 
   4542     // This cannot happen, mNALLengthSize springs to life by adding 1 to
   4543     // a 2-bit integer.
   4544     CHECK(!"Should not be here.");
   4545 
   4546     return 0;
   4547 }
   4548 
   4549 status_t MPEG4Source::read(
   4550         MediaBuffer **out, const ReadOptions *options) {
   4551     Mutex::Autolock autoLock(mLock);
   4552 
   4553     CHECK(mStarted);
   4554 
   4555     if (options != nullptr && options->getNonBlocking() && !mGroup->has_buffers()) {
   4556         *out = nullptr;
   4557         return WOULD_BLOCK;
   4558     }
   4559 
   4560     if (mFirstMoofOffset > 0) {
   4561         return fragmentedRead(out, options);
   4562     }
   4563 
   4564     *out = NULL;
   4565 
   4566     int64_t targetSampleTimeUs = -1;
   4567 
   4568     int64_t seekTimeUs;
   4569     ReadOptions::SeekMode mode;
   4570     if (options && options->getSeekTo(&seekTimeUs, &mode)) {
   4571         if (mIsHEIF) {
   4572             CHECK(mSampleTable == NULL);
   4573             CHECK(mItemTable != NULL);
   4574 
   4575             status_t err;
   4576             if (seekTimeUs >= 0) {
   4577                 err = mItemTable->findPrimaryImage(&mCurrentSampleIndex);
   4578             } else {
   4579                 err = mItemTable->findThumbnail(&mCurrentSampleIndex);
   4580             }
   4581             if (err != OK) {
   4582                 return err;
   4583             }
   4584         } else {
   4585             uint32_t findFlags = 0;
   4586             switch (mode) {
   4587                 case ReadOptions::SEEK_PREVIOUS_SYNC:
   4588                     findFlags = SampleTable::kFlagBefore;
   4589                     break;
   4590                 case ReadOptions::SEEK_NEXT_SYNC:
   4591                     findFlags = SampleTable::kFlagAfter;
   4592                     break;
   4593                 case ReadOptions::SEEK_CLOSEST_SYNC:
   4594                 case ReadOptions::SEEK_CLOSEST:
   4595                     findFlags = SampleTable::kFlagClosest;
   4596                     break;
   4597                 default:
   4598                     CHECK(!"Should not be here.");
   4599                     break;
   4600             }
   4601 
   4602             uint32_t sampleIndex;
   4603             status_t err = mSampleTable->findSampleAtTime(
   4604                     seekTimeUs, 1000000, mTimescale,
   4605                     &sampleIndex, findFlags);
   4606 
   4607             if (mode == ReadOptions::SEEK_CLOSEST) {
   4608                 // We found the closest sample already, now we want the sync
   4609                 // sample preceding it (or the sample itself of course), even
   4610                 // if the subsequent sync sample is closer.
   4611                 findFlags = SampleTable::kFlagBefore;
   4612             }
   4613 
   4614             uint32_t syncSampleIndex;
   4615             if (err == OK) {
   4616                 err = mSampleTable->findSyncSampleNear(
   4617                         sampleIndex, &syncSampleIndex, findFlags);
   4618             }
   4619 
   4620             uint32_t sampleTime;
   4621             if (err == OK) {
   4622                 err = mSampleTable->getMetaDataForSample(
   4623                         sampleIndex, NULL, NULL, &sampleTime);
   4624             }
   4625 
   4626             if (err != OK) {
   4627                 if (err == ERROR_OUT_OF_RANGE) {
   4628                     // An attempt to seek past the end of the stream would
   4629                     // normally cause this ERROR_OUT_OF_RANGE error. Propagating
   4630                     // this all the way to the MediaPlayer would cause abnormal
   4631                     // termination. Legacy behaviour appears to be to behave as if
   4632                     // we had seeked to the end of stream, ending normally.
