1 /*
2  * Copyright (C) 2010 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 //#define LOG_NDEBUG 0
18 #define LOG_TAG "ESQueue"
19 #include <media/stagefright/foundation/ADebug.h>
20 
21 #include "ESQueue.h"
22 
23 #include <media/stagefright/foundation/hexdump.h>
24 #include <media/stagefright/foundation/ABitReader.h>
25 #include <media/stagefright/foundation/ABuffer.h>
26 #include <media/stagefright/foundation/AMessage.h>
27 #include <media/stagefright/foundation/ByteUtils.h>
28 #include <media/stagefright/foundation/avc_utils.h>
29 #include <media/stagefright/MediaErrors.h>
30 #include <media/stagefright/MediaDefs.h>
31 #include <media/stagefright/MetaData.h>
32 #include <media/stagefright/MetaDataUtils.h>
33 #include <media/cas/DescramblerAPI.h>
34 #include <media/hardware/CryptoAPI.h>
35 
36 #include <inttypes.h>
37 #include <netinet/in.h>
38 
39 namespace android {
40 
ElementaryStreamQueue(Mode mode,uint32_t flags)41 ElementaryStreamQueue::ElementaryStreamQueue(Mode mode, uint32_t flags)
42     : mMode(mode),
43       mFlags(flags),
44       mEOSReached(false),
45       mCASystemId(0),
46       mAUIndex(0) {
47 
48     ALOGV("ElementaryStreamQueue(%p) mode %x  flags %x  isScrambled %d  isSampleEncrypted %d",
49             this, mode, flags, isScrambled(), isSampleEncrypted());
50 
51     // Create the decryptor anyway since we don't know the use-case unless key is provided
52     // Won't decrypt if key info not available (e.g., scanner/extractor just parsing ts files)
53     mSampleDecryptor = isSampleEncrypted() ? new HlsSampleDecryptor : NULL;
54 }
55 
getFormat()56 sp<MetaData> ElementaryStreamQueue::getFormat() {
57     return mFormat;
58 }
59 
clear(bool clearFormat)60 void ElementaryStreamQueue::clear(bool clearFormat) {
61     if (mBuffer != NULL) {
62         mBuffer->setRange(0, 0);
63     }
64 
65     mRangeInfos.clear();
66 
67     if (mScrambledBuffer != NULL) {
68         mScrambledBuffer->setRange(0, 0);
69     }
70     mScrambledRangeInfos.clear();
71 
72     if (clearFormat) {
73         mFormat.clear();
74     }
75 
76     mEOSReached = false;
77 }
78 
isScrambled() const79 bool ElementaryStreamQueue::isScrambled() const {
80     return (mFlags & kFlag_ScrambledData) != 0;
81 }
82 
setCasInfo(int32_t systemId,const std::vector<uint8_t> & sessionId)83 void ElementaryStreamQueue::setCasInfo(
84         int32_t systemId, const std::vector<uint8_t> &sessionId) {
85     mCASystemId = systemId;
86     mCasSessionId = sessionId;
87 }
88 
89 // Parse AC3 header assuming the current ptr is start position of syncframe,
90 // update metadata only applicable, and return the payload size
parseAC3SyncFrame(const uint8_t * ptr,size_t size,sp<MetaData> * metaData)91 static unsigned parseAC3SyncFrame(
92         const uint8_t *ptr, size_t size, sp<MetaData> *metaData) {
93     static const unsigned channelCountTable[] = {2, 1, 2, 3, 3, 4, 4, 5};
94     static const unsigned samplingRateTable[] = {48000, 44100, 32000};
95 
96     static const unsigned frameSizeTable[19][3] = {
97         { 64, 69, 96 },
98         { 80, 87, 120 },
99         { 96, 104, 144 },
100         { 112, 121, 168 },
101         { 128, 139, 192 },
102         { 160, 174, 240 },
103         { 192, 208, 288 },
104         { 224, 243, 336 },
105         { 256, 278, 384 },
106         { 320, 348, 480 },
107         { 384, 417, 576 },
108         { 448, 487, 672 },
109         { 512, 557, 768 },
110         { 640, 696, 960 },
111         { 768, 835, 1152 },
112         { 896, 975, 1344 },
113         { 1024, 1114, 1536 },
114         { 1152, 1253, 1728 },
115         { 1280, 1393, 1920 },
116     };
117 
118     ABitReader bits(ptr, size);
119     if (bits.numBitsLeft() < 16) {
120         return 0;
121     }
122     if (bits.getBits(16) != 0x0B77) {
123         return 0;
124     }
125 
126     if (bits.numBitsLeft() < 16 + 2 + 6 + 5 + 3 + 3) {
127         ALOGV("Not enough bits left for further parsing");
128         return 0;
129     }
130     bits.skipBits(16);  // crc1
131 
132     unsigned fscod = bits.getBits(2);
133     if (fscod == 3) {
134         ALOGW("Incorrect fscod in AC3 header");
135         return 0;
136     }
137 
138     unsigned frmsizecod = bits.getBits(6);
139     if (frmsizecod > 37) {
140         ALOGW("Incorrect frmsizecod in AC3 header");
141         return 0;
142     }
143 
144     unsigned bsid = bits.getBits(5);
145     if (bsid > 8) {
146         ALOGW("Incorrect bsid in AC3 header. Possibly E-AC-3?");
147         return 0;
148     }
149 
150     unsigned bsmod __unused = bits.getBits(3);
151     unsigned acmod = bits.getBits(3);
152     unsigned cmixlev __unused = 0;
153     unsigned surmixlev __unused = 0;
154     unsigned dsurmod __unused = 0;
155 
156     if ((acmod & 1) > 0 && acmod != 1) {
157         if (bits.numBitsLeft() < 2) {
158             return 0;
159         }
160         cmixlev = bits.getBits(2);
161     }
162     if ((acmod & 4) > 0) {
163         if (bits.numBitsLeft() < 2) {
164             return 0;
165         }
166         surmixlev = bits.getBits(2);
167     }
168     if (acmod == 2) {
169         if (bits.numBitsLeft() < 2) {
170             return 0;
171         }
172         dsurmod = bits.getBits(2);
173     }
174 
175     if (bits.numBitsLeft() < 1) {
176         return 0;
177     }
178     unsigned lfeon = bits.getBits(1);
179 
180     unsigned samplingRate = samplingRateTable[fscod];
181     unsigned payloadSize = frameSizeTable[frmsizecod >> 1][fscod];
182     if (fscod == 1) {
183         payloadSize += frmsizecod & 1;
184     }
185     payloadSize <<= 1;  // convert from 16-bit words to bytes
186 
187     unsigned channelCount = channelCountTable[acmod] + lfeon;
188 
189     if (metaData != NULL) {
190         (*metaData)->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_AC3);
191         (*metaData)->setInt32(kKeyChannelCount, channelCount);
192         (*metaData)->setInt32(kKeySampleRate, samplingRate);
193     }
194 
195     return payloadSize;
196 }
197 
IsSeeminglyValidAC3Header(const uint8_t * ptr,size_t size)198 static bool IsSeeminglyValidAC3Header(const uint8_t *ptr, size_t size) {
199     return parseAC3SyncFrame(ptr, size, NULL) > 0;
200 }
201 
IsSeeminglyValidADTSHeader(const uint8_t * ptr,size_t size,size_t * frameLength)202 static bool IsSeeminglyValidADTSHeader(
203         const uint8_t *ptr, size_t size, size_t *frameLength) {
204     if (size < 7) {
205         // Not enough data to verify header.
206         return false;
207     }
208 
209     if (ptr[0] != 0xff || (ptr[1] >> 4) != 0x0f) {
210         return false;
211     }
212 
213     unsigned layer = (ptr[1] >> 1) & 3;
214 
215     if (layer != 0) {
216         return false;
217     }
218 
219     unsigned ID = (ptr[1] >> 3) & 1;
220     unsigned profile_ObjectType = ptr[2] >> 6;
221 
222     if (ID == 1 && profile_ObjectType == 3) {
223         // MPEG-2 profile 3 is reserved.
