summaryrefslogtreecommitdiffstats
path: root/dom/media/ogg
diff options
context:
space:
mode:
Diffstat (limited to 'dom/media/ogg')
-rw-r--r--dom/media/ogg/OggCodecState.cpp1800
-rw-r--r--dom/media/ogg/OggCodecState.h628
-rw-r--r--dom/media/ogg/OggCodecStore.cpp31
-rw-r--r--dom/media/ogg/OggCodecStore.h37
-rw-r--r--dom/media/ogg/OggDecoder.cpp82
-rw-r--r--dom/media/ogg/OggDecoder.h29
-rw-r--r--dom/media/ogg/OggDemuxer.cpp2170
-rw-r--r--dom/media/ogg/OggDemuxer.h363
-rw-r--r--dom/media/ogg/OggRLBox.h30
-rw-r--r--dom/media/ogg/OggRLBoxTypes.h17
-rw-r--r--dom/media/ogg/OggWriter.cpp197
-rw-r--r--dom/media/ogg/OggWriter.h55
-rw-r--r--dom/media/ogg/OpusParser.cpp217
-rw-r--r--dom/media/ogg/OpusParser.h48
-rw-r--r--dom/media/ogg/moz.build32
15 files changed, 5736 insertions, 0 deletions
diff --git a/dom/media/ogg/OggCodecState.cpp b/dom/media/ogg/OggCodecState.cpp
new file mode 100644
index 0000000000..c20a6a17bc
--- /dev/null
+++ b/dom/media/ogg/OggCodecState.cpp
@@ -0,0 +1,1800 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <string.h>
+
+#include "mozilla/EndianUtils.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/TextUtils.h"
+#include "mozilla/Utf8.h"
+#include <stdint.h>
+#include <algorithm>
+#include <opus/opus.h>
+
+#include "OggCodecState.h"
+#include "OggRLBox.h"
+#include "OpusDecoder.h"
+#include "OpusParser.h"
+#include "VideoUtils.h"
+#include "XiphExtradata.h"
+#include "nsDebug.h"
+#include "opus/opus_multistream.h"
+
+namespace mozilla {
+
+extern LazyLogModule gMediaDecoderLog;
+#define LOG(type, msg) MOZ_LOG(gMediaDecoderLog, type, msg)
+
+using media::TimeUnit;
+
+/** Decoder base class for Ogg-encapsulated streams. */
+UniquePtr<OggCodecState> OggCodecState::Create(
+ rlbox_sandbox_ogg* aSandbox, tainted_opaque_ogg<ogg_page*> aPage,
+ uint32_t aSerial) {
+ NS_ASSERTION(sandbox_invoke(*aSandbox, ogg_page_bos, aPage)
+ .unverified_safe_because(RLBOX_SAFE_DEBUG_ASSERTION),
+ "Only call on BOS page!");
+ UniquePtr<OggCodecState> codecState;
+ tainted_ogg<ogg_page*> aPage_t = rlbox::from_opaque(aPage);
+ const char codec_reason[] =
+ "These conditions set the type of codec. Since we are relying on "
+ "ogg_page to determine the codec type, the library could lie about "
+ "this. We allow this as it does not directly allow renderer "
+ "vulnerabilities if this is incorrect.";
+ long body_len = aPage_t->body_len.unverified_safe_because(codec_reason);
+
+ if (body_len > 6 && rlbox::memcmp(*aSandbox, aPage_t->body + 1, "theora", 6u)
+ .unverified_safe_because(codec_reason) == 0) {
+ codecState = MakeUnique<TheoraState>(aSandbox, aPage, aSerial);
+ } else if (body_len > 6 &&
+ rlbox::memcmp(*aSandbox, aPage_t->body + 1, "vorbis", 6u)
+ .unverified_safe_because(codec_reason) == 0) {
+ codecState = MakeUnique<VorbisState>(aSandbox, aPage, aSerial);
+ } else if (body_len > 8 &&
+ rlbox::memcmp(*aSandbox, aPage_t->body, "OpusHead", 8u)
+ .unverified_safe_because(codec_reason) == 0) {
+ codecState = MakeUnique<OpusState>(aSandbox, aPage, aSerial);
+ } else if (body_len > 8 &&
+ rlbox::memcmp(*aSandbox, aPage_t->body, "fishead\0", 8u)
+ .unverified_safe_because(codec_reason) == 0) {
+ codecState = MakeUnique<SkeletonState>(aSandbox, aPage, aSerial);
+ } else if (body_len > 5 &&
+ rlbox::memcmp(*aSandbox, aPage_t->body, "\177FLAC", 5u)
+ .unverified_safe_because(codec_reason) == 0) {
+ codecState = MakeUnique<FlacState>(aSandbox, aPage, aSerial);
+ } else {
+ // Can't use MakeUnique here, OggCodecState is protected.
+ codecState.reset(new OggCodecState(aSandbox, aPage, aSerial, false));
+ }
+
+ if (!codecState->OggCodecState::InternalInit()) {
+ codecState.reset();
+ }
+
+ return codecState;
+}
+
+OggCodecState::OggCodecState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial, bool aActive)
+ : mPacketCount(0),
+ mSerial(aSerial),
+ mActive(aActive),
+ mDoneReadingHeaders(!aActive),
+ mSandbox(aSandbox) {
+ MOZ_COUNT_CTOR(OggCodecState);
+ tainted_ogg<ogg_stream_state*> state =
+ mSandbox->malloc_in_sandbox<ogg_stream_state>();
+ MOZ_RELEASE_ASSERT(state != nullptr);
+ rlbox::memset(*mSandbox, state, 0, sizeof(ogg_stream_state));
+ mState = state.to_opaque();
+}
+
+OggCodecState::~OggCodecState() {
+ MOZ_COUNT_DTOR(OggCodecState);
+ Reset();
+#ifdef DEBUG
+ int ret =
+#endif
+ sandbox_invoke(*mSandbox, ogg_stream_clear, mState)
+ .unverified_safe_because(RLBOX_SAFE_DEBUG_ASSERTION);
+ NS_ASSERTION(ret == 0, "ogg_stream_clear failed");
+ mSandbox->free_in_sandbox(rlbox::from_opaque(mState));
+ tainted_ogg<ogg_stream_state*> nullval = nullptr;
+ mState = nullval.to_opaque();
+}
+
+nsresult OggCodecState::Reset() {
+ if (sandbox_invoke(*mSandbox, ogg_stream_reset, mState)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) != 0) {
+ return NS_ERROR_FAILURE;
+ }
+ mPackets.Erase();
+ ClearUnstamped();
+ return NS_OK;
+}
+
+void OggCodecState::ClearUnstamped() { mUnstamped.Clear(); }
+
+bool OggCodecState::InternalInit() {
+ int ret = sandbox_invoke(*mSandbox, ogg_stream_init, mState, mSerial)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON);
+ return ret == 0;
+}
+
+bool OggCodecState::IsValidVorbisTagName(nsCString& aName) {
+ // Tag names must consist of ASCII 0x20 through 0x7D,
+ // excluding 0x3D '=' which is the separator.
+ uint32_t length = aName.Length();
+ const char* data = aName.Data();
+ for (uint32_t i = 0; i < length; i++) {
+ if (data[i] < 0x20 || data[i] > 0x7D || data[i] == '=') {
+ return false;
+ }
+ }
+ return true;
+}
+
+bool OggCodecState::AddVorbisComment(UniquePtr<MetadataTags>& aTags,
+ const char* aComment, uint32_t aLength) {
+ const char* div = (const char*)memchr(aComment, '=', aLength);
+ if (!div) {
+ LOG(LogLevel::Debug, ("Skipping comment: no separator"));
+ return false;
+ }
+ nsCString key = nsCString(aComment, div - aComment);
+ if (!IsValidVorbisTagName(key)) {
+ LOG(LogLevel::Debug, ("Skipping comment: invalid tag name"));
+ return false;
+ }
+ uint32_t valueLength = aLength - (div - aComment);
+ nsCString value = nsCString(div + 1, valueLength);
+ if (!IsUtf8(value)) {
+ LOG(LogLevel::Debug, ("Skipping comment: invalid UTF-8 in value"));
+ return false;
+ }
+ aTags->InsertOrUpdate(key, value);
+ return true;
+}
+
+bool OggCodecState::SetCodecSpecificConfig(MediaByteBuffer* aBuffer,
+ OggPacketQueue& aHeaders) {
+ nsTArray<const unsigned char*> headers;
+ nsTArray<size_t> headerLens;
+ for (size_t i = 0; i < aHeaders.Length(); i++) {
+ headers.AppendElement(aHeaders[i]->packet);
+ headerLens.AppendElement(aHeaders[i]->bytes);
+ }
+ // Save header packets for the decoder
+ if (!XiphHeadersToExtradata(aBuffer, headers, headerLens)) {
+ return false;
+ }
+ aHeaders.Erase();
+ return true;
+}
+
+void VorbisState::RecordVorbisPacketSamples(ogg_packet* aPacket,
+ long aSamples) {
+#ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+ mVorbisPacketSamples[aPacket] = aSamples;
+#endif
+}
+
+void VorbisState::ValidateVorbisPacketSamples(ogg_packet* aPacket,
+ long aSamples) {
+#ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+ NS_ASSERTION(mVorbisPacketSamples[aPacket] == aSamples,
+ "Decoded samples for Vorbis packet don't match expected!");
+ mVorbisPacketSamples.erase(aPacket);
+#endif
+}
+
+void VorbisState::AssertHasRecordedPacketSamples(ogg_packet* aPacket) {
+#ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+ NS_ASSERTION(mVorbisPacketSamples.count(aPacket) == 1,
+ "Must have recorded packet samples");
+#endif
+}
+
+// Clone the given packet from memory accessible to the sandboxed libOgg to
+// memory accessible only to the Firefox renderer
+static OggPacketPtr CloneOutOfSandbox(tainted_ogg<ogg_packet*> aPacket) {
+ ogg_packet* clone =
+ aPacket.copy_and_verify([](std::unique_ptr<tainted_ogg<ogg_packet>> val) {
+ const char packet_reason[] =
+ "Packets have no guarantees on what data they hold. The renderer's "
+ "safety is not compromised even if packets return garbage data.";
+
+ ogg_packet* p = new ogg_packet();
+ p->bytes = val->bytes.unverified_safe_because(packet_reason);
+ p->b_o_s = val->b_o_s.unverified_safe_because(packet_reason);
+ p->e_o_s = val->e_o_s.unverified_safe_because(packet_reason);
+ p->granulepos = val->granulepos.unverified_safe_because(packet_reason);
+ p->packetno = val->packetno.unverified_safe_because(packet_reason);
+ if (p->bytes == 0) {
+ p->packet = nullptr;
+ } else {
+ p->packet = val->packet.copy_and_verify_range(
+ [](std::unique_ptr<unsigned char[]> packet) {
+ return packet.release();
+ },
+ p->bytes);
+ }
+ return p;
+ });
+ return OggPacketPtr(clone);
+}
+
+void OggPacketQueue::Append(OggPacketPtr aPacket) {
+ nsDeque::Push(aPacket.release());
+}
+
+bool OggCodecState::IsPacketReady() { return !mPackets.IsEmpty(); }
+
+OggPacketPtr OggCodecState::PacketOut() {
+ if (mPackets.IsEmpty()) {
+ return nullptr;
+ }
+ return mPackets.PopFront();
+}
+
+ogg_packet* OggCodecState::PacketPeek() {
+ if (mPackets.IsEmpty()) {
+ return nullptr;
+ }
+ return mPackets.PeekFront();
+}
+
+void OggCodecState::PushFront(OggPacketQueue&& aOther) {
+ while (!aOther.IsEmpty()) {
+ mPackets.PushFront(aOther.Pop());
+ }
+}
+
+already_AddRefed<MediaRawData> OggCodecState::PacketOutAsMediaRawData() {
+ OggPacketPtr packet = PacketOut();
+ if (!packet) {
+ return nullptr;
+ }
+
+ NS_ASSERTION(
+ !IsHeader(packet.get()),
+ "PacketOutAsMediaRawData can only be called on non-header packets");
+ RefPtr<MediaRawData> sample = new MediaRawData(packet->packet, packet->bytes);
+ if (packet->bytes && !sample->Data()) {
+ // OOM.
+ return nullptr;
+ }
+
+ int64_t end_tstamp = Time(packet->granulepos);
+ NS_ASSERTION(end_tstamp >= 0, "timestamp invalid");
+
+ int64_t duration = PacketDuration(packet.get());
+ NS_ASSERTION(duration >= 0, "duration invalid");
+
+ sample->mTimecode = TimeUnit::FromMicroseconds(packet->granulepos);
+ sample->mTime = TimeUnit::FromMicroseconds(end_tstamp - duration);
+ sample->mDuration = TimeUnit::FromMicroseconds(duration);
+ sample->mKeyframe = IsKeyframe(packet.get());
+ sample->mEOS = packet->e_o_s;
+
+ return sample.forget();
+}
+
+nsresult OggCodecState::PageIn(tainted_opaque_ogg<ogg_page*> aPage) {
+ if (!mActive) {
+ return NS_OK;
+ }
+ NS_ASSERTION((rlbox::sandbox_static_cast<uint32_t>(sandbox_invoke(
+ *mSandbox, ogg_page_serialno, aPage)) == mSerial)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON),
+ "Page must be for this stream!");
+ if (sandbox_invoke(*mSandbox, ogg_stream_pagein, mState, aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == -1) {
+ return NS_ERROR_FAILURE;
+ }
+ int r;
+ tainted_ogg<ogg_packet*> packet = mSandbox->malloc_in_sandbox<ogg_packet>();
+ if (!packet) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ auto clean_packet = MakeScopeExit([&] { mSandbox->free_in_sandbox(packet); });
+
+ do {
+ r = sandbox_invoke(*mSandbox, ogg_stream_packetout, mState, packet)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON);
+ if (r == 1) {
+ mPackets.Append(CloneOutOfSandbox(packet));
+ }
+ } while (r != 0);
+ if (sandbox_invoke(*mSandbox, ogg_stream_check, mState)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON)) {
+ NS_WARNING("Unrecoverable error in ogg_stream_packetout");
+ return NS_ERROR_FAILURE;
+ }
+ return NS_OK;
+}
+
+nsresult OggCodecState::PacketOutUntilGranulepos(bool& aFoundGranulepos) {
+ tainted_ogg<int> r;
+ aFoundGranulepos = false;
+ // Extract packets from the sync state until either no more packets
+ // come out, or we get a data packet with non -1 granulepos.
+ tainted_ogg<ogg_packet*> packet = mSandbox->malloc_in_sandbox<ogg_packet>();
+ if (!packet) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ auto clean_packet = MakeScopeExit([&] { mSandbox->free_in_sandbox(packet); });
+
+ do {
+ r = sandbox_invoke(*mSandbox, ogg_stream_packetout, mState, packet);
+ if (r.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == 1) {
+ OggPacketPtr clone = CloneOutOfSandbox(packet);
+ if (IsHeader(clone.get())) {
+ // Header packets go straight into the packet queue.
+ mPackets.Append(std::move(clone));
+ } else {
+ // We buffer data packets until we encounter a granulepos. We'll
+ // then use the granulepos to figure out the granulepos of the
+ // preceeding packets.
+ aFoundGranulepos = clone.get()->granulepos > 0;
+ mUnstamped.AppendElement(std::move(clone));
+ }
+ }
+ } while (r.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) != 0 &&
+ !aFoundGranulepos);
+ if (sandbox_invoke(*mSandbox, ogg_stream_check, mState)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON)) {
+ NS_WARNING("Unrecoverable error in ogg_stream_packetout");
+ return NS_ERROR_FAILURE;
+ }
+ return NS_OK;
+}
+
+TheoraState::TheoraState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial)
+ : OggCodecState(aSandbox, aBosPage, aSerial, true),
+ mSetup(nullptr),
+ mCtx(nullptr) {
+ MOZ_COUNT_CTOR(TheoraState);
+ th_info_init(&mTheoraInfo);
+ th_comment_init(&mComment);
+}
+
+TheoraState::~TheoraState() {
+ MOZ_COUNT_DTOR(TheoraState);
+ th_setup_free(mSetup);
+ th_decode_free(mCtx);
+ th_comment_clear(&mComment);
+ th_info_clear(&mTheoraInfo);
+ Reset();
+}
+
+bool TheoraState::Init() {
+ if (!mActive) {
+ return false;
+ }
+
+ int64_t n = mTheoraInfo.aspect_numerator;
+ int64_t d = mTheoraInfo.aspect_denominator;
+
+ float aspectRatio =
+ (n == 0 || d == 0) ? 1.0f : static_cast<float>(n) / static_cast<float>(d);
+
+ // Ensure the frame and picture regions aren't larger than our prescribed
+ // maximum, or zero sized.
+ gfx::IntSize frame(mTheoraInfo.frame_width, mTheoraInfo.frame_height);
+ gfx::IntRect picture(mTheoraInfo.pic_x, mTheoraInfo.pic_y,
+ mTheoraInfo.pic_width, mTheoraInfo.pic_height);
+ gfx::IntSize display(mTheoraInfo.pic_width, mTheoraInfo.pic_height);
+ ScaleDisplayByAspectRatio(display, aspectRatio);
+ if (!IsValidVideoRegion(frame, picture, display)) {
+ return mActive = false;
+ }
+
+ mCtx = th_decode_alloc(&mTheoraInfo, mSetup);
+ if (!mCtx) {
+ return mActive = false;
+ }
+
+ // Video track's frame sizes will not overflow. Activate the video track.
+ mInfo.mMimeType = "video/theora"_ns;
+ mInfo.mDisplay = display;
+ mInfo.mImage = frame;
+ mInfo.SetImageRect(picture);
+
+ return mActive = SetCodecSpecificConfig(mInfo.mCodecSpecificConfig, mHeaders);
+}
+
+nsresult TheoraState::Reset() {
+ mHeaders.Erase();
+ return OggCodecState::Reset();
+}
+
+bool TheoraState::DecodeHeader(OggPacketPtr aPacket) {
+ ogg_packet* packet = aPacket.get(); // Will be owned by mHeaders.
+ mHeaders.Append(std::move(aPacket));
+ mPacketCount++;
+ int ret = th_decode_headerin(&mTheoraInfo, &mComment, &mSetup, packet);
+
+ // We must determine when we've read the last header packet.
+ // th_decode_headerin() does not tell us when it's read the last header, so
+ // we must keep track of the headers externally.
+ //
+ // There are 3 header packets, the Identification, Comment, and Setup
+ // headers, which must be in that order. If they're out of order, the file
+ // is invalid. If we've successfully read a header, and it's the setup
+ // header, then we're done reading headers. The first byte of each packet
+ // determines it's type as follows:
+ // 0x80 -> Identification header
+ // 0x81 -> Comment header
+ // 0x82 -> Setup header
+ // See http://www.theora.org/doc/Theora.pdf Chapter 6, "Bitstream Headers",
+ // for more details of the Ogg/Theora containment scheme.
+ bool isSetupHeader = packet->bytes > 0 && packet->packet[0] == 0x82;
+ if (ret < 0 || mPacketCount > 3) {
+ // We've received an error, or the first three packets weren't valid
+ // header packets. Assume bad input.
+ // Our caller will deactivate the bitstream.
+ return false;
+ } else if (ret > 0 && isSetupHeader && mPacketCount == 3) {
+ // Successfully read the three header packets.
+ mDoneReadingHeaders = true;
+ }
+ return true;
+}
+
+int64_t TheoraState::Time(int64_t granulepos) {
+ if (!mActive) {
+ return -1;
+ }
+ return TheoraState::Time(&mTheoraInfo, granulepos);
+}
+
+bool TheoraState::IsHeader(ogg_packet* aPacket) {
+ return th_packet_isheader(aPacket);
+}
+
+#define TH_VERSION_CHECK(_info, _maj, _min, _sub) \
+ (((_info)->version_major > (_maj) || (_info)->version_major == (_maj)) && \
+ (((_info)->version_minor > (_min) || (_info)->version_minor == (_min)) && \
+ (_info)->version_subminor >= (_sub)))
+
+int64_t TheoraState::Time(th_info* aInfo, int64_t aGranulepos) {
+ if (aGranulepos < 0 || aInfo->fps_numerator == 0) {
+ return -1;
+ }
+ // Implementation of th_granule_frame inlined here to operate
+ // on the th_info structure instead of the theora_state.
+ int shift = aInfo->keyframe_granule_shift;
+ ogg_int64_t iframe = aGranulepos >> shift;
+ ogg_int64_t pframe = aGranulepos - (iframe << shift);
+ int64_t frameno = iframe + pframe - TH_VERSION_CHECK(aInfo, 3, 2, 1);
+ CheckedInt64 t =
+ ((CheckedInt64(frameno) + 1) * USECS_PER_S) * aInfo->fps_denominator;
+ if (!t.isValid()) {
+ return -1;
+ }
+ t /= aInfo->fps_numerator;
+ return t.isValid() ? t.value() : -1;
+}
+
+int64_t TheoraState::StartTime(int64_t granulepos) {
+ if (granulepos < 0 || !mActive || mTheoraInfo.fps_numerator == 0) {
+ return -1;
+ }
+ CheckedInt64 t =
+ (CheckedInt64(th_granule_frame(mCtx, granulepos)) * USECS_PER_S) *
+ mTheoraInfo.fps_denominator;
+ if (!t.isValid()) {
+ return -1;
+ }
+ return t.value() / mTheoraInfo.fps_numerator;
+}
+
+int64_t TheoraState::PacketDuration(ogg_packet* aPacket) {
+ if (!mActive || mTheoraInfo.fps_numerator == 0) {
+ return -1;
+ }
+ CheckedInt64 t = SaferMultDiv(mTheoraInfo.fps_denominator, USECS_PER_S,
+ mTheoraInfo.fps_numerator);
+ return t.isValid() ? t.value() : -1;
+}
+
+int64_t TheoraState::MaxKeyframeOffset() {
+ // Determine the maximum time in microseconds by which a key frame could
+ // offset for the theora bitstream. Theora granulepos encode time as:
+ // ((key_frame_number << granule_shift) + frame_offset).
+ // Therefore the maximum possible time by which any frame could be offset
+ // from a keyframe is the duration of (1 << granule_shift) - 1) frames.
+ int64_t frameDuration;
+
+ // Max number of frames keyframe could possibly be offset.
+ int64_t keyframeDiff = (1 << mTheoraInfo.keyframe_granule_shift) - 1;
+
+ // Length of frame in usecs.
+ frameDuration =
+ (mTheoraInfo.fps_denominator * USECS_PER_S) / mTheoraInfo.fps_numerator;
+
+ // Total time in usecs keyframe can be offset from any given frame.
+ return frameDuration * keyframeDiff;
+}
+
+bool TheoraState::IsKeyframe(ogg_packet* pkt) {
+ // first bit of packet is 1 for header, 0 for data
+ // second bit of packet is 1 for inter frame, 0 for intra frame
+ return (pkt->bytes >= 1 && (pkt->packet[0] & 0x40) == 0x00);
+}
+
+nsresult TheoraState::PageIn(tainted_opaque_ogg<ogg_page*> aPage) {
+ if (!mActive) return NS_OK;
+ NS_ASSERTION((rlbox::sandbox_static_cast<uint32_t>(sandbox_invoke(
+ *mSandbox, ogg_page_serialno, aPage)) == mSerial)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON),
+ "Page must be for this stream!");
+ if (sandbox_invoke(*mSandbox, ogg_stream_pagein, mState, aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == -1) {
+ return NS_ERROR_FAILURE;
+ }
+ bool foundGp;
+ nsresult res = PacketOutUntilGranulepos(foundGp);
+ if (NS_FAILED(res)) return res;
+ if (foundGp && mDoneReadingHeaders) {
+ // We've found a packet with a granulepos, and we've loaded our metadata
+ // and initialized our decoder. Determine granulepos of buffered packets.
+ ReconstructTheoraGranulepos();
+ for (uint32_t i = 0; i < mUnstamped.Length(); ++i) {
+ OggPacketPtr packet = std::move(mUnstamped[i]);
+#ifdef DEBUG
+ NS_ASSERTION(!IsHeader(packet.get()),
+ "Don't try to recover header packet gp");
+ NS_ASSERTION(packet->granulepos != -1, "Packet must have gp by now");
+#endif
+ mPackets.Append(std::move(packet));
+ }
+ mUnstamped.Clear();
+ }
+ return NS_OK;
+}
+
+// Returns 1 if the Theora info struct is decoding a media of Theora
+// version (maj,min,sub) or later, otherwise returns 0.
+int TheoraVersion(th_info* info, unsigned char maj, unsigned char min,
+ unsigned char sub) {
+ ogg_uint32_t ver = (maj << 16) + (min << 8) + sub;
+ ogg_uint32_t th_ver = (info->version_major << 16) +
+ (info->version_minor << 8) + info->version_subminor;
+ return (th_ver >= ver) ? 1 : 0;
+}
+
+void TheoraState::ReconstructTheoraGranulepos() {
+ if (mUnstamped.Length() == 0) {
+ return;
+ }
+ ogg_int64_t lastGranulepos = mUnstamped[mUnstamped.Length() - 1]->granulepos;
+ NS_ASSERTION(lastGranulepos != -1, "Must know last granulepos");
+
+ // Reconstruct the granulepos (and thus timestamps) of the decoded
+ // frames. Granulepos are stored as ((keyframe<<shift)+offset). We
+ // know the granulepos of the last frame in the list, so we can infer
+ // the granulepos of the intermediate frames using their frame numbers.
+ ogg_int64_t shift = mTheoraInfo.keyframe_granule_shift;
+ ogg_int64_t version_3_2_1 = TheoraVersion(&mTheoraInfo, 3, 2, 1);
+ ogg_int64_t lastFrame =
+ th_granule_frame(mCtx, lastGranulepos) + version_3_2_1;
+ ogg_int64_t firstFrame = lastFrame - mUnstamped.Length() + 1;
+
+ // Until we encounter a keyframe, we'll assume that the "keyframe"
+ // segment of the granulepos is the first frame, or if that causes
+ // the "offset" segment to overflow, we assume the required
+ // keyframe is maximumally offset. Until we encounter a keyframe
+ // the granulepos will probably be wrong, but we can't decode the
+ // frame anyway (since we don't have its keyframe) so it doesn't really
+ // matter.
+ ogg_int64_t keyframe = lastGranulepos >> shift;
+
+ // The lastFrame, firstFrame, keyframe variables, as well as the frame
+ // variable in the loop below, store the frame number for Theora
+ // version >= 3.2.1 streams, and store the frame index for Theora
+ // version < 3.2.1 streams.
+ for (uint32_t i = 0; i < mUnstamped.Length() - 1; ++i) {
+ ogg_int64_t frame = firstFrame + i;
+ ogg_int64_t granulepos;
+ auto& packet = mUnstamped[i];
+ bool isKeyframe = th_packet_iskeyframe(packet.get()) == 1;
+
+ if (isKeyframe) {
+ granulepos = frame << shift;
+ keyframe = frame;
+ } else if (frame >= keyframe &&
+ frame - keyframe < ((ogg_int64_t)1 << shift)) {
+ // (frame - keyframe) won't overflow the "offset" segment of the
+ // granulepos, so it's safe to calculate the granulepos.
+ granulepos = (keyframe << shift) + (frame - keyframe);
+ } else {
+ // (frame - keyframeno) will overflow the "offset" segment of the
+ // granulepos, so we take "keyframe" to be the max possible offset
+ // frame instead.
+ ogg_int64_t k =
+ std::max(frame - (((ogg_int64_t)1 << shift) - 1), version_3_2_1);
+ granulepos = (k << shift) + (frame - k);
+ }
+ // Theora 3.2.1+ granulepos store frame number [1..N], so granulepos
+ // should be > 0.
+ // Theora 3.2.0 granulepos store the frame index [0..(N-1)], so
+ // granulepos should be >= 0.
+ NS_ASSERTION(granulepos >= version_3_2_1,
+ "Invalid granulepos for Theora version");
+
+ // Check that the frame's granule number is one more than the
+ // previous frame's.
+ NS_ASSERTION(
+ i == 0 || th_granule_frame(mCtx, granulepos) ==
+ th_granule_frame(mCtx, mUnstamped[i - 1]->granulepos) + 1,
+ "Granulepos calculation is incorrect!");
+
+ packet->granulepos = granulepos;
+ }
+
+ // Check that the second to last frame's granule number is one less than
+ // the last frame's (the known granule number). If not our granulepos
+ // recovery missed a beat.