   4633                     err = ERROR_END_OF_STREAM;
   4634                 }
   4635                 ALOGV("end of stream");
   4636                 return err;
   4637             }
   4638 
   4639             if (mode == ReadOptions::SEEK_CLOSEST) {
   4640                 targetSampleTimeUs = (sampleTime * 1000000ll) / mTimescale;
   4641             }
   4642 
   4643 #if 0
   4644             uint32_t syncSampleTime;
   4645             CHECK_EQ(OK, mSampleTable->getMetaDataForSample(
   4646                         syncSampleIndex, NULL, NULL, &syncSampleTime));
   4647 
   4648             ALOGI("seek to time %lld us => sample at time %lld us, "
   4649                  "sync sample at time %lld us",
   4650                  seekTimeUs,
   4651                  sampleTime * 1000000ll / mTimescale,
   4652                  syncSampleTime * 1000000ll / mTimescale);
   4653 #endif
   4654 
   4655             mCurrentSampleIndex = syncSampleIndex;
   4656         }
   4657 
   4658         if (mBuffer != NULL) {
   4659             mBuffer->release();
   4660             mBuffer = NULL;
   4661         }
   4662 
   4663         // fall through
   4664     }
   4665 
   4666     off64_t offset = 0;
   4667     size_t size = 0;
   4668     uint32_t cts, stts;
   4669     bool isSyncSample;
   4670     bool newBuffer = false;
   4671     if (mBuffer == NULL) {
   4672         newBuffer = true;
   4673 
   4674         status_t err;
   4675         if (!mIsHEIF) {
   4676             err = mSampleTable->getMetaDataForSample(
   4677                     mCurrentSampleIndex, &offset, &size, &cts, &isSyncSample, &stts);
   4678         } else {
   4679             err = mItemTable->getImageOffsetAndSize(
   4680                     options && options->getSeekTo(&seekTimeUs, &mode) ?
   4681                             &mCurrentSampleIndex : NULL, &offset, &size);
   4682 
   4683             cts = stts = 0;
   4684             isSyncSample = 0;
   4685             ALOGV("image offset %lld, size %zu", (long long)offset, size);
   4686         }
   4687 
   4688         if (err != OK) {
   4689             return err;
   4690         }
   4691 
   4692         err = mGroup->acquire_buffer(&mBuffer);
   4693 
   4694         if (err != OK) {
   4695             CHECK(mBuffer == NULL);
   4696             return err;
   4697         }
   4698         if (size > mBuffer->size()) {
   4699             ALOGE("buffer too small: %zu > %zu", size, mBuffer->size());
   4700             mBuffer->release();
   4701             mBuffer = NULL;
   4702             return ERROR_BUFFER_TOO_SMALL;
   4703         }
   4704     }
   4705 
   4706     if ((!mIsAVC && !mIsHEVC) || mWantsNALFragments) {
   4707         if (newBuffer) {
   4708             ssize_t num_bytes_read =
   4709                 mDataSource->readAt(offset, (uint8_t *)mBuffer->data(), size);
   4710 
   4711             if (num_bytes_read < (ssize_t)size) {
   4712                 mBuffer->release();
   4713                 mBuffer = NULL;
   4714 
   4715                 return ERROR_IO;
   4716             }
   4717 
   4718             CHECK(mBuffer != NULL);
   4719             mBuffer->set_range(0, size);
   4720             mBuffer->meta_data()->clear();
   4721             mBuffer->meta_data()->setInt64(
   4722                     kKeyTime, ((int64_t)cts * 1000000) / mTimescale);
   4723             mBuffer->meta_data()->setInt64(
   4724                     kKeyDuration, ((int64_t)stts * 1000000) / mTimescale);
   4725 
   4726             if (targetSampleTimeUs >= 0) {
   4727                 mBuffer->meta_data()->setInt64(
   4728                         kKeyTargetTime, targetSampleTimeUs);
   4729             }
   4730 
   4731             if (isSyncSample) {
   4732                 mBuffer->meta_data()->setInt32(kKeyIsSyncFrame, 1);
   4733             }
   4734 
   4735             ++mCurrentSampleIndex;
   4736         }
   4737 
   4738         if (!mIsAVC && !mIsHEVC) {
   4739             *out = mBuffer;
   4740             mBuffer = NULL;
   4741 
   4742             return OK;
   4743         }
   4744 
   4745         // Each NAL unit is split up into its constituent fragments and
   4746         // each one of them returned in its own buffer.
   4747 
   4748         CHECK(mBuffer->range_length() >= mNALLengthSize);
   4749 
   4750         const uint8_t *src =
   4751             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
   4752 
   4753         size_t nal_size = parseNALSize(src);
   4754         if (mNALLengthSize > SIZE_MAX - nal_size) {
   4755             ALOGE("b/24441553, b/24445122");
   4756         }
   4757         if (mBuffer->range_length() - mNALLengthSize < nal_size) {
   4758             ALOGE("incomplete NAL unit.");
   4759 
   4760             mBuffer->release();
   4761             mBuffer = NULL;
   4762 
   4763             return ERROR_MALFORMED;
   4764         }
   4765 
   4766         MediaBuffer *clone = mBuffer->clone();
   4767         CHECK(clone != NULL);
   4768         clone->set_range(mBuffer->range_offset() + mNALLengthSize, nal_size);
   4769 
   4770         CHECK(mBuffer != NULL);
   4771         mBuffer->set_range(
   4772                 mBuffer->range_offset() + mNALLengthSize + nal_size,
   4773                 mBuffer->range_length() - mNALLengthSize - nal_size);
   4774 
   4775         if (mBuffer->range_length() == 0) {
   4776             mBuffer->release();
   4777             mBuffer = NULL;
   4778         }
   4779 
   4780         *out = clone;
   4781 
   4782         return OK;
   4783     } else {
   4784         // Whole NAL units are returned but each fragment is prefixed by
   4785         // the start code (0x00 00 00 01).