224         return false;
225     }
226 
227     size_t frameLengthInHeader =
228             ((ptr[3] & 3) << 11) + (ptr[4] << 3) + ((ptr[5] >> 5) & 7);
229     if (frameLengthInHeader > size) {
230         return false;
231     }
232 
233     *frameLength = frameLengthInHeader;
234     return true;
235 }
236 
IsSeeminglyValidMPEGAudioHeader(const uint8_t * ptr,size_t size)237 static bool IsSeeminglyValidMPEGAudioHeader(const uint8_t *ptr, size_t size) {
238     if (size < 3) {
239         // Not enough data to verify header.
240         return false;
241     }
242 
243     if (ptr[0] != 0xff || (ptr[1] >> 5) != 0x07) {
244         return false;
245     }
246 
247     unsigned ID = (ptr[1] >> 3) & 3;
248 
249     if (ID == 1) {
250         return false;  // reserved
251     }
252 
253     unsigned layer = (ptr[1] >> 1) & 3;
254 
255     if (layer == 0) {
256         return false;  // reserved
257     }
258 
259     unsigned bitrateIndex = (ptr[2] >> 4);
260 
261     if (bitrateIndex == 0x0f) {
262         return false;  // reserved
263     }
264 
265     unsigned samplingRateIndex = (ptr[2] >> 2) & 3;
266 
267     if (samplingRateIndex == 3) {
268         return false;  // reserved
269     }
270 
271     return true;
272 }
273 
appendData(const void * data,size_t size,int64_t timeUs,int32_t payloadOffset,uint32_t pesScramblingControl)274 status_t ElementaryStreamQueue::appendData(
275         const void *data, size_t size, int64_t timeUs,
276         int32_t payloadOffset, uint32_t pesScramblingControl) {
277 
278     if (mEOSReached) {
279         ALOGE("appending data after EOS");
280         return ERROR_MALFORMED;
281     }
282     if (mBuffer == NULL || mBuffer->size() == 0) {
283         switch (mMode) {
284             case H264:
285             case MPEG_VIDEO:
286             {
287 #if 0
288                 if (size < 4 || memcmp("\x00\x00\x00\x01", data, 4)) {
289                     return ERROR_MALFORMED;
290                 }
291 #else
292                 uint8_t *ptr = (uint8_t *)data;
293 
294                 ssize_t startOffset = -1;
295                 for (size_t i = 0; i + 2 < size; ++i) {
296                     if (!memcmp("\x00\x00\x01", &ptr[i], 3)) {
297                         startOffset = i;
298                         break;
299                     }
300                 }
301 
302                 if (startOffset < 0) {
303                     return ERROR_MALFORMED;
304                 }
305 
306                 if (mFormat == NULL && startOffset > 0) {
307                     ALOGI("found something resembling an H.264/MPEG syncword "
308                           "at offset %zd",
309                           startOffset);
310                 }
311 
312                 data = &ptr[startOffset];
313                 size -= startOffset;
314 #endif
315                 break;
316             }
317 
318             case MPEG4_VIDEO:
319             {
320 #if 0
321                 if (size < 3 || memcmp("\x00\x00\x01", data, 3)) {
322                     return ERROR_MALFORMED;
323                 }
324 #else
325                 uint8_t *ptr = (uint8_t *)data;
326 
327                 ssize_t startOffset = -1;
328                 for (size_t i = 0; i + 2 < size; ++i) {
329                     if (!memcmp("\x00\x00\x01", &ptr[i], 3)) {
330                         startOffset = i;
331                         break;
332                     }
333                 }
334 
335                 if (startOffset < 0) {
336                     return ERROR_MALFORMED;
337                 }
338 
339                 if (startOffset > 0) {
340                     ALOGI("found something resembling an H.264/MPEG syncword "
341                           "at offset %zd",
342                           startOffset);
343                 }
344 
345                 data = &ptr[startOffset];
346                 size -= startOffset;
347 #endif
348                 break;
349             }
350 
351             case AAC:
352             {
353                 uint8_t *ptr = (uint8_t *)data;
354 
355 #if 0
356                 if (size < 2 || ptr[0] != 0xff || (ptr[1] >> 4) != 0x0f) {
357                     return ERROR_MALFORMED;
358                 }
359 #else
360                 ssize_t startOffset = -1;
361                 size_t frameLength;
362                 for (size_t i = 0; i < size; ++i) {
363                     if (IsSeeminglyValidADTSHeader(
364                             &ptr[i], size - i, &frameLength)) {
365                         startOffset = i;
366                         break;
367                     }
368                 }
369 
370                 if (startOffset < 0) {
371                     return ERROR_MALFORMED;
372                 }
373 
374                 if (startOffset > 0) {
375                     ALOGI("found something resembling an AAC syncword at "
376                           "offset %zd",
377                           startOffset);
378                 }
379 
380                 if (frameLength != size - startOffset) {
381                     ALOGV("First ADTS AAC frame length is %zd bytes, "
382                           "while the buffer size is %zd bytes.",
383                           frameLength, size - startOffset);
384                 }
385 
386                 data = &ptr[startOffset];
387                 size -= startOffset;
388 #endif
389                 break;
390             }
391 
392             case AC3:
393             {
394                 uint8_t *ptr = (uint8_t *)data;
395 
396                 ssize_t startOffset = -1;
397                 for (size_t i = 0; i < size; ++i) {
398                     if (IsSeeminglyValidAC3Header(&ptr[i], size - i)) {
399                         startOffset = i;
400                         break;
401                     }
402                 }
403 
404                 if (startOffset < 0) {
405                     return ERROR_MALFORMED;
406                 }
407 
408                 if (startOffset > 0) {
409                     ALOGI("found something resembling an AC3 syncword at "
410                           "offset %zd",
411                           startOffset);
412                 }
413 
414                 data = &ptr[startOffset];
415                 size -= startOffset;
416                 break;
417             }
418 
419             case MPEG_AUDIO:
420             {
421                 uint8_t *ptr = (uint8_t *)data;
422 
423                 ssize_t startOffset = -1;
424                 for (size_t i = 0; i < size; ++i) {
425                     if (IsSeeminglyValidMPEGAudioHeader(&ptr[i], size - i)) {
426                         startOffset = i;
427                         break;
428                     }
429                 }
430 
431                 if (startOffset < 0) {
432                     return ERROR_MALFORMED;
433                 }
434 
435                 if (startOffset > 0) {
436                     ALOGI("found something resembling an MPEG audio "
437                           "syncword at offset %zd",
438                           startOffset);
439                 }
440 
441                 data = &ptr[startOffset];
442                 size -= startOffset;
443                 break;
444             }
445 
446             case PCM_AUDIO:
447             case METADATA:
448             {
449                 break;
450             }
451 
452             default:
453                 ALOGE("Unknown mode: %d", mMode);
454                 return ERROR_MALFORMED;
455         }
456     }
457 
458     size_t neededSize = (mBuffer == NULL ? 0 : mBuffer->size()) + size;
459     if (mBuffer == NULL || neededSize > mBuffer->capacity()) {
460         neededSize = (neededSize + 65535) & ~65535;
461 
462         ALOGV("resizing buffer to size %zu", neededSize);
463 
464         sp<ABuffer> buffer = new ABuffer(neededSize);
465         if (mBuffer != NULL) {
466             memcpy(buffer->data(), mBuffer->data(), mBuffer->size());
467             buffer->setRange(0, mBuffer->size());
