fecdec: Fix a double-free bug in clear_group().
[paraslash.git] / fecdec_filter.c
index 103f4ffc7b2d5f53b6bff2ac98a7e71092b464f4..8cb17ad642098e81621e2be6f6c0643ac6de4038 100644 (file)
@@ -4,7 +4,7 @@
  * Licensed under the GPL v2. For licencing details see COPYING.
  */
 
-/** \file fecdec_filter.c A filter fec-decodes an audio stream. */
+/** \file fecdec_filter.c A filter that fec-decodes an audio stream. */
 
 #include <dirent.h>
 #include "para.h"
@@ -78,12 +78,15 @@ struct private_fecdec_data {
        struct fec_parms *fec;
        /** Keeps track of what was received so far. */
        struct fecdec_group groups[NUM_FEC_GROUPS];
+       /** Whether an audio file header was already received. */
        int have_header;
+       /** Points to the first received group. */
+       struct fecdec_group *first_complete_group;
 };
 
 /** Iterate over all fecdec groups. */
 #define FOR_EACH_FECDEC_GROUP(g, d) for (g = (d)->groups; \
-       (g) - (d)->groups < NUM_FEC_GROUPS; (g)++)
+       (g) < (d)->groups + NUM_FEC_GROUPS; (g)++)
 
 static int group_complete(struct fecdec_group *fg)
 {
@@ -105,7 +108,9 @@ static void clear_group(struct fecdec_group *fg)
                fg->idx[i] = -1;
        }
        free(fg->data);
+       fg->data = NULL;
        free(fg->idx);
+       fg->idx = NULL;
        fg->num_slices = 0;
        memset(&fg->h, 0, sizeof(struct fec_header));
        fg->num_received_slices = 0;
@@ -152,6 +157,12 @@ static struct fecdec_group *try_to_free_group(struct private_fecdec_data *pfd)
        FOR_EACH_FECDEC_GROUP(fg, pfd) {
                if (!group_complete(fg))
                        continue;
+               /*
+                * Don't clear the first complete group if it has not yet been
+                * decoded.
+                */
+               if (fg == pfd->first_complete_group)
+                       continue;
                clear_group(fg);
                return fg;
        }
@@ -170,6 +181,8 @@ static struct fecdec_group *free_oldest_group(struct private_fecdec_data *pfd)
                PARA_WARNING_LOG("Clearing incomplete group %d "
                        "(contains %d slices)\n", oldest->h.group_num,
                        oldest->num_received_slices);
+       if (oldest == pfd->first_complete_group)
+               pfd->first_complete_group = NULL;
        clear_group(oldest);
        return oldest;
 }
@@ -210,21 +223,21 @@ static int add_slice(char *buf, struct fecdec_group *fg)
        int r, slice_num;
 
        if (group_complete(fg)) {
-               PARA_DEBUG_LOG("group complete, ignoring slice %d\n",
-                       fg->h.slice_num);
+               PARA_DEBUG_LOG("group %d complete, ignoring slice %d\n",
+                       fg->h.group_num, fg->h.slice_num);
                fg->num_received_slices++;
                return 0;
        }
        slice_num = fg->h.slice_num;
        if (fg->num_slices == 0) {
                fg->num_slices = fg->h.slices_per_group;
-               fg->idx = malloc(fg->num_slices * sizeof(int));
-               fg->data = malloc(fg->num_slices * sizeof(unsigned char *));
+               fg->idx = para_malloc(fg->num_slices * sizeof(int));
+               fg->data = para_malloc(fg->num_slices * sizeof(unsigned char *));
                memset(fg->data, 0, fg->num_slices * sizeof(unsigned char *));
        }
        r = fg->num_received_slices;
        fg->idx[r] = slice_num;
-       fg->data[r] = malloc(fg->h.slice_bytes);
+       fg->data[r] = para_malloc(fg->h.slice_bytes);
        memcpy(fg->data[r], buf, fg->h.slice_bytes);
        fg->num_received_slices++;
        return 1;
@@ -234,6 +247,7 @@ enum fec_group_usability {
        FEC_GROUP_UNUSABLE,
        FEC_GROUP_USABLE,
        FEC_GROUP_USABLE_SKIP_HEADER,
+       FEC_GROUP_USABLE_WITH_HEADER
 };
 
 static enum fec_group_usability group_is_usable(struct fecdec_group *fg,
@@ -251,14 +265,14 @@ static enum fec_group_usability group_is_usable(struct fecdec_group *fg,
        if (fg->h.bos)
                return FEC_GROUP_USABLE;
        if (fg->h.audio_header_size)
-               return FEC_GROUP_USABLE;
+               return FEC_GROUP_USABLE_WITH_HEADER;
        return FEC_GROUP_UNUSABLE;
 }
 
 static int decode_group(struct fecdec_group *fg, struct filter_node *fn)
 {
        int i, ret, sb = fg->h.slice_bytes;
-       size_t written = 0, need;
+       size_t written, need;
        struct private_fecdec_data *pfd = fn->private_data;
        enum fec_group_usability u = group_is_usable(fg, pfd);
 