   4786         ssize_t num_bytes_read = 0;
   4787         int32_t drm = 0;
   4788         bool usesDRM = (mFormat->findInt32(kKeyIsDRM, &drm) && drm != 0);
   4789         if (usesDRM) {
   4790             num_bytes_read =
   4791                 mDataSource->readAt(offset, (uint8_t*)mBuffer->data(), size);
   4792         } else {
   4793             num_bytes_read = mDataSource->readAt(offset, mSrcBuffer, size);
   4794         }
   4795 
   4796         if (num_bytes_read < (ssize_t)size) {
   4797             mBuffer->release();
   4798             mBuffer = NULL;
   4799 
   4800             return ERROR_IO;
   4801         }
   4802 
   4803         if (usesDRM) {
   4804             CHECK(mBuffer != NULL);
   4805             mBuffer->set_range(0, size);
   4806 
   4807         } else {
   4808             uint8_t *dstData = (uint8_t *)mBuffer->data();
   4809             size_t srcOffset = 0;
   4810             size_t dstOffset = 0;
   4811 
   4812             while (srcOffset < size) {
   4813                 bool isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize);
   4814                 size_t nalLength = 0;
   4815                 if (!isMalFormed) {
   4816                     nalLength = parseNALSize(&mSrcBuffer[srcOffset]);
   4817                     srcOffset += mNALLengthSize;
   4818                     isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength);
   4819                 }
   4820 
   4821                 if (isMalFormed) {
   4822                     ALOGE("Video is malformed");
   4823                     mBuffer->release();
   4824                     mBuffer = NULL;
   4825                     return ERROR_MALFORMED;
   4826                 }
   4827 
   4828                 if (nalLength == 0) {
   4829                     continue;
   4830                 }
   4831 
   4832                 if (dstOffset > SIZE_MAX - 4 ||
   4833                         dstOffset + 4 > SIZE_MAX - nalLength ||
   4834                         dstOffset + 4 + nalLength > mBuffer->size()) {
   4835                     ALOGE("b/27208621 : %zu %zu", dstOffset, mBuffer->size());
   4836                     android_errorWriteLog(0x534e4554, "27208621");
   4837                     mBuffer->release();
   4838                     mBuffer = NULL;
   4839                     return ERROR_MALFORMED;
   4840                 }
   4841 
   4842                 dstData[dstOffset++] = 0;
   4843                 dstData[dstOffset++] = 0;
   4844                 dstData[dstOffset++] = 0;
   4845                 dstData[dstOffset++] = 1;
   4846                 memcpy(&dstData[dstOffset], &mSrcBuffer[srcOffset], nalLength);
   4847                 srcOffset += nalLength;
   4848                 dstOffset += nalLength;
   4849             }
   4850             CHECK_EQ(srcOffset, size);
   4851             CHECK(mBuffer != NULL);
   4852             mBuffer->set_range(0, dstOffset);
   4853         }
   4854 
   4855         mBuffer->meta_data()->clear();
   4856         mBuffer->meta_data()->setInt64(
   4857                 kKeyTime, ((int64_t)cts * 1000000) / mTimescale);
   4858         mBuffer->meta_data()->setInt64(
   4859                 kKeyDuration, ((int64_t)stts * 1000000) / mTimescale);
   4860 
   4861         if (targetSampleTimeUs >= 0) {
   4862             mBuffer->meta_data()->setInt64(
   4863                     kKeyTargetTime, targetSampleTimeUs);
   4864         }
   4865 
   4866         if (mIsAVC) {
   4867             uint32_t layerId = FindAVCLayerId(
   4868                     (const uint8_t *)mBuffer->data(), mBuffer->range_length());
   4869             mBuffer->meta_data()->setInt32(kKeyTemporalLayerId, layerId);
   4870         }
   4871 
   4872         if (isSyncSample) {
   4873             mBuffer->meta_data()->setInt32(kKeyIsSyncFrame, 1);
   4874         }
   4875 
   4876         ++mCurrentSampleIndex;
   4877 
   4878         *out = mBuffer;
   4879         mBuffer = NULL;
   4880 
   4881         return OK;
   4882     }
   4883 }
   4884 
   4885 status_t MPEG4Source::fragmentedRead(
   4886         MediaBuffer **out, const ReadOptions *options) {
   4887 
   4888     ALOGV("MPEG4Source::fragmentedRead");
   4889 
   4890     CHECK(mStarted);
   4891 
   4892     *out = NULL;
   4893 
   4894     int64_t targetSampleTimeUs = -1;
   4895 
   4896     int64_t seekTimeUs;
   4897     ReadOptions::SeekMode mode;
   4898     if (options && options->getSeekTo(&seekTimeUs, &mode)) {
   4899 
   4900         int numSidxEntries = mSegments.size();
   4901         if (numSidxEntries != 0) {
   4902             int64_t totalTime = 0;
   4903             off64_t totalOffset = mFirstMoofOffset;