468         } else {
469             buffer->setRange(0, 0);
470         }
471 
472         mBuffer = buffer;
473     }
474 
475     memcpy(mBuffer->data() + mBuffer->size(), data, size);
476     mBuffer->setRange(0, mBuffer->size() + size);
477 
478     RangeInfo info;
479     info.mLength = size;
480     info.mTimestampUs = timeUs;
481     info.mPesOffset = payloadOffset;
482     info.mPesScramblingControl = pesScramblingControl;
483     mRangeInfos.push_back(info);
484 
485 #if 0
486     if (mMode == AAC) {
487         ALOGI("size = %zu, timeUs = %.2f secs", size, timeUs / 1E6);
488         hexdump(data, size);
489     }
490 #endif
491 
492     return OK;
493 }
494 
appendScrambledData(const void * data,size_t size,int32_t keyId,bool isSync,sp<ABuffer> clearSizes,sp<ABuffer> encSizes)495 void ElementaryStreamQueue::appendScrambledData(
496         const void *data, size_t size,
497         int32_t keyId, bool isSync,
498         sp<ABuffer> clearSizes, sp<ABuffer> encSizes) {
499     if (!isScrambled()) {
500         return;
501     }
502 
503     size_t neededSize = (mScrambledBuffer == NULL ? 0 : mScrambledBuffer->size()) + size;
504     if (mScrambledBuffer == NULL || neededSize > mScrambledBuffer->capacity()) {
505         neededSize = (neededSize + 65535) & ~65535;
506 
507         ALOGI("resizing scrambled buffer to size %zu", neededSize);
508 
509         sp<ABuffer> buffer = new ABuffer(neededSize);
510         if (mScrambledBuffer != NULL) {
511             memcpy(buffer->data(), mScrambledBuffer->data(), mScrambledBuffer->size());
512             buffer->setRange(0, mScrambledBuffer->size());
513         } else {
514             buffer->setRange(0, 0);
515         }
516 
517         mScrambledBuffer = buffer;
518     }
519     memcpy(mScrambledBuffer->data() + mScrambledBuffer->size(), data, size);
520     mScrambledBuffer->setRange(0, mScrambledBuffer->size() + size);
521 
522     ScrambledRangeInfo scrambledInfo;
523     scrambledInfo.mLength = size;
524     scrambledInfo.mKeyId = keyId;
525     scrambledInfo.mIsSync = isSync;
526     scrambledInfo.mClearSizes = clearSizes;
527     scrambledInfo.mEncSizes = encSizes;
528 
529     ALOGV("[stream %d] appending scrambled range: size=%zu", mMode, size);
530 
531     mScrambledRangeInfos.push_back(scrambledInfo);
532 }
533 
dequeueScrambledAccessUnit()534 sp<ABuffer> ElementaryStreamQueue::dequeueScrambledAccessUnit() {
535     size_t nextScan = mBuffer->size();
536     mBuffer->setRange(0, 0);
537     int32_t pesOffset = 0, pesScramblingControl = 0;
538     int64_t timeUs = fetchTimestamp(nextScan, &pesOffset, &pesScramblingControl);
539     if (timeUs < 0ll) {
540         ALOGE("Negative timeUs");
541         return NULL;
542     }
543 
544     // return scrambled unit
545     int32_t keyId = pesScramblingControl, isSync = 0, scrambledLength = 0;
546     sp<ABuffer> clearSizes, encSizes;
547     while (mScrambledRangeInfos.size() > mRangeInfos.size()) {
548         auto it = mScrambledRangeInfos.begin();
549         ALOGV("[stream %d] fetching scrambled range: size=%zu", mMode, it->mLength);
550 
551         if (scrambledLength > 0) {
552             // This shouldn't happen since we always dequeue the entire PES.
553             ALOGW("Discarding srambled length %d", scrambledLength);
554         }
555         scrambledLength = it->mLength;
556 
557         // TODO: handle key id change, use first non-zero keyId for now
558         if (keyId == 0) {
559             keyId = it->mKeyId;
560         }
561         clearSizes = it->mClearSizes;
562         encSizes = it->mEncSizes;
563         isSync = it->mIsSync;
564         mScrambledRangeInfos.erase(it);
565     }
566     if (scrambledLength == 0) {
567         ALOGE("[stream %d] empty scrambled unit!", mMode);
568         return NULL;
569     }
570 
571     // skip the PES header, and copy the rest into scrambled access unit
572     sp<ABuffer> scrambledAccessUnit = ABuffer::CreateAsCopy(
573             mScrambledBuffer->data() + pesOffset,
574             scrambledLength - pesOffset);
575 
576     // fix up first sample size after skipping the PES header
577     if (pesOffset > 0) {
578         int32_t &firstClearSize = *(int32_t*)clearSizes->data();
579         int32_t &firstEncSize = *(int32_t*)encSizes->data();
580         // Cut away the PES header
581         if (firstClearSize >= pesOffset) {
582             // This is for TS-level scrambling, we descrambled the first
583             // (or it was clear to begin with)
584             firstClearSize -= pesOffset;
585         } else if (firstEncSize >= pesOffset) {
586             // This can only be PES-level scrambling
587             firstEncSize -= pesOffset;
588         }
589     }
590 
591     scrambledAccessUnit->meta()->setInt64("timeUs", timeUs);
592     if (isSync) {
593         scrambledAccessUnit->meta()->setInt32("isSync", 1);
594     }
595 
596     // fill in CryptoInfo fields for AnotherPacketSource::read()
597     // MediaCas doesn't use cryptoMode, but set to non-zero value here.
598     scrambledAccessUnit->meta()->setInt32(
599             "cryptoMode", CryptoPlugin::kMode_AES_CTR);
600     scrambledAccessUnit->meta()->setInt32("cryptoKey", keyId);
601     scrambledAccessUnit->meta()->setBuffer("clearBytes", clearSizes);
602     scrambledAccessUnit->meta()->setBuffer("encBytes", encSizes);
603 
604     memmove(mScrambledBuffer->data(),
605             mScrambledBuffer->data() + scrambledLength,
606             mScrambledBuffer->size() - scrambledLength);
607 
608     mScrambledBuffer->setRange(0, mScrambledBuffer->size() - scrambledLength);
609 
610     ALOGV("[stream %d] dequeued scrambled AU: timeUs=%lld, size=%zu",
611             mMode, (long long)timeUs, scrambledAccessUnit->size());
612 
613     return scrambledAccessUnit;
614 }
615 
dequeueAccessUnit()616 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnit() {
617     if ((mFlags & kFlag_AlignedData) && mMode == H264 && !isScrambled()) {
618         if (mRangeInfos.empty()) {
619             return NULL;
620         }
621 
622         RangeInfo info = *mRangeInfos.begin();
623         mRangeInfos.erase(mRangeInfos.begin());
624 
625         sp<ABuffer> accessUnit = new ABuffer(info.mLength);
626         memcpy(accessUnit->data(), mBuffer->data(), info.mLength);
627         accessUnit->meta()->setInt64("timeUs", info.mTimestampUs);
628 
629         memmove(mBuffer->data(),
630                 mBuffer->data() + info.mLength,
631                 mBuffer->size() - info.mLength);
632 
633         mBuffer->setRange(0, mBuffer->size() - info.mLength);
634 
635         if (mFormat == NULL) {
636             mFormat = new MetaData;
637             if (!MakeAVCCodecSpecificData(*mFormat, accessUnit->data(), accessUnit->size())) {
638                 mFormat.clear();
639             }
640         }
641 
642         return accessUnit;
643     }
644 
645     switch (mMode) {
646         case H264:
647             return dequeueAccessUnitH264();
648         case AAC:
649             return dequeueAccessUnitAAC();
650         case AC3:
651             return dequeueAccessUnitAC3();
652         case MPEG_VIDEO:
653             return dequeueAccessUnitMPEGVideo();
654         case MPEG4_VIDEO:
655             return dequeueAccessUnitMPEG4Video();
656         case PCM_AUDIO:
657             return dequeueAccessUnitPCMAudio();
658         case METADATA:
659             return dequeueAccessUnitMetadata();
660         default:
661             if (mMode != MPEG_AUDIO) {
662                 ALOGE("Unknown mode");
663                 return NULL;
664             }
665             return dequeueAccessUnitMPEGAudio();
666     }
667 }
668 
dequeueAccessUnitAC3()669 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitAC3() {
670     unsigned syncStartPos = 0;  // in bytes
671     unsigned payloadSize = 0;
672     sp<MetaData> format = new MetaData;
673 
674     ALOGV("dequeueAccessUnit_AC3[%d]: mBuffer %p(%zu)", mAUIndex, mBuffer->data(), mBuffer->size());