+ NS_ASSERTION(mUnstamped.Length() < 2 ||
+ (th_granule_frame(
+ mCtx, mUnstamped[mUnstamped.Length() - 2]->granulepos) +
+ 1) == th_granule_frame(mCtx, lastGranulepos),
+ "Granulepos recovery should catch up with packet->granulepos!");
+}
+
+nsresult VorbisState::Reset() {
+ nsresult res = NS_OK;
+ if (mActive && vorbis_synthesis_restart(&mDsp) != 0) {
+ res = NS_ERROR_FAILURE;
+ }
+ mHeaders.Erase();
+ if (NS_FAILED(OggCodecState::Reset())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ mGranulepos = 0;
+ mPrevVorbisBlockSize = 0;
+
+ return res;
+}
+
+VorbisState::VorbisState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial)
+ : OggCodecState(aSandbox, aBosPage, aSerial, true),
+ mPrevVorbisBlockSize(0),
+ mGranulepos(0) {
+ MOZ_COUNT_CTOR(VorbisState);
+ vorbis_info_init(&mVorbisInfo);
+ vorbis_comment_init(&mComment);
+ memset(&mDsp, 0, sizeof(vorbis_dsp_state));
+ memset(&mBlock, 0, sizeof(vorbis_block));
+}
+
+VorbisState::~VorbisState() {
+ MOZ_COUNT_DTOR(VorbisState);
+ Reset();
+ vorbis_block_clear(&mBlock);
+ vorbis_dsp_clear(&mDsp);
+ vorbis_info_clear(&mVorbisInfo);
+ vorbis_comment_clear(&mComment);
+}
+
+bool VorbisState::DecodeHeader(OggPacketPtr aPacket) {
+ ogg_packet* packet = aPacket.get(); // Will be owned by mHeaders.
+ mHeaders.Append(std::move(aPacket));
+ mPacketCount++;
+ int ret = vorbis_synthesis_headerin(&mVorbisInfo, &mComment, packet);
+ // We must determine when we've read the last header packet.
+ // vorbis_synthesis_headerin() does not tell us when it's read the last
+ // header, so we must keep track of the headers externally.
+ //
+ // There are 3 header packets, the Identification, Comment, and Setup
+ // headers, which must be in that order. If they're out of order, the file
+ // is invalid. If we've successfully read a header, and it's the setup
+ // header, then we're done reading headers. The first byte of each packet
+ // determines it's type as follows:
+ // 0x1 -> Identification header
+ // 0x3 -> Comment header
+ // 0x5 -> Setup header
+ // For more details of the Vorbis/Ogg containment scheme, see the Vorbis I
+ // Specification, Chapter 4, Codec Setup and Packet Decode:
+ // http://www.xiph.org/vorbis/doc/Vorbis_I_spec.html#x1-580004
+
+ bool isSetupHeader = packet->bytes > 0 && packet->packet[0] == 0x5;
+
+ if (ret < 0 || mPacketCount > 3) {
+ // We've received an error, or the first three packets weren't valid
+ // header packets. Assume bad input. Our caller will deactivate the
+ // bitstream.
+ return false;
+ } else if (!ret && isSetupHeader && mPacketCount == 3) {
+ // Successfully read the three header packets.
+ // The bitstream remains active.
+ mDoneReadingHeaders = true;
+ }
+
+ return true;
+}
+
+bool VorbisState::Init() {
+ if (!mActive) {
+ return false;
+ }
+
+ int ret = vorbis_synthesis_init(&mDsp, &mVorbisInfo);
+ if (ret != 0) {
+ NS_WARNING("vorbis_synthesis_init() failed initializing vorbis bitstream");
+ return mActive = false;
+ }
+ ret = vorbis_block_init(&mDsp, &mBlock);
+ if (ret != 0) {
+ NS_WARNING("vorbis_block_init() failed initializing vorbis bitstream");
+ if (mActive) {
+ vorbis_dsp_clear(&mDsp);
+ }
+ return mActive = false;
+ }
+
+ nsTArray<const unsigned char*> headers;
+ nsTArray<size_t> headerLens;
+ for (size_t i = 0; i < mHeaders.Length(); i++) {
+ headers.AppendElement(mHeaders[i]->packet);
+ headerLens.AppendElement(mHeaders[i]->bytes);
+ }
+ // Save header packets for the decoder
+ VorbisCodecSpecificData vorbisCodecSpecificData{};
+ if (!XiphHeadersToExtradata(vorbisCodecSpecificData.mHeadersBinaryBlob,
+ headers, headerLens)) {
+ return mActive = false;
+ }
+ mHeaders.Erase();
+ mInfo.mMimeType = "audio/vorbis"_ns;
+ mInfo.mRate = mVorbisInfo.rate;
+ mInfo.mChannels = mVorbisInfo.channels;
+ mInfo.mBitDepth = 16;
+ mInfo.mCodecSpecificConfig =
+ AudioCodecSpecificVariant{std::move(vorbisCodecSpecificData)};
+
+ return true;
+}
+
+int64_t VorbisState::Time(int64_t granulepos) {
+ if (!mActive) {
+ return -1;
+ }
+
+ return VorbisState::Time(&mVorbisInfo, granulepos);
+}
+
+int64_t VorbisState::Time(vorbis_info* aInfo, int64_t aGranulepos) {
+ if (aGranulepos == -1 || aInfo->rate == 0) {
+ return -1;
+ }
+ CheckedInt64 t = SaferMultDiv(aGranulepos, USECS_PER_S, aInfo->rate);
+ return t.isValid() ? t.value() : 0;
+}
+
+int64_t VorbisState::PacketDuration(ogg_packet* aPacket) {
+ if (!mActive) {
+ return -1;
+ }
+ if (aPacket->granulepos == -1) {
+ return -1;
+ }
+ // @FIXME store these in a more stable place
+ if (mVorbisPacketSamples.count(aPacket) == 0) {
+ // We haven't seen this packet, don't know its size?
+ return -1;
+ }
+
+ long samples = mVorbisPacketSamples[aPacket];
+ return Time(samples);
+}
+
+bool VorbisState::IsHeader(ogg_packet* aPacket) {
+ // The first byte in each Vorbis header packet is either 0x01, 0x03, or 0x05,
+ // i.e. the first bit is odd. Audio data packets have their first bit as 0x0.
+ // Any packet with its first bit set cannot be a data packet, it's a
+ // (possibly invalid) header packet.
+ // See: http://xiph.org/vorbis/doc/Vorbis_I_spec.html#x1-610004.2.1
+ return aPacket->bytes > 0 ? (aPacket->packet[0] & 0x1) : false;
+}
+
+UniquePtr<MetadataTags> VorbisState::GetTags() {
+ NS_ASSERTION(mComment.user_comments, "no vorbis comment strings!");
+ NS_ASSERTION(mComment.comment_lengths, "no vorbis comment lengths!");
+ auto tags = MakeUnique<MetadataTags>();
+ for (int i = 0; i < mComment.comments; i++) {
+ AddVorbisComment(tags, mComment.user_comments[i],
+ mComment.comment_lengths[i]);
+ }
+ return tags;
+}
+
+nsresult VorbisState::PageIn(tainted_opaque_ogg<ogg_page*> aPage) {
+ if (!mActive) {
+ return NS_OK;
+ }
+ NS_ASSERTION((rlbox::sandbox_static_cast<uint32_t>(sandbox_invoke(
+ *mSandbox, ogg_page_serialno, aPage)) == mSerial)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON),
+ "Page must be for this stream!");
+ if (sandbox_invoke(*mSandbox, ogg_stream_pagein, mState, aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == -1) {
+ return NS_ERROR_FAILURE;
+ }
+ bool foundGp;
+ nsresult res = PacketOutUntilGranulepos(foundGp);
+ if (NS_FAILED(res)) {
+ return res;
+ }
+ if (foundGp && mDoneReadingHeaders) {
+ // We've found a packet with a granulepos, and we've loaded our metadata
+ // and initialized our decoder. Determine granulepos of buffered packets.
+ ReconstructVorbisGranulepos();
+ for (uint32_t i = 0; i < mUnstamped.Length(); ++i) {
+ OggPacketPtr packet = std::move(mUnstamped[i]);
+ AssertHasRecordedPacketSamples(packet.get());
+ NS_ASSERTION(!IsHeader(packet.get()),
+ "Don't try to recover header packet gp");
+ NS_ASSERTION(packet->granulepos != -1, "Packet must have gp by now");
+ mPackets.Append(std::move(packet));
+ }
+ mUnstamped.Clear();
+ }
+ return NS_OK;
+}
+
+void VorbisState::ReconstructVorbisGranulepos() {
+ // The number of samples in a Vorbis packet is:
+ // window_blocksize(previous_packet)/4+window_blocksize(current_packet)/4
+ // See: http://xiph.org/vorbis/doc/Vorbis_I_spec.html#x1-230001.3.2
+ // So we maintain mPrevVorbisBlockSize, the block size of the last packet
+ // encountered. We also maintain mGranulepos, which is the granulepos of
+ // the last encountered packet. This enables us to give granulepos to
+ // packets when the last packet in mUnstamped doesn't have a granulepos
+ // (for example if the stream was truncated).
+ //
+ // We validate our prediction of the number of samples decoded when
+ // VALIDATE_VORBIS_SAMPLE_CALCULATION is defined by recording the predicted
+ // number of samples, and verifing we extract that many when decoding
+ // each packet.
+
+ NS_ASSERTION(mUnstamped.Length() > 0, "Length must be > 0");
+ auto& last = mUnstamped.LastElement();
+ NS_ASSERTION(last->e_o_s || last->granulepos >= 0,
+ "Must know last granulepos!");
+ if (mUnstamped.Length() == 1) {
+ auto& packet = mUnstamped[0];
+ long blockSize = vorbis_packet_blocksize(&mVorbisInfo, packet.get());
+ if (blockSize < 0) {
+ // On failure vorbis_packet_blocksize returns < 0. If we've got
+ // a bad packet, we just assume that decode will have to skip this
+ // packet, i.e. assume 0 samples are decodable from this packet.
+ blockSize = 0;
+ mPrevVorbisBlockSize = 0;
+ }
+ long samples = mPrevVorbisBlockSize / 4 + blockSize / 4;
+ mPrevVorbisBlockSize = blockSize;
+ if (packet->granulepos == -1) {
+ packet->granulepos = mGranulepos + samples;
+ }
+
+ // Account for a partial last frame
+ if (packet->e_o_s && packet->granulepos >= mGranulepos) {
+ samples = packet->granulepos - mGranulepos;
+ }
+
+ mGranulepos = packet->granulepos;
+ RecordVorbisPacketSamples(packet.get(), samples);
+ return;
+ }
+
+ bool unknownGranulepos = last->granulepos == -1;
+ int totalSamples = 0;
+ for (int32_t i = mUnstamped.Length() - 1; i > 0; i--) {
+ auto& packet = mUnstamped[i];
+ auto& prev = mUnstamped[i - 1];
+ ogg_int64_t granulepos = packet->granulepos;
+ NS_ASSERTION(granulepos != -1, "Must know granulepos!");
+ long prevBlockSize = vorbis_packet_blocksize(&mVorbisInfo, prev.get());
+ long blockSize = vorbis_packet_blocksize(&mVorbisInfo, packet.get());
+
+ if (blockSize < 0 || prevBlockSize < 0) {
+ // On failure vorbis_packet_blocksize returns < 0. If we've got
+ // a bad packet, we just assume that decode will have to skip this
+ // packet, i.e. assume 0 samples are decodable from this packet.
+ blockSize = 0;
+ prevBlockSize = 0;
+ }
+
+ long samples = prevBlockSize / 4 + blockSize / 4;
+ totalSamples += samples;
+ prev->granulepos = granulepos - samples;
+ RecordVorbisPacketSamples(packet.get(), samples);
+ }
+
+ if (unknownGranulepos) {
+ for (uint32_t i = 0; i < mUnstamped.Length(); i++) {
+ mUnstamped[i]->granulepos += mGranulepos + totalSamples + 1;
+ }
+ }
+
+ auto& first = mUnstamped[0];
+ long blockSize = vorbis_packet_blocksize(&mVorbisInfo, first.get());
+ if (blockSize < 0) {
+ mPrevVorbisBlockSize = 0;
+ blockSize = 0;
+ }
+
+ long samples = (mPrevVorbisBlockSize == 0)
+ ? 0
+ : mPrevVorbisBlockSize / 4 + blockSize / 4;
+ int64_t start = first->granulepos - samples;
+ RecordVorbisPacketSamples(first.get(), samples);
+
+ if (last->e_o_s && start < mGranulepos) {
+ // We've calculated that there are more samples in this page than its
+ // granulepos claims, and it's the last page in the stream. This is legal,
+ // and we will need to prune the trailing samples when we come to decode it.
+ // We must correct the timestamps so that they follow the last Vorbis page's
+ // samples.
+ int64_t pruned = mGranulepos - start;
+ for (uint32_t i = 0; i < mUnstamped.Length() - 1; i++) {
+ mUnstamped[i]->granulepos += pruned;
+ }
+#ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+ mVorbisPacketSamples[last.get()] -= pruned;
+#endif
+ }
+
+ mPrevVorbisBlockSize = vorbis_packet_blocksize(&mVorbisInfo, last.get());
+ mPrevVorbisBlockSize = std::max(static_cast<long>(0), mPrevVorbisBlockSize);
+ mGranulepos = last->granulepos;
+}
+
+OpusState::OpusState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage, uint32_t aSerial)
+ : OggCodecState(aSandbox, aBosPage, aSerial, true),
+ mParser(nullptr),
+ mDecoder(nullptr),
+ mPrevPacketGranulepos(0),
+ mPrevPageGranulepos(0) {
+ MOZ_COUNT_CTOR(OpusState);
+}
+
+OpusState::~OpusState() {
+ MOZ_COUNT_DTOR(OpusState);
+ Reset();
+
+ if (mDecoder) {
+ opus_multistream_decoder_destroy(mDecoder);
+ mDecoder = nullptr;
+ }
+}
+
+nsresult OpusState::Reset() { return Reset(false); }
+
+nsresult OpusState::Reset(bool aStart) {
+ nsresult res = NS_OK;
+
+ if (mActive && mDecoder) {
+ // Reset the decoder.
+ opus_multistream_decoder_ctl(mDecoder, OPUS_RESET_STATE);
+ // This lets us distinguish the first page being the last page vs. just
+ // not having processed the previous page when we encounter the last page.
+ mPrevPageGranulepos = aStart ? 0 : -1;
+ mPrevPacketGranulepos = aStart ? 0 : -1;
+ }
+
+ // Clear queued data.
+ if (NS_FAILED(OggCodecState::Reset())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ LOG(LogLevel::Debug, ("Opus decoder reset"));
+
+ return res;
+}
+
+bool OpusState::Init(void) {
+ if (!mActive) {
+ return false;
+ }
+
+ int error;
+
+ NS_ASSERTION(mDecoder == nullptr, "leaking OpusDecoder");
+
+ mDecoder = opus_multistream_decoder_create(
+ mParser->mRate, mParser->mChannels, mParser->mStreams,
+ mParser->mCoupledStreams, mParser->mMappingTable, &error);
+
+ mInfo.mMimeType = "audio/opus"_ns;
+ mInfo.mRate = mParser->mRate;
+ mInfo.mChannels = mParser->mChannels;
+ mInfo.mBitDepth = 16;
+ // Save preskip & the first header packet for the Opus decoder
+ OpusCodecSpecificData opusData;
+ opusData.mContainerCodecDelayMicroSeconds = Time(0, mParser->mPreSkip);
+
+ if (!mHeaders.PeekFront()) {
+ return false;
+ }
+ opusData.mHeadersBinaryBlob->AppendElements(mHeaders.PeekFront()->packet,
+ mHeaders.PeekFront()->bytes);
+ mInfo.mCodecSpecificConfig = AudioCodecSpecificVariant{std::move(opusData)};
+
+ mHeaders.Erase();
+ LOG(LogLevel::Debug, ("Opus decoder init"));
+
+ return error == OPUS_OK;
+}
+
+bool OpusState::DecodeHeader(OggPacketPtr aPacket) {
+ switch (mPacketCount++) {
+ // Parse the id header.
+ case 0:
+ mParser = MakeUnique<OpusParser>();
+ if (!mParser->DecodeHeader(aPacket->packet, aPacket->bytes)) {
+ return false;
+ }
+ mHeaders.Append(std::move(aPacket));
+ break;
+
+ // Parse the metadata header.
+ case 1:
+ if (!mParser->DecodeTags(aPacket->packet, aPacket->bytes)) {
+ return false;
+ }
+ break;
+
+ // We made it to the first data packet (which includes reconstructing
+ // timestamps for it in PageIn). Success!
+ default:
+ mDoneReadingHeaders = true;
+ // Put it back on the queue so we can decode it.
+ mPackets.PushFront(std::move(aPacket));
+ break;
+ }
+ return true;
+}
+
+/* Construct and return a tags hashmap from our internal array */
+UniquePtr<MetadataTags> OpusState::GetTags() {
+ auto tags = MakeUnique<MetadataTags>();
+ for (uint32_t i = 0; i < mParser->mTags.Length(); i++) {
+ AddVorbisComment(tags, mParser->mTags[i].Data(),
+ mParser->mTags[i].Length());
+ }
+
+ return tags;
+}
+
+/* Return the timestamp (in microseconds) equivalent to a granulepos. */
+int64_t OpusState::Time(int64_t aGranulepos) {
+ if (!mActive) {
+ return -1;
+ }
+
+ return Time(mParser->mPreSkip, aGranulepos);
+}
+
+int64_t OpusState::Time(int aPreSkip, int64_t aGranulepos) {
+ if (aGranulepos < 0) {
+ return -1;
+ }
+
+ // Ogg Opus always runs at a granule rate of 48 kHz.
+ CheckedInt64 t = SaferMultDiv(aGranulepos - aPreSkip, USECS_PER_S, 48000);
+ return t.isValid() ? t.value() : -1;
+}
+
+bool OpusState::IsHeader(ogg_packet* aPacket) {
+ return aPacket->bytes >= 16 && (!memcmp(aPacket->packet, "OpusHead", 8) ||
+ !memcmp(aPacket->packet, "OpusTags", 8));
+}
+
+nsresult OpusState::PageIn(tainted_opaque_ogg<ogg_page*> aPage) {
+ if (!mActive) {
+ return NS_OK;
+ }
+ NS_ASSERTION((rlbox::sandbox_static_cast<uint32_t>(sandbox_invoke(
+ *mSandbox, ogg_page_serialno, aPage)) == mSerial)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON),
+ "Page must be for this stream!");
+ if (sandbox_invoke(*mSandbox, ogg_stream_pagein, mState, aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == -1) {
+ return NS_ERROR_FAILURE;
+ }
+
+ bool haveGranulepos;
+ nsresult rv = PacketOutUntilGranulepos(haveGranulepos);
+ if (NS_FAILED(rv) || !haveGranulepos || mPacketCount < 2) {
+ return rv;
+ }
+ if (!ReconstructOpusGranulepos()) {
+ return NS_ERROR_FAILURE;
+ }
+ for (uint32_t i = 0; i < mUnstamped.Length(); i++) {
+ OggPacketPtr packet = std::move(mUnstamped[i]);
+ NS_ASSERTION(!IsHeader(packet.get()), "Don't try to play a header packet");
+ NS_ASSERTION(packet->granulepos != -1, "Packet should have a granulepos");
+ mPackets.Append(std::move(packet));
+ }
+ mUnstamped.Clear();
+ return NS_OK;
+}
+
+// Helper method to return the change in granule position due to an Opus packet
+// (as distinct from the number of samples in the packet, which depends on the
+// decoder rate). It should work with a multistream Opus file, and continue to
+// work should we ever allow the decoder to decode at a rate other than 48 kHz.
+// It even works before we've created the actual Opus decoder.
+static int GetOpusDeltaGP(ogg_packet* packet) {
+ int nframes;
+ nframes = opus_packet_get_nb_frames(packet->packet, packet->bytes);
+ if (nframes > 0) {
+ return nframes * opus_packet_get_samples_per_frame(packet->packet, 48000);
+ }
+ NS_WARNING("Invalid Opus packet.");
+ return nframes;
+}
+
+int64_t OpusState::PacketDuration(ogg_packet* aPacket) {
+ CheckedInt64 t = SaferMultDiv(GetOpusDeltaGP(aPacket), USECS_PER_S, 48000);
+ return t.isValid() ? t.value() : -1;
+}
+
+bool OpusState::ReconstructOpusGranulepos(void) {
+ NS_ASSERTION(mUnstamped.Length() > 0, "Must have unstamped packets");
+ NS_ASSERTION(mUnstamped.LastElement()->e_o_s ||
+ mUnstamped.LastElement()->granulepos > 0,
+ "Must know last granulepos!");
+ int64_t gp;
+ // If this is the last page, and we've seen at least one previous page (or
+ // this is the first page)...
+ if (mUnstamped.LastElement()->e_o_s) {
+ auto& last = mUnstamped.LastElement();
+ if (mPrevPageGranulepos != -1) {
+ // If this file only has one page and the final granule position is
+ // smaller than the pre-skip amount, we MUST reject the stream.
+ if (!mDoneReadingHeaders && last->granulepos < mParser->mPreSkip)
+ return false;
+ int64_t last_gp = last->granulepos;
+ gp = mPrevPageGranulepos;
+ // Loop through the packets forwards, adding the current packet's
+ // duration to the previous granulepos to get the value for the
+ // current packet.
+ for (uint32_t i = 0; i < mUnstamped.Length() - 1; ++i) {
+ auto& packet = mUnstamped[i];
+ int offset = GetOpusDeltaGP(packet.get());
+ // Check for error (negative offset) and overflow.
+ if (offset >= 0 && gp <= INT64_MAX - offset) {
+ gp += offset;
+ if (gp >= last_gp) {
+ NS_WARNING("Opus end trimming removed more than a full packet.");
+ // We were asked to remove a full packet's worth of data or more.
+ // Encoders SHOULD NOT produce streams like this, but we'll handle
+ // it for them anyway.
+ gp = last_gp;
+ mUnstamped.RemoveLastElements(mUnstamped.Length() - (i + 1));
+ packet->e_o_s = 1;
+ }
+ }
+ packet->granulepos = gp;
+ }
+ mPrevPageGranulepos = last_gp;
+ return true;
+ } else {
+ NS_WARNING("No previous granule position to use for Opus end trimming.");
+ // If we don't have a previous granule position, fall through.
+ // We simply won't trim any samples from the end.
+ // TODO: Are we guaranteed to have seen a previous page if there is one?
+ }
+ }
+
+ auto& last = mUnstamped.LastElement();
+ gp = last->granulepos;
+ // Loop through the packets backwards, subtracting the next
+ // packet's duration from its granulepos to get the value
+ // for the current packet.
+ for (uint32_t i = mUnstamped.Length() - 1; i > 0; i--) {
+ int offset = GetOpusDeltaGP(mUnstamped[i].get());
+ // Check for error (negative offset) and overflow.
+ if (offset >= 0) {
+ if (offset <= gp) {
+ gp -= offset;
+ } else {
+ // If the granule position of the first data page is smaller than the
+ // number of decodable audio samples on that page, then we MUST reject
+ // the stream.
+ if (!mDoneReadingHeaders) return false;
+ // It's too late to reject the stream.
+ // If we get here, this almost certainly means the file has screwed-up
+ // timestamps somewhere after the first page.
+ NS_WARNING("Clamping negative Opus granulepos to zero.");
+ gp = 0;
+ }
+ }
+ mUnstamped[i - 1]->granulepos = gp;
+ }
+
+ // Check to make sure the first granule position is at least as large as the
+ // total number of samples decodable from the first page with completed
+ // packets. This requires looking at the duration of the first packet, too.
+ // We MUST reject such streams.
+ if (!mDoneReadingHeaders && GetOpusDeltaGP(mUnstamped[0].get()) > gp) {
+ return false;
+ }
+ mPrevPageGranulepos = last->granulepos;
+ return true;
+}
+
+already_AddRefed<MediaRawData> OpusState::PacketOutAsMediaRawData() {
+ ogg_packet* packet = PacketPeek();
+ if (!packet) {
+ return nullptr;
+ }
+
+ uint32_t frames = 0;
+ const int64_t endFrame = packet->granulepos;
+
+ if (packet->e_o_s) {
+ frames = GetOpusDeltaGP(packet);
+ }
+
+ RefPtr<MediaRawData> data = OggCodecState::PacketOutAsMediaRawData();
+ if (!data) {
+ return nullptr;
+ }
+
+ if (data->mEOS && mPrevPacketGranulepos != -1) {
+ // If this is the last packet, perform end trimming.
+ int64_t startFrame = mPrevPacketGranulepos;
+ frames -= std::max<int64_t>(
+ 0, std::min(endFrame - startFrame, static_cast<int64_t>(frames)));
+ data->mDiscardPadding = frames;
+ }
+
+ // Save this packet's granule position in case we need to perform end
+ // trimming on the next packet.
+ mPrevPacketGranulepos = endFrame;
+
+ return data.forget();
+}
+
+FlacState::FlacState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage, uint32_t aSerial)
+ : OggCodecState(aSandbox, aBosPage, aSerial, true) {}
+
+bool FlacState::DecodeHeader(OggPacketPtr aPacket) {
+ if (mParser.DecodeHeaderBlock(aPacket->packet, aPacket->bytes).isErr()) {
+ return false;
+ }
+ if (mParser.HasFullMetadata()) {
+ mDoneReadingHeaders = true;
+ }
+ return true;
+}
+
+int64_t FlacState::Time(int64_t granulepos) {
+ if (!mParser.mInfo.IsValid()) {
+ return -1;
+ }
+ CheckedInt64 t = SaferMultDiv(granulepos, USECS_PER_S, mParser.mInfo.mRate);
+ if (!t.isValid()) {
+ return -1;
+ }
+ return t.value();
+}
+
+int64_t FlacState::PacketDuration(ogg_packet* aPacket) {
+ return mParser.BlockDuration(aPacket->packet, aPacket->bytes);
+}
+
+bool FlacState::IsHeader(ogg_packet* aPacket) {
+ auto res = mParser.IsHeaderBlock(aPacket->packet, aPacket->bytes);
+ return res.isOk() ? res.unwrap() : false;
+}
+
+nsresult FlacState::PageIn(tainted_opaque_ogg<ogg_page*> aPage) {
+ if (!mActive) {
+ return NS_OK;
+ }
+ NS_ASSERTION((rlbox::sandbox_static_cast<uint32_t>(sandbox_invoke(
+ *mSandbox, ogg_page_serialno, aPage)) == mSerial)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON),
+ "Page must be for this stream!");
+ if (sandbox_invoke(*mSandbox, ogg_stream_pagein, mState, aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == -1) {
+ return NS_ERROR_FAILURE;
+ }
+ bool foundGp;
+ nsresult res = PacketOutUntilGranulepos(foundGp);
+ if (NS_FAILED(res)) {
+ return res;
+ }
+ if (foundGp && mDoneReadingHeaders) {
+ // We've found a packet with a granulepos, and we've loaded our metadata
+ // and initialized our decoder. Determine granulepos of buffered packets.
+ ReconstructFlacGranulepos();
+ for (uint32_t i = 0; i < mUnstamped.Length(); ++i) {
+ OggPacketPtr packet = std::move(mUnstamped[i]);
+ NS_ASSERTION(!IsHeader(packet.get()),
+ "Don't try to recover header packet gp");
+ NS_ASSERTION(packet->granulepos != -1, "Packet must have gp by now");
+ mPackets.Append(std::move(packet));
+ }
+ mUnstamped.Clear();
+ }
+ return NS_OK;
+}
+
+// Return a hash table with tag metadata.
+UniquePtr<MetadataTags> FlacState::GetTags() { return mParser.GetTags(); }
+
+const TrackInfo* FlacState::GetInfo() const { return &mParser.mInfo; }
+
+bool FlacState::ReconstructFlacGranulepos(void) {
+ NS_ASSERTION(mUnstamped.Length() > 0, "Must have unstamped packets");
+ auto& last = mUnstamped.LastElement();
+ NS_ASSERTION(last->e_o_s || last->granulepos > 0,
+ "Must know last granulepos!");
+ int64_t gp;
+
+ gp = last->granulepos;
+ // Loop through the packets backwards, subtracting the next
+ // packet's duration from its granulepos to get the value
+ // for the current packet.
+ for (uint32_t i = mUnstamped.Length() - 1; i > 0; i--) {
+ int offset =
+ mParser.BlockDuration(mUnstamped[i]->packet, mUnstamped[i]->bytes);
+ // Check for error (negative offset) and overflow.
+ if (offset >= 0) {
+ if (offset <= gp) {
+ gp -= offset;
+ } else {
+ // If the granule position of the first data page is smaller than the
+ // number of decodable audio samples on that page, then we MUST reject
+ // the stream.
+ if (!mDoneReadingHeaders) {
+ return false;
+ }
+ // It's too late to reject the stream.
+ // If we get here, this almost certainly means the file has screwed-up
+ // timestamps somewhere after the first page.
+ NS_WARNING("Clamping negative granulepos to zero.");
+ gp = 0;
+ }
+ }
+ mUnstamped[i - 1]->granulepos = gp;
+ }
+
+ return true;
+}
+
+SkeletonState::SkeletonState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial)
+ : OggCodecState(aSandbox, aBosPage, aSerial, true),
+ mVersion(0),
+ mPresentationTime(0),
+ mLength(0) {
+ MOZ_COUNT_CTOR(SkeletonState);
+}
+
+SkeletonState::~SkeletonState() { MOZ_COUNT_DTOR(SkeletonState); }
+
+// Support for Ogg Skeleton 4.0, as per specification at:
+// http://wiki.xiph.org/Ogg_Skeleton_4
+
+// Minimum length in bytes of a Skeleton header packet.