   4904             for (int i = 0; i < numSidxEntries; i++) {
   4905                 const SidxEntry *se = &mSegments[i];
   4906                 if (totalTime + se->mDurationUs > seekTimeUs) {
   4907                     // The requested time is somewhere in this segment
   4908                     if ((mode == ReadOptions::SEEK_NEXT_SYNC && seekTimeUs > totalTime) ||
   4909                         (mode == ReadOptions::SEEK_CLOSEST_SYNC &&
   4910                         (seekTimeUs - totalTime) > (totalTime + se->mDurationUs - seekTimeUs))) {
   4911                         // requested next sync, or closest sync and it was closer to the end of
   4912                         // this segment
   4913                         totalTime += se->mDurationUs;
   4914                         totalOffset += se->mSize;
   4915                     }
   4916                     break;
   4917                 }
   4918                 totalTime += se->mDurationUs;
   4919                 totalOffset += se->mSize;
   4920             }
   4921             mCurrentMoofOffset = totalOffset;
   4922             mNextMoofOffset = -1;
   4923             mCurrentSamples.clear();
   4924             mCurrentSampleIndex = 0;
   4925             status_t err = parseChunk(&totalOffset);
   4926             if (err != OK) {
   4927                 return err;
   4928             }
   4929             mCurrentTime = totalTime * mTimescale / 1000000ll;
   4930         } else {
   4931             // without sidx boxes, we can only seek to 0
   4932             mCurrentMoofOffset = mFirstMoofOffset;
   4933             mNextMoofOffset = -1;
   4934             mCurrentSamples.clear();
   4935             mCurrentSampleIndex = 0;
   4936             off64_t tmp = mCurrentMoofOffset;
   4937             status_t err = parseChunk(&tmp);
   4938             if (err != OK) {
   4939                 return err;
   4940             }
   4941             mCurrentTime = 0;
   4942         }
   4943 
   4944         if (mBuffer != NULL) {
   4945             mBuffer->release();
   4946             mBuffer = NULL;
   4947         }
   4948 
   4949         // fall through
   4950     }
   4951 
   4952     off64_t offset = 0;
   4953     size_t size = 0;
   4954     uint32_t cts = 0;
   4955     bool isSyncSample = false;
   4956     bool newBuffer = false;
   4957     if (mBuffer == NULL) {
   4958         newBuffer = true;
   4959 
   4960         if (mCurrentSampleIndex >= mCurrentSamples.size()) {
   4961             // move to next fragment if there is one
   4962             if (mNextMoofOffset <= mCurrentMoofOffset) {
   4963                 return ERROR_END_OF_STREAM;
   4964             }
   4965             off64_t nextMoof = mNextMoofOffset;
   4966             mCurrentMoofOffset = nextMoof;
   4967             mCurrentSamples.clear();
   4968             mCurrentSampleIndex = 0;
   4969             status_t err = parseChunk(&nextMoof);
   4970             if (err != OK) {
   4971                 return err;
   4972             }
   4973             if (mCurrentSampleIndex >= mCurrentSamples.size()) {
   4974                 return ERROR_END_OF_STREAM;
   4975             }
   4976         }
   4977 
   4978         const Sample *smpl = &mCurrentSamples[mCurrentSampleIndex];
   4979         offset = smpl->offset;
   4980         size = smpl->size;
   4981         cts = mCurrentTime + smpl->compositionOffset;
   4982         mCurrentTime += smpl->duration;
   4983         isSyncSample = (mCurrentSampleIndex == 0); // XXX
   4984 
   4985         status_t err = mGroup->acquire_buffer(&mBuffer);
   4986 
   4987         if (err != OK) {
   4988             CHECK(mBuffer == NULL);
   4989             ALOGV("acquire_buffer returned %d", err);
   4990             return err;
   4991         }
   4992         if (size > mBuffer->size()) {
   4993             ALOGE("buffer too small: %zu > %zu", size, mBuffer->size());
   4994             mBuffer->release();
   4995             mBuffer = NULL;
   4996             return ERROR_BUFFER_TOO_SMALL;
   4997         }
   4998     }
   4999 
   5000     const Sample *smpl = &mCurrentSamples[mCurrentSampleIndex];
   5001     const sp<MetaData> bufmeta = mBuffer->meta_data();
   5002     bufmeta->clear();
   5003     if (smpl->encryptedsizes.size()) {
   5004         // store clear/encrypted lengths in metadata
   5005         bufmeta->setData(kKeyPlainSizes, 0,
   5006                 smpl->clearsizes.array(), smpl->clearsizes.size() * 4);
   5007         bufmeta->setData(kKeyEncryptedSizes, 0,
   5008                 smpl->encryptedsizes.array(), smpl->encryptedsizes.size() * 4);
   5009         bufmeta->setData(kKeyCryptoIV, 0, smpl->iv, 16); // use 16 or the actual size?
