osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
wireshark/wiretap/mpeg.c

416 lines
11 KiB
C
Raw Blame History

/* mpeg.c
*
* MPEG-1/2 file format decoder for the Wiretap library.
* Written by Shaun Jackman <sjackman@gmail.com>
* Copyright 2007 Shaun Jackman
*
* MPEG-1/2 Program Streams (ISO/IEC 11172-1, ISO/IEC 13818-1 / ITU-T H.220.0)
* MPEG-1/2 Video bitstream (ISO/IEC 11172-2, ISO/IEC 13818-2 / ITU-T H.262)
* MPEG-1/2 Audio files (ISO/IEC 11172-3, ISO/IEC 13818-3)
*
* Does not handle other MPEG-2 container formats such as Transport Streams
* (also ISO/IEC 13818-1 / ITU-T H.222.0) or MPEG-4 containers such as
* MPEG-4 Part 14 / MP4 (ISO/IEC 14496-14). Support in wiretap for those
* two formats is provided in mp2t.c and mp4.c, respectively.
*
* Wiretap Library
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "config.h"
#include <sys/types.h>
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#include "mpeg.h"
#include "wsutil/mpeg-audio.h"
#include "wtap-int.h"
#include <wsutil/buffer.h>
#include "file_wrappers.h"
#include <stdlib.h>
#include <string.h>
#include <time.h>
#define PES_PREFIX 1
#define PES_VALID(n) (((n) >> 8 & 0xffffff) == PES_PREFIX)
typedef struct {
nstime_t now;
time_t t0;
gboolean is_audio;
} mpeg_t;
static int mpeg_file_type_subtype = -1;
void register_mpeg(void);
static int
mpeg_resync(FILE_T fh, int *err)
{
gint64 offset = file_tell(fh);
int count = 0;
int byte = file_getc(fh);
while (byte != EOF) {
if (byte == 0xff && count > 0) {
byte = file_getc(fh);
if (byte != EOF && (byte & 0xe0) == 0xe0)
break;
} else
byte = file_getc(fh);
count++;
}
if (file_seek(fh, offset, SEEK_SET, err) == -1)
return 0;
return count;
}
#define SCRHZ 27000000
static unsigned int
mpeg_read_audio_packet(wtap *wth, FILE_T fh, gboolean is_random, int *err, gchar **err_info)
{
mpeg_t *mpeg = (mpeg_t *)wth->priv;
unsigned int packet_size;
guint32 n;
if (!wtap_read_bytes_or_eof(fh, &n, sizeof n, err, err_info))
return 0;
if (file_seek(fh, -(gint64)(sizeof n), SEEK_CUR, err) == -1)
return 0;
n = g_ntohl(n);
struct mpa mpa;
MPA_UNMARSHAL(&mpa, n);
if (MPA_VALID(&mpa)) {
packet_size = MPA_BYTES(&mpa);
if (!is_random) {
mpeg->now.nsecs += MPA_DURATION_NS(&mpa);
if (mpeg->now.nsecs >= 1000000000) {
mpeg->now.secs++;
mpeg->now.nsecs -= 1000000000;
}
}
} else {
if ((n & 0xffffff00) == 0x49443300) {
/* We have an ID3v2 header; read the size */
if (file_seek(fh, 6, SEEK_CUR, err) == -1)
return 0;
if (!wtap_read_bytes_or_eof(fh, &n, sizeof n, err, err_info))
return 0;
if (file_seek(fh, -(gint64)(6+sizeof(n)), SEEK_CUR, err) == -1)
return 0;
n = g_ntohl(n);
/* ID3v2 size does not include the 10-byte header */
packet_size = decode_synchsafe_int(n) + 10;
} else {
packet_size = mpeg_resync(fh, err);
}
}
return packet_size;
}
static unsigned int
mpeg_read_pes_packet(wtap *wth, FILE_T fh, gboolean is_random, int *err, gchar **err_info)
{
mpeg_t *mpeg = (mpeg_t *)wth->priv;
unsigned int packet_size = 0;
guint32 n;
while (1) {
if (!wtap_read_bytes_or_eof(fh, &n, sizeof n, err, err_info))
return 0;
if (file_seek(fh, -(gint64)(sizeof n), SEEK_CUR, err) == -1)
return 0;
n = g_ntohl(n);
if (PES_VALID(n)) {
break;
} else if (n == PES_PREFIX) {
if (!wtap_read_bytes(fh, NULL, 1, err, err_info))
return 0;
break;
} else if (n != 0) {
/* XXX: We could try to recover from errors and
* resynchronize to the next start code.