+static const long SKELETON_MIN_HEADER_LEN = 28;
+static const long SKELETON_4_0_MIN_HEADER_LEN = 80;
+
+// Minimum length in bytes of a Skeleton 4.0 index packet.
+static const long SKELETON_4_0_MIN_INDEX_LEN = 42;
+
+// Minimum length in bytes of a Skeleton 3.0/4.0 Fisbone packet.
+static const long SKELETON_MIN_FISBONE_LEN = 52;
+
+// Minimum possible size of a compressed index keypoint.
+static const size_t MIN_KEY_POINT_SIZE = 2;
+
+// Byte offset of the major and minor version numbers in the
+// Ogg Skeleton 4.0 header packet.
+static const size_t SKELETON_VERSION_MAJOR_OFFSET = 8;
+static const size_t SKELETON_VERSION_MINOR_OFFSET = 10;
+
+// Byte-offsets of the presentation time numerator and denominator
+static const size_t SKELETON_PRESENTATION_TIME_NUMERATOR_OFFSET = 12;
+static const size_t SKELETON_PRESENTATION_TIME_DENOMINATOR_OFFSET = 20;
+
+// Byte-offsets of the length of file field in the Skeleton 4.0 header packet.
+static const size_t SKELETON_FILE_LENGTH_OFFSET = 64;
+
+// Byte-offsets of the fields in the Skeleton index packet.
+static const size_t INDEX_SERIALNO_OFFSET = 6;
+static const size_t INDEX_NUM_KEYPOINTS_OFFSET = 10;
+static const size_t INDEX_TIME_DENOM_OFFSET = 18;
+static const size_t INDEX_FIRST_NUMER_OFFSET = 26;
+static const size_t INDEX_LAST_NUMER_OFFSET = 34;
+static const size_t INDEX_KEYPOINT_OFFSET = 42;
+
+// Byte-offsets of the fields in the Skeleton Fisbone packet.
+static const size_t FISBONE_MSG_FIELDS_OFFSET = 8;
+static const size_t FISBONE_SERIALNO_OFFSET = 12;
+
+static bool IsSkeletonBOS(ogg_packet* aPacket) {
+ static_assert(SKELETON_MIN_HEADER_LEN >= 8,
+ "Minimum length of skeleton BOS header incorrect");
+ return aPacket->bytes >= SKELETON_MIN_HEADER_LEN &&
+ memcmp(reinterpret_cast<char*>(aPacket->packet), "fishead", 8) == 0;
+}
+
+static bool IsSkeletonIndex(ogg_packet* aPacket) {
+ static_assert(SKELETON_4_0_MIN_INDEX_LEN >= 5,
+ "Minimum length of skeleton index header incorrect");
+ return aPacket->bytes >= SKELETON_4_0_MIN_INDEX_LEN &&
+ memcmp(reinterpret_cast<char*>(aPacket->packet), "index", 5) == 0;
+}
+
+static bool IsSkeletonFisbone(ogg_packet* aPacket) {
+ static_assert(SKELETON_MIN_FISBONE_LEN >= 8,
+ "Minimum length of skeleton fisbone header incorrect");
+ return aPacket->bytes >= SKELETON_MIN_FISBONE_LEN &&
+ memcmp(reinterpret_cast<char*>(aPacket->packet), "fisbone", 8) == 0;
+}
+
+// Reads a variable length encoded integer at p. Will not read
+// past aLimit. Returns pointer to character after end of integer.
+static const unsigned char* ReadVariableLengthInt(const unsigned char* p,
+ const unsigned char* aLimit,
+ int64_t& n) {
+ int shift = 0;
+ int64_t byte = 0;
+ n = 0;
+ while (p < aLimit && (byte & 0x80) != 0x80 && shift < 57) {
+ byte = static_cast<int64_t>(*p);
+ n |= ((byte & 0x7f) << shift);
+ shift += 7;
+ p++;
+ }
+ return p;
+}
+
+bool SkeletonState::DecodeIndex(ogg_packet* aPacket) {
+ NS_ASSERTION(aPacket->bytes >= SKELETON_4_0_MIN_INDEX_LEN,
+ "Index must be at least minimum size");
+ if (!mActive) {
+ return false;
+ }
+
+ uint32_t serialno =
+ LittleEndian::readUint32(aPacket->packet + INDEX_SERIALNO_OFFSET);
+ int64_t numKeyPoints =
+ LittleEndian::readInt64(aPacket->packet + INDEX_NUM_KEYPOINTS_OFFSET);
+
+ int64_t endTime = 0, startTime = 0;
+ const unsigned char* p = aPacket->packet;
+
+ int64_t timeDenom =
+ LittleEndian::readInt64(aPacket->packet + INDEX_TIME_DENOM_OFFSET);
+ if (timeDenom == 0) {
+ LOG(LogLevel::Debug, ("Ogg Skeleton Index packet for stream %u has 0 "
+ "timestamp denominator.",
+ serialno));
+ return (mActive = false);
+ }
+
+ // Extract the start time.
+ int64_t timeRawInt = LittleEndian::readInt64(p + INDEX_FIRST_NUMER_OFFSET);
+ CheckedInt64 t = SaferMultDiv(timeRawInt, USECS_PER_S, timeDenom);
+ if (!t.isValid()) {
+ return (mActive = false);
+ } else {
+ startTime = t.value();
+ }
+
+ // Extract the end time.
+ timeRawInt = LittleEndian::readInt64(p + INDEX_LAST_NUMER_OFFSET);
+ t = SaferMultDiv(timeRawInt, USECS_PER_S, timeDenom);
+ if (!t.isValid()) {
+ return (mActive = false);
+ } else {
+ endTime = t.value();
+ }
+
+ // Check the numKeyPoints value read, ensure we're not going to run out of
+ // memory while trying to decode the index packet.
+ CheckedInt64 minPacketSize =
+ (CheckedInt64(numKeyPoints) * MIN_KEY_POINT_SIZE) + INDEX_KEYPOINT_OFFSET;
+ if (!minPacketSize.isValid()) {
+ return (mActive = false);
+ }
+
+ int64_t sizeofIndex = aPacket->bytes - INDEX_KEYPOINT_OFFSET;
+ int64_t maxNumKeyPoints = sizeofIndex / MIN_KEY_POINT_SIZE;
+ if (aPacket->bytes < minPacketSize.value() ||
+ numKeyPoints > maxNumKeyPoints || numKeyPoints < 0) {
+ // Packet size is less than the theoretical minimum size, or the packet is
+ // claiming to store more keypoints than it's capable of storing. This means
+ // that the numKeyPoints field is too large or small for the packet to
+ // possibly contain as many packets as it claims to, so the numKeyPoints
+ // field is possibly malicious. Don't try decoding this index, we may run
+ // out of memory.
+ LOG(LogLevel::Debug, ("Possibly malicious number of key points reported "
+ "(%" PRId64 ") in index packet for stream %u.",
+ numKeyPoints, serialno));
+ return (mActive = false);
+ }
+
+ UniquePtr<nsKeyFrameIndex> keyPoints(new nsKeyFrameIndex(startTime, endTime));
+
+ p = aPacket->packet + INDEX_KEYPOINT_OFFSET;
+ const unsigned char* limit = aPacket->packet + aPacket->bytes;
+ int64_t numKeyPointsRead = 0;
+ CheckedInt64 offset = 0;
+ CheckedInt64 time = 0;
+ while (p < limit && numKeyPointsRead < numKeyPoints) {
+ int64_t delta = 0;
+ p = ReadVariableLengthInt(p, limit, delta);
+ offset += delta;
+ if (p == limit || !offset.isValid() || offset.value() > mLength ||
+ offset.value() < 0) {
+ return (mActive = false);
+ }
+ p = ReadVariableLengthInt(p, limit, delta);
+ time += delta;
+ if (!time.isValid() || time.value() > endTime || time.value() < startTime) {
+ return (mActive = false);
+ }
+ CheckedInt64 timeUsecs = SaferMultDiv(time.value(), USECS_PER_S, timeDenom);
+ if (!timeUsecs.isValid()) {
+ return (mActive = false);
+ }
+ keyPoints->Add(offset.value(), timeUsecs.value());
+ numKeyPointsRead++;
+ }
+
+ int32_t keyPointsRead = keyPoints->Length();
+ if (keyPointsRead > 0) {
+ mIndex.InsertOrUpdate(serialno, std::move(keyPoints));
+ }
+
+ LOG(LogLevel::Debug, ("Loaded %d keypoints for Skeleton on stream %u",
+ keyPointsRead, serialno));
+ return true;
+}
+
+nsresult SkeletonState::IndexedSeekTargetForTrack(uint32_t aSerialno,
+ int64_t aTarget,
+ nsKeyPoint& aResult) {
+ nsKeyFrameIndex* index = nullptr;
+ mIndex.Get(aSerialno, &index);
+
+ if (!index || index->Length() == 0 || aTarget < index->mStartTime ||
+ aTarget > index->mEndTime) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Binary search to find the last key point with time less than target.
+ int start = 0;
+ int end = index->Length() - 1;
+ while (end > start) {
+ int mid = start + ((end - start + 1) >> 1);
+ if (index->Get(mid).mTime == aTarget) {
+ start = mid;
+ break;
+ } else if (index->Get(mid).mTime < aTarget) {
+ start = mid;
+ } else {
+ end = mid - 1;
+ }
+ }
+
+ aResult = index->Get(start);
+ NS_ASSERTION(aResult.mTime <= aTarget, "Result should have time <= target");
+ return NS_OK;
+}
+
+nsresult SkeletonState::IndexedSeekTarget(int64_t aTarget,
+ nsTArray<uint32_t>& aTracks,
+ nsSeekTarget& aResult) {
+ if (!mActive || mVersion < SKELETON_VERSION(4, 0)) {
+ return NS_ERROR_FAILURE;
+ }
+ // Loop over all requested tracks' indexes, and get the keypoint for that
+ // seek target. Record the keypoint with the lowest offset, this will be
+ // our seek result. User must seek to the one with lowest offset to ensure we
+ // pass "keyframes" on all tracks when we decode forwards to the seek target.
+ nsSeekTarget r;
+ for (uint32_t i = 0; i < aTracks.Length(); i++) {
+ nsKeyPoint k;
+ if (NS_SUCCEEDED(IndexedSeekTargetForTrack(aTracks[i], aTarget, k)) &&
+ k.mOffset < r.mKeyPoint.mOffset) {
+ r.mKeyPoint = k;
+ r.mSerial = aTracks[i];
+ }
+ }
+ if (r.IsNull()) {
+ return NS_ERROR_FAILURE;
+ }
+ LOG(LogLevel::Debug,
+ ("Indexed seek target for time %" PRId64 " is offset %" PRId64, aTarget,
+ r.mKeyPoint.mOffset));
+ aResult = r;
+ return NS_OK;
+}
+
+nsresult SkeletonState::GetDuration(const nsTArray<uint32_t>& aTracks,
+ int64_t& aDuration) {
+ if (!mActive || mVersion < SKELETON_VERSION(4, 0) || !HasIndex() ||
+ aTracks.Length() == 0) {
+ return NS_ERROR_FAILURE;
+ }
+ int64_t endTime = INT64_MIN;
+ int64_t startTime = INT64_MAX;
+ for (uint32_t i = 0; i < aTracks.Length(); i++) {
+ nsKeyFrameIndex* index = nullptr;
+ mIndex.Get(aTracks[i], &index);
+ if (!index) {
+ // Can't get the timestamps for one of the required tracks, fail.
+ return NS_ERROR_FAILURE;
+ }
+ if (index->mEndTime > endTime) {
+ endTime = index->mEndTime;
+ }
+ if (index->mStartTime < startTime) {
+ startTime = index->mStartTime;
+ }
+ }
+ NS_ASSERTION(endTime > startTime, "Duration must be positive");
+ CheckedInt64 duration = CheckedInt64(endTime) - startTime;
+ aDuration = duration.isValid() ? duration.value() : 0;
+ return duration.isValid() ? NS_OK : NS_ERROR_FAILURE;
+}
+
+bool SkeletonState::DecodeFisbone(ogg_packet* aPacket) {
+ if (aPacket->bytes < static_cast<long>(FISBONE_MSG_FIELDS_OFFSET + 4)) {
+ return false;
+ }
+ uint32_t offsetMsgField =
+ LittleEndian::readUint32(aPacket->packet + FISBONE_MSG_FIELDS_OFFSET);
+
+ if (aPacket->bytes < static_cast<long>(FISBONE_SERIALNO_OFFSET + 4)) {
+ return false;
+ }
+ uint32_t serialno =
+ LittleEndian::readUint32(aPacket->packet + FISBONE_SERIALNO_OFFSET);
+
+ CheckedUint32 checked_fields_pos =
+ CheckedUint32(FISBONE_MSG_FIELDS_OFFSET) + offsetMsgField;
+ if (!checked_fields_pos.isValid() ||
+ aPacket->bytes < static_cast<int64_t>(checked_fields_pos.value())) {
+ return false;
+ }
+ int64_t msgLength = aPacket->bytes - checked_fields_pos.value();
+ char* msgProbe = (char*)aPacket->packet + checked_fields_pos.value();
+ char* msgHead = msgProbe;
+ UniquePtr<MessageField> field(new MessageField());
+
+ const static FieldPatternType kFieldTypeMaps[] = {
+ {"Content-Type:", eContentType},
+ {"Role:", eRole},
+ {"Name:", eName},
+ {"Language:", eLanguage},
+ {"Title:", eTitle},
+ {"Display-hint:", eDisplayHint},
+ {"Altitude:", eAltitude},
+ {"TrackOrder:", eTrackOrder},
+ {"Track dependencies:", eTrackDependencies}};
+
+ bool isContentTypeParsed = false;
+ while (msgLength > 1) {
+ if (*msgProbe == '\r' && *(msgProbe + 1) == '\n') {
+ nsAutoCString strMsg(msgHead, msgProbe - msgHead);
+ for (size_t i = 0; i < ArrayLength(kFieldTypeMaps); i++) {
+ if (strMsg.Find(kFieldTypeMaps[i].mPatternToRecognize) != -1) {
+ // The content of message header fields follows [RFC2822], and the
+ // mandatory message field must be encoded in US-ASCII, others
+ // must be be encoded in UTF-8. "Content-Type" must come first
+ // for all of message header fields.
+ // See
+ // http://svn.annodex.net/standards/draft-pfeiffer-oggskeleton-current.txt.
+ if (i != 0 && !isContentTypeParsed) {
+ return false;
+ }
+
+ if ((i == 0 && IsAscii(strMsg)) || (i != 0 && IsUtf8(strMsg))) {
+ EMsgHeaderType eHeaderType = kFieldTypeMaps[i].mMsgHeaderType;
+ Unused << field->mValuesStore.LookupOrInsertWith(
+ eHeaderType, [i, msgHead, msgProbe]() {
+ uint32_t nameLen =
+ strlen(kFieldTypeMaps[i].mPatternToRecognize);
+ return MakeUnique<nsCString>(msgHead + nameLen,
+ msgProbe - msgHead - nameLen);
+ });
+ isContentTypeParsed = i == 0 ? true : isContentTypeParsed;
+ }
+ break;
+ }
+ }
+ msgProbe += 2;
+ msgLength -= 2;
+ msgHead = msgProbe;
+ continue;
+ }
+ msgLength--;
+ msgProbe++;
+ }
+
+ return mMsgFieldStore.WithEntryHandle(serialno, [&](auto&& entry) {
+ if (entry) {
+ // mMsgFieldStore has an entry for serialno already.
+ return false;
+ }
+ entry.Insert(std::move(field));
+ return true;
+ });
+}
+
+bool SkeletonState::DecodeHeader(OggPacketPtr aPacket) {
+ if (IsSkeletonBOS(aPacket.get())) {
+ uint16_t verMajor = LittleEndian::readUint16(aPacket->packet +
+ SKELETON_VERSION_MAJOR_OFFSET);
+ uint16_t verMinor = LittleEndian::readUint16(aPacket->packet +
+ SKELETON_VERSION_MINOR_OFFSET);
+
+ // Read the presentation time. We read this before the version check as the
+ // presentation time exists in all versions.
+ int64_t n = LittleEndian::readInt64(
+ aPacket->packet + SKELETON_PRESENTATION_TIME_NUMERATOR_OFFSET);
+ int64_t d = LittleEndian::readInt64(
+ aPacket->packet + SKELETON_PRESENTATION_TIME_DENOMINATOR_OFFSET);
+ mPresentationTime =
+ d == 0 ? 0
+ : (static_cast<float>(n) / static_cast<float>(d)) * USECS_PER_S;
+
+ mVersion = SKELETON_VERSION(verMajor, verMinor);
+ // We can only care to parse Skeleton version 4.0+.
+ if (mVersion < SKELETON_VERSION(4, 0) ||
+ mVersion >= SKELETON_VERSION(5, 0) ||
+ aPacket->bytes < SKELETON_4_0_MIN_HEADER_LEN) {
+ return false;
+ }
+
+ // Extract the segment length.
+ mLength =
+ LittleEndian::readInt64(aPacket->packet + SKELETON_FILE_LENGTH_OFFSET);
+
+ LOG(LogLevel::Debug, ("Skeleton segment length: %" PRId64, mLength));
+
+ // Initialize the serialno-to-index map.
+ return true;
+ }
+ if (IsSkeletonIndex(aPacket.get()) && mVersion >= SKELETON_VERSION(4, 0)) {
+ return DecodeIndex(aPacket.get());
+ }
+ if (IsSkeletonFisbone(aPacket.get())) {
+ return DecodeFisbone(aPacket.get());
+ }
+ if (aPacket->e_o_s) {
+ mDoneReadingHeaders = true;
+ }
+ return true;
+}
+
+#undef LOG
+
+} // namespace mozilla
diff --git a/dom/media/ogg/OggCodecState.h b/dom/media/ogg/OggCodecState.h
new file mode 100644
index 0000000000..b8a3857875
--- /dev/null
+++ b/dom/media/ogg/OggCodecState.h
@@ -0,0 +1,628 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(OggCodecState_h_)
+# define OggCodecState_h_
+
+# include <ogg/ogg.h>
+// For MOZ_SAMPLE_TYPE_*
+# include "FlacFrameParser.h"
+# include "OggRLBoxTypes.h"
+# include "VideoUtils.h"
+# include <nsDeque.h>
+# include <nsTArray.h>
+# include <nsClassHashtable.h>
+
+# include <theora/theoradec.h>
+# ifdef MOZ_TREMOR
+# include <tremor/ivorbiscodec.h>
+# else
+# include <vorbis/codec.h>
+# endif
+
+// Uncomment the following to validate that we're predicting the number
+// of Vorbis samples in each packet correctly.
+# define VALIDATE_VORBIS_SAMPLE_CALCULATION
+# ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+# include <map>
+# endif
+
+struct OpusMSDecoder;
+
+namespace mozilla {
+
+inline constexpr char RLBOX_SAFE_DEBUG_ASSERTION[] =
+ "Tainted data is being inspected only for debugging purposes. This is not "
+ "a condition that is critical for safety of the renderer.";
+
+inline constexpr char RLBOX_OGG_STATE_ASSERT_REASON[] =
+ "Tainted data is being inspected only to check the internal state of "
+ "libogg structures. This is not a condition that is critical for safety of "
+ "the renderer.";
+
+inline constexpr char RLBOX_OGG_PAGE_SERIAL_REASON[] =
+ "We are checking the serial of the page. If libogg is operating correctly, "
+ "we check serial numbers to make sure the Firefox renderer is correctly "
+ "passing streams to the correct source. If libogg has been corrupted, it "
+ "could return an incorrect serial, however this would mean that an OGG "
+ "file has intentionally corrupted data across multiple logical streams. "
+ "This however cannot compromise memory safety of the renderer.";
+
+class OpusParser;
+
+struct OggPacketDeletePolicy {
+ void operator()(ogg_packet* aPacket) const {
+ delete[] aPacket->packet;
+ delete aPacket;
+ }
+};
+
+using OggPacketPtr = UniquePtr<ogg_packet, OggPacketDeletePolicy>;
+
+// Deallocates a packet, used in OggPacketQueue below.
+class OggPacketDeallocator : public nsDequeFunctor<ogg_packet> {
+ virtual void operator()(ogg_packet* aPacket) override {
+ OggPacketDeletePolicy()(aPacket);
+ }
+};
+
+// A queue of ogg_packets. When we read a page, we extract the page's packets
+// and buffer them in the owning stream's OggCodecState. This is because
+// if we're skipping up to the next keyframe in very large frame sized videos,
+// there may be several megabytes of data between keyframes, and the
+// ogg_stream_state would end up resizing its buffer every time we added a
+// new 4KB page to the bitstream, which kills performance on Windows. This
+// also gives us the option to timestamp packets rather than decoded
+// frames/samples, reducing the amount of frames/samples we must decode to
+// determine start-time at a particular offset, and gives us finer control
+// over memory usage.
+class OggPacketQueue : private nsDeque<ogg_packet> {
+ public:
+ OggPacketQueue() : nsDeque(new OggPacketDeallocator()) {}
+ ~OggPacketQueue() { Erase(); }
+ bool IsEmpty() { return nsDeque<ogg_packet>::GetSize() == 0; }
+ void Append(OggPacketPtr aPacket);
+ OggPacketPtr PopFront() {
+ return OggPacketPtr(nsDeque<ogg_packet>::PopFront());
+ }
+ ogg_packet* PeekFront() { return nsDeque<ogg_packet>::PeekFront(); }
+ OggPacketPtr Pop() { return OggPacketPtr(nsDeque<ogg_packet>::Pop()); }
+ ogg_packet* operator[](size_t aIndex) const {
+ return nsDeque<ogg_packet>::ObjectAt(aIndex);
+ }
+ size_t Length() const { return nsDeque<ogg_packet>::GetSize(); }
+ void PushFront(OggPacketPtr aPacket) {
+ nsDeque<ogg_packet>::PushFront(aPacket.release());
+ }
+ void Erase() { nsDeque<ogg_packet>::Erase(); }
+};
+
+// Encapsulates the data required for decoding an ogg bitstream and for
+// converting granulepos to timestamps.
+class OggCodecState {
+ public:
+ typedef mozilla::MetadataTags MetadataTags;
+ // Ogg types we know about
+ enum CodecType {
+ TYPE_VORBIS = 0,
+ TYPE_THEORA,
+ TYPE_OPUS,
+ TYPE_SKELETON,
+ TYPE_FLAC,
+ TYPE_UNKNOWN
+ };
+
+ virtual ~OggCodecState();
+
+ // Factory for creating nsCodecStates. Use instead of constructor.
+ // aPage should be a beginning-of-stream page.
+ static UniquePtr<OggCodecState> Create(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aPage,
+ uint32_t aSerial);
+
+ virtual CodecType GetType() { return TYPE_UNKNOWN; }
+
+ // Reads a header packet. Returns false if an error was encountered
+ // while reading header packets. Callers should check DoneReadingHeaders()
+ // to determine if the last header has been read.
+ // This function takes ownership of the packet and is responsible for
+ // releasing it or queuing it for later processing.
+ virtual bool DecodeHeader(OggPacketPtr aPacket) {
+ return (mDoneReadingHeaders = true);
+ }
+
+ // Build a hash table with tag metadata parsed from the stream.
+ virtual UniquePtr<MetadataTags> GetTags() { return nullptr; }
+
+ // Returns the end time that a granulepos represents.
+ virtual int64_t Time(int64_t granulepos) { return -1; }
+
+ // Returns the start time that a granulepos represents.
+ virtual int64_t StartTime(int64_t granulepos) { return -1; }
+
+ // Returns the duration of the given packet, if it can be determined.
+ virtual int64_t PacketDuration(ogg_packet* aPacket) { return -1; }
+
+ // Returns the start time of the given packet, if it can be determined.
+ virtual int64_t PacketStartTime(ogg_packet* aPacket) {
+ if (aPacket->granulepos < 0) {
+ return -1;
+ }
+ int64_t endTime = Time(aPacket->granulepos);
+ int64_t duration = PacketDuration(aPacket);
+ if (duration > endTime) {
+ // Audio preskip may eat a whole packet or more.
+ return 0;
+ } else {
+ return endTime - duration;
+ }
+ }
+
+ // Initializes the codec state.
+ virtual bool Init() { return true; }
+
+ // Returns true when this bitstream has finished reading all its
+ // header packets.
+ bool DoneReadingHeaders() { return mDoneReadingHeaders; }
+
+ // Deactivates the bitstream. Only the primary video and audio bitstreams
+ // should be active.
+ void Deactivate() {
+ mActive = false;
+ mDoneReadingHeaders = true;
+ Reset();
+ }
+
+ // Resets decoding state.
+ virtual nsresult Reset();
+
+ // Returns true if the OggCodecState thinks this packet is a header
+ // packet. Note this does not verify the validity of the header packet,
+ // it just guarantees that the packet is marked as a header packet (i.e.
+ // it is definintely not a data packet). Do not use this to identify
+ // streams, use it to filter header packets from data packets while
+ // decoding.
+ virtual bool IsHeader(ogg_packet* aPacket) { return false; }
+
+ // Returns true if the OggCodecState thinks this packet represents a
+ // keyframe, from which decoding can restart safely.
+ virtual bool IsKeyframe(ogg_packet* aPacket) { return true; }
+
+ // Returns true if there is a packet available for dequeueing in the stream.
+ bool IsPacketReady();
+
+ // Returns the next raw packet in the stream, or nullptr if there are no more
+ // packets buffered in the packet queue. More packets can be buffered by
+ // inserting one or more pages into the stream by calling PageIn().
+ // The packet will have a valid granulepos.
+ OggPacketPtr PacketOut();
+
+ // Returns the next raw packet in the stream, or nullptr if there are no more
+ // packets buffered in the packet queue, without consuming it.
+ // The packet will have a valid granulepos.
+ ogg_packet* PacketPeek();
+
+ // Moves all raw packets from aOther to the front of the current packet queue.
+ void PushFront(OggPacketQueue&& aOther);
+
+ // Returns the next packet in the stream as a MediaRawData, or nullptr
+ // if there are no more packets buffered in the packet queue. More packets
+ // can be buffered by inserting one or more pages into the stream by calling
+ // PageIn(). The packet will have a valid granulepos.
+ virtual already_AddRefed<MediaRawData> PacketOutAsMediaRawData();
+
+ // Extracts all packets from the page, and inserts them into the packet
+ // queue. They can be extracted by calling PacketOut(). Packets from an
+ // inactive stream are not buffered, i.e. this call has no effect for
+ // inactive streams. Multiple pages may need to be inserted before
+ // PacketOut() starts to return packets, as granulepos may need to be
+ // captured.
+ virtual nsresult PageIn(tainted_opaque_ogg<ogg_page*> aPage);
+
+ // Returns the maximum number of microseconds which a keyframe can be offset
+ // from any given interframe.b
+ virtual int64_t MaxKeyframeOffset() { return 0; }
+ // Public access for mTheoraInfo.keyframe_granule_shift
+ virtual int32_t KeyFrameGranuleJobs() { return 0; }
+
+ // Number of packets read.
+ uint64_t mPacketCount;
+
+ // Serial number of the bitstream.
+ uint32_t mSerial;
+
+ // Ogg specific state.
+ tainted_opaque_ogg<ogg_stream_state*> mState;
+
+ // Queue of as yet undecoded packets. Packets are guaranteed to have
+ // a valid granulepos.
+ OggPacketQueue mPackets;
+
+ // Is the bitstream active; whether we're decoding and playing this bitstream.
+ bool mActive;
+
+ // True when all headers packets have been read.
+ bool mDoneReadingHeaders;
+
+ // All invocations of libogg functionality from the demuxer is sandboxed using
+ // wasm library sandboxes on supported platforms. This is the sandbox
+ // instance.
+ rlbox_sandbox_ogg* mSandbox;
+
+ virtual const TrackInfo* GetInfo() const {
+ MOZ_RELEASE_ASSERT(false, "Can't be called directly");
+ return nullptr;
+ }
+
+ // Validation utility for vorbis-style tag names.
+ static bool IsValidVorbisTagName(nsCString& aName);
+
+ // Utility method to parse and add a vorbis-style comment
+ // to a metadata hash table. Most Ogg-encapsulated codecs
+ // use the vorbis comment format for metadata.
+ static bool AddVorbisComment(UniquePtr<MetadataTags>& aTags,
+ const char* aComment, uint32_t aLength);
+
+ protected:
+ // Constructs a new OggCodecState. aActive denotes whether the stream is
+ // active. For streams of unsupported or unknown types, aActive should be
+ // false.
+ OggCodecState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage, uint32_t aSerial,
+ bool aActive);
+
+ // Deallocates all packets stored in mUnstamped, and clears the array.
+ void ClearUnstamped();
+
+ // Extracts packets out of mState until a data packet with a non -1
+ // granulepos is encountered, or no more packets are readable. Header
+ // packets are pushed into the packet queue immediately, and data packets
+ // are buffered in mUnstamped. Once a non -1 granulepos packet is read
+ // the granulepos of the packets in mUnstamped can be inferred, and they
+ // can be pushed over to mPackets. Used by PageIn() implementations in
+ // subclasses.
+ nsresult PacketOutUntilGranulepos(bool& aFoundGranulepos);
+
+ // Temporary buffer in which to store packets while we're reading packets
+ // in order to capture granulepos.