   5010         bufmeta->setInt32(kKeyCryptoDefaultIVSize, mDefaultIVSize);
   5011         bufmeta->setInt32(kKeyCryptoMode, mCryptoMode);
   5012         bufmeta->setData(kKeyCryptoKey, 0, mCryptoKey, 16);
   5013     }
   5014 
   5015     if ((!mIsAVC && !mIsHEVC)|| mWantsNALFragments) {
   5016         if (newBuffer) {
   5017             if (!isInRange((size_t)0u, mBuffer->size(), size)) {
   5018                 mBuffer->release();
   5019                 mBuffer = NULL;
   5020 
   5021                 ALOGE("fragmentedRead ERROR_MALFORMED size %zu", size);
   5022                 return ERROR_MALFORMED;
   5023             }
   5024 
   5025             ssize_t num_bytes_read =
   5026                 mDataSource->readAt(offset, (uint8_t *)mBuffer->data(), size);
   5027 
   5028             if (num_bytes_read < (ssize_t)size) {
   5029                 mBuffer->release();
   5030                 mBuffer = NULL;
   5031 
   5032                 ALOGE("i/o error");
   5033                 return ERROR_IO;
   5034             }
   5035 
   5036             CHECK(mBuffer != NULL);
   5037             mBuffer->set_range(0, size);
   5038             mBuffer->meta_data()->setInt64(
   5039                     kKeyTime, ((int64_t)cts * 1000000) / mTimescale);
   5040             mBuffer->meta_data()->setInt64(
   5041                     kKeyDuration, ((int64_t)smpl->duration * 1000000) / mTimescale);
   5042 
   5043             if (targetSampleTimeUs >= 0) {
   5044                 mBuffer->meta_data()->setInt64(
   5045                         kKeyTargetTime, targetSampleTimeUs);
   5046             }
   5047 
   5048             if (mIsAVC) {
   5049                 uint32_t layerId = FindAVCLayerId(
   5050                         (const uint8_t *)mBuffer->data(), mBuffer->range_length());
   5051                 mBuffer->meta_data()->setInt32(kKeyTemporalLayerId, layerId);
   5052             }
   5053 
   5054             if (isSyncSample) {
   5055                 mBuffer->meta_data()->setInt32(kKeyIsSyncFrame, 1);
   5056             }
   5057 
   5058             ++mCurrentSampleIndex;
   5059         }
   5060 
   5061         if (!mIsAVC && !mIsHEVC) {
   5062             *out = mBuffer;
   5063             mBuffer = NULL;
   5064 
   5065             return OK;
   5066         }
   5067 
   5068         // Each NAL unit is split up into its constituent fragments and
   5069         // each one of them returned in its own buffer.
   5070 
   5071         CHECK(mBuffer->range_length() >= mNALLengthSize);
   5072 
   5073         const uint8_t *src =
   5074             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
   5075 
   5076         size_t nal_size = parseNALSize(src);
   5077         if (mNALLengthSize > SIZE_MAX - nal_size) {
   5078             ALOGE("b/24441553, b/24445122");
   5079         }
   5080 
   5081         if (mBuffer->range_length() - mNALLengthSize < nal_size) {
   5082             ALOGE("incomplete NAL unit.");
   5083 
   5084             mBuffer->release();
   5085             mBuffer = NULL;
   5086 
   5087             return ERROR_MALFORMED;
   5088         }
   5089 
   5090         MediaBuffer *clone = mBuffer->clone();
   5091         CHECK(clone != NULL);
   5092         clone->set_range(mBuffer->range_offset() + mNALLengthSize, nal_size);
   5093 
   5094         CHECK(mBuffer != NULL);
   5095         mBuffer->set_range(
   5096                 mBuffer->range_offset() + mNALLengthSize + nal_size,
   5097                 mBuffer->range_length() - mNALLengthSize - nal_size);
   5098 
   5099         if (mBuffer->range_length() == 0) {
   5100             mBuffer->release();
   5101             mBuffer = NULL;
   5102         }
   5103 
   5104         *out = clone;
   5105 
   5106         return OK;
   5107     } else {
   5108         ALOGV("whole NAL");
   5109         // Whole NAL units are returned but each fragment is prefixed by
   5110         // the start code (0x00 00 00 01).