675 
676     while (true) {
677         if (syncStartPos + 2 >= mBuffer->size()) {
678             return NULL;
679         }
680 
681         payloadSize = parseAC3SyncFrame(
682                 mBuffer->data() + syncStartPos,
683                 mBuffer->size() - syncStartPos,
684                 &format);
685         if (payloadSize > 0) {
686             break;
687         }
688 
689         ALOGV("dequeueAccessUnit_AC3[%d]: syncStartPos %u payloadSize %u",
690                 mAUIndex, syncStartPos, payloadSize);
691 
692         ++syncStartPos;
693     }
694 
695     if (mBuffer->size() < syncStartPos + payloadSize) {
696         ALOGV("Not enough buffer size for AC3");
697         return NULL;
698     }
699 
700     if (mFormat == NULL) {
701         mFormat = format;
702     }
703 
704 
705     int64_t timeUs = fetchTimestamp(syncStartPos + payloadSize);
706     if (timeUs < 0ll) {
707         ALOGE("negative timeUs");
708         return NULL;
709     }
710 
711     // Not decrypting if key info not available (e.g., scanner/extractor parsing ts files)
712     if (mSampleDecryptor != NULL) {
713         mSampleDecryptor->processAC3(mBuffer->data() + syncStartPos, payloadSize);
714     }
715     mAUIndex++;
716 
717     sp<ABuffer> accessUnit = new ABuffer(syncStartPos + payloadSize);
718     memcpy(accessUnit->data(), mBuffer->data(), syncStartPos + payloadSize);
719 
720     accessUnit->meta()->setInt64("timeUs", timeUs);
721     accessUnit->meta()->setInt32("isSync", 1);
722 
723     memmove(
724             mBuffer->data(),
725             mBuffer->data() + syncStartPos + payloadSize,
726             mBuffer->size() - syncStartPos - payloadSize);
727 
728     mBuffer->setRange(0, mBuffer->size() - syncStartPos - payloadSize);
729 
730     return accessUnit;
731 }
732 
dequeueAccessUnitPCMAudio()733 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitPCMAudio() {
734     if (mBuffer->size() < 4) {
735         return NULL;
736     }
737 
738     ABitReader bits(mBuffer->data(), 4);
739     if (bits.getBits(8) != 0xa0) {
740         ALOGE("Unexpected bit values");
741         return NULL;
742     }
743     unsigned numAUs = bits.getBits(8);
744     bits.skipBits(8);
745     unsigned quantization_word_length __unused = bits.getBits(2);
746     unsigned audio_sampling_frequency = bits.getBits(3);
747     unsigned num_channels = bits.getBits(3);
748 
749     if (audio_sampling_frequency != 2) {
750         ALOGE("Wrong sampling freq");
751         return NULL;
752     }
753     if (num_channels != 1u) {
754         ALOGE("Wrong channel #");
755         return NULL;
756     }
757 
758     if (mFormat == NULL) {
759         mFormat = new MetaData;
760         mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_RAW);
761         mFormat->setInt32(kKeyChannelCount, 2);
762         mFormat->setInt32(kKeySampleRate, 48000);
763         mFormat->setInt32(kKeyPcmEncoding, kAudioEncodingPcm16bit);
764     }
765 
766     static const size_t kFramesPerAU = 80;
767     size_t frameSize = 2 /* numChannels */ * sizeof(int16_t);
768 
769     size_t payloadSize = numAUs * frameSize * kFramesPerAU;
770 
771     if (mBuffer->size() < 4 + payloadSize) {
772         return NULL;
773     }
774 
775     sp<ABuffer> accessUnit = new ABuffer(payloadSize);
776     memcpy(accessUnit->data(), mBuffer->data() + 4, payloadSize);
777 
778     int64_t timeUs = fetchTimestamp(payloadSize + 4);
779     if (timeUs < 0ll) {
780         ALOGE("Negative timeUs");
781         return NULL;
782     }
783     accessUnit->meta()->setInt64("timeUs", timeUs);
784     accessUnit->meta()->setInt32("isSync", 1);
785 
786     int16_t *ptr = (int16_t *)accessUnit->data();
787     for (size_t i = 0; i < payloadSize / sizeof(int16_t); ++i) {
788         ptr[i] = ntohs(ptr[i]);
789     }
790 
791     memmove(
792             mBuffer->data(),
793             mBuffer->data() + 4 + payloadSize,
794             mBuffer->size() - 4 - payloadSize);
795 
796     mBuffer->setRange(0, mBuffer->size() - 4 - payloadSize);
797 
798     return accessUnit;
799 }
800 
dequeueAccessUnitAAC()801 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitAAC() {
802     if (mBuffer->size() == 0) {
803         return NULL;
804     }
805 
806     if (mRangeInfos.empty()) {
807         return NULL;
808     }
809 
810     const RangeInfo &info = *mRangeInfos.begin();
811     if (mBuffer->size() < info.mLength) {
812         return NULL;
813     }
814 
815     if (info.mTimestampUs < 0ll) {
816         ALOGE("Negative info.mTimestampUs");
817         return NULL;
818     }
819 
820     ALOGV("dequeueAccessUnit_AAC[%d]: mBuffer %zu info.mLength %zu",
821             mAUIndex, mBuffer->size(), info.mLength);
822 
823     struct ADTSPosition {
824         size_t offset;
825         size_t headerSize;
826         size_t length;
827     };
828 
829     Vector<ADTSPosition> frames;
830 
831     // The idea here is consume all AAC frames starting at offsets before
832     // info.mLength so we can assign a meaningful timestamp without
833     // having to interpolate.
834     // The final AAC frame may well extend into the next RangeInfo but
835     // that's ok.
836     size_t offset = 0;
837     while (offset < info.mLength) {
838         if (offset + 7 > mBuffer->size()) {
839             return NULL;
840         }
841 
842         ABitReader bits(mBuffer->data() + offset, mBuffer->size() - offset);
843 
844         // adts_fixed_header
845 
846         if (bits.getBits(12) != 0xfffu) {
847             ALOGE("Wrong atds_fixed_header");
848             return NULL;
849         }
850         bits.skipBits(3);  // ID, layer
851         bool protection_absent = bits.getBits(1) != 0;
852 
853         if (mFormat == NULL) {
854             unsigned profile = bits.getBits(2);
855             if (profile == 3u) {
856                 ALOGE("profile should not be 3");
857                 return NULL;
858             }
859             unsigned sampling_freq_index = bits.getBits(4);
860             bits.getBits(1);  // private_bit
861             unsigned channel_configuration = bits.getBits(3);
862             if (channel_configuration == 0u) {
863                 ALOGE("channel_config should not be 0");
864                 return NULL;
865             }
866             bits.skipBits(2);  // original_copy, home
867 
868             mFormat = new MetaData;
869             MakeAACCodecSpecificData(*mFormat,
870                     profile, sampling_freq_index, channel_configuration);
871 
872             mFormat->setInt32(kKeyIsADTS, true);
873 
874             int32_t sampleRate;
875             int32_t numChannels;
876             if (!mFormat->findInt32(kKeySampleRate, &sampleRate)) {
877                 ALOGE("SampleRate not found");
878                 return NULL;
879             }
880             if (!mFormat->findInt32(kKeyChannelCount, &numChannels)) {
881                 ALOGE("ChannelCount not found");
882                 return NULL;
883             }
884 
885             ALOGI("found AAC codec config (%d Hz, %d channels)",
886                  sampleRate, numChannels);
887         } else {
888             // profile_ObjectType, sampling_frequency_index, private_bits,
889             // channel_configuration, original_copy, home
890             bits.skipBits(12);
891         }
892 
893         // adts_variable_header
894 
895         // copyright_identification_bit, copyright_identification_start
896         bits.skipBits(2);
897 
898         unsigned aac_frame_length = bits.getBits(13);
899         if (aac_frame_length == 0){
900             ALOGE("b/62673179, Invalid AAC frame length!");
901             android_errorWriteLog(0x534e4554, "62673179");
902             return NULL;
903         }
904 
905         bits.skipBits(11);  // adts_buffer_fullness
906 
907         unsigned number_of_raw_data_blocks_in_frame = bits.getBits(2);
908 
909         if (number_of_raw_data_blocks_in_frame != 0) {
910             // To be implemented.