+ nsTArray<OggPacketPtr> mUnstamped;
+
+ bool SetCodecSpecificConfig(MediaByteBuffer* aBuffer,
+ OggPacketQueue& aHeaders);
+
+ private:
+ bool InternalInit();
+};
+
+class VorbisState : public OggCodecState {
+ public:
+ explicit VorbisState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial);
+ virtual ~VorbisState();
+
+ CodecType GetType() override { return TYPE_VORBIS; }
+ bool DecodeHeader(OggPacketPtr aPacket) override;
+ int64_t Time(int64_t granulepos) override;
+ int64_t PacketDuration(ogg_packet* aPacket) override;
+ bool Init() override;
+ nsresult Reset() override;
+ bool IsHeader(ogg_packet* aPacket) override;
+ nsresult PageIn(tainted_opaque_ogg<ogg_page*> aPage) override;
+ const TrackInfo* GetInfo() const override { return &mInfo; }
+
+ // Return a hash table with tag metadata.
+ UniquePtr<MetadataTags> GetTags() override;
+
+ private:
+ AudioInfo mInfo;
+ vorbis_info mVorbisInfo;
+ vorbis_comment mComment;
+ vorbis_dsp_state mDsp;
+ vorbis_block mBlock;
+ OggPacketQueue mHeaders;
+
+ // Returns the end time that a granulepos represents.
+ static int64_t Time(vorbis_info* aInfo, int64_t aGranulePos);
+
+ // Reconstructs the granulepos of Vorbis packets stored in the mUnstamped
+ // array.
+ void ReconstructVorbisGranulepos();
+
+ // The "block size" of the previously decoded Vorbis packet, or 0 if we've
+ // not yet decoded anything. This is used to calculate the number of samples
+ // in a Vorbis packet, since each Vorbis packet depends on the previous
+ // packet while being decoded.
+ long mPrevVorbisBlockSize;
+
+ // Granulepos (end sample) of the last decoded Vorbis packet. This is used
+ // to calculate the Vorbis granulepos when we don't find a granulepos to
+ // back-propagate from.
+ int64_t mGranulepos;
+
+# ifdef VALIDATE_VORBIS_SAMPLE_CALCULATION
+ // When validating that we've correctly predicted Vorbis packets' number
+ // of samples, we store each packet's predicted number of samples in this
+ // map, and verify we decode the predicted number of samples.
+ std::map<ogg_packet*, long> mVorbisPacketSamples;
+# endif
+
+ // Records that aPacket is predicted to have aSamples samples.
+ // This function has no effect if VALIDATE_VORBIS_SAMPLE_CALCULATION
+ // is not defined.
+ void RecordVorbisPacketSamples(ogg_packet* aPacket, long aSamples);
+
+ // Verifies that aPacket has had its number of samples predicted.
+ // This function has no effect if VALIDATE_VORBIS_SAMPLE_CALCULATION
+ // is not defined.
+ void AssertHasRecordedPacketSamples(ogg_packet* aPacket);
+
+ public:
+ // Asserts that the number of samples predicted for aPacket is aSamples.
+ // This function has no effect if VALIDATE_VORBIS_SAMPLE_CALCULATION
+ // is not defined.
+ void ValidateVorbisPacketSamples(ogg_packet* aPacket, long aSamples);
+};
+
+// Returns 1 if the Theora info struct is decoding a media of Theora
+// version (maj,min,sub) or later, otherwise returns 0.
+int TheoraVersion(th_info* info, unsigned char maj, unsigned char min,
+ unsigned char sub);
+
+class TheoraState : public OggCodecState {
+ public:
+ explicit TheoraState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial);
+ virtual ~TheoraState();
+
+ CodecType GetType() override { return TYPE_THEORA; }
+ bool DecodeHeader(OggPacketPtr aPacket) override;
+ int64_t Time(int64_t granulepos) override;
+ int64_t StartTime(int64_t granulepos) override;
+ int64_t PacketDuration(ogg_packet* aPacket) override;
+ bool Init() override;
+ nsresult Reset() override;
+ bool IsHeader(ogg_packet* aPacket) override;
+ bool IsKeyframe(ogg_packet* aPacket) override;
+ nsresult PageIn(tainted_opaque_ogg<ogg_page*> aPage) override;
+ const TrackInfo* GetInfo() const override { return &mInfo; }
+ int64_t MaxKeyframeOffset() override;
+ int32_t KeyFrameGranuleJobs() override {
+ return mTheoraInfo.keyframe_granule_shift;
+ }
+
+ private:
+ // Returns the end time that a granulepos represents.
+ static int64_t Time(th_info* aInfo, int64_t aGranulePos);
+
+ th_info mTheoraInfo;
+ th_comment mComment;
+ th_setup_info* mSetup;
+ th_dec_ctx* mCtx;
+
+ VideoInfo mInfo;
+ OggPacketQueue mHeaders;
+
+ // Reconstructs the granulepos of Theora packets stored in the
+ // mUnstamped array. mUnstamped must be filled with consecutive packets from
+ // the stream, with the last packet having a known granulepos. Using this
+ // known granulepos, and the known frame numbers, we recover the granulepos
+ // of all frames in the array. This enables us to determine their timestamps.
+ void ReconstructTheoraGranulepos();
+};
+
+class OpusState : public OggCodecState {
+ public:
+ explicit OpusState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage, uint32_t aSerial);
+ virtual ~OpusState();
+
+ CodecType GetType() override { return TYPE_OPUS; }
+ bool DecodeHeader(OggPacketPtr aPacket) override;
+ int64_t Time(int64_t aGranulepos) override;
+ int64_t PacketDuration(ogg_packet* aPacket) override;
+ bool Init() override;
+ nsresult Reset() override;
+ nsresult Reset(bool aStart);
+ bool IsHeader(ogg_packet* aPacket) override;
+ nsresult PageIn(tainted_opaque_ogg<ogg_page*> aPage) override;
+ already_AddRefed<MediaRawData> PacketOutAsMediaRawData() override;
+ const TrackInfo* GetInfo() const override { return &mInfo; }
+
+ // Returns the end time that a granulepos represents.
+ static int64_t Time(int aPreSkip, int64_t aGranulepos);
+
+ // Construct and return a table of tags from the metadata header.
+ UniquePtr<MetadataTags> GetTags() override;
+
+ private:
+ UniquePtr<OpusParser> mParser;
+ OpusMSDecoder* mDecoder;
+
+ // Granule position (end sample) of the last decoded Opus packet. This is
+ // used to calculate the amount we should trim from the last packet.
+ int64_t mPrevPacketGranulepos;
+
+ // Reconstructs the granulepos of Opus packets stored in the
+ // mUnstamped array. mUnstamped must be filled with consecutive packets from
+ // the stream, with the last packet having a known granulepos. Using this
+ // known granulepos, and the known frame numbers, we recover the granulepos
+ // of all frames in the array. This enables us to determine their timestamps.
+ bool ReconstructOpusGranulepos();
+
+ // Granule position (end sample) of the last decoded Opus page. This is
+ // used to calculate the Opus per-packet granule positions on the last page,
+ // where we may need to trim some samples from the end.
+ int64_t mPrevPageGranulepos;
+ AudioInfo mInfo;
+ OggPacketQueue mHeaders;
+};
+
+// Constructs a 32bit version number out of two 16 bit major,minor
+// version numbers.
+# define SKELETON_VERSION(major, minor) (((major) << 16) | (minor))
+
+enum EMsgHeaderType {
+ eContentType,
+ eRole,
+ eName,
+ eLanguage,
+ eTitle,
+ eDisplayHint,
+ eAltitude,
+ eTrackOrder,
+ eTrackDependencies
+};
+
+struct FieldPatternType {
+ const char* mPatternToRecognize;
+ EMsgHeaderType mMsgHeaderType;
+};
+
+// Stores the message information for different logical bitstream.
+struct MessageField {
+ nsClassHashtable<nsUint32HashKey, nsCString> mValuesStore;
+};
+
+class SkeletonState : public OggCodecState {
+ public:
+ explicit SkeletonState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage,
+ uint32_t aSerial);
+ ~SkeletonState();
+
+ nsClassHashtable<nsUint32HashKey, MessageField> mMsgFieldStore;
+
+ CodecType GetType() override { return TYPE_SKELETON; }
+ bool DecodeHeader(OggPacketPtr aPacket) override;
+ int64_t Time(int64_t granulepos) override { return -1; }
+ bool IsHeader(ogg_packet* aPacket) override { return true; }
+
+ // Return true if the given time (in milliseconds) is within
+ // the presentation time defined in the skeleton track.
+ bool IsPresentable(int64_t aTime) { return aTime >= mPresentationTime; }
+
+ // Stores the offset of the page on which a keyframe starts,
+ // and its presentation time.
+ class nsKeyPoint {
+ public:
+ nsKeyPoint() : mOffset(INT64_MAX), mTime(INT64_MAX) {}
+
+ nsKeyPoint(int64_t aOffset, int64_t aTime)
+ : mOffset(aOffset), mTime(aTime) {}
+
+ // Offset from start of segment/link-in-the-chain in bytes.
+ int64_t mOffset;
+
+ // Presentation time in usecs.
+ int64_t mTime;
+
+ bool IsNull() { return mOffset == INT64_MAX && mTime == INT64_MAX; }
+ };
+
+ // Stores a keyframe's byte-offset, presentation time and the serialno
+ // of the stream it belongs to.
+ class nsSeekTarget {
+ public:
+ nsSeekTarget() : mSerial(0) {}
+ nsKeyPoint mKeyPoint;
+ uint32_t mSerial;
+ bool IsNull() { return mKeyPoint.IsNull() && mSerial == 0; }
+ };
+
+ // Determines from the seek index the keyframe which you must seek back to
+ // in order to get all keyframes required to render all streams with
+ // serialnos in aTracks, at time aTarget.
+ nsresult IndexedSeekTarget(int64_t aTarget, nsTArray<uint32_t>& aTracks,
+ nsSeekTarget& aResult);
+
+ bool HasIndex() const { return mIndex.Count() > 0; }
+
+ // Returns the duration of the active tracks in the media, if we have
+ // an index. aTracks must be filled with the serialnos of the active tracks.
+ // The duration is calculated as the greatest end time of all active tracks,
+ // minus the smalled start time of all the active tracks.
+ nsresult GetDuration(const nsTArray<uint32_t>& aTracks, int64_t& aDuration);
+
+ private:
+ // Decodes an index packet. Returns false on failure.
+ bool DecodeIndex(ogg_packet* aPacket);
+ // Decodes an fisbone packet. Returns false on failure.
+ bool DecodeFisbone(ogg_packet* aPacket);
+
+ // Gets the keypoint you must seek to in order to get the keyframe required
+ // to render the stream at time aTarget on stream with serial aSerialno.
+ nsresult IndexedSeekTargetForTrack(uint32_t aSerialno, int64_t aTarget,
+ nsKeyPoint& aResult);
+
+ // Version of the decoded skeleton track, as per the SKELETON_VERSION macro.
+ uint32_t mVersion;
+
+ // Presentation time of the resource in milliseconds
+ int64_t mPresentationTime;
+
+ // Length of the resource in bytes.
+ int64_t mLength;
+
+ // Stores the keyframe index and duration information for a particular
+ // stream.
+ class nsKeyFrameIndex {
+ public:
+ nsKeyFrameIndex(int64_t aStartTime, int64_t aEndTime)
+ : mStartTime(aStartTime), mEndTime(aEndTime) {
+ MOZ_COUNT_CTOR(nsKeyFrameIndex);
+ }
+
+ MOZ_COUNTED_DTOR(nsKeyFrameIndex)
+
+ void Add(int64_t aOffset, int64_t aTimeMs) {
+ mKeyPoints.AppendElement(nsKeyPoint(aOffset, aTimeMs));
+ }
+
+ const nsKeyPoint& Get(uint32_t aIndex) const { return mKeyPoints[aIndex]; }
+
+ uint32_t Length() const { return mKeyPoints.Length(); }
+
+ // Presentation time of the first sample in this stream in usecs.
+ const int64_t mStartTime;
+
+ // End time of the last sample in this stream in usecs.
+ const int64_t mEndTime;
+
+ private:
+ nsTArray<nsKeyPoint> mKeyPoints;
+ };
+
+ // Maps Ogg serialnos to the index-keypoint list.
+ nsClassHashtable<nsUint32HashKey, nsKeyFrameIndex> mIndex;
+};
+
+class FlacState : public OggCodecState {
+ public:
+ explicit FlacState(rlbox_sandbox_ogg* aSandbox,
+ tainted_opaque_ogg<ogg_page*> aBosPage, uint32_t aSerial);
+
+ CodecType GetType() override { return TYPE_FLAC; }
+ bool DecodeHeader(OggPacketPtr aPacket) override;
+ int64_t Time(int64_t granulepos) override;
+ int64_t PacketDuration(ogg_packet* aPacket) override;
+ bool IsHeader(ogg_packet* aPacket) override;
+ nsresult PageIn(tainted_opaque_ogg<ogg_page*> aPage) override;
+
+ // Return a hash table with tag metadata.
+ UniquePtr<MetadataTags> GetTags() override;
+
+ const TrackInfo* GetInfo() const override;
+
+ private:
+ bool ReconstructFlacGranulepos(void);
+
+ FlacFrameParser mParser;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/OggCodecStore.cpp b/dom/media/ogg/OggCodecStore.cpp
new file mode 100644
index 0000000000..ef3498adec
--- /dev/null
+++ b/dom/media/ogg/OggCodecStore.cpp
@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/DebugOnly.h"
+
+#include "OggCodecStore.h"
+
+namespace mozilla {
+
+OggCodecStore::OggCodecStore() : mMonitor("CodecStore") {}
+
+OggCodecState* OggCodecStore::Add(uint32_t serial,
+ UniquePtr<OggCodecState> codecState) {
+ MonitorAutoLock mon(mMonitor);
+ return mCodecStates.InsertOrUpdate(serial, std::move(codecState)).get();
+}
+
+bool OggCodecStore::Contains(uint32_t serial) {
+ MonitorAutoLock mon(mMonitor);
+ return mCodecStates.Get(serial, nullptr);
+}
+
+OggCodecState* OggCodecStore::Get(uint32_t serial) {
+ MonitorAutoLock mon(mMonitor);
+ return mCodecStates.Get(serial);
+}
+
+} // namespace mozilla
diff --git a/dom/media/ogg/OggCodecStore.h b/dom/media/ogg/OggCodecStore.h
new file mode 100644
index 0000000000..bcde8bed00
--- /dev/null
+++ b/dom/media/ogg/OggCodecStore.h
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(OggCodecStore_h_)
+# define OggCodecStore_h_
+
+# include <ogg/ogg.h>
+
+# include "OggCodecState.h"
+# include "VideoUtils.h"
+# include "mozilla/Monitor.h"
+
+namespace mozilla {
+
+// Thread safe container to store the codec information and the serial for each
+// streams.
+class OggCodecStore {
+ public:
+ OggCodecStore();
+ OggCodecState* Add(uint32_t serial, UniquePtr<OggCodecState> codecState);
+ bool Contains(uint32_t serial);
+ OggCodecState* Get(uint32_t serial);
+ bool IsKnownStream(uint32_t aSerial);
+
+ private:
+ // Maps Ogg serialnos to OggStreams.
+ nsClassHashtable<nsUint32HashKey, OggCodecState> mCodecStates;
+
+ // Protects the |mCodecStates| and the |mKnownStreams| members.
+ Monitor mMonitor MOZ_UNANNOTATED;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/OggDecoder.cpp b/dom/media/ogg/OggDecoder.cpp
new file mode 100644
index 0000000000..5f6d61f694
--- /dev/null
+++ b/dom/media/ogg/OggDecoder.cpp
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "OggDecoder.h"
+#include "MediaContainerType.h"
+#include "MediaDecoder.h"
+#include "mozilla/StaticPrefs_media.h"
+#include "nsMimeTypes.h"
+
+namespace mozilla {
+
+/* static */
+bool OggDecoder::IsSupportedType(const MediaContainerType& aContainerType) {
+ if (!StaticPrefs::media_ogg_enabled()) {
+ return false;
+ }
+
+ if (aContainerType.Type() != MEDIAMIMETYPE(AUDIO_OGG) &&
+ aContainerType.Type() != MEDIAMIMETYPE(VIDEO_OGG) &&
+ aContainerType.Type() != MEDIAMIMETYPE("application/ogg")) {
+ return false;
+ }
+
+ const bool isOggVideo = (aContainerType.Type() != MEDIAMIMETYPE(AUDIO_OGG));
+
+ const MediaCodecs& codecs = aContainerType.ExtendedType().Codecs();
+ if (codecs.IsEmpty()) {
+ // Ogg guarantees that the only codecs it contained are supported.
+ return true;
+ }
+ // Verify that all the codecs specified are ones that we expect that
+ // we can play.
+ for (const auto& codec : codecs.Range()) {
+ if ((MediaDecoder::IsOpusEnabled() && codec.EqualsLiteral("opus")) ||
+ codec.EqualsLiteral("vorbis") || codec.EqualsLiteral("flac")) {
+ continue;
+ }
+ // Note: Only accept Theora in a video container type, not in an audio
+ // container type.
+ if (isOggVideo && codec.EqualsLiteral("theora")) {
+ continue;
+ }
+ // Some unsupported codec.
+ return false;
+ }
+ return true;
+}
+
+/* static */
+nsTArray<UniquePtr<TrackInfo>> OggDecoder::GetTracksInfo(
+ const MediaContainerType& aType) {
+ nsTArray<UniquePtr<TrackInfo>> tracks;
+ if (!IsSupportedType(aType)) {
+ return tracks;
+ }
+
+ const MediaCodecs& codecs = aType.ExtendedType().Codecs();
+ if (codecs.IsEmpty()) {
+ // Codecs must be specified for ogg as it can't be implied.
+ return tracks;
+ }
+
+ for (const auto& codec : codecs.Range()) {
+ if (codec.EqualsLiteral("opus") || codec.EqualsLiteral("vorbis") ||
+ codec.EqualsLiteral("flac")) {
+ tracks.AppendElement(
+ CreateTrackInfoWithMIMETypeAndContainerTypeExtraParameters(
+ "audio/"_ns + NS_ConvertUTF16toUTF8(codec), aType));
+ } else {
+ MOZ_ASSERT(codec.EqualsLiteral("theora"));
+ tracks.AppendElement(
+ CreateTrackInfoWithMIMETypeAndContainerTypeExtraParameters(
+ "video/"_ns + NS_ConvertUTF16toUTF8(codec), aType));
+ }
+ }
+ return tracks;
+}
+
+} // namespace mozilla
diff --git a/dom/media/ogg/OggDecoder.h b/dom/media/ogg/OggDecoder.h
new file mode 100644
index 0000000000..95e8663746
--- /dev/null
+++ b/dom/media/ogg/OggDecoder.h
@@ -0,0 +1,29 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(OggDecoder_h_)
+# define OggDecoder_h_
+
+# include "mozilla/UniquePtr.h"
+# include "nsTArray.h"
+
+namespace mozilla {
+
+class MediaContainerType;
+class TrackInfo;
+
+class OggDecoder {
+ public:
+ // Returns true if aContainerType is an Ogg type that we think we can render
+ // with an enabled platform decoder backend.
+ // If provided, codecs are checked for support.
+ static bool IsSupportedType(const MediaContainerType& aContainerType);
+ static nsTArray<UniquePtr<TrackInfo>> GetTracksInfo(
+ const MediaContainerType& aType);
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/OggDemuxer.cpp b/dom/media/ogg/OggDemuxer.cpp
new file mode 100644
index 0000000000..3885a59400
--- /dev/null
+++ b/dom/media/ogg/OggDemuxer.cpp
@@ -0,0 +1,2170 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "OggDemuxer.h"
+#include "OggRLBox.h"
+#include "MediaDataDemuxer.h"
+#include "OggCodecState.h"
+#include "XiphExtradata.h"
+#include "mozilla/AbstractThread.h"
+#include "mozilla/Atomics.h"
+#include "mozilla/PodOperations.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/SharedThreadPool.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/TimeStamp.h"
+#ifdef MOZ_WASM_SANDBOXING_OGG
+# include "mozilla/ipc/LibrarySandboxPreload.h"
+#endif
+#include "nsAutoRef.h"
+#include "nsError.h"
+
+#include <algorithm>
+
+extern mozilla::LazyLogModule gMediaDemuxerLog;
+#define OGG_DEBUG(arg, ...) \
+ DDMOZ_LOG(gMediaDemuxerLog, mozilla::LogLevel::Debug, "::%s: " arg, \
+ __func__, ##__VA_ARGS__)
+
+// Un-comment to enable logging of seek bisections.
+//#define SEEK_LOGGING
+#ifdef SEEK_LOGGING
+# define SEEK_LOG(type, msg) MOZ_LOG(gMediaDemuxerLog, type, msg)
+#else
+# define SEEK_LOG(type, msg)
+#endif
+
+#define CopyAndVerifyOrFail(t, cond, failed) \
+ (t).copy_and_verify([&](auto val) { \
+ if (!(cond)) { \
+ *(failed) = true; \
+ } \
+ return val; \
+ })
+
+namespace mozilla {
+
+using media::TimeInterval;
+using media::TimeIntervals;
+using media::TimeUnit;
+
+// The number of microseconds of "fuzz" we use in a bisection search over
+// HTTP. When we're seeking with fuzz, we'll stop the search if a bisection
+// lands between the seek target and OGG_SEEK_FUZZ_USECS microseconds before the
+// seek target. This is becaue it's usually quicker to just keep downloading
+// from an exisiting connection than to do another bisection inside that
+// small range, which would open a new HTTP connetion.
+static const uint32_t OGG_SEEK_FUZZ_USECS = 500000;
+
+// The number of microseconds of "pre-roll" we use for Opus streams.
+// The specification recommends 80 ms.
+static const int64_t OGG_SEEK_OPUS_PREROLL = 80 * USECS_PER_MS;
+
+static Atomic<uint32_t> sStreamSourceID(0u);
+
+OggDemuxer::nsAutoOggSyncState::nsAutoOggSyncState(rlbox_sandbox_ogg* aSandbox)
+ : mSandbox(aSandbox) {
+ if (mSandbox) {
+ tainted_ogg<ogg_sync_state*> state =
+ mSandbox->malloc_in_sandbox<ogg_sync_state>();
+ MOZ_RELEASE_ASSERT(state != nullptr);
+ mState = state.to_opaque();
+ sandbox_invoke(*mSandbox, ogg_sync_init, mState);
+ }
+}
+OggDemuxer::nsAutoOggSyncState::~nsAutoOggSyncState() {
+ if (mSandbox) {
+ sandbox_invoke(*mSandbox, ogg_sync_clear, mState);
+ mSandbox->free_in_sandbox(rlbox::from_opaque(mState));
+ tainted_ogg<ogg_sync_state*> null = nullptr;
+ mState = null.to_opaque();
+ }
+}
+
+/* static */
+rlbox_sandbox_ogg* OggDemuxer::CreateSandbox() {
+ rlbox_sandbox_ogg* sandbox = new rlbox_sandbox_ogg();
+#ifdef MOZ_WASM_SANDBOXING_OGG
+ bool success = sandbox->create_sandbox(false /* infallible */);
+#else
+ bool success = sandbox->create_sandbox();
+#endif
+ if (!success) {
+ delete sandbox;
+ sandbox = nullptr;
+ }
+ return sandbox;
+}
+
+void OggDemuxer::SandboxDestroy::operator()(rlbox_sandbox_ogg* sandbox) {
+ if (sandbox) {
+ sandbox->destroy_sandbox();
+ delete sandbox;
+ }
+}
+
+// Return the corresponding category in aKind based on the following specs.
+// (https://www.whatwg.org/specs/web-apps/current-
+// work/multipage/embedded-content.html#dom-audiotrack-kind) &
+// (http://wiki.xiph.org/SkeletonHeaders)
+const nsString OggDemuxer::GetKind(const nsCString& aRole) {
+ if (aRole.Find("audio/main") != -1 || aRole.Find("video/main") != -1) {
+ return u"main"_ns;
+ } else if (aRole.Find("audio/alternate") != -1 ||
+ aRole.Find("video/alternate") != -1) {
+ return u"alternative"_ns;
+ } else if (aRole.Find("audio/audiodesc") != -1) {
+ return u"descriptions"_ns;
+ } else if (aRole.Find("audio/described") != -1) {
+ return u"main-desc"_ns;
+ } else if (aRole.Find("audio/dub") != -1) {
+ return u"translation"_ns;
+ } else if (aRole.Find("audio/commentary") != -1) {
+ return u"commentary"_ns;
+ } else if (aRole.Find("video/sign") != -1) {
+ return u"sign"_ns;
+ } else if (aRole.Find("video/captioned") != -1) {
+ return u"captions"_ns;
+ } else if (aRole.Find("video/subtitled") != -1) {
+ return u"subtitles"_ns;
+ }
+ return u""_ns;
+}
+
+void OggDemuxer::InitTrack(MessageField* aMsgInfo, TrackInfo* aInfo,
+ bool aEnable) {
+ MOZ_ASSERT(aMsgInfo);
+ MOZ_ASSERT(aInfo);
+
+ nsCString* sName = aMsgInfo->mValuesStore.Get(eName);
+ nsCString* sRole = aMsgInfo->mValuesStore.Get(eRole);
+ nsCString* sTitle = aMsgInfo->mValuesStore.Get(eTitle);
+ nsCString* sLanguage = aMsgInfo->mValuesStore.Get(eLanguage);
+ aInfo->Init(sName ? NS_ConvertUTF8toUTF16(*sName) : EmptyString(),
+ sRole ? GetKind(*sRole) : u""_ns,
+ sTitle ? NS_ConvertUTF8toUTF16(*sTitle) : EmptyString(),
+ sLanguage ? NS_ConvertUTF8toUTF16(*sLanguage) : EmptyString(),
+ aEnable);
+}
+
+OggDemuxer::OggDemuxer(MediaResource* aResource)
+ : mSandbox(CreateSandbox()),
+ mTheoraState(nullptr),
+ mVorbisState(nullptr),
+ mOpusState(nullptr),
+ mFlacState(nullptr),
+ mOpusEnabled(MediaDecoder::IsOpusEnabled()),
+ mSkeletonState(nullptr),
+ mAudioOggState(aResource, mSandbox.get()),
+ mVideoOggState(aResource, mSandbox.get()),
+ mIsChained(false),
+ mTimedMetadataEvent(nullptr),
+ mOnSeekableEvent(nullptr) {
+ MOZ_COUNT_CTOR(OggDemuxer);
+ // aResource is referenced through inner m{Audio,Video}OffState members.
