1/*
2 * Copyright (C) 2010 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17//#define LOG_NDEBUG 0
18#define LOG_TAG "ESQueue"
19#include <media/stagefright/foundation/ADebug.h>
20
21#include "ESQueue.h"
22
23#include <media/stagefright/foundation/hexdump.h>
24#include <media/stagefright/foundation/ABitReader.h>
25#include <media/stagefright/foundation/ABuffer.h>
26#include <media/stagefright/foundation/AMessage.h>
27#include <media/stagefright/MediaErrors.h>
28#include <media/stagefright/MediaDefs.h>
29#include <media/stagefright/MetaData.h>
30#include <media/stagefright/Utils.h>
31#include <media/cas/DescramblerAPI.h>
32#include <media/hardware/CryptoAPI.h>
33
34#include "include/avc_utils.h"
35
36#include <inttypes.h>
37#include <netinet/in.h>
38
39namespace android {
40
41ElementaryStreamQueue::ElementaryStreamQueue(Mode mode, uint32_t flags)
42    : mMode(mode),
43      mFlags(flags),
44      mEOSReached(false),
45      mCASystemId(0),
46      mAUIndex(0) {
47
48    ALOGV("ElementaryStreamQueue(%p) mode %x  flags %x  isScrambled %d  isSampleEncrypted %d",
49            this, mode, flags, isScrambled(), isSampleEncrypted());
50
51    // Create the decryptor anyway since we don't know the use-case unless key is provided
52    // Won't decrypt if key info not available (e.g., scanner/extractor just parsing ts files)
53    mSampleDecryptor = isSampleEncrypted() ? new HlsSampleDecryptor : NULL;
54}
55
56sp<MetaData> ElementaryStreamQueue::getFormat() {
57    return mFormat;
58}
59
60void ElementaryStreamQueue::clear(bool clearFormat) {
61    if (mBuffer != NULL) {
62        mBuffer->setRange(0, 0);
63    }
64
65    mRangeInfos.clear();
66
67    if (mScrambledBuffer != NULL) {
68        mScrambledBuffer->setRange(0, 0);
69    }
70    mScrambledRangeInfos.clear();
71
72    if (clearFormat) {
73        mFormat.clear();
74    }
75
76    mEOSReached = false;
77}
78
79bool ElementaryStreamQueue::isScrambled() const {
80    return (mFlags & kFlag_ScrambledData) != 0;
81}
82
83void ElementaryStreamQueue::setCasInfo(
84        int32_t systemId, const std::vector<uint8_t> &sessionId) {
85    mCASystemId = systemId;
86    mCasSessionId = sessionId;
87}
88
89// Parse AC3 header assuming the current ptr is start position of syncframe,
90// update metadata only applicable, and return the payload size
91static unsigned parseAC3SyncFrame(
92        const uint8_t *ptr, size_t size, sp<MetaData> *metaData) {
93    static const unsigned channelCountTable[] = {2, 1, 2, 3, 3, 4, 4, 5};
94    static const unsigned samplingRateTable[] = {48000, 44100, 32000};
95
96    static const unsigned frameSizeTable[19][3] = {
97        { 64, 69, 96 },
98        { 80, 87, 120 },
99        { 96, 104, 144 },
100        { 112, 121, 168 },
101        { 128, 139, 192 },
102        { 160, 174, 240 },
103        { 192, 208, 288 },
104        { 224, 243, 336 },
105        { 256, 278, 384 },
106        { 320, 348, 480 },
107        { 384, 417, 576 },
108        { 448, 487, 672 },
109        { 512, 557, 768 },
110        { 640, 696, 960 },
111        { 768, 835, 1152 },
112        { 896, 975, 1344 },
113        { 1024, 1114, 1536 },
114        { 1152, 1253, 1728 },
115        { 1280, 1393, 1920 },
116    };
117
118    ABitReader bits(ptr, size);
119    if (bits.numBitsLeft() < 16) {
120        return 0;
121    }
122    if (bits.getBits(16) != 0x0B77) {
123        return 0;
124    }
125
126    if (bits.numBitsLeft() < 16 + 2 + 6 + 5 + 3 + 3) {
127        ALOGV("Not enough bits left for further parsing");
128        return 0;
129    }
130    bits.skipBits(16);  // crc1
131
132    unsigned fscod = bits.getBits(2);
133    if (fscod == 3) {
134        ALOGW("Incorrect fscod in AC3 header");
135        return 0;
136    }
137
138    unsigned frmsizecod = bits.getBits(6);
139    if (frmsizecod > 37) {
140        ALOGW("Incorrect frmsizecod in AC3 header");
141        return 0;
142    }
143
144    unsigned bsid = bits.getBits(5);
145    if (bsid > 8) {
146        ALOGW("Incorrect bsid in AC3 header. Possibly E-AC-3?");
147        return 0;
148    }
149
150    unsigned bsmod __unused = bits.getBits(3);
151    unsigned acmod = bits.getBits(3);
152    unsigned cmixlev __unused = 0;
153    unsigned surmixlev __unused = 0;
154    unsigned dsurmod __unused = 0;
155
156    if ((acmod & 1) > 0 && acmod != 1) {
157        if (bits.numBitsLeft() < 2) {
158            return 0;
159        }
160        cmixlev = bits.getBits(2);
161    }
162    if ((acmod & 4) > 0) {
163        if (bits.numBitsLeft() < 2) {
164            return 0;
165        }
166        surmixlev = bits.getBits(2);
167    }
168    if (acmod == 2) {
169        if (bits.numBitsLeft() < 2) {
170            return 0;
171        }
172        dsurmod = bits.getBits(2);
173    }
174
175    if (bits.numBitsLeft() < 1) {
176        return 0;
177    }
178    unsigned lfeon = bits.getBits(1);
179
180    unsigned samplingRate = samplingRateTable[fscod];
181    unsigned payloadSize = frameSizeTable[frmsizecod >> 1][fscod];
182    if (fscod == 1) {
183        payloadSize += frmsizecod & 1;
184    }
185    payloadSize <<= 1;  // convert from 16-bit words to bytes
186
187    unsigned channelCount = channelCountTable[acmod] + lfeon;
188
189    if (metaData != NULL) {
190        (*metaData)->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_AC3);
191        (*metaData)->setInt32(kKeyChannelCount, channelCount);
192        (*metaData)->setInt32(kKeySampleRate, samplingRate);
193    }
194
195    return payloadSize;
196}
197
198static bool IsSeeminglyValidAC3Header(const uint8_t *ptr, size_t size) {
199    return parseAC3SyncFrame(ptr, size, NULL) > 0;
200}
201
202static bool IsSeeminglyValidADTSHeader(
203        const uint8_t *ptr, size_t size, size_t *frameLength) {
204    if (size < 7) {
205        // Not enough data to verify header.