911             ALOGE("Should not reach here.");
912             return NULL;
913         }
914 
915         if (offset + aac_frame_length > mBuffer->size()) {
916             return NULL;
917         }
918 
919         size_t headerSize = protection_absent ? 7 : 9;
920 
921         // tracking the frame positions first then decrypt only if an accessUnit to be generated
922         if (mSampleDecryptor != NULL) {
923             ADTSPosition frame = {
924                 .offset     = offset,
925                 .headerSize = headerSize,
926                 .length     = aac_frame_length
927             };
928 
929             frames.push(frame);
930         }
931 
932         offset += aac_frame_length;
933     }
934 
935     // Decrypting only if the loop didn't exit early and an accessUnit is about to be generated
936     // Not decrypting if key info not available (e.g., scanner/extractor parsing ts files)
937     if (mSampleDecryptor != NULL) {
938         for (size_t frameId = 0; frameId < frames.size(); frameId++) {
939             const ADTSPosition &frame = frames.itemAt(frameId);
940 
941             mSampleDecryptor->processAAC(frame.headerSize,
942                     mBuffer->data() + frame.offset, frame.length);
943 //            ALOGV("dequeueAccessUnitAAC[%zu]: while offset %zu headerSize %zu frame_len %zu",
944 //                    frameId, frame.offset, frame.headerSize, frame.length);
945         }
946     }
947     mAUIndex++;
948 
949     int64_t timeUs = fetchTimestamp(offset);
950 
951     sp<ABuffer> accessUnit = new ABuffer(offset);
952     memcpy(accessUnit->data(), mBuffer->data(), offset);
953 
954     memmove(mBuffer->data(), mBuffer->data() + offset,
955             mBuffer->size() - offset);
956     mBuffer->setRange(0, mBuffer->size() - offset);
957 
958     accessUnit->meta()->setInt64("timeUs", timeUs);
959     accessUnit->meta()->setInt32("isSync", 1);
960 
961     return accessUnit;
962 }
963 
fetchTimestamp(size_t size,int32_t * pesOffset,int32_t * pesScramblingControl)964 int64_t ElementaryStreamQueue::fetchTimestamp(
965         size_t size, int32_t *pesOffset, int32_t *pesScramblingControl) {
966     int64_t timeUs = -1;
967     bool first = true;
968 
969     while (size > 0) {
970         if (mRangeInfos.empty()) {
971             return timeUs;
972         }
973 
974         RangeInfo *info = &*mRangeInfos.begin();
975 
976         if (first) {
977             timeUs = info->mTimestampUs;
978             if (pesOffset != NULL) {
979                 *pesOffset = info->mPesOffset;
980             }
981             if (pesScramblingControl != NULL) {
982                 *pesScramblingControl = info->mPesScramblingControl;
983             }
984             first = false;
985         }
986 
987         if (info->mLength > size) {
988             info->mLength -= size;
989             size = 0;
990         } else {
991             size -= info->mLength;
992 
993             mRangeInfos.erase(mRangeInfos.begin());
994             info = NULL;
995         }
996 
997     }
998 
999     if (timeUs == 0ll) {
1000         ALOGV("Returning 0 timestamp");
1001     }
1002 
1003     return timeUs;
1004 }
1005 
dequeueAccessUnitH264()1006 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitH264() {
1007     if (isScrambled()) {
1008         if (mBuffer == NULL || mBuffer->size() == 0) {
1009             return NULL;
1010         }
1011         if (mFormat == NULL) {
1012             mFormat = new MetaData;
1013             if (!MakeAVCCodecSpecificData(*mFormat, mBuffer->data(), mBuffer->size())) {
1014                 ALOGW("Creating dummy AVC format for scrambled content");
1015                 mFormat = new MetaData;
1016                 mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_AVC);
1017                 mFormat->setInt32(kKeyWidth, 1280);
1018                 mFormat->setInt32(kKeyHeight, 720);
1019             }
1020             // for MediaExtractor.CasInfo
1021             mFormat->setInt32(kKeyCASystemID, mCASystemId);
1022             mFormat->setData(kKeyCASessionID, 0,
1023                     mCasSessionId.data(), mCasSessionId.size());
1024         }
1025         return dequeueScrambledAccessUnit();
1026     }
1027 
1028     const uint8_t *data = mBuffer->data();
1029 
1030     size_t size = mBuffer->size();
1031     Vector<NALPosition> nals;
1032 
1033     size_t totalSize = 0;
1034     size_t seiCount = 0;
1035 
1036     status_t err;
1037     const uint8_t *nalStart;
1038     size_t nalSize;
1039     bool foundSlice = false;
1040     bool foundIDR = false;
1041 
1042     ALOGV("dequeueAccessUnit_H264[%d] %p/%zu", mAUIndex, data, size);
1043 
1044     while ((err = getNextNALUnit(&data, &size, &nalStart, &nalSize)) == OK) {
1045         if (nalSize == 0) continue;
1046 
1047         unsigned nalType = nalStart[0] & 0x1f;
1048         bool flush = false;
1049 
1050         if (nalType == 1 || nalType == 5) {
1051             if (nalType == 5) {
1052                 foundIDR = true;
1053             }
1054             if (foundSlice) {
1055                 //TODO: Shouldn't this have been called with nalSize-1?
1056                 ABitReader br(nalStart + 1, nalSize);
1057                 unsigned first_mb_in_slice = parseUE(&br);
1058 
1059                 if (first_mb_in_slice == 0) {
1060                     // This slice starts a new frame.
1061 
1062                     flush = true;
1063                 }
1064             }
1065 
1066             foundSlice = true;
1067         } else if ((nalType == 9 || nalType == 7) && foundSlice) {
1068             // Access unit delimiter and SPS will be associated with the
1069             // next frame.
1070 
1071             flush = true;
1072         } else if (nalType == 6 && nalSize > 0) {
1073             // found non-zero sized SEI
1074             ++seiCount;
1075         }
1076 
1077         if (flush) {
1078             // The access unit will contain all nal units up to, but excluding
1079             // the current one, separated by 0x00 0x00 0x00 0x01 startcodes.