   5111         ssize_t num_bytes_read = 0;
   5112         int32_t drm = 0;
   5113         bool usesDRM = (mFormat->findInt32(kKeyIsDRM, &drm) && drm != 0);
   5114         void *data = NULL;
   5115         bool isMalFormed = false;
   5116         if (usesDRM) {
   5117             if (mBuffer == NULL || !isInRange((size_t)0u, mBuffer->size(), size)) {
   5118                 isMalFormed = true;
   5119             } else {
   5120                 data = mBuffer->data();
   5121             }
   5122         } else {
   5123             int32_t max_size;
   5124             if (mFormat == NULL
   5125                     || !mFormat->findInt32(kKeyMaxInputSize, &max_size)
   5126                     || !isInRange((size_t)0u, (size_t)max_size, size)) {
   5127                 isMalFormed = true;
   5128             } else {
   5129                 data = mSrcBuffer;
   5130             }
   5131         }
   5132 
   5133         if (isMalFormed || data == NULL) {
   5134             ALOGE("isMalFormed size %zu", size);
   5135             if (mBuffer != NULL) {
   5136                 mBuffer->release();
   5137                 mBuffer = NULL;
   5138             }
   5139             return ERROR_MALFORMED;
   5140         }
   5141         num_bytes_read = mDataSource->readAt(offset, data, size);
   5142 
   5143         if (num_bytes_read < (ssize_t)size) {
   5144             mBuffer->release();
   5145             mBuffer = NULL;
   5146 
   5147             ALOGE("i/o error");
   5148             return ERROR_IO;
   5149         }
   5150 
   5151         if (usesDRM) {
   5152             CHECK(mBuffer != NULL);
   5153             mBuffer->set_range(0, size);
   5154 
   5155         } else {
   5156             uint8_t *dstData = (uint8_t *)mBuffer->data();
   5157             size_t srcOffset = 0;
   5158             size_t dstOffset = 0;
   5159 
   5160             while (srcOffset < size) {
   5161                 isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize);
   5162                 size_t nalLength = 0;
   5163                 if (!isMalFormed) {
   5164                     nalLength = parseNALSize(&mSrcBuffer[srcOffset]);
   5165                     srcOffset += mNALLengthSize;
   5166                     isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength)
   5167                             || !isInRange((size_t)0u, mBuffer->size(), dstOffset, (size_t)4u)
   5168                             || !isInRange((size_t)0u, mBuffer->size(), dstOffset + 4, nalLength);
   5169                 }
   5170 
   5171                 if (isMalFormed) {
   5172                     ALOGE("Video is malformed; nalLength %zu", nalLength);
   5173                     mBuffer->release();
   5174                     mBuffer = NULL;
   5175                     return ERROR_MALFORMED;
   5176                 }
   5177 
   5178                 if (nalLength == 0) {
   5179                     continue;
   5180                 }
   5181 
   5182                 if (dstOffset > SIZE_MAX - 4 ||
   5183                         dstOffset + 4 > SIZE_MAX - nalLength ||
   5184                         dstOffset + 4 + nalLength > mBuffer->size()) {
   5185                     ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
   5186                     android_errorWriteLog(0x534e4554, "26365349");
   5187                     mBuffer->release();
   5188                     mBuffer = NULL;
   5189                     return ERROR_MALFORMED;
   5190                 }
   5191 
   5192                 dstData[dstOffset++] = 0;
   5193                 dstData[dstOffset++] = 0;
   5194                 dstData[dstOffset++] = 0;
   5195                 dstData[dstOffset++] = 1;
   5196                 memcpy(&dstData[dstOffset], &mSrcBuffer[srcOffset], nalLength);
   5197                 srcOffset += nalLength;
   5198                 dstOffset += nalLength;
   5199             }
   5200             CHECK_EQ(srcOffset, size);
   5201             CHECK(mBuffer != NULL);
   5202             mBuffer->set_range(0, dstOffset);
   5203         }
   5204 
   5205         mBuffer->meta_data()->setInt64(
   5206                 kKeyTime, ((int64_t)cts * 1000000) / mTimescale);
   5207         mBuffer->meta_data()->setInt64(