206        return false;
207    }
208
209    if (ptr[0] != 0xff || (ptr[1] >> 4) != 0x0f) {
210        return false;
211    }
212
213    unsigned layer = (ptr[1] >> 1) & 3;
214
215    if (layer != 0) {
216        return false;
217    }
218
219    unsigned ID = (ptr[1] >> 3) & 1;
220    unsigned profile_ObjectType = ptr[2] >> 6;
221
222    if (ID == 1 && profile_ObjectType == 3) {
223        // MPEG-2 profile 3 is reserved.
224        return false;
225    }
226
227    size_t frameLengthInHeader =
228            ((ptr[3] & 3) << 11) + (ptr[4] << 3) + ((ptr[5] >> 5) & 7);
229    if (frameLengthInHeader > size) {
230        return false;
231    }
232
233    *frameLength = frameLengthInHeader;
234    return true;
235}
236
237static bool IsSeeminglyValidMPEGAudioHeader(const uint8_t *ptr, size_t size) {
238    if (size < 3) {
239        // Not enough data to verify header.
240        return false;
241    }
242
243    if (ptr[0] != 0xff || (ptr[1] >> 5) != 0x07) {
244        return false;
245    }
246
247    unsigned ID = (ptr[1] >> 3) & 3;
248
249    if (ID == 1) {
250        return false;  // reserved
251    }
252
253    unsigned layer = (ptr[1] >> 1) & 3;
254
255    if (layer == 0) {
256        return false;  // reserved
257    }
258
259    unsigned bitrateIndex = (ptr[2] >> 4);
260
261    if (bitrateIndex == 0x0f) {
262        return false;  // reserved
263    }
264
265    unsigned samplingRateIndex = (ptr[2] >> 2) & 3;
266
267    if (samplingRateIndex == 3) {
268        return false;  // reserved
269    }
270
271    return true;
272}
273
274status_t ElementaryStreamQueue::appendData(
275        const void *data, size_t size, int64_t timeUs,
276        int32_t payloadOffset, uint32_t pesScramblingControl) {
277
278    if (mEOSReached) {
279        ALOGE("appending data after EOS");
280        return ERROR_MALFORMED;
281    }
282    if (mBuffer == NULL || mBuffer->size() == 0) {
283        switch (mMode) {
284            case H264:
285            case MPEG_VIDEO:
286            {
287#if 0
288                if (size < 4 || memcmp("\x00\x00\x00\x01", data, 4)) {
289                    return ERROR_MALFORMED;
290                }
291#else
292                uint8_t *ptr = (uint8_t *)data;
293
294                ssize_t startOffset = -1;
295                for (size_t i = 0; i + 2 < size; ++i) {
296                    if (!memcmp("\x00\x00\x01", &ptr[i], 3)) {
297                        startOffset = i;
298                        break;
299                    }
300                }
301
302                if (startOffset < 0) {
303                    return ERROR_MALFORMED;
304                }
305
306                if (mFormat == NULL && startOffset > 0) {
307                    ALOGI("found something resembling an H.264/MPEG syncword "
308                          "at offset %zd",
309                          startOffset);
310                }
311
312                data = &ptr[startOffset];
313                size -= startOffset;
314#endif
315                break;
316            }
317
318            case MPEG4_VIDEO:
319            {
320#if 0
321                if (size < 3 || memcmp("\x00\x00\x01", data, 3)) {
322                    return ERROR_MALFORMED;
323                }
324#else
325                uint8_t *ptr = (uint8_t *)data;
326
327                ssize_t startOffset = -1;
328                for (size_t i = 0; i + 2 < size; ++i) {
329                    if (!memcmp("\x00\x00\x01", &ptr[i], 3)) {
330                        startOffset = i;
331                        break;
332                    }
333                }
334
335                if (startOffset < 0) {
336                    return ERROR_MALFORMED;
337                }
338
339                if (startOffset > 0) {
340                    ALOGI("found something resembling an H.264/MPEG syncword "
341                          "at offset %zd",
342                          startOffset);
343                }
344
345                data = &ptr[startOffset];
346                size -= startOffset;
347#endif
348                break;
349            }
350
351            case AAC:
352            {
353                uint8_t *ptr = (uint8_t *)data;
354
355#if 0
356                if (size < 2 || ptr[0] != 0xff || (ptr[1] >> 4) != 0x0f) {
357                    return ERROR_MALFORMED;
358                }
359#else
360                ssize_t startOffset = -1;
361                size_t frameLength;
362                for (size_t i = 0; i < size; ++i) {
363                    if (IsSeeminglyValidADTSHeader(
364                            &ptr[i], size - i, &frameLength)) {
365                        startOffset = i;
366                        break;
367                    }
368                }
369
370                if (startOffset < 0) {
371                    return ERROR_MALFORMED;
372                }
373
374                if (startOffset > 0) {
375                    ALOGI("found something resembling an AAC syncword at "
376                          "offset %zd",
377                          startOffset);
378                }
379
380                if (frameLength != size - startOffset) {
381                    ALOGV("First ADTS AAC frame length is %zd bytes, "
382                          "while the buffer size is %zd bytes.",
383                          frameLength, size - startOffset);
384                }
385
386                data = &ptr[startOffset];
387                size -= startOffset;
388#endif
389                break;
390            }
391
392            case AC3:
393            {
394                uint8_t *ptr = (uint8_t *)data;
395
396                ssize_t startOffset = -1;
397                for (size_t i = 0; i < size; ++i) {
398                    if (IsSeeminglyValidAC3Header(&ptr[i], size - i)) {
399                        startOffset = i;
400                        break;
401                    }
402                }
403
404                if (startOffset < 0) {
405                    return ERROR_MALFORMED;
406                }
407
408                if (startOffset > 0) {
409                    ALOGI("found something resembling an AC3 syncword at "
410                          "offset %zd",
411                          startOffset);
412                }
413
414                data = &ptr[startOffset];
415                size -= startOffset;
416                break;
417            }
418
419            case MPEG_AUDIO:
420            {
421                uint8_t *ptr = (uint8_t *)data;
422
423                ssize_t startOffset = -1;
424                for (size_t i = 0; i < size; ++i) {
425                    if (IsSeeminglyValidMPEGAudioHeader(&ptr[i], size - i)) {
426                        startOffset = i;
427                        break;
428                    }
429                }
430
431                if (startOffset < 0) {
432                    return ERROR_MALFORMED;
433                }
434
435                if (startOffset > 0) {
436                    ALOGI("found something resembling an MPEG audio "
437                          "syncword at offset %zd",
438                          startOffset);
439                }
440
441                data = &ptr[startOffset];
442                size -= startOffset;
443                break;
444            }
445
446            case PCM_AUDIO:
447            case METADATA:
448            {
449                break;
450            }
451
452            default:
453                ALOGE("Unknown mode: %d", mMode);
454                return ERROR_MALFORMED;
455        }
456    }
457
458    size_t neededSize = (mBuffer == NULL ? 0 : mBuffer->size()) + size;
459    if (mBuffer == NULL || neededSize > mBuffer->capacity()) {
460        neededSize = (neededSize + 65535) & ~65535;
461
462        ALOGV("resizing buffer to size %zu", neededSize);
463
464        sp<ABuffer> buffer = new ABuffer(neededSize);
465        if (mBuffer != NULL) {
466            memcpy(buffer->data(), mBuffer->data(), mBuffer->size());
467            buffer->setRange(0, mBuffer->size());
468        } else {
469            buffer->setRange(0, 0);
470        }
471
472        mBuffer = buffer;
473    }
474
475    memcpy(mBuffer->data() + mBuffer->size(), data, size);
476    mBuffer->setRange(0, mBuffer->size() + size);
477
478    RangeInfo info;
479    info.mLength = size;
480    info.mTimestampUs = timeUs;
481    info.mPesOffset = payloadOffset;
482    info.mPesScramblingControl = pesScramblingControl;
483    mRangeInfos.push_back(info);
484
485#if 0
486    if (mMode == AAC) {
487        ALOGI("size = %zu, timeUs = %.2f secs", size, timeUs / 1E6);
488        hexdump(data, size);
489    }
490#endif
491
492    return OK;
493}
494
495void ElementaryStreamQueue::appendScrambledData(
496        const void *data, size_t size,
497        int32_t keyId, bool isSync,
498        sp<ABuffer> clearSizes, sp<ABuffer> encSizes) {
499    if (!isScrambled()) {
500        return;
501    }
502
503    size_t neededSize = (mScrambledBuffer == NULL ? 0 : mScrambledBuffer->size()) + size;
504    if (mScrambledBuffer == NULL || neededSize > mScrambledBuffer->capacity()) {
505        neededSize = (neededSize + 65535) & ~65535;
506
507        ALOGI("resizing scrambled buffer to size %zu", neededSize);
508
509        sp<ABuffer> buffer = new ABuffer(neededSize);
510        if (mScrambledBuffer != NULL) {
511            memcpy(buffer->data(), mScrambledBuffer->data(), mScrambledBuffer->size());
512            buffer->setRange(0, mScrambledBuffer->size());
513        } else {
514            buffer->setRange(0, 0);
515        }
516
517        mScrambledBuffer = buffer;
518    }
519    memcpy(mScrambledBuffer->data() + mScrambledBuffer->size(), data, size);
520    mScrambledBuffer->setRange(0, mScrambledBuffer->size() + size);
521
522    ScrambledRangeInfo scrambledInfo;
523    scrambledInfo.mLength = size;
524    scrambledInfo.mKeyId = keyId;
525    scrambledInfo.mIsSync = isSync;
526    scrambledInfo.mClearSizes = clearSizes;
527    scrambledInfo.mEncSizes = encSizes;
528
529    ALOGV("[stream %d] appending scrambled range: size=%zu", mMode, size);
530
531    mScrambledRangeInfos.push_back(scrambledInfo);
532}
533
534sp<ABuffer> ElementaryStreamQueue::dequeueScrambledAccessUnit() {
535    size_t nextScan = mBuffer->size();
536    mBuffer->setRange(0, 0);
537    int32_t pesOffset = 0, pesScramblingControl = 0;
538    int64_t timeUs = fetchTimestamp(nextScan, &pesOffset, &pesScramblingControl);
539    if (timeUs < 0ll) {
540        ALOGE("Negative timeUs");
541        return NULL;
542    }
543
544    // return scrambled unit
545    int32_t keyId = pesScramblingControl, isSync = 0, scrambledLength = 0;
546    sp<ABuffer> clearSizes, encSizes;
547    while (mScrambledRangeInfos.size() > mRangeInfos.size()) {
548        auto it = mScrambledRangeInfos.begin();
549        ALOGV("[stream %d] fetching scrambled range: size=%zu", mMode, it->mLength);
550
551        if (scrambledLength > 0) {
552            // This shouldn't happen since we always dequeue the entire PES.
553            ALOGW("Discarding srambled length %d", scrambledLength);
554        }
555        scrambledLength = it->mLength;
556
557        // TODO: handle key id change, use first non-zero keyId for now
558        if (keyId == 0) {
559            keyId = it->mKeyId;
560        }
561        clearSizes = it->mClearSizes;
562        encSizes = it->mEncSizes;
563        isSync = it->mIsSync;
564        mScrambledRangeInfos.erase(it);
565    }
566    if (scrambledLength == 0) {
567        ALOGE("[stream %d] empty scrambled unit!", mMode);
568        return NULL;
569    }
570
571    // skip the PES header, and copy the rest into scrambled access unit
572    sp<ABuffer> scrambledAccessUnit = ABuffer::CreateAsCopy(
573            mScrambledBuffer->data() + pesOffset,
574            scrambledLength - pesOffset);
575
576    // fix up first sample size after skipping the PES header
577    if (pesOffset > 0) {
578        int32_t &firstClearSize = *(int32_t*)clearSizes->data();
579        int32_t &firstEncSize = *(int32_t*)encSizes->data();
580        // Cut away the PES header
581        if (firstClearSize >= pesOffset) {
582            // This is for TS-level scrambling, we descrambled the first
583            // (or it was clear to begin with)
584            firstClearSize -= pesOffset;
585        } else if (firstEncSize >= pesOffset) {
586            // This can only be PES-level scrambling
587            firstEncSize -= pesOffset;
588        }
589    }
590
591    scrambledAccessUnit->meta()->setInt64("timeUs", timeUs);
592    if (isSync) {
593        scrambledAccessUnit->meta()->setInt32("isSync", 1);
594    }
595
596    // fill in CryptoInfo fields for AnotherPacketSource::read()
597    // MediaCas doesn't use cryptoMode, but set to non-zero value here.