*/
*err = WTAP_ERR_BAD_FILE;
*err_info = ws_strdup("mpeg: Non-zero stuffing bytes before start code");
return 0;
}
if (!wtap_read_bytes(fh, NULL, 2, err, err_info))
return 0;
}
gint64 offset = file_tell(fh);
guint8 stream;
if (!wtap_read_bytes(fh, NULL, 3, err, err_info))
return 0;
if (!wtap_read_bytes(fh, &stream, sizeof stream, err, err_info))
return 0;
if (stream == 0xba) {
guint32 pack1;
guint32 pack0;
guint64 pack;
guint8 stuffing;
if (!wtap_read_bytes(fh, &pack1, sizeof pack1, err, err_info))
return 0;
if (!wtap_read_bytes(fh, &pack0, sizeof pack0, err, err_info))
return 0;
pack = (guint64)g_ntohl(pack1) << 32 | g_ntohl(pack0);
switch (pack >> 62) {
case 1:
if (!wtap_read_bytes(fh, NULL, 1, err,
err_info))
return FALSE;
if (!wtap_read_bytes(fh, &stuffing,
sizeof stuffing, err, err_info))
return FALSE;
stuffing &= 0x07;
packet_size = 14 + stuffing;
if (!is_random) {
guint64 bytes = pack >> 16;
guint64 ts_val =
(bytes >> 43 & 0x0007) << 30 |
(bytes >> 27 & 0x7fff) << 15 |
(bytes >> 11 & 0x7fff) << 0;
guint ext = (guint)((bytes >> 1) & 0x1ff);
guint64 cr = 300 * ts_val + ext;
guint rem = (guint)(cr % SCRHZ);
mpeg->now.secs
= mpeg->t0 + (time_t)(cr / SCRHZ);
mpeg->now.nsecs
= (int)(G_GINT64_CONSTANT(1000000000) * rem / SCRHZ);
}
break;
default:
packet_size = 12;
}
} else if (stream == 0xb9) {
/* MPEG_program_end_code */
packet_size = 4;
} else {
guint16 length;
if (!wtap_read_bytes(fh, &length, sizeof length, err, err_info))
return FALSE;
length = g_ntohs(length);
packet_size = 6 + length;
}
if (file_seek(fh, offset, SEEK_SET, err) == -1)
return 0;
return packet_size;
}
static gboolean
mpeg_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec, Buffer *buf,
gboolean is_random, int *err, gchar **err_info)
{
mpeg_t *mpeg = (mpeg_t *)wth->priv;
unsigned int packet_size;
nstime_t ts = mpeg->now;
if (mpeg->is_audio) {
/* mpeg_read_audio_packet calculates the duration of this
* packet to determine an updated relative timestamp for the
* next packet, if possible.
*/
packet_size = mpeg_read_audio_packet(wth, fh, is_random, err, err_info);
} else {
/* mpeg_read_pes_packet uses the System Clock Reference counter
* to produce a relative timestamp for this packet, if possible.
*/
packet_size = mpeg_read_pes_packet(wth, fh, is_random, err, err_info);
}
if (packet_size == 0)
return FALSE;
if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
return FALSE;
rec->rec_type = REC_TYPE_PACKET;
rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
rec->presence_flags = 0; /* we may or may not have a time stamp */
if (!is_random) {
/* XXX - relative, not absolute, time stamps */
rec->presence_flags = WTAP_HAS_TS;
rec->ts = ts;
}
rec->rec_header.packet_header.caplen = packet_size;
rec->rec_header.packet_header.len = packet_size;
return TRUE;
}
static gboolean
mpeg_read(wtap *wth, wtap_rec *rec, Buffer *buf, int *err,
gchar **err_info, gint64 *data_offset)
{
*data_offset = file_tell(wth->fh);
return mpeg_read_packet(wth, wth->fh, rec, buf, FALSE, err, err_info);
}
static gboolean
mpeg_seek_read(wtap *wth, gint64 seek_off,
wtap_rec *rec, Buffer *buf,
int *err, gchar **err_info)
{
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
return FALSE;
if (!mpeg_read_packet(wth, wth->random_fh, rec, buf, TRUE, err,
err_info)) {
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
return TRUE;
}
struct _mpeg_magic {
size_t len;
const gchar* match;
gboolean is_audio;
} magic[] = {
{ 3, "TAG", TRUE }, /* ID3v1 */
/* XXX: ID3v1 tags come at the end of MP3 files, so in practice the
* untagged magic number is used instead.
*/
{ 3, "ID3", TRUE }, /* ID3v2 */
{ 3, "\0\0\1", FALSE }, /* MPEG PES */
{ 2, "\xff\xfb", TRUE }, /* MP3 (MPEG-1 Audio Layer 3, no CRC), taken from https://en.wikipedia.org/wiki/MP3#File_structure */
#if 0
/* XXX: The value above is for MPEG-1 Audio Layer 3 with no CRC.