   5208                 kKeyDuration, ((int64_t)smpl->duration * 1000000) / mTimescale);
   5209 
   5210         if (targetSampleTimeUs >= 0) {
   5211             mBuffer->meta_data()->setInt64(
   5212                     kKeyTargetTime, targetSampleTimeUs);
   5213         }
   5214 
   5215         if (isSyncSample) {
   5216             mBuffer->meta_data()->setInt32(kKeyIsSyncFrame, 1);
   5217         }
   5218 
   5219         ++mCurrentSampleIndex;
   5220 
   5221         *out = mBuffer;
   5222         mBuffer = NULL;
   5223 
   5224         return OK;
   5225     }
   5226 }
   5227 
   5228 MPEG4Extractor::Track *MPEG4Extractor::findTrackByMimePrefix(
   5229         const char *mimePrefix) {
   5230     for (Track *track = mFirstTrack; track != NULL; track = track->next) {
   5231         const char *mime;
   5232         if (track->meta != NULL
   5233                 && track->meta->findCString(kKeyMIMEType, &mime)
   5234                 && !strncasecmp(mime, mimePrefix, strlen(mimePrefix))) {
   5235             return track;
   5236         }
   5237     }
   5238 
   5239     return NULL;
   5240 }
   5241 
   5242 void MPEG4Extractor::populateMetrics() {
   5243     ALOGV("MPEG4Extractor::populateMetrics");
   5244     // write into mAnalyticsItem
   5245 }
   5246 
   5247 static bool LegacySniffMPEG4(
   5248         const sp<DataSource> &source, String8 *mimeType, float *confidence) {
   5249     uint8_t header[8];
   5250 
   5251     ssize_t n = source->readAt(4, header, sizeof(header));
   5252     if (n < (ssize_t)sizeof(header)) {
   5253         return false;
   5254     }
   5255 
   5256     if (!memcmp(header, "ftyp3gp", 7) || !memcmp(header, "ftypmp42", 8)
   5257         || !memcmp(header, "ftyp3gr6", 8) || !memcmp(header, "ftyp3gs6", 8)
   5258         || !memcmp(header, "ftyp3ge6", 8) || !memcmp(header, "ftyp3gg6", 8)
   5259         || !memcmp(header, "ftypisom", 8) || !memcmp(header, "ftypM4V ", 8)
   5260         || !memcmp(header, "ftypM4A ", 8) || !memcmp(header, "ftypf4v ", 8)
   5261         || !memcmp(header, "ftypkddi", 8) || !memcmp(header, "ftypM4VP", 8)
   5262         || !memcmp(header, "ftypmif1", 8) || !memcmp(header, "ftypheic", 8)) {
   5263         *mimeType = MEDIA_MIMETYPE_CONTAINER_MPEG4;
   5264         *confidence = 0.4;
   5265 
   5266         return true;
   5267     }
   5268 
   5269     return false;
   5270 }
   5271 
   5272 static bool isCompatibleBrand(uint32_t fourcc) {
   5273     static const uint32_t kCompatibleBrands[] = {
   5274         FOURCC('i', 's', 'o', 'm'),
   5275         FOURCC('i', 's', 'o', '2'),
   5276         FOURCC('a', 'v', 'c', '1'),
   5277         FOURCC('h', 'v', 'c', '1'),
   5278         FOURCC('h', 'e', 'v', '1'),
   5279         FOURCC('3', 'g', 'p', '4'),
   5280         FOURCC('m', 'p', '4', '1'),
   5281         FOURCC('m', 'p', '4', '2'),
   5282         FOURCC('d', 'a', 's', 'h'),
   5283 
   5284         // Won't promise that the following file types can be played.
   5285         // Just give these file types a chance.
   5286         FOURCC('q', 't', ' ', ' '),  // Apple's QuickTime
   5287         FOURCC('M', 'S', 'N', 'V'),  // Sony's PSP
   5288 
   5289         FOURCC('3', 'g', '2', 'a'),  // 3GPP2
   5290         FOURCC('3', 'g', '2', 'b'),
   5291         FOURCC('m', 'i', 'f', '1'),  // HEIF image
   5292         FOURCC('h', 'e', 'i', 'c'),  // HEIF image
   5293     };
   5294 
   5295     for (size_t i = 0;
   5296          i < sizeof(kCompatibleBrands) / sizeof(kCompatibleBrands[0]);
   5297          ++i) {
   5298         if (kCompatibleBrands[i] == fourcc) {
   5299             return true;
   5300         }
   5301     }
   5302 
   5303     return false;
   5304 }
   5305 
   5306 // Attempt to actually parse the 'ftyp' atom and determine if a suitable
   5307 // compatible brand is present.
   5308 // Also try to identify where this file's metadata ends
   5309 // (end of the 'moov' atom) and report it to the caller as part of
   5310 // the metadata.
   5311 static bool BetterSniffMPEG4(
   5312         const sp<DataSource> &source, String8 *mimeType, float *confidence,
   5313         sp<AMessage> *meta) {
   5314     // We scan up to 128 bytes to identify this file as an MP4.