598    scrambledAccessUnit->meta()->setInt32(
599            "cryptoMode", CryptoPlugin::kMode_AES_CTR);
600    scrambledAccessUnit->meta()->setInt32("cryptoKey", keyId);
601    scrambledAccessUnit->meta()->setBuffer("clearBytes", clearSizes);
602    scrambledAccessUnit->meta()->setBuffer("encBytes", encSizes);
603
604    memmove(mScrambledBuffer->data(),
605            mScrambledBuffer->data() + scrambledLength,
606            mScrambledBuffer->size() - scrambledLength);
607
608    mScrambledBuffer->setRange(0, mScrambledBuffer->size() - scrambledLength);
609
610    ALOGV("[stream %d] dequeued scrambled AU: timeUs=%lld, size=%zu",
611            mMode, (long long)timeUs, scrambledAccessUnit->size());
612
613    return scrambledAccessUnit;
614}
615
616sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnit() {
617    if ((mFlags & kFlag_AlignedData) && mMode == H264 && !isScrambled()) {
618        if (mRangeInfos.empty()) {
619            return NULL;
620        }
621
622        RangeInfo info = *mRangeInfos.begin();
623        mRangeInfos.erase(mRangeInfos.begin());
624
625        sp<ABuffer> accessUnit = new ABuffer(info.mLength);
626        memcpy(accessUnit->data(), mBuffer->data(), info.mLength);
627        accessUnit->meta()->setInt64("timeUs", info.mTimestampUs);
628
629        memmove(mBuffer->data(),
630                mBuffer->data() + info.mLength,
631                mBuffer->size() - info.mLength);
632
633        mBuffer->setRange(0, mBuffer->size() - info.mLength);
634
635        if (mFormat == NULL) {
636            mFormat = MakeAVCCodecSpecificData(accessUnit);
637        }
638
639        return accessUnit;
640    }
641
642    switch (mMode) {
643        case H264:
644            return dequeueAccessUnitH264();
645        case AAC:
646            return dequeueAccessUnitAAC();
647        case AC3:
648            return dequeueAccessUnitAC3();
649        case MPEG_VIDEO:
650            return dequeueAccessUnitMPEGVideo();
651        case MPEG4_VIDEO:
652            return dequeueAccessUnitMPEG4Video();
653        case PCM_AUDIO:
654            return dequeueAccessUnitPCMAudio();
655        case METADATA:
656            return dequeueAccessUnitMetadata();
657        default:
658            if (mMode != MPEG_AUDIO) {
659                ALOGE("Unknown mode");
660                return NULL;
661            }
662            return dequeueAccessUnitMPEGAudio();
663    }
664}
665
666sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitAC3() {
667    unsigned syncStartPos = 0;  // in bytes
668    unsigned payloadSize = 0;
669    sp<MetaData> format = new MetaData;
670
671    ALOGV("dequeueAccessUnit_AC3[%d]: mBuffer %p(%zu)", mAUIndex, mBuffer->data(), mBuffer->size());
672
673    while (true) {
674        if (syncStartPos + 2 >= mBuffer->size()) {
675            return NULL;
676        }
677
678        payloadSize = parseAC3SyncFrame(
679                mBuffer->data() + syncStartPos,
680                mBuffer->size() - syncStartPos,
681                &format);
682        if (payloadSize > 0) {
683            break;
684        }
685
686        ALOGV("dequeueAccessUnit_AC3[%d]: syncStartPos %u payloadSize %u",
687                mAUIndex, syncStartPos, payloadSize);
688
689        ++syncStartPos;
690    }
691
692    if (mBuffer->size() < syncStartPos + payloadSize) {
693        ALOGV("Not enough buffer size for AC3");
694        return NULL;
695    }
696
697    if (mFormat == NULL) {
698        mFormat = format;
699    }
700
701
702    int64_t timeUs = fetchTimestamp(syncStartPos + payloadSize);
703    if (timeUs < 0ll) {
704        ALOGE("negative timeUs");
705        return NULL;
706    }
707
708    // Not decrypting if key info not available (e.g., scanner/extractor parsing ts files)
709    if (mSampleDecryptor != NULL) {
710        mSampleDecryptor->processAC3(mBuffer->data() + syncStartPos, payloadSize);
711    }
712    mAUIndex++;
713
714    sp<ABuffer> accessUnit = new ABuffer(syncStartPos + payloadSize);
715    memcpy(accessUnit->data(), mBuffer->data(), syncStartPos + payloadSize);
716
717    accessUnit->meta()->setInt64("timeUs", timeUs);
718    accessUnit->meta()->setInt32("isSync", 1);
719
720    memmove(
721            mBuffer->data(),
722            mBuffer->data() + syncStartPos + payloadSize,
723            mBuffer->size() - syncStartPos - payloadSize);
724
725    mBuffer->setRange(0, mBuffer->size() - syncStartPos - payloadSize);
726
727    return accessUnit;
728}
729
730sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitPCMAudio() {
731    if (mBuffer->size() < 4) {
732        return NULL;
733    }
734
735    ABitReader bits(mBuffer->data(), 4);
736    if (bits.getBits(8) != 0xa0) {
737        ALOGE("Unexpected bit values");
738        return NULL;
739    }
740    unsigned numAUs = bits.getBits(8);
741    bits.skipBits(8);
742    unsigned quantization_word_length __unused = bits.getBits(2);
743    unsigned audio_sampling_frequency = bits.getBits(3);
744    unsigned num_channels = bits.getBits(3);
745
746    if (audio_sampling_frequency != 2) {
747        ALOGE("Wrong sampling freq");
748        return NULL;
749    }
750    if (num_channels != 1u) {
751        ALOGE("Wrong channel #");
752        return NULL;
753    }
754
755    if (mFormat == NULL) {
756        mFormat = new MetaData;
757        mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_RAW);
758        mFormat->setInt32(kKeyChannelCount, 2);
759        mFormat->setInt32(kKeySampleRate, 48000);
760        mFormat->setInt32(kKeyPcmEncoding, kAudioEncodingPcm16bit);
761    }
762
763    static const size_t kFramesPerAU = 80;
764    size_t frameSize = 2 /* numChannels */ * sizeof(int16_t);
765
766    size_t payloadSize = numAUs * frameSize * kFramesPerAU;
767
768    if (mBuffer->size() < 4 + payloadSize) {
769        return NULL;
770    }
771
772    sp<ABuffer> accessUnit = new ABuffer(payloadSize);
773    memcpy(accessUnit->data(), mBuffer->data() + 4, payloadSize);
774
775    int64_t timeUs = fetchTimestamp(payloadSize + 4);
776    if (timeUs < 0ll) {
777        ALOGE("Negative timeUs");
778        return NULL;
779    }
780    accessUnit->meta()->setInt64("timeUs", timeUs);
781    accessUnit->meta()->setInt32("isSync", 1);
782
783    int16_t *ptr = (int16_t *)accessUnit->data();
784    for (size_t i = 0; i < payloadSize / sizeof(int16_t); ++i) {
785        ptr[i] = ntohs(ptr[i]);
786    }
787
788    memmove(
789            mBuffer->data(),
790            mBuffer->data() + 4 + payloadSize,
791            mBuffer->size() - 4 - payloadSize);
792
793    mBuffer->setRange(0, mBuffer->size() - 4 - payloadSize);
794
795    return accessUnit;
796}
797
798sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitAAC() {
799    if (mBuffer->size() == 0) {
800        return NULL;
801    }
802
803    if (mRangeInfos.empty()) {
804        return NULL;
805    }
806
807    const RangeInfo &info = *mRangeInfos.begin();
808    if (mBuffer->size() < info.mLength) {
809        return NULL;
810    }
811
812    if (info.mTimestampUs < 0ll) {
813        ALOGE("Negative info.mTimestampUs");
814        return NULL;
815    }
816
817    ALOGV("dequeueAccessUnit_AAC[%d]: mBuffer %zu info.mLength %zu",
818            mAUIndex, mBuffer->size(), info.mLength);
819
820    struct ADTSPosition {
821        size_t offset;
822        size_t headerSize;
823        size_t length;
824    };
825
826    Vector<ADTSPosition> frames;
827
828    // The idea here is consume all AAC frames starting at offsets before
829    // info.mLength so we can assign a meaningful timestamp without
830    // having to interpolate.