1080 
1081             size_t auSize = 4 * nals.size() + totalSize;
1082             sp<ABuffer> accessUnit = new ABuffer(auSize);
1083             sp<ABuffer> sei;
1084 
1085             if (seiCount > 0) {
1086                 sei = new ABuffer(seiCount * sizeof(NALPosition));
1087                 accessUnit->meta()->setBuffer("sei", sei);
1088             }
1089 
1090 #if !LOG_NDEBUG
1091             AString out;
1092 #endif
1093 
1094             size_t dstOffset = 0;
1095             size_t seiIndex = 0;
1096             size_t shrunkBytes = 0;
1097             for (size_t i = 0; i < nals.size(); ++i) {
1098                 const NALPosition &pos = nals.itemAt(i);
1099 
1100                 unsigned nalType = mBuffer->data()[pos.nalOffset] & 0x1f;
1101 
1102                 if (nalType == 6 && pos.nalSize > 0) {
1103                     if (seiIndex >= sei->size() / sizeof(NALPosition)) {
1104                         ALOGE("Wrong seiIndex");
1105                         return NULL;
1106                     }
1107                     NALPosition &seiPos = ((NALPosition *)sei->data())[seiIndex++];
1108                     seiPos.nalOffset = dstOffset + 4;
1109                     seiPos.nalSize = pos.nalSize;
1110                 }
1111 
1112 #if !LOG_NDEBUG
1113                 char tmp[128];
1114                 sprintf(tmp, "0x%02x", nalType);
1115                 if (i > 0) {
1116                     out.append(", ");
1117                 }
1118                 out.append(tmp);
1119 #endif
1120 
1121                 memcpy(accessUnit->data() + dstOffset, "\x00\x00\x00\x01", 4);
1122 
1123                 if (mSampleDecryptor != NULL && (nalType == 1 || nalType == 5)) {
1124                     uint8_t *nalData = mBuffer->data() + pos.nalOffset;
1125                     size_t newSize = mSampleDecryptor->processNal(nalData, pos.nalSize);
1126                     // Note: the data can shrink due to unescaping
1127                     memcpy(accessUnit->data() + dstOffset + 4,
1128                             nalData,
1129                             newSize);
1130                     dstOffset += newSize + 4;
1131 
1132                     size_t thisShrunkBytes = pos.nalSize - newSize;
1133                     //ALOGV("dequeueAccessUnitH264[%d]: nalType: %d -> %zu (%zu)",
1134                     //        nalType, (int)pos.nalSize, newSize, thisShrunkBytes);
1135 
1136                     shrunkBytes += thisShrunkBytes;
1137                 }
1138                 else {
1139                     memcpy(accessUnit->data() + dstOffset + 4,
1140                             mBuffer->data() + pos.nalOffset,
1141                             pos.nalSize);
1142 
1143                     dstOffset += pos.nalSize + 4;
1144                     //ALOGV("dequeueAccessUnitH264 [%d] %d @%d",
1145                     //        nalType, (int)pos.nalSize, (int)pos.nalOffset);
1146                 }
1147             }
1148 
1149 #if !LOG_NDEBUG
1150             ALOGV("accessUnit contains nal types %s", out.c_str());
1151 #endif
1152 
1153             const NALPosition &pos = nals.itemAt(nals.size() - 1);
1154             size_t nextScan = pos.nalOffset + pos.nalSize;
1155 
1156             memmove(mBuffer->data(),
1157                     mBuffer->data() + nextScan,
1158                     mBuffer->size() - nextScan);
1159 
1160             mBuffer->setRange(0, mBuffer->size() - nextScan);
1161 
1162             int64_t timeUs = fetchTimestamp(nextScan);
1163             if (timeUs < 0ll) {
1164                 ALOGE("Negative timeUs");
1165                 return NULL;
1166             }
1167 
1168             accessUnit->meta()->setInt64("timeUs", timeUs);
1169             if (foundIDR) {
1170                 accessUnit->meta()->setInt32("isSync", 1);
1171             }
1172 
1173             if (mFormat == NULL) {
1174                 mFormat = new MetaData;
1175                 if (!MakeAVCCodecSpecificData(*mFormat,
1176                         accessUnit->data(),
1177                         accessUnit->size())) {
1178                     mFormat.clear();
1179                 }
1180             }
1181 
1182             if (mSampleDecryptor != NULL && shrunkBytes > 0) {
1183                 size_t adjustedSize = accessUnit->size() - shrunkBytes;
1184                 ALOGV("dequeueAccessUnitH264[%d]: AU size adjusted %zu -> %zu",
1185                         mAUIndex, accessUnit->size(), adjustedSize);
1186                 accessUnit->setRange(0, adjustedSize);
1187             }
1188 
1189             ALOGV("dequeueAccessUnitH264[%d]: AU %p(%zu) dstOffset:%zu, nals:%zu, totalSize:%zu ",
1190                     mAUIndex, accessUnit->data(), accessUnit->size(),
1191                     dstOffset, nals.size(), totalSize);
1192             mAUIndex++;
1193 
1194             return accessUnit;
1195         }
1196 
1197         NALPosition pos;
1198         pos.nalOffset = nalStart - mBuffer->data();
1199         pos.nalSize = nalSize;
1200 
1201         nals.push(pos);
1202 
1203         totalSize += nalSize;
1204     }
1205     if (err != (status_t)-EAGAIN) {
1206         ALOGE("Unexpeted err");
1207         return NULL;
1208     }
1209 
1210     return NULL;
1211 }
1212 
dequeueAccessUnitMPEGAudio()1213 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEGAudio() {
1214     const uint8_t *data = mBuffer->data();
1215     size_t size = mBuffer->size();
1216 
1217     if (size < 4) {
1218         return NULL;
1219     }
1220 
1221     uint32_t header = U32_AT(data);
1222 
1223     size_t frameSize;
1224     int samplingRate, numChannels, bitrate, numSamples;
1225     if (!GetMPEGAudioFrameSize(
1226                 header, &frameSize, &samplingRate, &numChannels,
1227                 &bitrate, &numSamples)) {
1228         ALOGE("Failed to get audio frame size");
1229         return NULL;
1230     }
1231 
1232     if (size < frameSize) {
1233         return NULL;
1234     }
1235 
1236     unsigned layer = 4 - ((header >> 17) & 3);
1237 
1238     sp<ABuffer> accessUnit = new ABuffer(frameSize);
1239     memcpy(accessUnit->data(), data, frameSize);
1240 
1241     memmove(mBuffer->data(),
1242             mBuffer->data() + frameSize,
1243             mBuffer->size() - frameSize);
1244 
1245     mBuffer->setRange(0, mBuffer->size() - frameSize);
1246 
1247     int64_t timeUs = fetchTimestamp(frameSize);
1248     if (timeUs < 0ll) {
1249         ALOGE("Negative timeUs");
1250         return NULL;
1251     }
1252 
1253     accessUnit->meta()->setInt64("timeUs", timeUs);
1254     accessUnit->meta()->setInt32("isSync", 1);
1255 
1256     if (mFormat == NULL) {
1257         mFormat = new MetaData;
1258 
1259         switch (layer) {
1260             case 1:
1261                 mFormat->setCString(
1262                         kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG_LAYER_I);
1263                 break;
1264             case 2:
1265                 mFormat->setCString(
1266                         kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG_LAYER_II);
1267                 break;
1268             case 3:
1269                 mFormat->setCString(
1270                         kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG);
1271                 break;
1272             default:
1273                 return NULL;
1274         }
1275 
1276         mFormat->setInt32(kKeySampleRate, samplingRate);
1277         mFormat->setInt32(kKeyChannelCount, numChannels);
1278     }
1279 
1280     return accessUnit;
1281 }
1282 
EncodeSize14(uint8_t ** _ptr,size_t size)1283 static void EncodeSize14(uint8_t **_ptr, size_t size) {
1284     if (size > 0x3fff) {
1285         ALOGE("Wrong size");
1286         return;
1287     }
1288 
1289     uint8_t *ptr = *_ptr;
1290 
1291     *ptr++ = 0x80 | (size >> 7);
1292     *ptr++ = size & 0x7f;
1293 
1294     *_ptr = ptr;
1295 }
1296 
MakeMPEGVideoESDS(const sp<ABuffer> & csd)1297 static sp<ABuffer> MakeMPEGVideoESDS(const sp<ABuffer> &csd) {
1298     sp<ABuffer> esds = new ABuffer(csd->size() + 25);
1299 
1300     uint8_t *ptr = esds->data();
1301     *ptr++ = 0x03;
1302     EncodeSize14(&ptr, 22 + csd->size());
1303 
1304     *ptr++ = 0x00;  // ES_ID
1305     *ptr++ = 0x00;
1306 
1307     *ptr++ = 0x00;  // streamDependenceFlag, URL_Flag, OCRstreamFlag
1308 
1309     *ptr++ = 0x04;
1310     EncodeSize14(&ptr, 16 + csd->size());
1311 
1312     *ptr++ = 0x40;  // Audio ISO/IEC 14496-3
1313 
1314     for (size_t i = 0; i < 12; ++i) {
1315         *ptr++ = 0x00;