+ DDLINKCHILD("resource", aResource);
+}
+
+OggDemuxer::~OggDemuxer() {
+ MOZ_COUNT_DTOR(OggDemuxer);
+ Reset(TrackInfo::kAudioTrack);
+ Reset(TrackInfo::kVideoTrack);
+}
+
+void OggDemuxer::SetChainingEvents(TimedMetadataEventProducer* aMetadataEvent,
+ MediaEventProducer<void>* aOnSeekableEvent) {
+ mTimedMetadataEvent = aMetadataEvent;
+ mOnSeekableEvent = aOnSeekableEvent;
+}
+
+bool OggDemuxer::HasAudio() const {
+ return mVorbisState || mOpusState || mFlacState;
+}
+
+bool OggDemuxer::HasVideo() const { return mTheoraState; }
+
+bool OggDemuxer::HaveStartTime() const { return mStartTime.isSome(); }
+
+int64_t OggDemuxer::StartTime() const { return mStartTime.refOr(0); }
+
+bool OggDemuxer::HaveStartTime(TrackInfo::TrackType aType) {
+ return OggState(aType).mStartTime.isSome();
+}
+
+int64_t OggDemuxer::StartTime(TrackInfo::TrackType aType) {
+ return OggState(aType).mStartTime.refOr(TimeUnit::Zero()).ToMicroseconds();
+}
+
+RefPtr<OggDemuxer::InitPromise> OggDemuxer::Init() {
+ if (!mSandbox) {
+ return InitPromise::CreateAndReject(NS_ERROR_OUT_OF_MEMORY, __func__);
+ }
+ const char RLBOX_OGG_RETURN_CODE_SAFE[] =
+ "Return codes only control whether to early exit. Incorrect return codes "
+ "will not lead to memory safety issues in the renderer.";
+
+ int ret = sandbox_invoke(*mSandbox, ogg_sync_init,
+ OggSyncState(TrackInfo::kAudioTrack))
+ .unverified_safe_because(RLBOX_OGG_RETURN_CODE_SAFE);
+ if (ret != 0) {
+ return InitPromise::CreateAndReject(NS_ERROR_OUT_OF_MEMORY, __func__);
+ }
+ ret = sandbox_invoke(*mSandbox, ogg_sync_init,
+ OggSyncState(TrackInfo::kVideoTrack))
+ .unverified_safe_because(RLBOX_OGG_RETURN_CODE_SAFE);
+ if (ret != 0) {
+ return InitPromise::CreateAndReject(NS_ERROR_OUT_OF_MEMORY, __func__);
+ }
+ if (ReadMetadata() != NS_OK) {
+ return InitPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_METADATA_ERR,
+ __func__);
+ }
+
+ if (!GetNumberTracks(TrackInfo::kAudioTrack) &&
+ !GetNumberTracks(TrackInfo::kVideoTrack)) {
+ return InitPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_METADATA_ERR,
+ __func__);
+ }
+
+ return InitPromise::CreateAndResolve(NS_OK, __func__);
+}
+
+OggCodecState* OggDemuxer::GetTrackCodecState(
+ TrackInfo::TrackType aType) const {
+ switch (aType) {
+ case TrackInfo::kAudioTrack:
+ if (mVorbisState) {
+ return mVorbisState;
+ } else if (mOpusState) {
+ return mOpusState;
+ } else {
+ return mFlacState;
+ }
+ case TrackInfo::kVideoTrack:
+ return mTheoraState;
+ default:
+ return 0;
+ }
+}
+
+TrackInfo::TrackType OggDemuxer::GetCodecStateType(
+ OggCodecState* aState) const {
+ switch (aState->GetType()) {
+ case OggCodecState::TYPE_THEORA:
+ return TrackInfo::kVideoTrack;
+ case OggCodecState::TYPE_OPUS:
+ case OggCodecState::TYPE_VORBIS:
+ case OggCodecState::TYPE_FLAC:
+ return TrackInfo::kAudioTrack;
+ default:
+ return TrackInfo::kUndefinedTrack;
+ }
+}
+
+uint32_t OggDemuxer::GetNumberTracks(TrackInfo::TrackType aType) const {
+ switch (aType) {
+ case TrackInfo::kAudioTrack:
+ return HasAudio() ? 1 : 0;
+ case TrackInfo::kVideoTrack:
+ return HasVideo() ? 1 : 0;
+ default:
+ return 0;
+ }
+}
+
+UniquePtr<TrackInfo> OggDemuxer::GetTrackInfo(TrackInfo::TrackType aType,
+ size_t aTrackNumber) const {
+ switch (aType) {
+ case TrackInfo::kAudioTrack:
+ return mInfo.mAudio.Clone();
+ case TrackInfo::kVideoTrack:
+ return mInfo.mVideo.Clone();
+ default:
+ return nullptr;
+ }
+}
+
+already_AddRefed<MediaTrackDemuxer> OggDemuxer::GetTrackDemuxer(
+ TrackInfo::TrackType aType, uint32_t aTrackNumber) {
+ if (GetNumberTracks(aType) <= aTrackNumber) {
+ return nullptr;
+ }
+ RefPtr<OggTrackDemuxer> e = new OggTrackDemuxer(this, aType, aTrackNumber);
+ DDLINKCHILD("track demuxer", e.get());
+ mDemuxers.AppendElement(e);
+
+ return e.forget();
+}
+
+nsresult OggDemuxer::Reset(TrackInfo::TrackType aType) {
+ // Discard any previously buffered packets/pages.
+ if (mSandbox) {
+ sandbox_invoke(*mSandbox, ogg_sync_reset, OggSyncState(aType));
+ }
+ OggCodecState* trackState = GetTrackCodecState(aType);
+ if (trackState) {
+ return trackState->Reset();
+ }
+ OggState(aType).mNeedKeyframe = true;
+ return NS_OK;
+}
+
+bool OggDemuxer::ReadHeaders(TrackInfo::TrackType aType,
+ OggCodecState* aState) {
+ while (!aState->DoneReadingHeaders()) {
+ DemuxUntilPacketAvailable(aType, aState);
+ OggPacketPtr packet = aState->PacketOut();
+ if (!packet) {
+ OGG_DEBUG("Ran out of header packets early; deactivating stream %" PRIu32,
+ aState->mSerial);
+ aState->Deactivate();
+ return false;
+ }
+
+ // Local OggCodecState needs to decode headers in order to process
+ // packet granulepos -> time mappings, etc.
+ if (!aState->DecodeHeader(std::move(packet))) {
+ OGG_DEBUG(
+ "Failed to decode ogg header packet; deactivating stream %" PRIu32,
+ aState->mSerial);
+ aState->Deactivate();
+ return false;
+ }
+ }
+
+ return aState->Init();
+}
+
+void OggDemuxer::BuildSerialList(nsTArray<uint32_t>& aTracks) {
+ // Obtaining seek index information for currently active bitstreams.
+ if (HasVideo()) {
+ aTracks.AppendElement(mTheoraState->mSerial);
+ }
+ if (HasAudio()) {
+ if (mVorbisState) {
+ aTracks.AppendElement(mVorbisState->mSerial);
+ } else if (mOpusState) {
+ aTracks.AppendElement(mOpusState->mSerial);
+ }
+ }
+}
+
+void OggDemuxer::SetupTarget(OggCodecState** aSavedState,
+ OggCodecState* aNewState) {
+ if (*aSavedState) {
+ (*aSavedState)->Reset();
+ }
+
+ if (aNewState->GetInfo()->GetAsAudioInfo()) {
+ mInfo.mAudio = *aNewState->GetInfo()->GetAsAudioInfo();
+ } else {
+ mInfo.mVideo = *aNewState->GetInfo()->GetAsVideoInfo();
+ }
+ *aSavedState = aNewState;
+}
+
+void OggDemuxer::SetupTargetSkeleton() {
+ // Setup skeleton related information after mVorbisState & mTheroState
+ // being set (if they exist).
+ if (mSkeletonState) {
+ if (!HasAudio() && !HasVideo()) {
+ // We have a skeleton track, but no audio or video, may as well disable
+ // the skeleton, we can't do anything useful with this media.
+ OGG_DEBUG("Deactivating skeleton stream %" PRIu32,
+ mSkeletonState->mSerial);
+ mSkeletonState->Deactivate();
+ } else if (ReadHeaders(TrackInfo::kAudioTrack, mSkeletonState) &&
+ mSkeletonState->HasIndex()) {
+ // We don't particularly care about which track we are currently using
+ // as both MediaResource points to the same content.
+ // Extract the duration info out of the index, so we don't need to seek to
+ // the end of resource to get it.
+ nsTArray<uint32_t> tracks;
+ BuildSerialList(tracks);
+ int64_t duration = 0;
+ if (NS_SUCCEEDED(mSkeletonState->GetDuration(tracks, duration))) {
+ OGG_DEBUG("Got duration from Skeleton index %" PRId64, duration);
+ mInfo.mMetadataDuration.emplace(TimeUnit::FromMicroseconds(duration));
+ }
+ }
+ }
+}
+
+void OggDemuxer::SetupMediaTracksInfo(const nsTArray<uint32_t>& aSerials) {
+ // For each serial number
+ // 1. Retrieve a codecState from mCodecStore by this serial number.
+ // 2. Retrieve a message field from mMsgFieldStore by this serial number.
+ // 3. For now, skip if the serial number refers to a non-primary bitstream.
+ // 4. Setup track and other audio/video related information per different
+ // types.
+ for (size_t i = 0; i < aSerials.Length(); i++) {
+ uint32_t serial = aSerials[i];
+ OggCodecState* codecState = mCodecStore.Get(serial);
+
+ MessageField* msgInfo = nullptr;
+ if (mSkeletonState) {
+ mSkeletonState->mMsgFieldStore.Get(serial, &msgInfo);
+ }
+
+ OggCodecState* primeState = nullptr;
+ switch (codecState->GetType()) {
+ case OggCodecState::TYPE_THEORA:
+ primeState = mTheoraState;
+ break;
+ case OggCodecState::TYPE_VORBIS:
+ primeState = mVorbisState;
+ break;
+ case OggCodecState::TYPE_OPUS:
+ primeState = mOpusState;
+ break;
+ case OggCodecState::TYPE_FLAC:
+ primeState = mFlacState;
+ break;
+ default:
+ break;
+ }
+ if (primeState && primeState == codecState) {
+ bool isAudio = primeState->GetInfo()->GetAsAudioInfo();
+ if (msgInfo) {
+ InitTrack(
+ msgInfo,
+ isAudio ? static_cast<TrackInfo*>(&mInfo.mAudio) : &mInfo.mVideo,
+ true);
+ }
+ FillTags(isAudio ? static_cast<TrackInfo*>(&mInfo.mAudio) : &mInfo.mVideo,
+ primeState->GetTags());
+ }
+ }
+}
+
+void OggDemuxer::FillTags(TrackInfo* aInfo, UniquePtr<MetadataTags>&& aTags) {
+ if (!aTags) {
+ return;
+ }
+ UniquePtr<MetadataTags> tags(std::move(aTags));
+ for (const auto& entry : *tags) {
+ aInfo->mTags.AppendElement(MetadataTag(entry.GetKey(), entry.GetData()));
+ }
+}
+
+nsresult OggDemuxer::ReadMetadata() {
+ OGG_DEBUG("OggDemuxer::ReadMetadata called!");
+
+ // We read packets until all bitstreams have read all their header packets.
+ // We record the offset of the first non-header page so that we know
+ // what page to seek to when seeking to the media start.
+
+ // @FIXME we have to read all the header packets on all the streams
+ // and THEN we can run SetupTarget*
+ // @fixme fixme
+
+ TrackInfo::TrackType tracks[2] = {TrackInfo::kAudioTrack,
+ TrackInfo::kVideoTrack};
+
+ nsTArray<OggCodecState*> bitstreams;
+ nsTArray<uint32_t> serials;
+
+ for (uint32_t i = 0; i < ArrayLength(tracks); i++) {
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+
+ bool readAllBOS = false;
+ while (!readAllBOS) {
+ if (!ReadOggPage(tracks[i], page.to_opaque())) {
+ // Some kind of error...
+ OGG_DEBUG("OggDemuxer::ReadOggPage failed? leaving ReadMetadata...");
+ return NS_ERROR_FAILURE;
+ }
+
+ uint32_t serial = static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON));
+
+ if (!sandbox_invoke(*mSandbox, ogg_page_bos, page)
+ .unverified_safe_because(
+ "If this value is incorrect, it would mean not all "
+ "bitstreams are read. This does not affect the memory "
+ "safety of the renderer.")) {
+ // We've encountered a non Beginning Of Stream page. No more BOS pages
+ // can follow in this Ogg segment, so there will be no other bitstreams
+ // in the Ogg (unless it's invalid).
+ readAllBOS = true;
+ } else if (!mCodecStore.Contains(serial)) {
+ // We've not encountered a stream with this serial number before. Create
+ // an OggCodecState to demux it, and map that to the OggCodecState
+ // in mCodecStates.
+ OggCodecState* const codecState = mCodecStore.Add(
+ serial,
+ OggCodecState::Create(mSandbox.get(), page.to_opaque(), serial));
+ bitstreams.AppendElement(codecState);
+ serials.AppendElement(serial);
+ }
+ if (NS_FAILED(DemuxOggPage(tracks[i], page.to_opaque()))) {
+ return NS_ERROR_FAILURE;
+ }
+ }
+ }
+
+ // We've read all BOS pages, so we know the streams contained in the media.
+ // 1. Find the first encountered Theora/Vorbis/Opus bitstream, and configure
+ // it as the target A/V bitstream.
+ // 2. Deactivate the rest of bitstreams for now, until we have MediaInfo
+ // support multiple track infos.
+ for (uint32_t i = 0; i < bitstreams.Length(); ++i) {
+ OggCodecState* s = bitstreams[i];
+ if (s) {
+ if (s->GetType() == OggCodecState::TYPE_THEORA &&
+ ReadHeaders(TrackInfo::kVideoTrack, s)) {
+ if (!mTheoraState) {
+ SetupTarget(&mTheoraState, s);
+ } else {
+ s->Deactivate();
+ }
+ } else if (s->GetType() == OggCodecState::TYPE_VORBIS &&
+ ReadHeaders(TrackInfo::kAudioTrack, s)) {
+ if (!mVorbisState) {
+ SetupTarget(&mVorbisState, s);
+ } else {
+ s->Deactivate();
+ }
+ } else if (s->GetType() == OggCodecState::TYPE_OPUS &&
+ ReadHeaders(TrackInfo::kAudioTrack, s)) {
+ if (mOpusEnabled) {
+ if (!mOpusState) {
+ SetupTarget(&mOpusState, s);
+ } else {
+ s->Deactivate();
+ }
+ } else {
+ NS_WARNING(
+ "Opus decoding disabled."
+ " See media.opus.enabled in about:config");
+ }
+ } else if (s->GetType() == OggCodecState::TYPE_FLAC &&
+ ReadHeaders(TrackInfo::kAudioTrack, s)) {
+ if (!mFlacState) {
+ SetupTarget(&mFlacState, s);
+ } else {
+ s->Deactivate();
+ }
+ } else if (s->GetType() == OggCodecState::TYPE_SKELETON &&
+ !mSkeletonState) {
+ mSkeletonState = static_cast<SkeletonState*>(s);
+ } else {
+ // Deactivate any non-primary bitstreams.
+ s->Deactivate();
+ }
+ }
+ }
+
+ SetupTargetSkeleton();
+ SetupMediaTracksInfo(serials);
+
+ if (HasAudio() || HasVideo()) {
+ int64_t startTime = -1;
+ FindStartTime(startTime);
+ if (startTime >= 0) {
+ OGG_DEBUG("Detected stream start time %" PRId64, startTime);
+ mStartTime.emplace(startTime);
+ }
+
+ if (mInfo.mMetadataDuration.isNothing() &&
+ Resource(TrackInfo::kAudioTrack)->GetLength() >= 0) {
+ // We didn't get a duration from the index or a Content-Duration header.
+ // Seek to the end of file to find the end time.
+ int64_t length = Resource(TrackInfo::kAudioTrack)->GetLength();
+
+ MOZ_ASSERT(length > 0, "Must have a content length to get end time");
+
+ int64_t endTime = RangeEndTime(TrackInfo::kAudioTrack, length);
+
+ if (endTime != -1) {
+ mInfo.mUnadjustedMetadataEndTime.emplace(
+ TimeUnit::FromMicroseconds(endTime));
+ mInfo.mMetadataDuration.emplace(
+ TimeUnit::FromMicroseconds(endTime - mStartTime.refOr(0)));
+ OGG_DEBUG("Got Ogg duration from seeking to end %" PRId64, endTime);
+ }
+ }
+ if (mInfo.mMetadataDuration.isNothing()) {
+ mInfo.mMetadataDuration.emplace(TimeUnit::FromInfinity());
+ }
+ if (HasAudio()) {
+ mInfo.mAudio.mDuration = mInfo.mMetadataDuration.ref();
+ }
+ if (HasVideo()) {
+ mInfo.mVideo.mDuration = mInfo.mMetadataDuration.ref();
+ }
+ } else {
+ OGG_DEBUG("no audio or video tracks");
+ return NS_ERROR_FAILURE;
+ }
+
+ OGG_DEBUG("success?!");
+ return NS_OK;
+}
+
+void OggDemuxer::SetChained() {
+ {
+ if (mIsChained) {
+ return;
+ }
+ mIsChained = true;
+ }
+ if (mOnSeekableEvent) {
+ mOnSeekableEvent->Notify();
+ }
+}
+
+bool OggDemuxer::ReadOggChain(const media::TimeUnit& aLastEndTime) {
+ bool chained = false;
+ OpusState* newOpusState = nullptr;
+ VorbisState* newVorbisState = nullptr;
+ FlacState* newFlacState = nullptr;
+ UniquePtr<MetadataTags> tags;
+
+ if (HasVideo() || HasSkeleton() || !HasAudio()) {
+ return false;
+ }
+
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return false;
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+ if (!ReadOggPage(TrackInfo::kAudioTrack, page.to_opaque()) ||
+ !sandbox_invoke(*mSandbox, ogg_page_bos, page)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON)) {
+ // Chaining is only supported for audio only ogg files.
+ return false;
+ }
+
+ uint32_t serial = static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page)
+ .unverified_safe_because(
+ "We are reading a new page with a serial number for the first "
+ "time and will check if we have seen it before prior to use."));
+ if (mCodecStore.Contains(serial)) {
+ return false;
+ }
+
+ UniquePtr<OggCodecState> codecState(
+ OggCodecState::Create(mSandbox.get(), page.to_opaque(), serial));
+ if (!codecState) {
+ return false;
+ }
+
+ if (mVorbisState && (codecState->GetType() == OggCodecState::TYPE_VORBIS)) {
+ newVorbisState = static_cast<VorbisState*>(codecState.get());
+ } else if (mOpusState &&
+ (codecState->GetType() == OggCodecState::TYPE_OPUS)) {
+ newOpusState = static_cast<OpusState*>(codecState.get());
+ } else if (mFlacState &&
+ (codecState->GetType() == OggCodecState::TYPE_FLAC)) {
+ newFlacState = static_cast<FlacState*>(codecState.get());
+ } else {
+ return false;
+ }
+
+ OggCodecState* state;
+
+ mCodecStore.Add(serial, std::move(codecState));
+ state = mCodecStore.Get(serial);
+
+ NS_ENSURE_TRUE(state != nullptr, false);
+
+ if (NS_FAILED(state->PageIn(page.to_opaque()))) {
+ return false;
+ }
+
+ MessageField* msgInfo = nullptr;
+ if (mSkeletonState) {
+ mSkeletonState->mMsgFieldStore.Get(serial, &msgInfo);
+ }
+
+ if ((newVorbisState && ReadHeaders(TrackInfo::kAudioTrack, newVorbisState)) &&
+ (mVorbisState->GetInfo()->GetAsAudioInfo()->mRate ==
+ newVorbisState->GetInfo()->GetAsAudioInfo()->mRate) &&
+ (mVorbisState->GetInfo()->GetAsAudioInfo()->mChannels ==
+ newVorbisState->GetInfo()->GetAsAudioInfo()->mChannels)) {
+ SetupTarget(&mVorbisState, newVorbisState);
+ OGG_DEBUG("New vorbis ogg link, serial=%d\n", mVorbisState->mSerial);
+
+ if (msgInfo) {
+ InitTrack(msgInfo, &mInfo.mAudio, true);
+ }
+
+ chained = true;
+ tags = newVorbisState->GetTags();
+ }
+
+ if ((newOpusState && ReadHeaders(TrackInfo::kAudioTrack, newOpusState)) &&
+ (mOpusState->GetInfo()->GetAsAudioInfo()->mRate ==
+ newOpusState->GetInfo()->GetAsAudioInfo()->mRate) &&
+ (mOpusState->GetInfo()->GetAsAudioInfo()->mChannels ==
+ newOpusState->GetInfo()->GetAsAudioInfo()->mChannels)) {
+ SetupTarget(&mOpusState, newOpusState);
+
+ if (msgInfo) {
+ InitTrack(msgInfo, &mInfo.mAudio, true);
+ }
+
+ chained = true;
+ tags = newOpusState->GetTags();
+ }
+
+ if ((newFlacState && ReadHeaders(TrackInfo::kAudioTrack, newFlacState)) &&
+ (mFlacState->GetInfo()->GetAsAudioInfo()->mRate ==
+ newFlacState->GetInfo()->GetAsAudioInfo()->mRate) &&
+ (mFlacState->GetInfo()->GetAsAudioInfo()->mChannels ==
+ newFlacState->GetInfo()->GetAsAudioInfo()->mChannels)) {
+ SetupTarget(&mFlacState, newFlacState);
+ OGG_DEBUG("New flac ogg link, serial=%d\n", mFlacState->mSerial);
+
+ if (msgInfo) {
+ InitTrack(msgInfo, &mInfo.mAudio, true);
+ }
+
+ chained = true;
+ tags = newFlacState->GetTags();
+ }
+
+ if (chained) {
+ SetChained();
+ mInfo.mMediaSeekable = false;
+ mDecodedAudioDuration += aLastEndTime;
+ if (mTimedMetadataEvent) {
+ mTimedMetadataEvent->Notify(
+ TimedMetadata(mDecodedAudioDuration, std::move(tags),
+ UniquePtr<MediaInfo>(new MediaInfo(mInfo))));
+ }
+ // Setup a new TrackInfo so that the MediaFormatReader will flush the
+ // current decoder.
+ mSharedAudioTrackInfo =
+ new TrackInfoSharedPtr(mInfo.mAudio, ++sStreamSourceID);
+ return true;
+ }
+
+ return false;
+}
+
+OggDemuxer::OggStateContext& OggDemuxer::OggState(TrackInfo::TrackType aType) {
+ if (aType == TrackInfo::kVideoTrack) {
+ return mVideoOggState;
+ }
+ return mAudioOggState;
+}
+
+tainted_opaque_ogg<ogg_sync_state*> OggDemuxer::OggSyncState(
+ TrackInfo::TrackType aType) {
+ return OggState(aType).mOggState.mState;
+}
+
+MediaResourceIndex* OggDemuxer::Resource(TrackInfo::TrackType aType) {
+ return &OggState(aType).mResource;
+}
+
+MediaResourceIndex* OggDemuxer::CommonResource() {
+ return &mAudioOggState.mResource;
+}
+
+bool OggDemuxer::ReadOggPage(TrackInfo::TrackType aType,
+ tainted_opaque_ogg<ogg_page*> aPage) {
+ int ret = 0;
+ while ((ret = sandbox_invoke(*mSandbox, ogg_sync_pageseek,
+ OggSyncState(aType), aPage)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON)) <=
+ 0) {
+ if (ret < 0) {
+ // Lost page sync, have to skip up to next page.
+ continue;
+ }
+ // Returns a buffer that can be written too
+ // with the given size. This buffer is stored
+ // in the ogg synchronisation structure.
+ const uint32_t MIN_BUFFER_SIZE = 4096;
+ tainted_ogg<char*> buffer_tainted = sandbox_invoke(
+ *mSandbox, ogg_sync_buffer, OggSyncState(aType), MIN_BUFFER_SIZE);
+ MOZ_ASSERT(buffer_tainted != nullptr, "ogg_sync_buffer failed");
+
+ // Read from the resource into the buffer
+ uint32_t bytesRead = 0;
+
+ char* buffer = buffer_tainted.copy_and_verify_buffer_address(
+ [](uintptr_t val) { return reinterpret_cast<char*>(val); },
+ MIN_BUFFER_SIZE);
+
+ nsresult rv = Resource(aType)->Read(buffer, MIN_BUFFER_SIZE, &bytesRead);
+ if (NS_FAILED(rv) || !bytesRead) {
+ // End of file or error.
+ return false;
+ }
+
+ // Update the synchronisation layer with the number
+ // of bytes written to the buffer
+ ret = sandbox_invoke(*mSandbox, ogg_sync_wrote, OggSyncState(aType),
+ bytesRead)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON);
+ NS_ENSURE_TRUE(ret == 0, false);
+ }
+
+ return true;
+}
+
+nsresult OggDemuxer::DemuxOggPage(TrackInfo::TrackType aType,
+ tainted_opaque_ogg<ogg_page*> aPage) {
+ tainted_ogg<int> serial = sandbox_invoke(*mSandbox, ogg_page_serialno, aPage);
+ OggCodecState* codecState = mCodecStore.Get(static_cast<uint32_t>(
+ serial.unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON)));
+ if (codecState == nullptr) {
+ OGG_DEBUG("encountered packet for unrecognized codecState");
+ return NS_ERROR_FAILURE;
+ }
+ if (GetCodecStateType(codecState) != aType &&
+ codecState->GetType() != OggCodecState::TYPE_SKELETON) {
+ // Not a page we're interested in.
+ return NS_OK;
+ }
+ if (NS_FAILED(codecState->PageIn(aPage))) {
+ OGG_DEBUG("codecState->PageIn failed");
+ return NS_ERROR_FAILURE;
+ }
+ return NS_OK;
+}
+
+bool OggDemuxer::IsSeekable() const {
+ if (mIsChained) {
+ return false;
+ }
+ return true;
+}
+
+UniquePtr<EncryptionInfo> OggDemuxer::GetCrypto() { return nullptr; }
+
+ogg_packet* OggDemuxer::GetNextPacket(TrackInfo::TrackType aType) {
+ OggCodecState* state = GetTrackCodecState(aType);
+ ogg_packet* packet = nullptr;
+ OggStateContext& context = OggState(aType);
+
+ while (true) {
+ if (packet) {
+ Unused << state->PacketOut();
+ }
+ DemuxUntilPacketAvailable(aType, state);
+
+ packet = state->PacketPeek();
+ if (!packet) {
+ break;
+ }
+ if (state->IsHeader(packet)) {
+ continue;
+ }
+ if (context.mNeedKeyframe && !state->IsKeyframe(packet)) {
+ continue;
+ }
+ context.mNeedKeyframe = false;
+ break;
+ }
+
+ return packet;
+}
+
+void OggDemuxer::DemuxUntilPacketAvailable(TrackInfo::TrackType aType,
+ OggCodecState* aState) {
+ while (!aState->IsPacketReady()) {
+ OGG_DEBUG("no packet yet, reading some more");
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ MOZ_RELEASE_ASSERT(page != nullptr);
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+ if (!ReadOggPage(aType, page.to_opaque())) {
+ OGG_DEBUG("no more pages to read in resource?");
+ return;
+ }
+ DemuxOggPage(aType, page.to_opaque());
+ }
+}
+
+TimeIntervals OggDemuxer::GetBuffered(TrackInfo::TrackType aType) {
+ if (!HaveStartTime(aType)) {
+ return TimeIntervals();
+ }
+ if (mIsChained) {
+ return TimeIntervals::Invalid();
+ }
+ TimeIntervals buffered;
+ // HasAudio and HasVideo are not used here as they take a lock and cause
+ // a deadlock. Accessing mInfo doesn't require a lock - it doesn't change
+ // after metadata is read.
+ if (!mInfo.HasValidMedia()) {
+ // No need to search through the file if there are no audio or video tracks
+ return buffered;
+ }
+
+ AutoPinned<MediaResource> resource(Resource(aType)->GetResource());
+ MediaByteRangeSet ranges;
+ nsresult res = resource->GetCachedRanges(ranges);
+ NS_ENSURE_SUCCESS(res, TimeIntervals::Invalid());
+
+ const char time_interval_reason[] =
+ "Even if this computation is incorrect due to the reliance on tainted "
+ "values, only the search for the time interval or the time interval "
+ "returned will be affected. However this will not result in a memory "
+ "safety vulnerabilty in the Firefox renderer.";
+
+ // Traverse across the buffered byte ranges, determining the time ranges
+ // they contain. MediaResource::GetNextCachedData(offset) returns -1 when
+ // offset is after the end of the media resource, or there's no more cached
+ // data after the offset. This loop will run until we've checked every
+ // buffered range in the media, in increasing order of offset.
+ nsAutoOggSyncState sync(mSandbox.get());
+ for (uint32_t index = 0; index < ranges.Length(); index++) {
+ // Ensure the offsets are after the header pages.
+ int64_t startOffset = ranges[index].mStart;
+ int64_t endOffset = ranges[index].mEnd;
+
+ // Because the granulepos time is actually the end time of the page,
+ // we special-case (startOffset == 0) so that the first
+ // buffered range always appears to be buffered from the media start
+ // time, rather than from the end-time of the first page.
+ int64_t startTime = (startOffset == 0) ? StartTime() : -1;
+
+ // Find the start time of the range. Read pages until we find one with a
+ // granulepos which we can convert into a timestamp to use as the time of
+ // the start of the buffered range.
+ sandbox_invoke(*mSandbox, ogg_sync_reset, sync.mState);
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return TimeIntervals::Invalid();
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+
+ while (startTime == -1) {
+ int32_t discard;
+ PageSyncResult pageSyncResult =
+ PageSync(mSandbox.get(), Resource(aType), sync.mState, true,
+ startOffset, endOffset, page, discard);
+ if (pageSyncResult == PAGE_SYNC_ERROR) {
+ return TimeIntervals::Invalid();
+ } else if (pageSyncResult == PAGE_SYNC_END_OF_RANGE) {
+ // Hit the end of range without reading a page, give up trying to
+ // find a start time for this buffered range, skip onto the next one.
+ break;
+ }
+
+ int64_t granulepos = sandbox_invoke(*mSandbox, ogg_page_granulepos, page)
+ .unverified_safe_because(time_interval_reason);
+ if (granulepos == -1) {
+ // Page doesn't have an end time, advance to the next page
+ // until we find one.
+
+ bool failedPageLenVerify = false;
+ // Page length should be under 64Kb according to
+ // https://xiph.org/ogg/doc/libogg/ogg_page.html
+ long pageLength =
+ CopyAndVerifyOrFail(page->header_len + page->body_len,
+ val <= 64 * 1024, &failedPageLenVerify);
+ if (failedPageLenVerify) {
+ return TimeIntervals::Invalid();
+ }
+
+ startOffset += pageLength;
+ continue;
+ }
+
+ tainted_ogg<uint32_t> serial = rlbox::sandbox_static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page));
+ if (aType == TrackInfo::kAudioTrack && mVorbisState &&
+ (serial == mVorbisState->mSerial)
+ .unverified_safe_because(time_interval_reason)) {
+ startTime = mVorbisState->Time(granulepos);
+ MOZ_ASSERT(startTime > 0, "Must have positive start time");
+ } else if (aType == TrackInfo::kAudioTrack && mOpusState &&
+ (serial == mOpusState->mSerial)
+ .unverified_safe_because(time_interval_reason)) {
+ startTime = mOpusState->Time(granulepos);
+ MOZ_ASSERT(startTime > 0, "Must have positive start time");
+ } else if (aType == TrackInfo::kAudioTrack && mFlacState &&
+ (serial == mFlacState->mSerial)
+ .unverified_safe_because(time_interval_reason)) {
+ startTime = mFlacState->Time(granulepos);
+ MOZ_ASSERT(startTime > 0, "Must have positive start time");
+ } else if (aType == TrackInfo::kVideoTrack && mTheoraState &&
+ (serial == mTheoraState->mSerial)
+ .unverified_safe_because(time_interval_reason)) {
+ startTime = mTheoraState->Time(granulepos);
+ MOZ_ASSERT(startTime > 0, "Must have positive start time");
+ } else if (mCodecStore.Contains(
+ serial.unverified_safe_because(time_interval_reason))) {
+ // Stream is not the theora or vorbis stream we're playing,
+ // but is one that we have header data for.