831    // The final AAC frame may well extend into the next RangeInfo but
832    // that's ok.
833    size_t offset = 0;
834    while (offset < info.mLength) {
835        if (offset + 7 > mBuffer->size()) {
836            return NULL;
837        }
838
839        ABitReader bits(mBuffer->data() + offset, mBuffer->size() - offset);
840
841        // adts_fixed_header
842
843        if (bits.getBits(12) != 0xfffu) {
844            ALOGE("Wrong atds_fixed_header");
845            return NULL;
846        }
847        bits.skipBits(3);  // ID, layer
848        bool protection_absent = bits.getBits(1) != 0;
849
850        if (mFormat == NULL) {
851            unsigned profile = bits.getBits(2);
852            if (profile == 3u) {
853                ALOGE("profile should not be 3");
854                return NULL;
855            }
856            unsigned sampling_freq_index = bits.getBits(4);
857            bits.getBits(1);  // private_bit
858            unsigned channel_configuration = bits.getBits(3);
859            if (channel_configuration == 0u) {
860                ALOGE("channel_config should not be 0");
861                return NULL;
862            }
863            bits.skipBits(2);  // original_copy, home
864
865            mFormat = MakeAACCodecSpecificData(
866                    profile, sampling_freq_index, channel_configuration);
867
868            mFormat->setInt32(kKeyIsADTS, true);
869
870            int32_t sampleRate;
871            int32_t numChannels;
872            if (!mFormat->findInt32(kKeySampleRate, &sampleRate)) {
873                ALOGE("SampleRate not found");
874                return NULL;
875            }
876            if (!mFormat->findInt32(kKeyChannelCount, &numChannels)) {
877                ALOGE("ChannelCount not found");
878                return NULL;
879            }
880
881            ALOGI("found AAC codec config (%d Hz, %d channels)",
882                 sampleRate, numChannels);
883        } else {
884            // profile_ObjectType, sampling_frequency_index, private_bits,
885            // channel_configuration, original_copy, home
886            bits.skipBits(12);
887        }
888
889        // adts_variable_header
890
891        // copyright_identification_bit, copyright_identification_start
892        bits.skipBits(2);
893
894        unsigned aac_frame_length = bits.getBits(13);
895        if (aac_frame_length == 0){
896            ALOGE("b/62673179, Invalid AAC frame length!");
897            android_errorWriteLog(0x534e4554, "62673179");
898            return NULL;
899        }
900
901        bits.skipBits(11);  // adts_buffer_fullness
902
903        unsigned number_of_raw_data_blocks_in_frame = bits.getBits(2);
904
905        if (number_of_raw_data_blocks_in_frame != 0) {
906            // To be implemented.
907            ALOGE("Should not reach here.");
908            return NULL;
909        }
910
911        if (offset + aac_frame_length > mBuffer->size()) {
912            return NULL;
913        }
914
915        size_t headerSize = protection_absent ? 7 : 9;
916
917        // tracking the frame positions first then decrypt only if an accessUnit to be generated
918        if (mSampleDecryptor != NULL) {
919            ADTSPosition frame = {
920                .offset     = offset,
921                .headerSize = headerSize,
922                .length     = aac_frame_length
923            };
924
925            frames.push(frame);
926        }
927
928        offset += aac_frame_length;
929    }
930
931    // Decrypting only if the loop didn't exit early and an accessUnit is about to be generated
932    // Not decrypting if key info not available (e.g., scanner/extractor parsing ts files)
933    if (mSampleDecryptor != NULL) {
934        for (size_t frameId = 0; frameId < frames.size(); frameId++) {
935            const ADTSPosition &frame = frames.itemAt(frameId);
936
937            mSampleDecryptor->processAAC(frame.headerSize,
938                    mBuffer->data() + frame.offset, frame.length);
939//            ALOGV("dequeueAccessUnitAAC[%zu]: while offset %zu headerSize %zu frame_len %zu",
940//                    frameId, frame.offset, frame.headerSize, frame.length);
941        }
942    }
943    mAUIndex++;
944
945    int64_t timeUs = fetchTimestamp(offset);
946
947    sp<ABuffer> accessUnit = new ABuffer(offset);
948    memcpy(accessUnit->data(), mBuffer->data(), offset);
949
950    memmove(mBuffer->data(), mBuffer->data() + offset,
951            mBuffer->size() - offset);
952    mBuffer->setRange(0, mBuffer->size() - offset);
953
954    accessUnit->meta()->setInt64("timeUs", timeUs);
955    accessUnit->meta()->setInt32("isSync", 1);
956
957    return accessUnit;
958}
959
960int64_t ElementaryStreamQueue::fetchTimestamp(
961        size_t size, int32_t *pesOffset, int32_t *pesScramblingControl) {
962    int64_t timeUs = -1;
963    bool first = true;
964
965    while (size > 0) {
966        if (mRangeInfos.empty()) {
967            return timeUs;
968        }
969
970        RangeInfo *info = &*mRangeInfos.begin();
971
972        if (first) {
973            timeUs = info->mTimestampUs;
974            if (pesOffset != NULL) {
975                *pesOffset = info->mPesOffset;
976            }
977            if (pesScramblingControl != NULL) {
978                *pesScramblingControl = info->mPesScramblingControl;
979            }
980            first = false;
981        }
982
983        if (info->mLength > size) {
984            info->mLength -= size;
985            size = 0;
986        } else {
987            size -= info->mLength;
988
989            mRangeInfos.erase(mRangeInfos.begin());
990            info = NULL;
991        }
992
993    }
994
995    if (timeUs == 0ll) {
996        ALOGV("Returning 0 timestamp");
997    }
998
999    return timeUs;
1000}
1001
1002sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitH264() {
1003    if (isScrambled()) {
1004        if (mBuffer == NULL || mBuffer->size() == 0) {
1005            return NULL;
1006        }
1007        if (mFormat == NULL) {
1008            mFormat = MakeAVCCodecSpecificData(mBuffer);