@@ -266,7 +280,7 @@ static int decode_group(struct fecdec_group *fg, struct filter_node *fn)
                PARA_INFO_LOG("dropping unusable group %d\n", fg->h.group_num);
                return 0;
        }
-       PARA_DEBUG_LOG("decoding group %d %d slices\n", fg->h.group_num,
+       PARA_DEBUG_LOG("decoding group %d (%d slices)\n", fg->h.group_num,
                fg->h.data_slices_per_group);
        ret = fec_decode(pfd->fec, fg->data, fg->idx, sb);
        if (ret < 0)
@@ -289,6 +303,21 @@ static int decode_group(struct fecdec_group *fg, struct filter_node *fn)
                PARA_INFO_LOG("increasing fec buf to %zu\n", fn->bufsize);
                fn->buf = para_realloc(fn->buf, fn->bufsize);
        }
+       if (u == FEC_GROUP_USABLE_WITH_HEADER) {
+               PARA_INFO_LOG("writing audio file header\n");
+               written = 0;
+               for (i = 0; i < fg->h.data_slices_per_group; i++) {
+                       size_t n = sb;
+                       if (written >= fg->h.audio_header_size)
+                               break;
+                       if (sb + written > fg->h.audio_header_size)
+                               n = fg->h.audio_header_size - written;
+                       memcpy(fn->buf + fn->loaded, fg->data[i], n);
+                       fn->loaded += n;
+                       written += n;
+               }
+       }
+       written = 0;
        for (; i < fg->h.data_slices_per_group; i++) {
                size_t n = sb;
                if (n + written > fg->h.group_bytes)
@@ -338,7 +367,7 @@ static int dispatch_slice(char *buf, size_t len, struct fec_header *h,
                struct filter_node *fn)
 {
        struct fecdec_group *fg;
-       int ret;
+       int ret, k, n;
        struct private_fecdec_data *pfd = fn->private_data;
 
        if (h->slice_bytes > len) /* can not use the thing, try to read more */
@@ -346,20 +375,39 @@ static int dispatch_slice(char *buf, size_t len, struct fec_header *h,
        ret = get_group(h, pfd, &fg);
        if (ret < 0)
                return ret;
-       if (!add_slice(buf, fg))
+       if (!add_slice(buf, fg)) /* group already complete */
+               return 1;
+       if (!group_complete(fg))
+               return 1;
+       /* this slice completed the group */
+       if (pfd->fec)
+               goto decode;
+       /* it's either the first or the second complete group */
+       if (!pfd->first_complete_group) { /* it's the first group */
+               enum fec_group_usability u = group_is_usable(fg, pfd);
+               assert(u != FEC_GROUP_USABLE_SKIP_HEADER);
+               if (u == FEC_GROUP_UNUSABLE) /* forget it */
+                       return 1;
+               pfd->first_complete_group = fg; /* remember it */
                return 1;
-       if (group_complete(fg)) {
-               if (!pfd->fec) {
-                       int k = h->data_slices_per_group, n = h->slices_per_group;
-                       PARA_NOTICE_LOG("init fec (%d, %d)\n", k, n);
-                       ret = fec_new(k, n, &pfd->fec);
-                       if (ret < 0)
-                               return ret;
-               }
-               ret = decode_group(fg, fn);
-               if (ret < 0)
-                       return ret;
        }
+       /* we have two complete groups, let's go */
+       k = h->data_slices_per_group;
+       n = h->slices_per_group;
+       PARA_NOTICE_LOG("init fec (%d, %d)\n", k, n);
+       ret = fec_new(k, n, &pfd->fec);
+       if (ret < 0)
+               return ret;
+       /* decode and clear the first group */
+       ret = decode_group(pfd->first_complete_group, fn);
+       if (ret < 0)
+               return ret;
+       clear_group(pfd->first_complete_group);
+       pfd->first_complete_group = NULL;
+decode:
+       ret = decode_group(fg, fn);
+       if (ret < 0)
+               return ret;
        return 1;
 }
 
@@ -399,9 +447,11 @@ static void fecdec_close(struct filter_node *fn)
 
 static void fecdec_open(struct filter_node *fn)
 {
+       struct private_fecdec_data *pfd;
        fn->bufsize = FECDEC_DEFAULT_OUTBUF_SIZE;
        fn->buf = para_malloc(fn->bufsize);
-       fn->private_data = para_calloc(sizeof(struct private_fecdec_data));
+       pfd = para_calloc(sizeof(*pfd));
+       fn->private_data = pfd;
        fn->loaded = 0;
 }