* Only the first three nibbles are the guaranteed sync byte.
* For the fourth nibble, the first bit is '1' for MPEG-1 and
* '0' for MPEG-2 (i.e., extension to lower sampling rates),
* the next two bits indicate the layer (1 for layer 3, 2 for
* layer 2, 3 for layer 1, 0 reserved), and the last ("protection")
* bit is 1 if there is no CRC and 0 if there is a CRC.
*
* The mpeg-audio dissector handles these, so wiretap should open
* them. Including all of them might increase false positives though.
*/
{ 2, "\xff\xf2", TRUE }, /* MPEG-2 Audio Layer 3, CRC */
{ 2, "\xff\xf3", TRUE }, /* MPEG-2 Audio Layer 3, No CRC */
{ 2, "\xff\xf4", TRUE }, /* MPEG-2 Audio Layer 2, CRC */
{ 2, "\xff\xf5", TRUE }, /* MPEG-2 Audio Layer 2, No CRC */
{ 2, "\xff\xf6", TRUE }, /* MPEG-2 Audio Layer 1, CRC */
{ 2, "\xff\xf7", TRUE }, /* MPEG-2 Audio Layer 1, No CRC */
{ 2, "\xff\xfa", TRUE }, /* MPEG-1 Audio Layer 3, CRC */
{ 2, "\xff\xfc", TRUE }, /* MPEG-1 Audio Layer 2, CRC */
{ 2, "\xff\xfd", TRUE }, /* MPEG-1 Audio Layer 2, No CRC */
{ 2, "\xff\xfe", TRUE }, /* MPEG-1 Audio Layer 1, CRC */
{ 2, "\xff\xff", TRUE }, /* MPEG-1 Audio Layer 1, No CRC */
#endif
{ 0, NULL, FALSE }
};
/*
* Even though this dissector uses magic numbers, it is registered in
* file_access.c as OPEN_INFO_HEURISTIC because the magic numbers are
* short and prone to false positives.
*
* XXX: There's room for improvement in detection if needed. A Program Stream
* starts with the pack_start_code, \x00\x00\x01\xba, and an uncontainered
* Video bitstream starts with the sequence_header_code, \x00\x00\x01\xb3.
* We could use those instead of matching any PES packet, which would greatly
* reduce false positives with e.g. PacketLogger files. (Unlike Transport
* Streams, unaligned file starts are unlikely with PS.)
*
* Untagged MPEG Audio files would still have to be heuristics, though.
*/
wtap_open_return_val
mpeg_open(wtap *wth, int *err, gchar **err_info)
{
char magic_buf[16];
struct _mpeg_magic* m;
mpeg_t *mpeg;
if (!wtap_read_bytes(wth->fh, magic_buf, sizeof magic_buf,
err, err_info)) {
if (*err != WTAP_ERR_SHORT_READ)
return WTAP_OPEN_ERROR;
return WTAP_OPEN_NOT_MINE;
}
for (m=magic; m->match; m++) {
if (memcmp(magic_buf, m->match, m->len) == 0)
goto good_magic;
}
return WTAP_OPEN_NOT_MINE;
good_magic:
/* This appears to be a file with MPEG data. */
if (file_seek(wth->fh, 0, SEEK_SET, err) == -1)
return WTAP_OPEN_ERROR;
wth->file_type_subtype = mpeg_file_type_subtype;
wth->file_encap = WTAP_ENCAP_MPEG;
wth->file_tsprec = WTAP_TSPREC_NSEC;
wth->subtype_read = mpeg_read;
wth->subtype_seek_read = mpeg_seek_read;
wth->snapshot_length = 0;
mpeg = g_new(mpeg_t, 1);
wth->priv = (void *)mpeg;
mpeg->now.secs = 0;
mpeg->now.nsecs = 0;
mpeg->t0 = mpeg->now.secs;
mpeg->is_audio = m->is_audio;
return WTAP_OPEN_MINE;
}
static const struct supported_block_type mpeg_blocks_supported[] = {
/*
* This file format divides the file up into a "packet" for
* each frame, and doesn't support any options.
*/
{ WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
};
static const struct file_type_subtype_info mpeg_info = {
"MPEG", "mpeg", "mpeg", "mpg;mp3",
FALSE, BLOCKS_SUPPORTED(mpeg_blocks_supported),
NULL, NULL, NULL
};
void register_mpeg(void)
{
mpeg_file_type_subtype = wtap_register_file_type_subtype(&mpeg_info);
/*
* Register name for backwards compatibility with the
* wtap_filetypes table in Lua.
*/
wtap_register_backwards_compatibility_lua_name("MPEG",
mpeg_file_type_subtype);
}
/*
* Editor modelines - https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/
Reference in New Issue View Git Blame Copy Permalink