1009            if (mFormat == NULL) {
1010                ALOGI("Creating dummy AVC format for scrambled content");
1011                mFormat = new MetaData;
1012                mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_AVC);
1013                mFormat->setInt32(kKeyWidth, 1280);
1014                mFormat->setInt32(kKeyHeight, 720);
1015            }
1016            // for MediaExtractor.CasInfo
1017            mFormat->setInt32(kKeyCASystemID, mCASystemId);
1018            mFormat->setData(kKeyCASessionID, 0,
1019                    mCasSessionId.data(), mCasSessionId.size());
1020        }
1021        return dequeueScrambledAccessUnit();
1022    }
1023
1024    const uint8_t *data = mBuffer->data();
1025
1026    size_t size = mBuffer->size();
1027    Vector<NALPosition> nals;
1028
1029    size_t totalSize = 0;
1030    size_t seiCount = 0;
1031
1032    status_t err;
1033    const uint8_t *nalStart;
1034    size_t nalSize;
1035    bool foundSlice = false;
1036    bool foundIDR = false;
1037
1038    ALOGV("dequeueAccessUnit_H264[%d] %p/%zu", mAUIndex, data, size);
1039
1040    while ((err = getNextNALUnit(&data, &size, &nalStart, &nalSize)) == OK) {
1041        if (nalSize == 0) continue;
1042
1043        unsigned nalType = nalStart[0] & 0x1f;
1044        bool flush = false;
1045
1046        if (nalType == 1 || nalType == 5) {
1047            if (nalType == 5) {
1048                foundIDR = true;
1049            }
1050            if (foundSlice) {
1051                //TODO: Shouldn't this have been called with nalSize-1?
1052                ABitReader br(nalStart + 1, nalSize);
1053                unsigned first_mb_in_slice = parseUE(&br);
1054
1055                if (first_mb_in_slice == 0) {
1056                    // This slice starts a new frame.
1057
1058                    flush = true;
1059                }
1060            }
1061
1062            foundSlice = true;
1063        } else if ((nalType == 9 || nalType == 7) && foundSlice) {
1064            // Access unit delimiter and SPS will be associated with the
1065            // next frame.
1066
1067            flush = true;
1068        } else if (nalType == 6 && nalSize > 0) {
1069            // found non-zero sized SEI
1070            ++seiCount;
1071        }
1072
1073        if (flush) {
1074            // The access unit will contain all nal units up to, but excluding
1075            // the current one, separated by 0x00 0x00 0x00 0x01 startcodes.
1076
1077            size_t auSize = 4 * nals.size() + totalSize;
1078            sp<ABuffer> accessUnit = new ABuffer(auSize);
1079            sp<ABuffer> sei;
1080
1081            if (seiCount > 0) {
1082                sei = new ABuffer(seiCount * sizeof(NALPosition));
1083                accessUnit->meta()->setBuffer("sei", sei);
1084            }
1085
1086#if !LOG_NDEBUG
1087            AString out;
1088#endif
1089
1090            size_t dstOffset = 0;
1091            size_t seiIndex = 0;
1092            size_t shrunkBytes = 0;
1093            for (size_t i = 0; i < nals.size(); ++i) {
1094                const NALPosition &pos = nals.itemAt(i);
1095
1096                unsigned nalType = mBuffer->data()[pos.nalOffset] & 0x1f;
1097
1098                if (nalType == 6 && pos.nalSize > 0) {
1099                    if (seiIndex >= sei->size() / sizeof(NALPosition)) {
1100                        ALOGE("Wrong seiIndex");
1101                        return NULL;
1102                    }
1103                    NALPosition &seiPos = ((NALPosition *)sei->data())[seiIndex++];
1104                    seiPos.nalOffset = dstOffset + 4;
1105                    seiPos.nalSize = pos.nalSize;
1106                }
1107
1108#if !LOG_NDEBUG
1109                char tmp[128];
1110                sprintf(tmp, "0x%02x", nalType);
1111                if (i > 0) {
1112                    out.append(", ");
1113                }
1114                out.append(tmp);
1115#endif
1116
1117                memcpy(accessUnit->data() + dstOffset, "\x00\x00\x00\x01", 4);
1118
1119                if (mSampleDecryptor != NULL && (nalType == 1 || nalType == 5)) {
1120                    uint8_t *nalData = mBuffer->data() + pos.nalOffset;
1121                    size_t newSize = mSampleDecryptor->processNal(nalData, pos.nalSize);
1122                    // Note: the data can shrink due to unescaping
1123                    memcpy(accessUnit->data() + dstOffset + 4,
1124                            nalData,
1125                            newSize);
1126                    dstOffset += newSize + 4;
1127
1128                    size_t thisShrunkBytes = pos.nalSize - newSize;
1129                    //ALOGV("dequeueAccessUnitH264[%d]: nalType: %d -> %zu (%zu)",
1130                    //        nalType, (int)pos.nalSize, newSize, thisShrunkBytes);
1131
1132                    shrunkBytes += thisShrunkBytes;
1133                }
1134                else {
1135                    memcpy(accessUnit->data() + dstOffset + 4,
1136                            mBuffer->data() + pos.nalOffset,
1137                            pos.nalSize);
1138
1139                    dstOffset += pos.nalSize + 4;
1140                    //ALOGV("dequeueAccessUnitH264 [%d] %d @%d",
1141                    //        nalType, (int)pos.nalSize, (int)pos.nalOffset);
1142                }
1143            }
1144
1145#if !LOG_NDEBUG
1146            ALOGV("accessUnit contains nal types %s", out.c_str());
1147#endif
1148
1149            const NALPosition &pos = nals.itemAt(nals.size() - 1);
1150            size_t nextScan = pos.nalOffset + pos.nalSize;
1151
1152            memmove(mBuffer->data(),
1153                    mBuffer->data() + nextScan,
1154                    mBuffer->size() - nextScan);
1155
1156            mBuffer->setRange(0, mBuffer->size() - nextScan);
1157
1158            int64_t timeUs = fetchTimestamp(nextScan);
1159            if (timeUs < 0ll) {
1160                ALOGE("Negative timeUs");
1161                return NULL;
1162            }
1163
1164            accessUnit->meta()->setInt64("timeUs", timeUs);