+
+ bool failedPageLenVerify = false;
+ // Page length should be under 64Kb according to
+ // https://xiph.org/ogg/doc/libogg/ogg_page.html
+ long pageLength =
+ CopyAndVerifyOrFail(page->header_len + page->body_len,
+ val <= 64 * 1024, &failedPageLenVerify);
+ if (failedPageLenVerify) {
+ return TimeIntervals::Invalid();
+ }
+
+ startOffset += pageLength;
+ continue;
+ } else {
+ // Page is for a stream we don't know about (possibly a chained
+ // ogg), return OK to abort the finding any further ranges. This
+ // prevents us searching through the rest of the media when we
+ // may not be able to extract timestamps from it.
+ SetChained();
+ return buffered;
+ }
+ }
+
+ if (startTime != -1) {
+ // We were able to find a start time for that range, see if we can
+ // find an end time.
+ int64_t endTime = RangeEndTime(aType, startOffset, endOffset, true);
+ if (endTime > startTime) {
+ buffered +=
+ TimeInterval(TimeUnit::FromMicroseconds(startTime - StartTime()),
+ TimeUnit::FromMicroseconds(endTime - StartTime()));
+ }
+ }
+ }
+
+ return buffered;
+}
+
+void OggDemuxer::FindStartTime(int64_t& aOutStartTime) {
+ // Extract the start times of the bitstreams in order to calculate
+ // the duration.
+ int64_t videoStartTime = INT64_MAX;
+ int64_t audioStartTime = INT64_MAX;
+
+ if (HasVideo()) {
+ FindStartTime(TrackInfo::kVideoTrack, videoStartTime);
+ if (videoStartTime != INT64_MAX) {
+ OGG_DEBUG("OggDemuxer::FindStartTime() video=%" PRId64, videoStartTime);
+ mVideoOggState.mStartTime =
+ Some(TimeUnit::FromMicroseconds(videoStartTime));
+ }
+ }
+ if (HasAudio()) {
+ FindStartTime(TrackInfo::kAudioTrack, audioStartTime);
+ if (audioStartTime != INT64_MAX) {
+ OGG_DEBUG("OggDemuxer::FindStartTime() audio=%" PRId64, audioStartTime);
+ mAudioOggState.mStartTime =
+ Some(TimeUnit::FromMicroseconds(audioStartTime));
+ }
+ }
+
+ int64_t startTime = std::min(videoStartTime, audioStartTime);
+ if (startTime != INT64_MAX) {
+ aOutStartTime = startTime;
+ }
+}
+
+void OggDemuxer::FindStartTime(TrackInfo::TrackType aType,
+ int64_t& aOutStartTime) {
+ int64_t startTime = INT64_MAX;
+
+ OggCodecState* state = GetTrackCodecState(aType);
+ ogg_packet* pkt = GetNextPacket(aType);
+ if (pkt) {
+ startTime = state->PacketStartTime(pkt);
+ }
+
+ if (startTime != INT64_MAX) {
+ aOutStartTime = startTime;
+ }
+}
+
+nsresult OggDemuxer::SeekInternal(TrackInfo::TrackType aType,
+ const TimeUnit& aTarget) {
+ int64_t target = aTarget.ToMicroseconds();
+ OGG_DEBUG("About to seek to %" PRId64, target);
+ nsresult res;
+ int64_t adjustedTarget = target;
+ int64_t startTime = StartTime(aType);
+ int64_t endTime = mInfo.mMetadataDuration->ToMicroseconds() + startTime;
+ if (aType == TrackInfo::kAudioTrack && mOpusState) {
+ adjustedTarget = std::max(startTime, target - OGG_SEEK_OPUS_PREROLL);
+ }
+
+ if (!HaveStartTime(aType) || adjustedTarget == startTime) {
+ // We've seeked to the media start or we can't seek.
+ // Just seek to the offset of the first content page.
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, 0);
+ NS_ENSURE_SUCCESS(res, res);
+
+ res = Reset(aType);
+ NS_ENSURE_SUCCESS(res, res);
+ } else {
+ // TODO: This may seek back unnecessarily far in the video, but we don't
+ // have a way of asking Skeleton to seek to a different target for each
+ // stream yet. Using adjustedTarget here is at least correct, if slow.
+ IndexedSeekResult sres = SeekToKeyframeUsingIndex(aType, adjustedTarget);
+ NS_ENSURE_TRUE(sres != SEEK_FATAL_ERROR, NS_ERROR_FAILURE);
+ if (sres == SEEK_INDEX_FAIL) {
+ // No index or other non-fatal index-related failure. Try to seek
+ // using a bisection search. Determine the already downloaded data
+ // in the media cache, so we can try to seek in the cached data first.
+ AutoTArray<SeekRange, 16> ranges;
+ res = GetSeekRanges(aType, ranges);
+ NS_ENSURE_SUCCESS(res, res);
+
+ // Figure out if the seek target lies in a buffered range.
+ SeekRange r =
+ SelectSeekRange(aType, ranges, target, startTime, endTime, true);
+
+ if (!r.IsNull()) {
+ // We know the buffered range in which the seek target lies, do a
+ // bisection search in that buffered range.
+ res = SeekInBufferedRange(aType, target, adjustedTarget, startTime,
+ endTime, ranges, r);
+ NS_ENSURE_SUCCESS(res, res);
+ } else {
+ // The target doesn't lie in a buffered range. Perform a bisection
+ // search over the whole media, using the known buffered ranges to
+ // reduce the search space.
+ res = SeekInUnbuffered(aType, target, startTime, endTime, ranges);
+ NS_ENSURE_SUCCESS(res, res);
+ }
+ }
+ }
+
+ // Demux forwards until we find the first keyframe prior the target.
+ // there may be non-keyframes in the page before the keyframe.
+ // Additionally, we may have seeked to the first page referenced by the
+ // page index which may be quite far off the target.
+ // When doing fastSeek we display the first frame after the seek, so
+ // we need to advance the decode to the keyframe otherwise we'll get
+ // visual artifacts in the first frame output after the seek.
+ OggCodecState* state = GetTrackCodecState(aType);
+ OggPacketQueue tempPackets;
+ bool foundKeyframe = false;
+ while (true) {
+ DemuxUntilPacketAvailable(aType, state);
+ ogg_packet* packet = state->PacketPeek();
+ if (packet == nullptr) {
+ OGG_DEBUG("End of stream reached before keyframe found in indexed seek");
+ break;
+ }
+ int64_t startTstamp = state->PacketStartTime(packet);
+ if (foundKeyframe && startTstamp > adjustedTarget) {
+ break;
+ }
+ if (state->IsKeyframe(packet)) {
+ OGG_DEBUG("keyframe found after seeking at %" PRId64, startTstamp);
+ tempPackets.Erase();
+ foundKeyframe = true;
+ }
+ if (foundKeyframe && startTstamp == adjustedTarget) {
+ break;
+ }
+ if (foundKeyframe) {
+ tempPackets.Append(state->PacketOut());
+ } else {
+ // Discard video packets before the first keyframe.
+ Unused << state->PacketOut();
+ }
+ }
+ // Re-add all packet into the codec state in order.
+ state->PushFront(std::move(tempPackets));
+
+ return NS_OK;
+}
+
+OggDemuxer::IndexedSeekResult OggDemuxer::RollbackIndexedSeek(
+ TrackInfo::TrackType aType, int64_t aOffset) {
+ if (mSkeletonState) {
+ mSkeletonState->Deactivate();
+ }
+ nsresult res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, aOffset);
+ NS_ENSURE_SUCCESS(res, SEEK_FATAL_ERROR);
+ return SEEK_INDEX_FAIL;
+}
+
+OggDemuxer::IndexedSeekResult OggDemuxer::SeekToKeyframeUsingIndex(
+ TrackInfo::TrackType aType, int64_t aTarget) {
+ if (!HasSkeleton() || !mSkeletonState->HasIndex()) {
+ return SEEK_INDEX_FAIL;
+ }
+ // We have an index from the Skeleton track, try to use it to seek.
+ AutoTArray<uint32_t, 2> tracks;
+ BuildSerialList(tracks);
+ SkeletonState::nsSeekTarget keyframe;
+ if (NS_FAILED(mSkeletonState->IndexedSeekTarget(aTarget, tracks, keyframe))) {
+ // Could not locate a keypoint for the target in the index.
+ return SEEK_INDEX_FAIL;
+ }
+
+ // Remember original resource read cursor position so we can rollback on
+ // failure.
+ int64_t tell = Resource(aType)->Tell();
+
+ // Seek to the keypoint returned by the index.
+ if (keyframe.mKeyPoint.mOffset > Resource(aType)->GetLength() ||
+ keyframe.mKeyPoint.mOffset < 0) {
+ // Index must be invalid.
+ return RollbackIndexedSeek(aType, tell);
+ }
+ OGG_DEBUG("Seeking using index to keyframe at offset %" PRId64 "\n",
+ keyframe.mKeyPoint.mOffset);
+ nsresult res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET,
+ keyframe.mKeyPoint.mOffset);
+ NS_ENSURE_SUCCESS(res, SEEK_FATAL_ERROR);
+
+ // We've moved the read set, so reset decode.
+ res = Reset(aType);
+ NS_ENSURE_SUCCESS(res, SEEK_FATAL_ERROR);
+
+ // Check that the page the index thinks is exactly here is actually exactly
+ // here. If not, the index is invalid.
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return SEEK_INDEX_FAIL;
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+ int skippedBytes = 0;
+ PageSyncResult syncres =
+ PageSync(mSandbox.get(), Resource(aType), OggSyncState(aType), false,
+ keyframe.mKeyPoint.mOffset, Resource(aType)->GetLength(), page,
+ skippedBytes);
+ NS_ENSURE_TRUE(syncres != PAGE_SYNC_ERROR, SEEK_FATAL_ERROR);
+ if (syncres != PAGE_SYNC_OK || skippedBytes != 0) {
+ OGG_DEBUG(
+ "Indexed-seek failure: Ogg Skeleton Index is invalid "
+ "or sync error after seek");
+ return RollbackIndexedSeek(aType, tell);
+ }
+ uint32_t serial = static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page)
+ .unverified_safe_because(
+ "Serial is only used to locate the correct page. If the serial "
+ "is incorrect the the renderer would just fail to seek with an "
+ "error code. This would not lead to any memory safety bugs."));
+ if (serial != keyframe.mSerial) {
+ // Serialno of page at offset isn't what the index told us to expect.
+ // Assume the index is invalid.
+ return RollbackIndexedSeek(aType, tell);
+ }
+ OggCodecState* codecState = mCodecStore.Get(serial);
+ if (codecState && codecState->mActive &&
+ sandbox_invoke(*mSandbox, ogg_stream_pagein, codecState->mState, page)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) != 0) {
+ // Couldn't insert page into the ogg resource, or somehow the resource
+ // is no longer active.
+ return RollbackIndexedSeek(aType, tell);
+ }
+ return SEEK_OK;
+}
+
+// Reads a page from the media resource.
+OggDemuxer::PageSyncResult OggDemuxer::PageSync(
+ rlbox_sandbox_ogg* aSandbox, MediaResourceIndex* aResource,
+ tainted_opaque_ogg<ogg_sync_state*> aState, bool aCachedDataOnly,
+ int64_t aOffset, int64_t aEndOffset, tainted_ogg<ogg_page*> aPage,
+ int& aSkippedBytes) {
+ aSkippedBytes = 0;
+ // Sync to the next page.
+ tainted_ogg<int> ret = 0;
+ uint32_t bytesRead = 0;
+ int64_t readHead = aOffset;
+ while (ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) <= 0) {
+ tainted_ogg<long> seek_ret =
+ sandbox_invoke(*aSandbox, ogg_sync_pageseek, aState, aPage);
+
+ // We aren't really verifying the value of seek_ret below.
+ // We are merely ensuring that it won't overflow an integer.
+ // However we are assigning the value to ret which is marked tainted, so
+ // this is fine.
+ bool failedVerify = false;
+ CheckedInt<int> checker;
+ ret = CopyAndVerifyOrFail(
+ seek_ret, (static_cast<void>(checker = val), checker.isValid()),
+ &failedVerify);
+ if (failedVerify) {
+ return PAGE_SYNC_ERROR;
+ }
+
+ if (ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == 0) {
+ const int page_step_val = PAGE_STEP;
+ tainted_ogg<char*> buffer_tainted =
+ sandbox_invoke(*aSandbox, ogg_sync_buffer, aState, page_step_val);
+ MOZ_ASSERT(buffer_tainted != nullptr, "Must have a buffer");
+
+ // Read from the file into the buffer
+ int64_t bytesToRead =
+ std::min(static_cast<int64_t>(PAGE_STEP), aEndOffset - readHead);
+ MOZ_ASSERT(bytesToRead <= UINT32_MAX, "bytesToRead range check");
+ if (bytesToRead <= 0) {
+ return PAGE_SYNC_END_OF_RANGE;
+ }
+ char* buffer = buffer_tainted.copy_and_verify_buffer_address(
+ [](uintptr_t val) { return reinterpret_cast<char*>(val); },
+ static_cast<size_t>(bytesToRead));
+
+ nsresult rv = NS_OK;
+ if (aCachedDataOnly) {
+ rv = aResource->GetResource()->ReadFromCache(
+ buffer, readHead, static_cast<uint32_t>(bytesToRead));
+ NS_ENSURE_SUCCESS(rv, PAGE_SYNC_ERROR);
+ bytesRead = static_cast<uint32_t>(bytesToRead);
+ } else {
+ rv = aResource->Seek(nsISeekableStream::NS_SEEK_SET, readHead);
+ NS_ENSURE_SUCCESS(rv, PAGE_SYNC_ERROR);
+ rv = aResource->Read(buffer, static_cast<uint32_t>(bytesToRead),
+ &bytesRead);
+ NS_ENSURE_SUCCESS(rv, PAGE_SYNC_ERROR);
+ }
+ if (bytesRead == 0 && NS_SUCCEEDED(rv)) {
+ // End of file.
+ return PAGE_SYNC_END_OF_RANGE;
+ }
+ readHead += bytesRead;
+
+ // Update the synchronisation layer with the number
+ // of bytes written to the buffer
+ ret = sandbox_invoke(*aSandbox, ogg_sync_wrote, aState, bytesRead);
+ NS_ENSURE_TRUE(
+ ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == 0,
+ PAGE_SYNC_ERROR);
+ continue;
+ }
+
+ if (ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) < 0) {
+ MOZ_ASSERT(aSkippedBytes >= 0, "Offset >= 0");
+ bool failedSkippedBytesVerify = false;
+ ret.copy_and_verify([&](int val) {
+ int64_t result = static_cast<int64_t>(aSkippedBytes) - val;
+ if (result > std::numeric_limits<int>::max() ||
+ result > (aEndOffset - aOffset) || result < 0) {
+ failedSkippedBytesVerify = true;
+ } else {
+ aSkippedBytes = result;
+ }
+ });
+ if (failedSkippedBytesVerify) {
+ return PAGE_SYNC_ERROR;
+ }
+ continue;
+ }
+ }
+
+ return PAGE_SYNC_OK;
+}
+
+// OggTrackDemuxer
+OggTrackDemuxer::OggTrackDemuxer(OggDemuxer* aParent,
+ TrackInfo::TrackType aType,
+ uint32_t aTrackNumber)
+ : mParent(aParent), mType(aType) {
+ mInfo = mParent->GetTrackInfo(aType, aTrackNumber);
+ MOZ_ASSERT(mInfo);
+}
+
+OggTrackDemuxer::~OggTrackDemuxer() = default;
+
+UniquePtr<TrackInfo> OggTrackDemuxer::GetInfo() const { return mInfo->Clone(); }
+
+RefPtr<OggTrackDemuxer::SeekPromise> OggTrackDemuxer::Seek(
+ const TimeUnit& aTime) {
+ // Seeks to aTime. Upon success, SeekPromise will be resolved with the
+ // actual time seeked to. Typically the random access point time
+ mQueuedSample = nullptr;
+ TimeUnit seekTime = aTime;
+ if (mParent->SeekInternal(mType, aTime) == NS_OK) {
+ RefPtr<MediaRawData> sample(NextSample());
+
+ // Check what time we actually seeked to.
+ if (sample != nullptr) {
+ seekTime = sample->mTime;
+ OGG_DEBUG("%p seeked to time %" PRId64, this, seekTime.ToMicroseconds());
+ }
+ mQueuedSample = sample;
+
+ return SeekPromise::CreateAndResolve(seekTime, __func__);
+ } else {
+ return SeekPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_DEMUXER_ERR,
+ __func__);
+ }
+}
+
+RefPtr<MediaRawData> OggTrackDemuxer::NextSample() {
+ if (mQueuedSample) {
+ RefPtr<MediaRawData> nextSample = mQueuedSample;
+ mQueuedSample = nullptr;
+ if (mType == TrackInfo::kAudioTrack) {
+ nextSample->mTrackInfo = mParent->mSharedAudioTrackInfo;
+ }
+ return nextSample;
+ }
+ ogg_packet* packet = mParent->GetNextPacket(mType);
+ if (!packet) {
+ return nullptr;
+ }
+ // Check the eos state in case we need to look for chained streams.
+ bool eos = packet->e_o_s;
+ OggCodecState* state = mParent->GetTrackCodecState(mType);
+ RefPtr<MediaRawData> data = state->PacketOutAsMediaRawData();
+ // ogg allows 'nil' packets, that are EOS and of size 0.
+ if (!data || (data->mEOS && data->Size() == 0)) {
+ return nullptr;
+ }
+ if (mType == TrackInfo::kAudioTrack) {
+ data->mTrackInfo = mParent->mSharedAudioTrackInfo;
+ }
+ // mDecodedAudioDuration gets adjusted during ReadOggChain().
+ TimeUnit totalDuration = mParent->mDecodedAudioDuration;
+ if (eos) {
+ // We've encountered an end of bitstream packet; check for a chained
+ // bitstream following this one.
+ // This will also update mSharedAudioTrackInfo.
+ mParent->ReadOggChain(data->GetEndTime());
+ }
+ data->mOffset = mParent->Resource(mType)->Tell();
+ // We adjust the start time of the sample to account for the potential ogg
+ // chaining.
+ data->mTime += totalDuration;
+ if (!data->mTime.IsValid()) {
+ return nullptr;
+ }
+
+ return data;
+}
+
+RefPtr<OggTrackDemuxer::SamplesPromise> OggTrackDemuxer::GetSamples(
+ int32_t aNumSamples) {
+ RefPtr<SamplesHolder> samples = new SamplesHolder;
+ if (!aNumSamples) {
+ return SamplesPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_DEMUXER_ERR,
+ __func__);
+ }
+
+ while (aNumSamples) {
+ RefPtr<MediaRawData> sample(NextSample());
+ if (!sample) {
+ break;
+ }
+ if (!sample->HasValidTime()) {
+ return SamplesPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_DEMUXER_ERR,
+ __func__);
+ }
+ samples->AppendSample(sample);
+ aNumSamples--;
+ }
+
+ if (samples->GetSamples().IsEmpty()) {
+ return SamplesPromise::CreateAndReject(NS_ERROR_DOM_MEDIA_END_OF_STREAM,
+ __func__);
+ } else {
+ return SamplesPromise::CreateAndResolve(samples, __func__);
+ }
+}
+
+void OggTrackDemuxer::Reset() {
+ mParent->Reset(mType);
+ mQueuedSample = nullptr;
+}
+
+RefPtr<OggTrackDemuxer::SkipAccessPointPromise>
+OggTrackDemuxer::SkipToNextRandomAccessPoint(const TimeUnit& aTimeThreshold) {
+ uint32_t parsed = 0;
+ bool found = false;
+ RefPtr<MediaRawData> sample;
+
+ OGG_DEBUG("TimeThreshold: %f", aTimeThreshold.ToSeconds());
+ while (!found && (sample = NextSample())) {
+ parsed++;
+ if (sample->mKeyframe && sample->mTime >= aTimeThreshold) {
+ found = true;
+ mQueuedSample = sample;
+ }
+ }
+ if (found) {
+ OGG_DEBUG("next sample: %f (parsed: %d)", sample->mTime.ToSeconds(),
+ parsed);
+ return SkipAccessPointPromise::CreateAndResolve(parsed, __func__);
+ } else {
+ SkipFailureHolder failure(NS_ERROR_DOM_MEDIA_END_OF_STREAM, parsed);
+ return SkipAccessPointPromise::CreateAndReject(std::move(failure),
+ __func__);
+ }
+}
+
+TimeIntervals OggTrackDemuxer::GetBuffered() {
+ return mParent->GetBuffered(mType);
+}
+
+void OggTrackDemuxer::BreakCycles() { mParent = nullptr; }
+
+// Returns an ogg page's checksum.
+tainted_opaque_ogg<ogg_uint32_t> OggDemuxer::GetPageChecksum(
+ tainted_opaque_ogg<ogg_page*> aPage) {
+ tainted_ogg<ogg_page*> page = rlbox::from_opaque(aPage);
+
+ const char hint_reason[] =
+ "Early bail out of checksum. Even if this is wrong, the renderer's "
+ "security is not compromised.";
+ if (page == nullptr ||
+ (page->header == nullptr).unverified_safe_because(hint_reason) ||
+ (page->header_len < 25).unverified_safe_because(hint_reason)) {
+ tainted_ogg<ogg_uint32_t> ret = 0;
+ return ret.to_opaque();
+ }
+
+ const int CHECKSUM_BYTES_LENGTH = 4;
+ const unsigned char* p =
+ (page->header + 22u)
+ .copy_and_verify_buffer_address(
+ [](uintptr_t val) {
+ return reinterpret_cast<const unsigned char*>(val);
+ },
+ CHECKSUM_BYTES_LENGTH);
+ uint32_t c =
+ static_cast<uint32_t>(p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24));
+ tainted_ogg<uint32_t> ret = c;
+ return ret.to_opaque();
+}
+
+int64_t OggDemuxer::RangeStartTime(TrackInfo::TrackType aType,
+ int64_t aOffset) {
+ int64_t position = Resource(aType)->Tell();
+ nsresult res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, aOffset);
+ NS_ENSURE_SUCCESS(res, 0);
+ int64_t startTime = 0;
+ FindStartTime(aType, startTime);
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, position);
+ NS_ENSURE_SUCCESS(res, -1);
+ return startTime;
+}
+
+struct nsDemuxerAutoOggSyncState {
+ explicit nsDemuxerAutoOggSyncState(rlbox_sandbox_ogg& aSandbox)
+ : mSandbox(aSandbox) {
+ mState = mSandbox.malloc_in_sandbox<ogg_sync_state>();
+ MOZ_RELEASE_ASSERT(mState != nullptr);
+ sandbox_invoke(mSandbox, ogg_sync_init, mState);
+ }
+ ~nsDemuxerAutoOggSyncState() {
+ sandbox_invoke(mSandbox, ogg_sync_clear, mState);
+ mSandbox.free_in_sandbox(mState);
+ }
+ rlbox_sandbox_ogg& mSandbox;
+ tainted_ogg<ogg_sync_state*> mState;
+};
+
+int64_t OggDemuxer::RangeEndTime(TrackInfo::TrackType aType,
+ int64_t aEndOffset) {
+ int64_t position = Resource(aType)->Tell();
+ int64_t endTime = RangeEndTime(aType, 0, aEndOffset, false);
+ nsresult res =
+ Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, position);
+ NS_ENSURE_SUCCESS(res, -1);
+ return endTime;
+}
+
+int64_t OggDemuxer::RangeEndTime(TrackInfo::TrackType aType,
+ int64_t aStartOffset, int64_t aEndOffset,
+ bool aCachedDataOnly) {
+ nsDemuxerAutoOggSyncState sync(*mSandbox);
+
+ // We need to find the last page which ends before aEndOffset that
+ // has a granulepos that we can convert to a timestamp. We do this by
+ // backing off from aEndOffset until we encounter a page on which we can
+ // interpret the granulepos. If while backing off we encounter a page which
+ // we've previously encountered before, we'll either backoff again if we
+ // haven't found an end time yet, or return the last end time found.
+ const int step = 5000;
+ const int maxOggPageSize = 65306;
+ int64_t readStartOffset = aEndOffset;
+ int64_t readLimitOffset = aEndOffset;
+ int64_t readHead = aEndOffset;
+ int64_t endTime = -1;
+ uint32_t checksumAfterSeek = 0;
+ uint32_t prevChecksumAfterSeek = 0;
+ bool mustBackOff = false;
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return -1;
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+ while (true) {
+ tainted_ogg<long> seek_ret =
+ sandbox_invoke(*mSandbox, ogg_sync_pageseek, sync.mState, page);
+
+ // We aren't really verifying the value of seek_ret below.
+ // We are merely ensuring that it won't overflow an integer.
+ // However we are assigning the value to ret which is marked tainted, so
+ // this is fine.
+ bool failedVerify = false;
+ CheckedInt<int> checker;
+ tainted_ogg<int> ret = CopyAndVerifyOrFail(
+ seek_ret, (static_cast<void>(checker = val), checker.isValid()),
+ &failedVerify);
+ if (failedVerify) {
+ return -1;
+ }
+
+ if (ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) == 0) {
+ // We need more data if we've not encountered a page we've seen before,
+ // or we've read to the end of file.
+ if (mustBackOff || readHead == aEndOffset || readHead == aStartOffset) {
+ if (endTime != -1 || readStartOffset == 0) {
+ // We have encountered a page before, or we're at the end of file.
+ break;
+ }
+ mustBackOff = false;
+ prevChecksumAfterSeek = checksumAfterSeek;
+ checksumAfterSeek = 0;
+ sandbox_invoke(*mSandbox, ogg_sync_reset, sync.mState);
+ readStartOffset =
+ std::max(static_cast<int64_t>(0), readStartOffset - step);
+ // There's no point reading more than the maximum size of
+ // an Ogg page into data we've previously scanned. Any data
+ // between readLimitOffset and aEndOffset must be garbage
+ // and we can ignore it thereafter.
+ readLimitOffset =
+ std::min(readLimitOffset, readStartOffset + maxOggPageSize);
+ readHead = std::max(aStartOffset, readStartOffset);
+ }
+
+ int64_t limit =
+ std::min(static_cast<int64_t>(UINT32_MAX), aEndOffset - readHead);
+ limit = std::max(static_cast<int64_t>(0), limit);
+ limit = std::min(limit, static_cast<int64_t>(step));
+ uint32_t bytesToRead = static_cast<uint32_t>(limit);
+ uint32_t bytesRead = 0;
+ tainted_ogg<char*> buffer_tainted =
+ sandbox_invoke(*mSandbox, ogg_sync_buffer, sync.mState, bytesToRead);
+ char* buffer = buffer_tainted.copy_and_verify_buffer_address(
+ [](uintptr_t val) { return reinterpret_cast<char*>(val); },
+ bytesToRead);
+ MOZ_ASSERT(buffer, "Must have buffer");
+ nsresult res;
+ if (aCachedDataOnly) {
+ res = Resource(aType)->GetResource()->ReadFromCache(buffer, readHead,
+ bytesToRead);
+ NS_ENSURE_SUCCESS(res, -1);
+ bytesRead = bytesToRead;
+ } else {
+ MOZ_ASSERT(readHead < aEndOffset,
+ "resource pos must be before range end");
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, readHead);
+ NS_ENSURE_SUCCESS(res, -1);
+ res = Resource(aType)->Read(buffer, bytesToRead, &bytesRead);
+ NS_ENSURE_SUCCESS(res, -1);
+ }
+ readHead += bytesRead;
+ if (readHead > readLimitOffset) {
+ mustBackOff = true;
+ }
+
+ // Update the synchronisation layer with the number
+ // of bytes written to the buffer
+ ret = sandbox_invoke(*mSandbox, ogg_sync_wrote, sync.mState, bytesRead);
+ bool failedWroteVerify = false;
+ int wrote_success =
+ CopyAndVerifyOrFail(ret, val == 0 || val == -1, &failedWroteVerify);
+ if (failedWroteVerify) {
+ return -1;
+ }
+
+ if (wrote_success != 0) {
+ endTime = -1;
+ break;
+ }
+ continue;
+ }
+
+ if (ret.unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) < 0 ||
+ sandbox_invoke(*mSandbox, ogg_page_granulepos, page)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON) < 0) {
+ continue;
+ }
+
+ tainted_ogg<uint32_t> checksum_tainted =
+ rlbox::from_opaque(GetPageChecksum(page.to_opaque()));
+ uint32_t checksum = checksum_tainted.unverified_safe_because(
+ "checksum is only being used as a hint as part of search for end time. "
+ "Incorrect values will not affect the memory safety of the renderer.");
+ if (checksumAfterSeek == 0) {
+ // This is the first page we've decoded after a backoff/seek. Remember
+ // the page checksum. If we backoff further and encounter this page
+ // again, we'll know that we won't find a page with an end time after
+ // this one, so we'll know to back off again.