1316     }
1317 
1318     *ptr++ = 0x05;
1319     EncodeSize14(&ptr, csd->size());
1320 
1321     memcpy(ptr, csd->data(), csd->size());
1322 
1323     return esds;
1324 }
1325 
dequeueAccessUnitMPEGVideo()1326 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEGVideo() {
1327     if (isScrambled()) {
1328         if (mBuffer == NULL || mBuffer->size() == 0) {
1329             return NULL;
1330         }
1331         if (mFormat == NULL) {
1332             ALOGI("Creating dummy MPEG format for scrambled content");
1333             mFormat = new MetaData;
1334             mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG2);
1335             mFormat->setInt32(kKeyWidth, 1280);
1336             mFormat->setInt32(kKeyHeight, 720);
1337 
1338             // for MediaExtractor.CasInfo
1339             mFormat->setInt32(kKeyCASystemID, mCASystemId);
1340             mFormat->setData(kKeyCASessionID, 0,
1341                     mCasSessionId.data(), mCasSessionId.size());
1342         }
1343         return dequeueScrambledAccessUnit();
1344     }
1345 
1346     const uint8_t *data = mBuffer->data();
1347     size_t size = mBuffer->size();
1348 
1349     Vector<size_t> userDataPositions;
1350 
1351     bool sawPictureStart = false;
1352     int pprevStartCode = -1;
1353     int prevStartCode = -1;
1354     int currentStartCode = -1;
1355     bool gopFound = false;
1356     bool isClosedGop = false;
1357     bool brokenLink = false;
1358 
1359     size_t offset = 0;
1360     while (offset + 3 < size) {
1361         if (memcmp(&data[offset], "\x00\x00\x01", 3)) {
1362             ++offset;
1363             continue;
1364         }
1365 
1366         pprevStartCode = prevStartCode;
1367         prevStartCode = currentStartCode;
1368         currentStartCode = data[offset + 3];
1369 
1370         if (currentStartCode == 0xb3 && mFormat == NULL) {
1371             memmove(mBuffer->data(), mBuffer->data() + offset, size - offset);
1372             size -= offset;
1373             (void)fetchTimestamp(offset);
1374             offset = 0;
1375             mBuffer->setRange(0, size);
1376         }
1377 
1378         if ((prevStartCode == 0xb3 && currentStartCode != 0xb5)
1379                 || (pprevStartCode == 0xb3 && prevStartCode == 0xb5)) {
1380             // seqHeader without/with extension
1381 
1382             if (mFormat == NULL) {
1383                 if (size < 7u) {
1384                     ALOGE("Size too small");
1385                     return NULL;
1386                 }
1387 
1388                 unsigned width =
1389                     (data[4] << 4) | data[5] >> 4;
1390 
1391                 unsigned height =
1392                     ((data[5] & 0x0f) << 8) | data[6];
1393 
1394                 mFormat = new MetaData;
1395                 mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG2);
1396                 mFormat->setInt32(kKeyWidth, width);
1397                 mFormat->setInt32(kKeyHeight, height);
1398 
1399                 ALOGI("found MPEG2 video codec config (%d x %d)", width, height);
1400 
1401                 sp<ABuffer> csd = new ABuffer(offset);
1402                 memcpy(csd->data(), data, offset);
1403 
1404                 memmove(mBuffer->data(),
1405                         mBuffer->data() + offset,
1406                         mBuffer->size() - offset);
1407 
1408                 mBuffer->setRange(0, mBuffer->size() - offset);
1409                 size -= offset;
1410                 (void)fetchTimestamp(offset);
1411                 offset = 0;
1412 
1413                 // hexdump(csd->data(), csd->size());
1414 
1415                 sp<ABuffer> esds = MakeMPEGVideoESDS(csd);
1416                 mFormat->setData(
1417                         kKeyESDS, kTypeESDS, esds->data(), esds->size());
1418 
1419                 return NULL;
1420             }
1421         }
1422 
1423         if (mFormat != NULL && currentStartCode == 0xb8) {
1424             // GOP layer
1425             if (offset + 7 >= size) {
1426                 ALOGE("Size too small");
1427                 return NULL;
1428             }
1429             gopFound = true;
1430             isClosedGop = (data[offset + 7] & 0x40) != 0;
1431             brokenLink = (data[offset + 7] & 0x20) != 0;
1432         }
1433 
1434         if (mFormat != NULL && currentStartCode == 0xb2) {
1435             userDataPositions.add(offset);
1436         }
1437 
1438         if (mFormat != NULL && currentStartCode == 0x00) {
1439             // Picture start
1440 
1441             if (!sawPictureStart) {
1442                 sawPictureStart = true;
1443             } else {
1444                 sp<ABuffer> accessUnit = new ABuffer(offset);
1445                 memcpy(accessUnit->data(), data, offset);
1446 
1447                 memmove(mBuffer->data(),
1448                         mBuffer->data() + offset,
1449                         mBuffer->size() - offset);
1450 
1451                 mBuffer->setRange(0, mBuffer->size() - offset);
1452 
1453                 int64_t timeUs = fetchTimestamp(offset);
1454                 if (timeUs < 0ll) {
1455                     ALOGE("Negative timeUs");
1456                     return NULL;
1457                 }
1458 
1459                 offset = 0;
1460 
1461                 accessUnit->meta()->setInt64("timeUs", timeUs);
1462                 if (gopFound && (!brokenLink || isClosedGop)) {
1463                     accessUnit->meta()->setInt32("isSync", 1);
1464                 }
1465 
1466                 ALOGV("returning MPEG video access unit at time %" PRId64 " us",
1467                       timeUs);
1468 
1469                 // hexdump(accessUnit->data(), accessUnit->size());
1470 
1471                 if (userDataPositions.size() > 0) {
1472                     sp<ABuffer> mpegUserData =
1473                         new ABuffer(userDataPositions.size() * sizeof(size_t));
1474                     if (mpegUserData != NULL && mpegUserData->data() != NULL) {
1475                         for (size_t i = 0; i < userDataPositions.size(); ++i) {
1476                             memcpy(
1477                                     mpegUserData->data() + i * sizeof(size_t),
1478                                     &userDataPositions[i], sizeof(size_t));
1479                         }
1480                         accessUnit->meta()->setBuffer("mpeg-user-data", mpegUserData);
1481                     }
1482                 }
1483 
1484                 return accessUnit;
1485             }
1486         }
1487 
1488         ++offset;
1489     }
1490 
1491     return NULL;
1492 }
1493 
getNextChunkSize(const uint8_t * data,size_t size)1494 static ssize_t getNextChunkSize(
1495         const uint8_t *data, size_t size) {
1496     static const char kStartCode[] = "\x00\x00\x01";
1497 
1498     // per ISO/IEC 14496-2 6.2.1, a chunk has a 3-byte prefix + 1-byte start code
1499     // we need at least <prefix><start><next prefix> to successfully scan
1500     if (size < 3 + 1 + 3) {
1501         return -EAGAIN;
1502     }
1503 
1504     if (memcmp(kStartCode, data, 3)) {
1505         return -EAGAIN;
1506     }
1507 
1508     size_t offset = 4;
1509     while (offset + 2 < size) {
1510         if (!memcmp(&data[offset], kStartCode, 3)) {
1511             return offset;
1512         }
1513 
1514         ++offset;
1515     }
1516 
1517     return -EAGAIN;
1518 }
1519 
dequeueAccessUnitMPEG4Video()1520 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEG4Video() {
1521     uint8_t *data = mBuffer->data();
1522     size_t size = mBuffer->size();
1523 
1524     enum {
1525         SKIP_TO_VISUAL_OBJECT_SEQ_START,
1526         EXPECT_VISUAL_OBJECT_START,
1527         EXPECT_VO_START,
1528         EXPECT_VOL_START,
1529         WAIT_FOR_VOP_START,
1530         SKIP_TO_VOP_START,
1531 
1532     } state;
1533 
1534     if (mFormat == NULL) {
1535         state = SKIP_TO_VISUAL_OBJECT_SEQ_START;
1536     } else {
1537         state = SKIP_TO_VOP_START;
1538     }
1539 
1540     int32_t width = -1, height = -1;
1541 
1542     size_t offset = 0;
1543     ssize_t chunkSize;
1544     while ((chunkSize = getNextChunkSize(
1545                     &data[offset], size - offset)) > 0) {
1546         bool discard = false;
1547 
1548         unsigned chunkType = data[offset + 3];
1549 
1550         switch (state) {
1551             case SKIP_TO_VISUAL_OBJECT_SEQ_START:
1552             {
1553                 if (chunkType == 0xb0) {
1554                     // Discard anything before this marker.