1165            if (foundIDR) {
1166                accessUnit->meta()->setInt32("isSync", 1);
1167            }
1168
1169            if (mFormat == NULL) {
1170                mFormat = MakeAVCCodecSpecificData(accessUnit);
1171            }
1172
1173            if (mSampleDecryptor != NULL && shrunkBytes > 0) {
1174                size_t adjustedSize = accessUnit->size() - shrunkBytes;
1175                ALOGV("dequeueAccessUnitH264[%d]: AU size adjusted %zu -> %zu",
1176                        mAUIndex, accessUnit->size(), adjustedSize);
1177                accessUnit->setRange(0, adjustedSize);
1178            }
1179
1180            ALOGV("dequeueAccessUnitH264[%d]: AU %p(%zu) dstOffset:%zu, nals:%zu, totalSize:%zu ",
1181                    mAUIndex, accessUnit->data(), accessUnit->size(),
1182                    dstOffset, nals.size(), totalSize);
1183            mAUIndex++;
1184
1185            return accessUnit;
1186        }
1187
1188        NALPosition pos;
1189        pos.nalOffset = nalStart - mBuffer->data();
1190        pos.nalSize = nalSize;
1191
1192        nals.push(pos);
1193
1194        totalSize += nalSize;
1195    }
1196    if (err != (status_t)-EAGAIN) {
1197        ALOGE("Unexpeted err");
1198        return NULL;
1199    }
1200
1201    return NULL;
1202}
1203
1204sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEGAudio() {
1205    const uint8_t *data = mBuffer->data();
1206    size_t size = mBuffer->size();
1207
1208    if (size < 4) {
1209        return NULL;
1210    }
1211
1212    uint32_t header = U32_AT(data);
1213
1214    size_t frameSize;
1215    int samplingRate, numChannels, bitrate, numSamples;
1216    if (!GetMPEGAudioFrameSize(
1217                header, &frameSize, &samplingRate, &numChannels,
1218                &bitrate, &numSamples)) {
1219        ALOGE("Failed to get audio frame size");
1220        return NULL;
1221    }
1222
1223    if (size < frameSize) {
1224        return NULL;
1225    }
1226
1227    unsigned layer = 4 - ((header >> 17) & 3);
1228
1229    sp<ABuffer> accessUnit = new ABuffer(frameSize);
1230    memcpy(accessUnit->data(), data, frameSize);
1231
1232    memmove(mBuffer->data(),
1233            mBuffer->data() + frameSize,
1234            mBuffer->size() - frameSize);
1235
1236    mBuffer->setRange(0, mBuffer->size() - frameSize);
1237
1238    int64_t timeUs = fetchTimestamp(frameSize);
1239    if (timeUs < 0ll) {
1240        ALOGE("Negative timeUs");
1241        return NULL;
1242    }
1243
1244    accessUnit->meta()->setInt64("timeUs", timeUs);
1245    accessUnit->meta()->setInt32("isSync", 1);
1246
1247    if (mFormat == NULL) {
1248        mFormat = new MetaData;
1249
1250        switch (layer) {
1251            case 1:
1252                mFormat->setCString(
1253                        kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG_LAYER_I);
1254                break;
1255            case 2:
1256                mFormat->setCString(
1257                        kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG_LAYER_II);
1258                break;
1259            case 3:
1260                mFormat->setCString(
1261                        kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG);
1262                break;
1263            default:
1264                return NULL;
1265        }
1266
1267        mFormat->setInt32(kKeySampleRate, samplingRate);
1268        mFormat->setInt32(kKeyChannelCount, numChannels);
1269    }
1270
1271    return accessUnit;
1272}
1273
1274static void EncodeSize14(uint8_t **_ptr, size_t size) {
1275    if (size > 0x3fff) {
1276        ALOGE("Wrong size");
1277        return;
1278    }
1279
1280    uint8_t *ptr = *_ptr;
1281
1282    *ptr++ = 0x80 | (size >> 7);
1283    *ptr++ = size & 0x7f;
1284
1285    *_ptr = ptr;
1286}
1287
1288static sp<ABuffer> MakeMPEGVideoESDS(const sp<ABuffer> &csd) {
1289    sp<ABuffer> esds = new ABuffer(csd->size() + 25);
1290
1291    uint8_t *ptr = esds->data();
1292    *ptr++ = 0x03;
1293    EncodeSize14(&ptr, 22 + csd->size());
1294
1295    *ptr++ = 0x00;  // ES_ID
1296    *ptr++ = 0x00;
1297
1298    *ptr++ = 0x00;  // streamDependenceFlag, URL_Flag, OCRstreamFlag
1299
1300    *ptr++ = 0x04;
1301    EncodeSize14(&ptr, 16 + csd->size());
1302
1303    *ptr++ = 0x40;  // Audio ISO/IEC 14496-3
1304
1305    for (size_t i = 0; i < 12; ++i) {
1306        *ptr++ = 0x00;
1307    }
1308
1309    *ptr++ = 0x05;
1310    EncodeSize14(&ptr, csd->size());
1311
1312    memcpy(ptr, csd->data(), csd->size());
1313
1314    return esds;
1315}
1316
1317sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEGVideo() {
1318    if (isScrambled()) {
1319        if (mBuffer == NULL || mBuffer->size() == 0) {
1320            return NULL;
1321        }
1322        if (mFormat == NULL) {
1323            ALOGI("Creating dummy MPEG format for scrambled content");
1324            mFormat = new MetaData;
1325            mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG2);
1326            mFormat->setInt32(kKeyWidth, 1280);
1327            mFormat->setInt32(kKeyHeight, 720);
1328
1329            // for MediaExtractor.CasInfo
1330            mFormat->setInt32(kKeyCASystemID, mCASystemId);
1331            mFormat->setData(kKeyCASessionID, 0,
1332                    mCasSessionId.data(), mCasSessionId.size());
1333        }
1334        return dequeueScrambledAccessUnit();
1335    }
1336
1337    const uint8_t *data = mBuffer->data();
1338    size_t size = mBuffer->size();
1339
1340    Vector<size_t> userDataPositions;
1341
1342    bool sawPictureStart = false;
1343    int pprevStartCode = -1;
1344    int prevStartCode = -1;
1345    int currentStartCode = -1;
1346    bool gopFound = false;
1347    bool isClosedGop = false;
1348    bool brokenLink = false;
1349
1350    size_t offset = 0;
1351    while (offset + 3 < size) {
1352        if (memcmp(&data[offset], "\x00\x00\x01", 3)) {
1353            ++offset;
1354            continue;
1355        }
1356
1357        pprevStartCode = prevStartCode;
1358        prevStartCode = currentStartCode;