+ checksumAfterSeek = checksum;
+ }
+ if (checksum == prevChecksumAfterSeek) {
+ // This page has the same checksum as the first page we encountered
+ // after the last backoff/seek. Since we've already scanned after this
+ // page and failed to find an end time, we may as well backoff again and
+ // try to find an end time from an earlier page.
+ mustBackOff = true;
+ continue;
+ }
+
+ int64_t granulepos =
+ sandbox_invoke(*mSandbox, ogg_page_granulepos, page)
+ .unverified_safe_because(
+ "If this is incorrect it may lead to incorrect seeking "
+ "behavior in the stream, however will not affect the memory "
+ "safety of the Firefox renderer.");
+ uint32_t serial = static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON));
+
+ OggCodecState* codecState = nullptr;
+ codecState = mCodecStore.Get(serial);
+ if (!codecState) {
+ // This page is from a bitstream which we haven't encountered yet.
+ // It's probably from a new "link" in a "chained" ogg. Don't
+ // bother even trying to find a duration...
+ SetChained();
+ endTime = -1;
+ break;
+ }
+
+ int64_t t = codecState->Time(granulepos);
+ if (t != -1) {
+ endTime = t;
+ }
+ }
+
+ return endTime;
+}
+
+nsresult OggDemuxer::GetSeekRanges(TrackInfo::TrackType aType,
+ nsTArray<SeekRange>& aRanges) {
+ AutoPinned<MediaResource> resource(Resource(aType)->GetResource());
+ MediaByteRangeSet cached;
+ nsresult res = resource->GetCachedRanges(cached);
+ NS_ENSURE_SUCCESS(res, res);
+
+ for (uint32_t index = 0; index < cached.Length(); index++) {
+ auto& range = cached[index];
+ int64_t startTime = -1;
+ int64_t endTime = -1;
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+ int64_t startOffset = range.mStart;
+ int64_t endOffset = range.mEnd;
+ startTime = RangeStartTime(aType, startOffset);
+ if (startTime != -1 && ((endTime = RangeEndTime(aType, endOffset)) != -1)) {
+ NS_WARNING_ASSERTION(startTime < endTime,
+ "Start time must be before end time");
+ aRanges.AppendElement(
+ SeekRange(startOffset, endOffset, startTime, endTime));
+ }
+ }
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+ return NS_OK;
+}
+
+OggDemuxer::SeekRange OggDemuxer::SelectSeekRange(
+ TrackInfo::TrackType aType, const nsTArray<SeekRange>& ranges,
+ int64_t aTarget, int64_t aStartTime, int64_t aEndTime, bool aExact) {
+ int64_t so = 0;
+ int64_t eo = Resource(aType)->GetLength();
+ int64_t st = aStartTime;
+ int64_t et = aEndTime;
+ for (uint32_t i = 0; i < ranges.Length(); i++) {
+ const SeekRange& r = ranges[i];
+ if (r.mTimeStart < aTarget) {
+ so = r.mOffsetStart;
+ st = r.mTimeStart;
+ }
+ if (r.mTimeEnd >= aTarget && r.mTimeEnd < et) {
+ eo = r.mOffsetEnd;
+ et = r.mTimeEnd;
+ }
+
+ if (r.mTimeStart < aTarget && aTarget <= r.mTimeEnd) {
+ // Target lies exactly in this range.
+ return ranges[i];
+ }
+ }
+ if (aExact || eo == -1) {
+ return SeekRange();
+ }
+ return SeekRange(so, eo, st, et);
+}
+
+nsresult OggDemuxer::SeekInBufferedRange(TrackInfo::TrackType aType,
+ int64_t aTarget,
+ int64_t aAdjustedTarget,
+ int64_t aStartTime, int64_t aEndTime,
+ const nsTArray<SeekRange>& aRanges,
+ const SeekRange& aRange) {
+ OGG_DEBUG("Seeking in buffered data to %" PRId64 " using bisection search",
+ aTarget);
+ if (aType == TrackInfo::kVideoTrack || aAdjustedTarget >= aTarget) {
+ // We know the exact byte range in which the target must lie. It must
+ // be buffered in the media cache. Seek there.
+ nsresult res = SeekBisection(aType, aTarget, aRange, 0);
+ if (NS_FAILED(res) || aType != TrackInfo::kVideoTrack) {
+ return res;
+ }
+
+ // We have an active Theora bitstream. Peek the next Theora frame, and
+ // extract its keyframe's time.
+ DemuxUntilPacketAvailable(aType, mTheoraState);
+ ogg_packet* packet = mTheoraState->PacketPeek();
+ if (packet && !mTheoraState->IsKeyframe(packet)) {
+ // First post-seek frame isn't a keyframe, seek back to previous keyframe,
+ // otherwise we'll get visual artifacts.
+ MOZ_ASSERT(packet->granulepos != -1, "Must have a granulepos");
+ int shift = mTheoraState->KeyFrameGranuleJobs();
+ int64_t keyframeGranulepos = (packet->granulepos >> shift) << shift;
+ int64_t keyframeTime = mTheoraState->StartTime(keyframeGranulepos);
+ SEEK_LOG(LogLevel::Debug,
+ ("Keyframe for %lld is at %lld, seeking back to it", frameTime,
+ keyframeTime));
+ aAdjustedTarget = std::min(aAdjustedTarget, keyframeTime);
+ }
+ }
+
+ nsresult res = NS_OK;
+ if (aAdjustedTarget < aTarget) {
+ SeekRange k = SelectSeekRange(aType, aRanges, aAdjustedTarget, aStartTime,
+ aEndTime, false);
+ res = SeekBisection(aType, aAdjustedTarget, k, OGG_SEEK_FUZZ_USECS);
+ }
+ return res;
+}
+
+nsresult OggDemuxer::SeekInUnbuffered(TrackInfo::TrackType aType,
+ int64_t aTarget, int64_t aStartTime,
+ int64_t aEndTime,
+ const nsTArray<SeekRange>& aRanges) {
+ OGG_DEBUG("Seeking in unbuffered data to %" PRId64 " using bisection search",
+ aTarget);
+
+ // If we've got an active Theora bitstream, determine the maximum possible
+ // time in usecs which a keyframe could be before a given interframe. We
+ // subtract this from our seek target, seek to the new target, and then
+ // will decode forward to the original seek target. We should encounter a
+ // keyframe in that interval. This prevents us from needing to run two
+ // bisections; one for the seek target frame, and another to find its
+ // keyframe. It's usually faster to just download this extra data, rather
+ // tham perform two bisections to find the seek target's keyframe. We
+ // don't do this offsetting when seeking in a buffered range,
+ // as the extra decoding causes a noticeable speed hit when all the data
+ // is buffered (compared to just doing a bisection to exactly find the
+ // keyframe).
+ int64_t keyframeOffsetMs = 0;
+ if (aType == TrackInfo::kVideoTrack && mTheoraState) {
+ keyframeOffsetMs = mTheoraState->MaxKeyframeOffset();
+ }
+ // Add in the Opus pre-roll if necessary, as well.
+ if (aType == TrackInfo::kAudioTrack && mOpusState) {
+ keyframeOffsetMs = std::max(keyframeOffsetMs, OGG_SEEK_OPUS_PREROLL);
+ }
+ int64_t seekTarget = std::max(aStartTime, aTarget - keyframeOffsetMs);
+ // Minimize the bisection search space using the known timestamps from the
+ // buffered ranges.
+ SeekRange k =
+ SelectSeekRange(aType, aRanges, seekTarget, aStartTime, aEndTime, false);
+ return SeekBisection(aType, seekTarget, k, OGG_SEEK_FUZZ_USECS);
+}
+
+nsresult OggDemuxer::SeekBisection(TrackInfo::TrackType aType, int64_t aTarget,
+ const SeekRange& aRange, uint32_t aFuzz) {
+ nsresult res;
+
+ if (aTarget <= aRange.mTimeStart) {
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, 0);
+ NS_ENSURE_SUCCESS(res, res);
+ return NS_OK;
+ }
+
+ // Bisection search, find start offset of last page with end time less than
+ // the seek target.
+ ogg_int64_t startOffset = aRange.mOffsetStart;
+ ogg_int64_t startTime = aRange.mTimeStart;
+ ogg_int64_t startLength = 0; // Length of the page at startOffset.
+ ogg_int64_t endOffset = aRange.mOffsetEnd;
+ ogg_int64_t endTime = aRange.mTimeEnd;
+
+ ogg_int64_t seekTarget = aTarget;
+ int64_t seekLowerBound = std::max(static_cast<int64_t>(0), aTarget - aFuzz);
+ int hops = 0;
+ DebugOnly<ogg_int64_t> previousGuess = -1;
+ int backsteps = 0;
+ const int maxBackStep = 10;
+ MOZ_ASSERT(
+ static_cast<uint64_t>(PAGE_STEP) * pow(2.0, maxBackStep) < INT32_MAX,
+ "Backstep calculation must not overflow");
+
+ // Seek via bisection search. Loop until we find the offset where the page
+ // before the offset is before the seek target, and the page after the offset
+ // is after the seek target.
+ tainted_ogg<ogg_page*> page = mSandbox->malloc_in_sandbox<ogg_page>();
+ if (!page) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ auto clean_page = MakeScopeExit([&] { mSandbox->free_in_sandbox(page); });
+ while (true) {
+ ogg_int64_t duration = 0;
+ double target = 0;
+ ogg_int64_t interval = 0;
+ ogg_int64_t guess = 0;
+ int skippedBytes = 0;
+ ogg_int64_t pageOffset = 0;
+ ogg_int64_t pageLength = 0;
+ ogg_int64_t granuleTime = -1;
+ bool mustBackoff = false;
+
+ // Guess where we should bisect to, based on the bit rate and the time
+ // remaining in the interval. Loop until we can determine the time at
+ // the guess offset.
+ while (true) {
+ // Discard any previously buffered packets/pages.
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ interval = endOffset - startOffset - startLength;
+ if (interval == 0) {
+ // Our interval is empty, we've found the optimal seek point, as the
+ // page at the start offset is before the seek target, and the page
+ // at the end offset is after the seek target.
+ SEEK_LOG(LogLevel::Debug,
+ ("Interval narrowed, terminating bisection."));
+ break;
+ }
+
+ // Guess bisection point.
+ duration = endTime - startTime;
+ target = (double)(seekTarget - startTime) / (double)duration;
+ guess = startOffset + startLength +
+ static_cast<ogg_int64_t>((double)interval * target);
+ guess = std::min(guess, endOffset - PAGE_STEP);
+ if (mustBackoff) {
+ // We previously failed to determine the time at the guess offset,
+ // probably because we ran out of data to decode. This usually happens
+ // when we guess very close to the end offset. So reduce the guess
+ // offset using an exponential backoff until we determine the time.
+ SEEK_LOG(
+ LogLevel::Debug,
+ ("Backing off %d bytes, backsteps=%d",
+ static_cast<int32_t>(PAGE_STEP * pow(2.0, backsteps)), backsteps));
+ guess -= PAGE_STEP * static_cast<ogg_int64_t>(pow(2.0, backsteps));
+
+ if (guess <= startOffset) {
+ // We've tried to backoff to before the start offset of our seek
+ // range. This means we couldn't find a seek termination position
+ // near the end of the seek range, so just set the seek termination
+ // condition, and break out of the bisection loop. We'll begin
+ // decoding from the start of the seek range.
+ interval = 0;
+ break;
+ }
+
+ backsteps = std::min(backsteps + 1, maxBackStep);
+ // We reset mustBackoff. If we still need to backoff further, it will
+ // be set to true again.
+ mustBackoff = false;
+ } else {
+ backsteps = 0;
+ }
+ guess = std::max(guess, startOffset + startLength);
+
+ SEEK_LOG(LogLevel::Debug,
+ ("Seek loop start[o=%lld..%lld t=%lld] "
+ "end[o=%lld t=%lld] "
+ "interval=%lld target=%lf guess=%lld",
+ startOffset, (startOffset + startLength), startTime, endOffset,
+ endTime, interval, target, guess));
+
+ MOZ_ASSERT(guess >= startOffset + startLength,
+ "Guess must be after range start");
+ MOZ_ASSERT(guess < endOffset, "Guess must be before range end");
+ MOZ_ASSERT(guess != previousGuess,
+ "Guess should be different to previous");
+ previousGuess = guess;
+
+ hops++;
+
+ // Locate the next page after our seek guess, and then figure out the
+ // granule time of the audio and video bitstreams there. We can then
+ // make a bisection decision based on our location in the media.
+ PageSyncResult pageSyncResult =
+ PageSync(mSandbox.get(), Resource(aType), OggSyncState(aType), false,
+ guess, endOffset, page, skippedBytes);
+ NS_ENSURE_TRUE(pageSyncResult != PAGE_SYNC_ERROR, NS_ERROR_FAILURE);
+
+ if (pageSyncResult == PAGE_SYNC_END_OF_RANGE) {
+ // Our guess was too close to the end, we've ended up reading the end
+ // page. Backoff exponentially from the end point, in case the last
+ // page/frame/sample is huge.
+ mustBackoff = true;
+ SEEK_LOG(LogLevel::Debug, ("Hit the end of range, backing off"));
+ continue;
+ }
+
+ // We've located a page of length |ret| at |guess + skippedBytes|.
+ // Remember where the page is located.
+ pageOffset = guess + skippedBytes;
+
+ bool failedPageLenVerify = false;
+ // Page length should be under 64Kb according to
+ // https://xiph.org/ogg/doc/libogg/ogg_page.html
+ pageLength = CopyAndVerifyOrFail(page->header_len + page->body_len,
+ val <= 64 * 1024, &failedPageLenVerify);
+ if (failedPageLenVerify) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Read pages until we can determine the granule time of the audio and
+ // video bitstream.
+ ogg_int64_t audioTime = -1;
+ ogg_int64_t videoTime = -1;
+ do {
+ // Add the page to its codec state, determine its granule time.
+ uint32_t serial = static_cast<uint32_t>(
+ sandbox_invoke(*mSandbox, ogg_page_serialno, page)
+ .unverified_safe_because(RLBOX_OGG_PAGE_SERIAL_REASON));
+ OggCodecState* codecState = mCodecStore.Get(serial);
+ if (codecState && GetCodecStateType(codecState) == aType) {
+ if (codecState->mActive) {
+ int ret =
+ sandbox_invoke(*mSandbox, ogg_stream_pagein, codecState->mState,
+ page)
+ .unverified_safe_because(RLBOX_OGG_STATE_ASSERT_REASON);
+ NS_ENSURE_TRUE(ret == 0, NS_ERROR_FAILURE);
+ }
+
+ ogg_int64_t granulepos =
+ sandbox_invoke(*mSandbox, ogg_page_granulepos, page)
+ .unverified_safe_because(
+ "If this is incorrect it may lead to incorrect seeking "
+ "behavior in the stream, however will not affect the "
+ "memory safety of the Firefox renderer.");
+
+ if (aType == TrackInfo::kAudioTrack && granulepos > 0 &&
+ audioTime == -1) {
+ if (mVorbisState && serial == mVorbisState->mSerial) {
+ audioTime = mVorbisState->Time(granulepos);
+ } else if (mOpusState && serial == mOpusState->mSerial) {
+ audioTime = mOpusState->Time(granulepos);
+ } else if (mFlacState && serial == mFlacState->mSerial) {
+ audioTime = mFlacState->Time(granulepos);
+ }
+ }
+
+ if (aType == TrackInfo::kVideoTrack && granulepos > 0 &&
+ serial == mTheoraState->mSerial && videoTime == -1) {
+ videoTime = mTheoraState->Time(granulepos);
+ }
+
+ if (pageOffset + pageLength >= endOffset) {
+ // Hit end of readable data.
+ break;
+ }
+ }
+ if (!ReadOggPage(aType, page.to_opaque())) {
+ break;
+ }
+
+ } while ((aType == TrackInfo::kAudioTrack && audioTime == -1) ||
+ (aType == TrackInfo::kVideoTrack && videoTime == -1));
+
+ if ((aType == TrackInfo::kAudioTrack && audioTime == -1) ||
+ (aType == TrackInfo::kVideoTrack && videoTime == -1)) {
+ // We don't have timestamps for all active tracks...
+ if (pageOffset == startOffset + startLength &&
+ pageOffset + pageLength >= endOffset) {
+ // We read the entire interval without finding timestamps for all
+ // active tracks. We know the interval start offset is before the seek
+ // target, and the interval end is after the seek target, and we can't
+ // terminate inside the interval, so we terminate the seek at the
+ // start of the interval.
+ interval = 0;
+ break;
+ }
+
+ // We should backoff; cause the guess to back off from the end, so
+ // that we've got more room to capture.
+ mustBackoff = true;
+ continue;
+ }
+
+ // We've found appropriate time stamps here. Proceed to bisect
+ // the search space.
+ granuleTime = aType == TrackInfo::kAudioTrack ? audioTime : videoTime;
+ MOZ_ASSERT(granuleTime > 0, "Must get a granuletime");
+ break;
+ } // End of "until we determine time at guess offset" loop.
+
+ if (interval == 0) {
+ // Seek termination condition; we've found the page boundary of the
+ // last page before the target, and the first page after the target.
+ SEEK_LOG(LogLevel::Debug,
+ ("Terminating seek at offset=%lld", startOffset));
+ MOZ_ASSERT(startTime < aTarget,
+ "Start time must always be less than target");
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, startOffset);
+ NS_ENSURE_SUCCESS(res, res);
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+ break;
+ }
+
+ SEEK_LOG(LogLevel::Debug,
+ ("Time at offset %lld is %lld", guess, granuleTime));
+ if (granuleTime < seekTarget && granuleTime > seekLowerBound) {
+ // We're within the fuzzy region in which we want to terminate the search.
+ res = Resource(aType)->Seek(nsISeekableStream::NS_SEEK_SET, pageOffset);
+ NS_ENSURE_SUCCESS(res, res);
+ if (NS_FAILED(Reset(aType))) {
+ return NS_ERROR_FAILURE;
+ }
+ SEEK_LOG(LogLevel::Debug,
+ ("Terminating seek at offset=%lld", pageOffset));
+ break;
+ }
+
+ if (granuleTime >= seekTarget) {
+ // We've landed after the seek target.
+ MOZ_ASSERT(pageOffset < endOffset, "offset_end must decrease");
+ endOffset = pageOffset;
+ endTime = granuleTime;
+ } else if (granuleTime < seekTarget) {
+ // Landed before seek target.
+ MOZ_ASSERT(pageOffset >= startOffset + startLength,
+ "Bisection point should be at or after end of first page in "
+ "interval");
+ startOffset = pageOffset;
+ startLength = pageLength;
+ startTime = granuleTime;
+ }
+ MOZ_ASSERT(startTime <= seekTarget, "Must be before seek target");
+ MOZ_ASSERT(endTime >= seekTarget, "End must be after seek target");
+ }
+
+ (void)hops;
+ SEEK_LOG(LogLevel::Debug, ("Seek complete in %d bisections.", hops));
+
+ return NS_OK;
+}
+
+#undef OGG_DEBUG
+#undef SEEK_LOG
+#undef CopyAndVerifyOrFail
+} // namespace mozilla
diff --git a/dom/media/ogg/OggDemuxer.h b/dom/media/ogg/OggDemuxer.h
new file mode 100644
index 0000000000..8a65398cf9
--- /dev/null
+++ b/dom/media/ogg/OggDemuxer.h
@@ -0,0 +1,363 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(OggDemuxer_h_)
+# define OggDemuxer_h_
+
+# include "nsTArray.h"
+# include "MediaDataDemuxer.h"
+# include "OggCodecState.h"
+# include "OggCodecStore.h"
+# include "OggRLBoxTypes.h"
+# include "MediaMetadataManager.h"
+
+# include <memory>
+
+namespace mozilla {
+
+class OggTrackDemuxer;
+
+DDLoggedTypeDeclNameAndBase(OggDemuxer, MediaDataDemuxer);
+DDLoggedTypeNameAndBase(OggTrackDemuxer, MediaTrackDemuxer);
+
+class OggDemuxer : public MediaDataDemuxer,
+ public DecoderDoctorLifeLogger<OggDemuxer> {
+ public:
+ explicit OggDemuxer(MediaResource* aResource);
+
+ RefPtr<InitPromise> Init() override;
+
+ uint32_t GetNumberTracks(TrackInfo::TrackType aType) const override;
+
+ already_AddRefed<MediaTrackDemuxer> GetTrackDemuxer(
+ TrackInfo::TrackType aType, uint32_t aTrackNumber) override;
+
+ bool IsSeekable() const override;
+
+ UniquePtr<EncryptionInfo> GetCrypto() override;
+
+ // Set the events to notify when chaining is encountered.
+ void SetChainingEvents(TimedMetadataEventProducer* aMetadataEvent,
+ MediaEventProducer<void>* aOnSeekableEvent);
+
+ private:
+ // helpers for friend OggTrackDemuxer
+ UniquePtr<TrackInfo> GetTrackInfo(TrackInfo::TrackType aType,
+ size_t aTrackNumber) const;
+
+ struct nsAutoOggSyncState {
+ explicit nsAutoOggSyncState(rlbox_sandbox_ogg* aSandbox);
+ ~nsAutoOggSyncState();
+ rlbox_sandbox_ogg* mSandbox;
+ tainted_opaque_ogg<ogg_sync_state*> mState;
+ };
+ media::TimeIntervals GetBuffered(TrackInfo::TrackType aType);
+ void FindStartTime(int64_t& aOutStartTime);
+ void FindStartTime(TrackInfo::TrackType, int64_t& aOutStartTime);
+
+ nsresult SeekInternal(TrackInfo::TrackType aType,
+ const media::TimeUnit& aTarget);
+
+ // Seeks to the keyframe preceding the target time using available
+ // keyframe indexes.
+ enum IndexedSeekResult {
+ SEEK_OK, // Success.
+ SEEK_INDEX_FAIL, // Failure due to no index, or invalid index.
+ SEEK_FATAL_ERROR // Error returned by a stream operation.
+ };
+ IndexedSeekResult SeekToKeyframeUsingIndex(TrackInfo::TrackType aType,
+ int64_t aTarget);
+
+ // Rolls back a seek-using-index attempt, returning a failure error code.
+ IndexedSeekResult RollbackIndexedSeek(TrackInfo::TrackType aType,
+ int64_t aOffset);
+
+ // Represents a section of contiguous media, with a start and end offset,
+ // and the timestamps of the start and end of that range, that is cached.
+ // Used to denote the extremities of a range in which we can seek quickly
+ // (because it's cached).
+ class SeekRange {
+ public:
+ SeekRange() : mOffsetStart(0), mOffsetEnd(0), mTimeStart(0), mTimeEnd(0) {}
+
+ SeekRange(int64_t aOffsetStart, int64_t aOffsetEnd, int64_t aTimeStart,
+ int64_t aTimeEnd)
+ : mOffsetStart(aOffsetStart),
+ mOffsetEnd(aOffsetEnd),
+ mTimeStart(aTimeStart),
+ mTimeEnd(aTimeEnd) {}
+
+ bool IsNull() const {
+ return mOffsetStart == 0 && mOffsetEnd == 0 && mTimeStart == 0 &&
+ mTimeEnd == 0;
+ }
+
+ int64_t mOffsetStart, mOffsetEnd; // in bytes.
+ int64_t mTimeStart, mTimeEnd; // in usecs.
+ };
+
+ nsresult GetSeekRanges(TrackInfo::TrackType aType,
+ nsTArray<SeekRange>& aRanges);
+ SeekRange SelectSeekRange(TrackInfo::TrackType aType,
+ const nsTArray<SeekRange>& ranges, int64_t aTarget,
+ int64_t aStartTime, int64_t aEndTime, bool aExact);
+
+ // Seeks to aTarget usecs in the buffered range aRange using bisection search,
+ // or to the keyframe prior to aTarget if we have video. aAdjustedTarget is
+ // an adjusted version of the target used to account for Opus pre-roll, if
+ // necessary. aStartTime must be the presentation time at the start of media,
+ // and aEndTime the time at end of media. aRanges must be the time/byte ranges
+ // buffered in the media cache as per GetSeekRanges().
+ nsresult SeekInBufferedRange(TrackInfo::TrackType aType, int64_t aTarget,
+ int64_t aAdjustedTarget, int64_t aStartTime,
+ int64_t aEndTime,
+ const nsTArray<SeekRange>& aRanges,
+ const SeekRange& aRange);
+
+ // Seeks to before aTarget usecs in media using bisection search. If the media
+ // has video, this will seek to before the keyframe required to render the
+ // media at aTarget. Will use aRanges in order to narrow the bisection
+ // search space. aStartTime must be the presentation time at the start of
+ // media, and aEndTime the time at end of media. aRanges must be the time/byte
+ // ranges buffered in the media cache as per GetSeekRanges().
+ nsresult SeekInUnbuffered(TrackInfo::TrackType aType, int64_t aTarget,
+ int64_t aStartTime, int64_t aEndTime,
+ const nsTArray<SeekRange>& aRanges);
+
+ // Performs a seek bisection to move the media stream's read cursor to the
+ // last ogg page boundary which has end time before aTarget usecs on both the
+ // Theora and Vorbis bitstreams. Limits its search to data inside aRange;
+ // i.e. it will only read inside of the aRange's start and end offsets.
+ // aFuzz is the number of usecs of leniency we'll allow; we'll terminate the
+ // seek when we land in the range (aTime - aFuzz, aTime) usecs.
+ nsresult SeekBisection(TrackInfo::TrackType aType, int64_t aTarget,
+ const SeekRange& aRange, uint32_t aFuzz);
+
+ // Chunk size to read when reading Ogg files. Average Ogg page length
+ // is about 4300 bytes, so we read the file in chunks larger than that.
+ static const int PAGE_STEP = 8192;
+
+ enum PageSyncResult {
+ PAGE_SYNC_ERROR = 1,
+ PAGE_SYNC_END_OF_RANGE = 2,
+ PAGE_SYNC_OK = 3
+ };
+ static PageSyncResult PageSync(rlbox_sandbox_ogg* aSandbox,
+ MediaResourceIndex* aResource,
+ tainted_opaque_ogg<ogg_sync_state*> aState,
+ bool aCachedDataOnly, int64_t aOffset,
+ int64_t aEndOffset,
+ tainted_ogg<ogg_page*> aPage,
+ int& aSkippedBytes);
+
+ // Demux next Ogg packet
+ ogg_packet* GetNextPacket(TrackInfo::TrackType aType);
+
+ nsresult Reset(TrackInfo::TrackType aType);
+
+ static const nsString GetKind(const nsCString& aRole);
+ static void InitTrack(MessageField* aMsgInfo, TrackInfo* aInfo, bool aEnable);
+
+ // Really private!
+ ~OggDemuxer();
+
+ // Read enough of the file to identify track information and header
+ // packets necessary for decoding to begin.
+ nsresult ReadMetadata();
+
+ // Read a page of data from the Ogg file. Returns true if a page has been
+ // read, false if the page read failed or end of file reached.
+ bool ReadOggPage(TrackInfo::TrackType aType,
+ tainted_opaque_ogg<ogg_page*> aPage);
+
+ // Send a page off to the individual streams it belongs to.
+ // Reconstructed packets, if any are ready, will be available
+ // on the individual OggCodecStates.
+ nsresult DemuxOggPage(TrackInfo::TrackType aType,
+ tainted_opaque_ogg<ogg_page*> aPage);
+
+ // Read data and demux until a packet is available on the given stream state
+ void DemuxUntilPacketAvailable(TrackInfo::TrackType aType,
+ OggCodecState* aState);
+
+ // Reads and decodes header packets for aState, until either header decode
+ // fails, or is complete. Initializes the codec state before returning.
+ // Returns true if reading headers and initializtion of the stream
+ // succeeds.
+ bool ReadHeaders(TrackInfo::TrackType aType, OggCodecState* aState);
+
+ // Reads the next link in the chain.
+ bool ReadOggChain(const media::TimeUnit& aLastEndTime);
+
+ // Set this media as being a chain and notifies the state machine that the
+ // media is no longer seekable.
+ void SetChained();
+
+ // Fills aTracks with the serial numbers of each active stream, for use by
+ // various SkeletonState functions.
+ void BuildSerialList(nsTArray<uint32_t>& aTracks);
+
+ // Setup target bitstreams for decoding.
+ void SetupTarget(OggCodecState** aSavedState, OggCodecState* aNewState);
+ void SetupTargetSkeleton();
+ void SetupMediaTracksInfo(const nsTArray<uint32_t>& aSerials);
+ void FillTags(TrackInfo* aInfo, UniquePtr<MetadataTags>&& aTags);
+
+ // Compute an ogg page's checksum
+ tainted_opaque_ogg<ogg_uint32_t> GetPageChecksum(
+ tainted_opaque_ogg<ogg_page*> aPage);
+
+ // Get the end time of aEndOffset. This is the playback position we'd reach
+ // after playback finished at aEndOffset.