1555 
1556                     state = EXPECT_VISUAL_OBJECT_START;
1557                 } else {
1558                     discard = true;
1559                     offset += chunkSize;
1560                     ALOGW("b/74114680, advance to next chunk");
1561                     android_errorWriteLog(0x534e4554, "74114680");
1562                 }
1563                 break;
1564             }
1565 
1566             case EXPECT_VISUAL_OBJECT_START:
1567             {
1568                 if (chunkType != 0xb5) {
1569                     ALOGE("Unexpected chunkType");
1570                     return NULL;
1571                 }
1572                 state = EXPECT_VO_START;
1573                 break;
1574             }
1575 
1576             case EXPECT_VO_START:
1577             {
1578                 if (chunkType > 0x1f) {
1579                     ALOGE("Unexpected chunkType");
1580                     return NULL;
1581                 }
1582                 state = EXPECT_VOL_START;
1583                 break;
1584             }
1585 
1586             case EXPECT_VOL_START:
1587             {
1588                 if ((chunkType & 0xf0) != 0x20) {
1589                     ALOGE("Wrong chunkType");
1590                     return NULL;
1591                 }
1592 
1593                 if (!ExtractDimensionsFromVOLHeader(
1594                             &data[offset], chunkSize,
1595                             &width, &height)) {
1596                     ALOGE("Failed to get dimension");
1597                     return NULL;
1598                 }
1599 
1600                 state = WAIT_FOR_VOP_START;
1601                 break;
1602             }
1603 
1604             case WAIT_FOR_VOP_START:
1605             {
1606                 if (chunkType == 0xb3 || chunkType == 0xb6) {
1607                     // group of VOP or VOP start.
1608 
1609                     mFormat = new MetaData;
1610                     mFormat->setCString(
1611                             kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG4);
1612 
1613                     mFormat->setInt32(kKeyWidth, width);
1614                     mFormat->setInt32(kKeyHeight, height);
1615 
1616                     ALOGI("found MPEG4 video codec config (%d x %d)",
1617                          width, height);
1618 
1619                     sp<ABuffer> csd = new ABuffer(offset);
1620                     memcpy(csd->data(), data, offset);
1621 
1622                     // hexdump(csd->data(), csd->size());
1623 
1624                     sp<ABuffer> esds = MakeMPEGVideoESDS(csd);
1625                     mFormat->setData(
1626                             kKeyESDS, kTypeESDS,
1627                             esds->data(), esds->size());
1628 
1629                     discard = true;
1630                     state = SKIP_TO_VOP_START;
1631                 }
1632 
1633                 break;
1634             }
1635 
1636             case SKIP_TO_VOP_START:
1637             {
1638                 if (chunkType == 0xb6) {
1639                     int vopCodingType = (data[offset + 4] & 0xc0) >> 6;
1640 
1641                     offset += chunkSize;
1642 
1643                     sp<ABuffer> accessUnit = new ABuffer(offset);
1644                     memcpy(accessUnit->data(), data, offset);
1645 
1646                     memmove(data, &data[offset], size - offset);
1647                     size -= offset;
1648                     mBuffer->setRange(0, size);
1649 
1650                     int64_t timeUs = fetchTimestamp(offset);
1651                     if (timeUs < 0ll) {
1652                         ALOGE("Negative timeus");
1653                         return NULL;
1654                     }
1655 
1656                     offset = 0;
1657 
1658                     accessUnit->meta()->setInt64("timeUs", timeUs);
1659                     if (vopCodingType == 0) {  // intra-coded VOP
1660                         accessUnit->meta()->setInt32("isSync", 1);
1661                     }
1662 
1663                     ALOGV("returning MPEG4 video access unit at time %" PRId64 " us",
1664                          timeUs);
1665 
1666                     // hexdump(accessUnit->data(), accessUnit->size());
1667 
1668                     return accessUnit;
1669                 } else if (chunkType != 0xb3) {
1670                     offset += chunkSize;
1671                     discard = true;
1672                 }
1673 
1674                 break;
1675             }
1676 
1677             default:
1678                 ALOGE("Unknown state: %d", state);
1679                 return NULL;
1680         }
1681 
1682         if (discard) {
1683             (void)fetchTimestamp(offset);
1684             memmove(data, &data[offset], size - offset);
1685             size -= offset;
1686             offset = 0;
1687             mBuffer->setRange(0, size);
1688         } else {
1689             offset += chunkSize;
1690         }
1691     }
1692 
1693     return NULL;
1694 }
1695 
signalEOS()1696 void ElementaryStreamQueue::signalEOS() {
1697     if (!mEOSReached) {
1698         if (mMode == MPEG_VIDEO) {
1699             const char *theEnd = "\x00\x00\x01\x00";
1700             appendData(theEnd, 4, 0);
1701         }
1702         mEOSReached = true;
1703     } else {
1704         ALOGW("EOS already signaled");
1705     }
1706 }
1707 
dequeueAccessUnitMetadata()1708 sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMetadata() {
1709     size_t size = mBuffer->size();
1710     if (!size) {
1711         return NULL;
1712     }
1713 
1714     sp<ABuffer> accessUnit = new ABuffer(size);
1715     int64_t timeUs = fetchTimestamp(size);
1716     accessUnit->meta()->setInt64("timeUs", timeUs);
1717 
1718     memcpy(accessUnit->data(), mBuffer->data(), size);
1719     mBuffer->setRange(0, 0);
1720 
1721     if (mFormat == NULL) {
1722         mFormat = new MetaData;
1723         mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_DATA_TIMED_ID3);
1724     }
1725 
1726     return accessUnit;
1727 }
1728 
signalNewSampleAesKey(const sp<AMessage> & keyItem)1729 void ElementaryStreamQueue::signalNewSampleAesKey(const sp<AMessage> &keyItem) {
1730     if (mSampleDecryptor == NULL) {
1731         ALOGE("signalNewSampleAesKey: Stream %x is not encrypted; keyItem: %p",
1732                 mMode, keyItem.get());
1733         return;
1734     }
1735 
1736     mSampleDecryptor->signalNewSampleAesKey(keyItem);
1737 }
1738 
1739 
1740 }  // namespace android
1741