   5315     static const off64_t kMaxScanOffset = 128ll;
   5316 
   5317     off64_t offset = 0ll;
   5318     bool foundGoodFileType = false;
   5319     off64_t moovAtomEndOffset = -1ll;
   5320     bool done = false;
   5321 
   5322     while (!done && offset < kMaxScanOffset) {
   5323         uint32_t hdr[2];
   5324         if (source->readAt(offset, hdr, 8) < 8) {
   5325             return false;
   5326         }
   5327 
   5328         uint64_t chunkSize = ntohl(hdr[0]);
   5329         uint32_t chunkType = ntohl(hdr[1]);
   5330         off64_t chunkDataOffset = offset + 8;
   5331 
   5332         if (chunkSize == 1) {
   5333             if (source->readAt(offset + 8, &chunkSize, 8) < 8) {
   5334                 return false;
   5335             }
   5336 
   5337             chunkSize = ntoh64(chunkSize);
   5338             chunkDataOffset += 8;
   5339 
   5340             if (chunkSize < 16) {
   5341                 // The smallest valid chunk is 16 bytes long in this case.
   5342                 return false;
   5343             }
   5344 
   5345         } else if (chunkSize < 8) {
   5346             // The smallest valid chunk is 8 bytes long.
   5347             return false;
   5348         }
   5349 
   5350         // (data_offset - offset) is either 8 or 16
   5351         off64_t chunkDataSize = chunkSize - (chunkDataOffset - offset);
   5352         if (chunkDataSize < 0) {
   5353             ALOGE("b/23540914");
   5354             return ERROR_MALFORMED;
   5355         }
   5356 
   5357         char chunkstring[5];
   5358         MakeFourCCString(chunkType, chunkstring);
   5359         ALOGV("saw chunk type %s, size %" PRIu64 " @ %lld", chunkstring, chunkSize, (long long)offset);
   5360         switch (chunkType) {
   5361             case FOURCC('f', 't', 'y', 'p'):
   5362             {
   5363                 if (chunkDataSize < 8) {
   5364                     return false;
   5365                 }
   5366 
   5367                 uint32_t numCompatibleBrands = (chunkDataSize - 8) / 4;
   5368                 for (size_t i = 0; i < numCompatibleBrands + 2; ++i) {
   5369                     if (i == 1) {
   5370                         // Skip this index, it refers to the minorVersion,
   5371                         // not a brand.
   5372                         continue;
   5373                     }
   5374 
   5375                     uint32_t brand;
   5376                     if (source->readAt(
   5377                                 chunkDataOffset + 4 * i, &brand, 4) < 4) {
   5378                         return false;
   5379                     }
   5380 
   5381                     brand = ntohl(brand);
   5382 
   5383                     if (isCompatibleBrand(brand)) {
   5384                         foundGoodFileType = true;
   5385                         break;
   5386                     }
   5387                 }
   5388 
   5389                 if (!foundGoodFileType) {
   5390                     return false;
   5391                 }
   5392 
   5393                 break;
   5394             }
   5395 
   5396             case FOURCC('m', 'o', 'o', 'v'):
   5397             {
   5398                 moovAtomEndOffset = offset + chunkSize;
   5399 
   5400                 done = true;
   5401                 break;
   5402             }
   5403 
   5404             default:
   5405                 break;
   5406         }
   5407 
   5408         offset += chunkSize;
   5409     }
   5410 
   5411     if (!foundGoodFileType) {
   5412         return false;
   5413     }
   5414 
   5415     *mimeType = MEDIA_MIMETYPE_CONTAINER_MPEG4;
   5416     *confidence = 0.4f;
   5417 
   5418     if (moovAtomEndOffset >= 0) {
   5419         *meta = new AMessage;
   5420         (*meta)->setInt64("meta-data-size", moovAtomEndOffset);
   5421 
   5422         ALOGV("found metadata size: %lld", (long long)moovAtomEndOffset);
   5423     }
   5424 
   5425     return true;
   5426 }
   5427 
   5428 bool SniffMPEG4(
   5429         const sp<DataSource> &source, String8 *mimeType, float *confidence,
   5430         sp<AMessage> *meta) {
   5431     if (BetterSniffMPEG4(source, mimeType, confidence, meta)) {
   5432         return true;
   5433     }
   5434 
   5435     if (LegacySniffMPEG4(source, mimeType, confidence)) {
   5436         ALOGW("Identified supported mpeg4 through LegacySniffMPEG4.");
   5437         return true;
   5438     }
   5439 
   5440     return false;
   5441 }
   5442 
   5443 }  // namespace android
   5444