+ int64_t RangeEndTime(TrackInfo::TrackType aType, int64_t aEndOffset);
+
+ // Get the end time of aEndOffset, without reading before aStartOffset.
+ // This is the playback position we'd reach after playback finished at
+ // aEndOffset. If bool aCachedDataOnly is true, then we'll only read
+ // from data which is cached in the media cached, otherwise we'll do
+ // regular blocking reads from the media stream. If bool aCachedDataOnly
+ // is true, this can safely be called on the main thread, otherwise it
+ // must be called on the state machine thread.
+ int64_t RangeEndTime(TrackInfo::TrackType aType, int64_t aStartOffset,
+ int64_t aEndOffset, bool aCachedDataOnly);
+
+ // Get the start time of the range beginning at aOffset. This is the start
+ // time of the first aType sample we'd be able to play if we
+ // started playback at aOffset.
+ int64_t RangeStartTime(TrackInfo::TrackType aType, int64_t aOffset);
+
+ // All invocations of libogg functionality from the demuxer is sandboxed using
+ // wasm library sandboxes on supported platforms. These functions that create
+ // and destroy the sandbox instance.
+ static rlbox_sandbox_ogg* CreateSandbox();
+ struct SandboxDestroy {
+ void operator()(rlbox_sandbox_ogg* sandbox);
+ };
+
+ // The sandbox instance used to sandbox libogg functionality in the demuxer.
+ // This must be declared before other members so that constructors/destructors
+ // run in the right order.
+ std::unique_ptr<rlbox_sandbox_ogg, SandboxDestroy> mSandbox;
+
+ MediaInfo mInfo;
+ nsTArray<RefPtr<OggTrackDemuxer>> mDemuxers;
+
+ // Map of codec-specific bitstream states.
+ OggCodecStore mCodecStore;
+
+ // Decode state of the Theora bitstream we're decoding, if we have video.
+ OggCodecState* mTheoraState;
+
+ // Decode state of the Vorbis bitstream we're decoding, if we have audio.
+ OggCodecState* mVorbisState;
+
+ // Decode state of the Opus bitstream we're decoding, if we have one.
+ OggCodecState* mOpusState;
+
+ // Get the bitstream decode state for the given track type
+ // Decode state of the Flac bitstream we're decoding, if we have one.
+ OggCodecState* mFlacState;
+
+ OggCodecState* GetTrackCodecState(TrackInfo::TrackType aType) const;
+ TrackInfo::TrackType GetCodecStateType(OggCodecState* aState) const;
+
+ // Represents the user pref media.opus.enabled at the time our
+ // contructor was called. We can't check it dynamically because
+ // we're not on the main thread;
+ bool mOpusEnabled;
+
+ // Decode state of the Skeleton bitstream.
+ SkeletonState* mSkeletonState;
+
+ // Ogg decoding state.
+ struct OggStateContext {
+ explicit OggStateContext(MediaResource* aResource,
+ rlbox_sandbox_ogg* aSandbox)
+ : mOggState(aSandbox), mResource(aResource), mNeedKeyframe(true) {}
+ nsAutoOggSyncState mOggState;
+ MediaResourceIndex mResource;
+ Maybe<media::TimeUnit> mStartTime;
+ bool mNeedKeyframe;
+ };
+
+ OggStateContext& OggState(TrackInfo::TrackType aType);
+ tainted_opaque_ogg<ogg_sync_state*> OggSyncState(TrackInfo::TrackType aType);
+ MediaResourceIndex* Resource(TrackInfo::TrackType aType);
+ MediaResourceIndex* CommonResource();
+ OggStateContext mAudioOggState;
+ OggStateContext mVideoOggState;
+
+ Maybe<int64_t> mStartTime;
+
+ // Booleans to indicate if we have audio and/or video data
+ bool HasVideo() const;
+ bool HasAudio() const;
+ bool HasSkeleton() const {
+ return mSkeletonState != 0 && mSkeletonState->mActive;
+ }
+ bool HaveStartTime() const;
+ bool HaveStartTime(TrackInfo::TrackType aType);
+ int64_t StartTime() const;
+ int64_t StartTime(TrackInfo::TrackType aType);
+
+ // The picture region inside Theora frame to be displayed, if we have
+ // a Theora video track.
+ gfx::IntRect mPicture;
+
+ // True if we are decoding a chained ogg.
+ bool mIsChained;
+
+ // Total audio duration played so far.
+ media::TimeUnit mDecodedAudioDuration;
+
+ // Events manager
+ TimedMetadataEventProducer* mTimedMetadataEvent;
+ MediaEventProducer<void>* mOnSeekableEvent;
+
+ // This will be populated only if a content change occurs, otherwise it
+ // will be left as null so the original metadata is used.
+ // It is updated once a chained ogg is encountered.
+ // As Ogg chaining is only supported for audio, we only need an audio track
+ // info.
+ RefPtr<TrackInfoSharedPtr> mSharedAudioTrackInfo;
+
+ friend class OggTrackDemuxer;
+};
+
+class OggTrackDemuxer : public MediaTrackDemuxer,
+ public DecoderDoctorLifeLogger<OggTrackDemuxer> {
+ public:
+ OggTrackDemuxer(OggDemuxer* aParent, TrackInfo::TrackType aType,
+ uint32_t aTrackNumber);
+
+ UniquePtr<TrackInfo> GetInfo() const override;
+
+ RefPtr<SeekPromise> Seek(const media::TimeUnit& aTime) override;
+
+ RefPtr<SamplesPromise> GetSamples(int32_t aNumSamples = 1) override;
+
+ void Reset() override;
+
+ RefPtr<SkipAccessPointPromise> SkipToNextRandomAccessPoint(
+ const media::TimeUnit& aTimeThreshold) override;
+
+ media::TimeIntervals GetBuffered() override;
+
+ void BreakCycles() override;
+
+ private:
+ ~OggTrackDemuxer();
+ void SetNextKeyFrameTime();
+ RefPtr<MediaRawData> NextSample();
+ RefPtr<OggDemuxer> mParent;
+ TrackInfo::TrackType mType;
+ UniquePtr<TrackInfo> mInfo;
+
+ // Queued sample extracted by the demuxer, but not yet returned.
+ RefPtr<MediaRawData> mQueuedSample;
+};
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/OggRLBox.h b/dom/media/ogg/OggRLBox.h
new file mode 100644
index 0000000000..0a451fa077
--- /dev/null
+++ b/dom/media/ogg/OggRLBox.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef OGG_RLBOX
+#define OGG_RLBOX
+
+#include "OggRLBoxTypes.h"
+
+// Load general firefox configuration of RLBox
+#include "mozilla/rlbox/rlbox_config.h"
+
+#ifdef MOZ_WASM_SANDBOXING_OGG
+// Include the generated header file so that we are able to resolve the symbols
+// in the wasm binary
+# include "rlbox.wasm.h"
+# define RLBOX_USE_STATIC_CALLS() rlbox_wasm2c_sandbox_lookup_symbol
+# include "mozilla/rlbox/rlbox_wasm2c_sandbox.hpp"
+#else
+# define RLBOX_USE_STATIC_CALLS() rlbox_noop_sandbox_lookup_symbol
+# include "mozilla/rlbox/rlbox_noop_sandbox.hpp"
+#endif
+
+#include "mozilla/rlbox/rlbox.hpp"
+
+#include "ogg/OggStructsForRLBox.h"
+rlbox_load_structs_from_library(ogg);
+
+#endif
diff --git a/dom/media/ogg/OggRLBoxTypes.h b/dom/media/ogg/OggRLBoxTypes.h
new file mode 100644
index 0000000000..d2dfdd1dff
--- /dev/null
+++ b/dom/media/ogg/OggRLBoxTypes.h
@@ -0,0 +1,17 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef OGG_RLBOX_TYPES
+#define OGG_RLBOX_TYPES
+
+#include "mozilla/rlbox/rlbox_types.hpp"
+
+#ifdef MOZ_WASM_SANDBOXING_OGG
+RLBOX_DEFINE_BASE_TYPES_FOR(ogg, wasm2c)
+#else
+RLBOX_DEFINE_BASE_TYPES_FOR(ogg, noop)
+#endif
+
+#endif
diff --git a/dom/media/ogg/OggWriter.cpp b/dom/media/ogg/OggWriter.cpp
new file mode 100644
index 0000000000..6f29d44124
--- /dev/null
+++ b/dom/media/ogg/OggWriter.cpp
@@ -0,0 +1,197 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+#include "OggWriter.h"
+#include "prtime.h"
+#include "mozilla/ProfilerLabels.h"
+
+#define LOG(args, ...)
+
+namespace mozilla {
+
+OggWriter::OggWriter()
+ : ContainerWriter(), mOggStreamState(), mOggPage(), mPacket() {
+ if (NS_FAILED(Init())) {
+ LOG("ERROR! Fail to initialize the OggWriter.");
+ }
+}
+
+OggWriter::~OggWriter() {
+ if (mInitialized) {
+ ogg_stream_clear(&mOggStreamState);
+ }
+ // mPacket's data was always owned by us, no need to ogg_packet_clear.
+}
+
+nsresult OggWriter::Init() {
+ MOZ_ASSERT(!mInitialized);
+
+ // The serial number (serialno) should be a random number, for the current
+ // implementation where the output file contains only a single stream, this
+ // serialno is used to differentiate between files.
+ srand(static_cast<unsigned>(PR_Now()));
+ int rc = ogg_stream_init(&mOggStreamState, rand());
+
+ mPacket.b_o_s = 1;
+ mPacket.e_o_s = 0;
+ mPacket.granulepos = 0;
+ mPacket.packet = nullptr;
+ mPacket.packetno = 0;
+ mPacket.bytes = 0;
+
+ mInitialized = (rc == 0);
+
+ return (rc == 0) ? NS_OK : NS_ERROR_NOT_INITIALIZED;
+}
+
+nsresult OggWriter::WriteEncodedTrack(
+ const nsTArray<RefPtr<EncodedFrame>>& aData, uint32_t aFlags) {
+ AUTO_PROFILER_LABEL("OggWriter::WriteEncodedTrack", OTHER);
+
+ uint32_t len = aData.Length();
+ for (uint32_t i = 0; i < len; i++) {
+ if (aData[i]->mFrameType != EncodedFrame::OPUS_AUDIO_FRAME) {
+ LOG("[OggWriter] wrong encoded data type!");
+ return NS_ERROR_FAILURE;
+ }
+
+ // only pass END_OF_STREAM on the last frame!
+ nsresult rv = WriteEncodedData(
+ *aData[i]->mFrameData, aData[i]->mDuration,
+ i < len - 1 ? (aFlags & ~ContainerWriter::END_OF_STREAM) : aFlags);
+ if (NS_FAILED(rv)) {
+ LOG("%p Failed to WriteEncodedTrack!", this);
+ return rv;
+ }
+ }
+ return NS_OK;
+}
+
+nsresult OggWriter::WriteEncodedData(const nsTArray<uint8_t>& aBuffer,
+ int aDuration, uint32_t aFlags) {
+ if (!mInitialized) {
+ LOG("[OggWriter] OggWriter has not initialized!");
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_ASSERT(!ogg_stream_eos(&mOggStreamState),
+ "No data can be written after eos has marked.");
+
+ // Set eos flag to true, and once the eos is written to a packet, there must
+ // not be anymore pages after a page has marked as eos.
+ if (aFlags & ContainerWriter::END_OF_STREAM) {
+ LOG("[OggWriter] Set e_o_s flag to true.");
+ mPacket.e_o_s = 1;
+ }
+
+ mPacket.packet = const_cast<uint8_t*>(aBuffer.Elements());
+ mPacket.bytes = aBuffer.Length();
+ mPacket.granulepos += aDuration;
+
+ // 0 returned on success. -1 returned in the event of internal error.
+ // The data in the packet is copied into the internal storage managed by the
+ // mOggStreamState, so we are free to alter the contents of mPacket after
+ // this call has returned.
+ int rc = ogg_stream_packetin(&mOggStreamState, &mPacket);
+ if (rc < 0) {
+ LOG("[OggWriter] Failed in ogg_stream_packetin! (%d).", rc);
+ return NS_ERROR_FAILURE;
+ }
+
+ if (mPacket.b_o_s) {
+ mPacket.b_o_s = 0;
+ }
+ mPacket.packetno++;
+ mPacket.packet = nullptr;
+
+ return NS_OK;
+}
+
+void OggWriter::ProduceOggPage(nsTArray<nsTArray<uint8_t>>* aOutputBufs) {
+ aOutputBufs->AppendElement();
+ aOutputBufs->LastElement().SetLength(mOggPage.header_len + mOggPage.body_len);
+ memcpy(aOutputBufs->LastElement().Elements(), mOggPage.header,
+ mOggPage.header_len);
+ memcpy(aOutputBufs->LastElement().Elements() + mOggPage.header_len,
+ mOggPage.body, mOggPage.body_len);
+}
+
+nsresult OggWriter::GetContainerData(nsTArray<nsTArray<uint8_t>>* aOutputBufs,
+ uint32_t aFlags) {
+ int rc = -1;
+ AUTO_PROFILER_LABEL("OggWriter::GetContainerData", OTHER);
+ // Generate the oggOpus Header
+ if (aFlags & ContainerWriter::GET_HEADER) {
+ OpusMetadata* meta = static_cast<OpusMetadata*>(mMetadata.get());
+ NS_ASSERTION(meta, "should have meta data");
+ NS_ASSERTION(meta->GetKind() == TrackMetadataBase::METADATA_OPUS,
+ "should have Opus meta data");
+
+ nsresult rv = WriteEncodedData(meta->mIdHeader, 0);
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ rc = ogg_stream_flush(&mOggStreamState, &mOggPage);
+ NS_ENSURE_TRUE(rc > 0, NS_ERROR_FAILURE);
+ ProduceOggPage(aOutputBufs);
+
+ rv = WriteEncodedData(meta->mCommentHeader, 0);
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ rc = ogg_stream_flush(&mOggStreamState, &mOggPage);
+ NS_ENSURE_TRUE(rc > 0, NS_ERROR_FAILURE);
+
+ // Force generate a page even if the amount of packet data is not enough.
+ // Usually do so after a header packet.
+
+ ProduceOggPage(aOutputBufs);
+ }
+
+ // return value 0 means insufficient data has accumulated to fill a page, or
+ // an internal error has occurred.
+ while (ogg_stream_pageout(&mOggStreamState, &mOggPage) != 0) {
+ ProduceOggPage(aOutputBufs);
+ }
+
+ if (aFlags & ContainerWriter::FLUSH_NEEDED) {
+ // return value 0 means no packet to put into a page, or an internal error.
+ if (ogg_stream_flush(&mOggStreamState, &mOggPage) != 0) {
+ ProduceOggPage(aOutputBufs);
+ }
+ mIsWritingComplete = true;
+ }
+
+ // We always return NS_OK here since it's OK to call this without having
+ // enough data to fill a page. It's the more common case compared to internal
+ // errors, and we cannot distinguish the two.
+ return NS_OK;
+}
+
+nsresult OggWriter::SetMetadata(
+ const nsTArray<RefPtr<TrackMetadataBase>>& aMetadata) {
+ MOZ_ASSERT(aMetadata.Length() == 1);
+ MOZ_ASSERT(aMetadata[0]);
+
+ AUTO_PROFILER_LABEL("OggWriter::SetMetadata", OTHER);
+
+ if (aMetadata[0]->GetKind() != TrackMetadataBase::METADATA_OPUS) {
+ LOG("wrong meta data type!");
+ return NS_ERROR_FAILURE;
+ }
+ // Validate each field of METADATA
+ mMetadata = static_cast<OpusMetadata*>(aMetadata[0].get());
+ if (mMetadata->mIdHeader.Length() == 0) {
+ LOG("miss mIdHeader!");
+ return NS_ERROR_FAILURE;
+ }
+ if (mMetadata->mCommentHeader.Length() == 0) {
+ LOG("miss mCommentHeader!");
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+} // namespace mozilla
+
+#undef LOG
diff --git a/dom/media/ogg/OggWriter.h b/dom/media/ogg/OggWriter.h
new file mode 100644
index 0000000000..73d5bd87e9
--- /dev/null
+++ b/dom/media/ogg/OggWriter.h
@@ -0,0 +1,55 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef OggWriter_h_
+#define OggWriter_h_
+
+#include "ContainerWriter.h"
+#include "OpusTrackEncoder.h"
+#include <ogg/ogg.h>
+
+namespace mozilla {
+/**
+ * WriteEncodedTrack inserts raw packets into Ogg stream (ogg_stream_state), and
+ * GetContainerData outputs an ogg_page when enough packets have been written
+ * to the Ogg stream.
+ * For more details, please reference:
+ * http://www.xiph.org/ogg/doc/libogg/encoding.html
+ */
+class OggWriter : public ContainerWriter {
+ public:
+ OggWriter();
+ ~OggWriter();
+
+ // Write frames into the ogg container. aFlags should be set to END_OF_STREAM
+ // for the final set of frames.
+ nsresult WriteEncodedTrack(const nsTArray<RefPtr<EncodedFrame>>& aData,
+ uint32_t aFlags = 0) override;
+
+ nsresult GetContainerData(nsTArray<nsTArray<uint8_t>>* aOutputBufs,
+ uint32_t aFlags = 0) override;
+
+ // Check metadata type integrity and reject unacceptable track encoder.
+ nsresult SetMetadata(
+ const nsTArray<RefPtr<TrackMetadataBase>>& aMetadata) override;
+
+ private:
+ nsresult Init();
+
+ nsresult WriteEncodedData(const nsTArray<uint8_t>& aBuffer, int aDuration,
+ uint32_t aFlags = 0);
+
+ void ProduceOggPage(nsTArray<nsTArray<uint8_t>>* aOutputBufs);
+ // Store the Medatata from track encoder
+ RefPtr<OpusMetadata> mMetadata;
+
+ ogg_stream_state mOggStreamState;
+ ogg_page mOggPage;
+ ogg_packet mPacket;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/OpusParser.cpp b/dom/media/ogg/OpusParser.cpp
new file mode 100644
index 0000000000..918888ea8c
--- /dev/null
+++ b/dom/media/ogg/OpusParser.cpp
@@ -0,0 +1,217 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <algorithm>
+#include "mozilla/EndianUtils.h"
+
+#include "OpusParser.h"
+#include "VideoUtils.h"
+
+#include "opus/opus.h"
+extern "C" {
+#include "opus/opus_multistream.h"
+}
+
+#include <cmath>
+
+namespace mozilla {
+
+extern LazyLogModule gMediaDecoderLog;
+#define OPUS_LOG(type, msg) MOZ_LOG(gMediaDecoderLog, type, msg)
+
+OpusParser::OpusParser()
+ : mRate(0),
+ mNominalRate(0),
+ mChannels(0),
+ mPreSkip(0),
+#ifdef MOZ_SAMPLE_TYPE_FLOAT32
+ mGain(1.0f),
+#else
+ mGain_Q16(65536),
+#endif
+ mChannelMapping(0),
+ mStreams(0),
+ mCoupledStreams(0),
+ mPrevPacketGranulepos(0) {
+}
+
+bool OpusParser::DecodeHeader(unsigned char* aData, size_t aLength) {
+ if (aLength < 19 || memcmp(aData, "OpusHead", 8)) {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: unrecognized header"));
+ return false;
+ }
+
+ mRate = 48000; // The Opus decoder runs at 48 kHz regardless.
+
+ int version = aData[8];
+ // Accept file format versions 0.x.
+ if ((version & 0xf0) != 0) {
+ OPUS_LOG(LogLevel::Debug,
+ ("Rejecting unknown Opus file version %d", version));
+ return false;
+ }
+
+ mChannels = aData[9];
+ if (mChannels < 1) {
+ OPUS_LOG(LogLevel::Debug,
+ ("Invalid Opus file: Number of channels %d", mChannels));
+ return false;
+ }
+
+ mPreSkip = LittleEndian::readUint16(aData + 10);
+ mNominalRate = LittleEndian::readUint32(aData + 12);
+ double gain_dB = LittleEndian::readInt16(aData + 16) / 256.0;
+#ifdef MOZ_SAMPLE_TYPE_FLOAT32
+ mGain = static_cast<float>(pow(10, 0.05 * gain_dB));
+#else
+ mGain_Q16 = static_cast<int32_t>(std::min(
+ 65536 * pow(10, 0.05 * gain_dB) + 0.5, static_cast<double>(INT32_MAX)));
+#endif
+ mChannelMapping = aData[18];
+
+ if (mChannelMapping == 0) {
+ // Mapping family 0 only allows two channels
+ if (mChannels > 2) {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: too many channels (%d) for"
+ " mapping family 0.",
+ mChannels));
+ return false;
+ }
+ mStreams = 1;
+ mCoupledStreams = mChannels - 1;
+ mMappingTable[0] = 0;
+ mMappingTable[1] = 1;
+ } else if (mChannelMapping == 1 || mChannelMapping == 2 ||
+ mChannelMapping == 255) {
+ // Currently only up to 8 channels are defined for mapping family 1
+ if (mChannelMapping == 1 && mChannels > 8) {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: too many channels (%d) for"
+ " mapping family 1.",
+ mChannels));
+ return false;
+ }
+ if (mChannelMapping == 2) {
+ if (!IsValidMapping2ChannelsCount(mChannels)) {
+ return false;
+ }
+ }
+ if (aLength > static_cast<unsigned>(20 + mChannels)) {
+ mStreams = aData[19];
+ mCoupledStreams = aData[20];
+ int i;
+ for (i = 0; i < mChannels; i++) {
+ mMappingTable[i] = aData[21 + i];
+ }
+ } else {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: channel mapping %d,"
+ " but no channel mapping table",
+ mChannelMapping));
+ return false;
+ }
+ } else {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: unsupported channel mapping "
+ "family %d",
+ mChannelMapping));
+ return false;
+ }
+ if (mStreams < 1) {
+ OPUS_LOG(LogLevel::Debug, ("Invalid Opus file: no streams"));
+ return false;
+ }
+ if (mCoupledStreams > mStreams) {
+ OPUS_LOG(LogLevel::Debug,
+ ("Invalid Opus file: more coupled streams (%d) than "
+ "total streams (%d)",
+ mCoupledStreams, mStreams));
+ return false;
+ }
+
+#ifdef DEBUG
+ OPUS_LOG(LogLevel::Debug, ("Opus stream header:"));
+ OPUS_LOG(LogLevel::Debug, (" channels: %d", mChannels));
+ OPUS_LOG(LogLevel::Debug, (" preskip: %d", mPreSkip));
+ OPUS_LOG(LogLevel::Debug, (" original: %d Hz", mNominalRate));
+ OPUS_LOG(LogLevel::Debug, (" gain: %.2f dB", gain_dB));
+ OPUS_LOG(LogLevel::Debug, ("Channel Mapping:"));
+ OPUS_LOG(LogLevel::Debug, (" family: %d", mChannelMapping));
+ OPUS_LOG(LogLevel::Debug, (" streams: %d", mStreams));
+#endif
+ return true;
+}
+
+bool OpusParser::DecodeTags(unsigned char* aData, size_t aLength) {
+ if (aLength < 16 || memcmp(aData, "OpusTags", 8)) return false;
+
+ // Copy out the raw comment lines, but only do basic validation
+ // checks against the string packing: too little data, too many
+ // comments, or comments that are too long. Rejecting these cases
+ // helps reduce the propagation of broken files.
+ // We do not ensure they are valid UTF-8 here, nor do we validate
+ // the required ASCII_TAG=value format of the user comments.
+ const unsigned char* buf = aData + 8;
+ uint32_t bytes = aLength - 8;
+ uint32_t len;
+ // Read the vendor string.
+ len = LittleEndian::readUint32(buf);
+ buf += 4;
+ bytes -= 4;
+ if (len > bytes) return false;
+ mVendorString = nsCString(reinterpret_cast<const char*>(buf), len);
+ buf += len;
+ bytes -= len;
+ // Read the user comments.
+ if (bytes < 4) return false;
+ uint32_t ncomments = LittleEndian::readUint32(buf);
+ buf += 4;
+ bytes -= 4;
+ // If there are so many comments even their length fields
+ // won't fit in the packet, stop reading now.
+ if (ncomments > (bytes >> 2)) return false;
+ for (uint32_t i = 0; i < ncomments; i++) {
+ if (bytes < 4) return false;
+ len = LittleEndian::readUint32(buf);
+ buf += 4;
+ bytes -= 4;
+ if (len > bytes) return false;
+ mTags.AppendElement(nsCString(reinterpret_cast<const char*>(buf), len));
+ buf += len;
+ bytes -= len;
+ }
+
+#ifdef DEBUG
+ OPUS_LOG(LogLevel::Debug, ("Opus metadata header:"));
+ OPUS_LOG(LogLevel::Debug, (" vendor: %s", mVendorString.get()));
+ for (uint32_t i = 0; i < mTags.Length(); i++) {
+ OPUS_LOG(LogLevel::Debug, (" %s", mTags[i].get()));
+ }
+#endif
+ return true;
+}
+
+/* static */
+bool OpusParser::IsValidMapping2ChannelsCount(uint8_t aChannels) {
+ // https://tools.ietf.org/html/draft-ietf-codec-ambisonics-08#page-4
+ // For both channel mapping family 2 and family 3, the allowed numbers
+ // of channels: (1 + n)^2 + 2j for n = 0, 1, ..., 14 and j = 0 or 1,
+ // where n denotes the (highest) ambisonic order and j denotes whether
+ // or not there is a separate non-diegetic stereo stream Explicitly the
+ // allowed number of channels are 1, 3, 4, 6, 9, 11, 16, 18, 25, 27, 36,
+ // 38, 49, 51, 64, 66, 81, 83, 100, 102, 121, 123, 144, 146, 169, 171,
+ // 196, 198, 225, and 227.
+
+ // We use the property that int(sqrt(n)) == int(sqrt(n+2)) for n != 3
+ // which is handled by the test n^2 + 2 != channel
+ if (aChannels < 1 || aChannels > 227) {
+ return false;
+ }
+ double val = sqrt(aChannels);
+ int32_t valInt = int32_t(val);
+ return val == valInt || valInt * valInt + 2 == aChannels;
+}
+
+#undef OPUS_LOG
+
+} // namespace mozilla
diff --git a/dom/media/ogg/OpusParser.h b/dom/media/ogg/OpusParser.h
new file mode 100644
index 0000000000..fc2fc5094d
--- /dev/null
+++ b/dom/media/ogg/OpusParser.h
@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(OpusParser_h_)
+# define OpusParser_h_
+
+# include "nsTArray.h"
+# include "nsString.h"
+
+namespace mozilla {
+
+class OpusParser {
+ public:
+ OpusParser();
+
+ bool DecodeHeader(unsigned char* aData, size_t aLength);
+ bool DecodeTags(unsigned char* aData, size_t aLength);
+ static bool IsValidMapping2ChannelsCount(uint8_t aChannels);
+
+ // Various fields from the Ogg Opus header.
+ int mRate; // Sample rate the decoder uses (always 48 kHz).
+ uint32_t mNominalRate; // Original sample rate of the data (informational).
+ int mChannels; // Number of channels the stream encodes.
+ uint16_t mPreSkip; // Number of samples to strip after decoder reset.
+# ifdef MOZ_SAMPLE_TYPE_FLOAT32
+ float mGain; // Gain to apply to decoder output.
+# else
+ int32_t mGain_Q16; // Gain to apply to the decoder output.
+# endif
+ int mChannelMapping; // Channel mapping family.
+ int mStreams; // Number of packed streams in each packet.
+ int mCoupledStreams; // Number of packed coupled streams in each packet.
+ unsigned char mMappingTable[255]; // Channel mapping table.
+
+ // Granule position (end sample) of the last decoded Opus packet. This is
+ // used to calculate the amount we should trim from the last packet.
+ int64_t mPrevPacketGranulepos;
+
+ nsTArray<nsCString> mTags; // Unparsed comment strings from the header.
+
+ nsCString mVendorString; // Encoder vendor string from the header.
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/dom/media/ogg/moz.build b/dom/media/ogg/moz.build
new file mode 100644
index 0000000000..863686686a
--- /dev/null
+++ b/dom/media/ogg/moz.build
@@ -0,0 +1,32 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+EXPORTS += [
+ "OggCodecState.h",
+ "OggCodecStore.h",
+ "OggDecoder.h",
+ "OggDemuxer.h",
+ "OggRLBox.h",
+ "OggRLBoxTypes.h",
+ "OggWriter.h",
+ "OpusParser.h",
+]
+
+UNIFIED_SOURCES += [
+ "OggCodecState.cpp",
+ "OggCodecStore.cpp",
+ "OggDecoder.cpp",
+ "OggDemuxer.cpp",
+ "OggWriter.cpp",
+ "OpusParser.cpp",
+]
+
+LOCAL_INCLUDES += ["!/security/rlbox"]
+
+FINAL_LIBRARY = "xul"
+
+# Add libFuzzer configuration directives
+include("/tools/fuzzing/libfuzzer-config.mozbuild")
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-30 21:07:29 +0000