1359        currentStartCode = data[offset + 3];
1360
1361        if (currentStartCode == 0xb3 && mFormat == NULL) {
1362            memmove(mBuffer->data(), mBuffer->data() + offset, size - offset);
1363            size -= offset;
1364            (void)fetchTimestamp(offset);
1365            offset = 0;
1366            mBuffer->setRange(0, size);
1367        }
1368
1369        if ((prevStartCode == 0xb3 && currentStartCode != 0xb5)
1370                || (pprevStartCode == 0xb3 && prevStartCode == 0xb5)) {
1371            // seqHeader without/with extension
1372
1373            if (mFormat == NULL) {
1374                if (size < 7u) {
1375                    ALOGE("Size too small");
1376                    return NULL;
1377                }
1378
1379                unsigned width =
1380                    (data[4] << 4) | data[5] >> 4;
1381
1382                unsigned height =
1383                    ((data[5] & 0x0f) << 8) | data[6];
1384
1385                mFormat = new MetaData;
1386                mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG2);
1387                mFormat->setInt32(kKeyWidth, width);
1388                mFormat->setInt32(kKeyHeight, height);
1389
1390                ALOGI("found MPEG2 video codec config (%d x %d)", width, height);
1391
1392                sp<ABuffer> csd = new ABuffer(offset);
1393                memcpy(csd->data(), data, offset);
1394
1395                memmove(mBuffer->data(),
1396                        mBuffer->data() + offset,
1397                        mBuffer->size() - offset);
1398
1399                mBuffer->setRange(0, mBuffer->size() - offset);
1400                size -= offset;
1401                (void)fetchTimestamp(offset);
1402                offset = 0;
1403
1404                // hexdump(csd->data(), csd->size());
1405
1406                sp<ABuffer> esds = MakeMPEGVideoESDS(csd);
1407                mFormat->setData(
1408                        kKeyESDS, kTypeESDS, esds->data(), esds->size());
1409
1410                return NULL;
1411            }
1412        }
1413
1414        if (mFormat != NULL && currentStartCode == 0xb8) {
1415            // GOP layer
1416            if (offset + 7 >= size) {
1417                ALOGE("Size too small");
1418                return NULL;
1419            }
1420            gopFound = true;
1421            isClosedGop = (data[offset + 7] & 0x40) != 0;
1422            brokenLink = (data[offset + 7] & 0x20) != 0;
1423        }
1424
1425        if (mFormat != NULL && currentStartCode == 0xb2) {
1426            userDataPositions.add(offset);
1427        }
1428
1429        if (mFormat != NULL && currentStartCode == 0x00) {
1430            // Picture start
1431
1432            if (!sawPictureStart) {
1433                sawPictureStart = true;
1434            } else {
1435                sp<ABuffer> accessUnit = new ABuffer(offset);
1436                memcpy(accessUnit->data(), data, offset);
1437
1438                memmove(mBuffer->data(),
1439                        mBuffer->data() + offset,
1440                        mBuffer->size() - offset);
1441
1442                mBuffer->setRange(0, mBuffer->size() - offset);
1443
1444                int64_t timeUs = fetchTimestamp(offset);
1445                if (timeUs < 0ll) {
1446                    ALOGE("Negative timeUs");
1447                    return NULL;
1448                }
1449
1450                offset = 0;
1451
1452                accessUnit->meta()->setInt64("timeUs", timeUs);
1453                if (gopFound && (!brokenLink || isClosedGop)) {
1454                    accessUnit->meta()->setInt32("isSync", 1);
1455                }
1456
1457                ALOGV("returning MPEG video access unit at time %" PRId64 " us",
1458                      timeUs);
1459
1460                // hexdump(accessUnit->data(), accessUnit->size());
1461
1462                if (userDataPositions.size() > 0) {
1463                    sp<ABuffer> mpegUserData =
1464                        new ABuffer(userDataPositions.size() * sizeof(size_t));
1465                    if (mpegUserData != NULL && mpegUserData->data() != NULL) {
1466                        for (size_t i = 0; i < userDataPositions.size(); ++i) {
1467                            memcpy(
1468                                    mpegUserData->data() + i * sizeof(size_t),
1469                                    &userDataPositions[i], sizeof(size_t));
1470                        }
1471                        accessUnit->meta()->setBuffer("mpegUserData", mpegUserData);
1472                    }
1473                }
1474
1475                return accessUnit;
1476            }
1477        }
1478
1479        ++offset;
1480    }
1481
1482    return NULL;
1483}
1484
1485static ssize_t getNextChunkSize(
1486        const uint8_t *data, size_t size) {
1487    static const char kStartCode[] = "\x00\x00\x01";
1488
1489    // per ISO/IEC 14496-2 6.2.1, a chunk has a 3-byte prefix + 1-byte start code
1490    // we need at least <prefix><start><next prefix> to successfully scan
1491    if (size < 3 + 1 + 3) {
1492        return -EAGAIN;
1493    }
1494
1495    if (memcmp(kStartCode, data, 3)) {
1496        return -EAGAIN;
1497    }
1498
1499    size_t offset = 4;
1500    while (offset + 2 < size) {
1501        if (!memcmp(&data[offset], kStartCode, 3)) {
1502            return offset;
1503        }
1504
1505        ++offset;
1506    }
1507
1508    return -EAGAIN;
1509}
1510
1511sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMPEG4Video() {
1512    uint8_t *data = mBuffer->data();
1513    size_t size = mBuffer->size();
1514
1515    enum {
1516        SKIP_TO_VISUAL_OBJECT_SEQ_START,
1517        EXPECT_VISUAL_OBJECT_START,
1518        EXPECT_VO_START,
1519        EXPECT_VOL_START,
1520        WAIT_FOR_VOP_START,
1521        SKIP_TO_VOP_START,
1522
1523    } state;
1524
1525    if (mFormat == NULL) {
1526        state = SKIP_TO_VISUAL_OBJECT_SEQ_START;
1527    } else {
1528        state = SKIP_TO_VOP_START;
1529    }
1530
1531    int32_t width = -1, height = -1;
1532
1533    size_t offset = 0;
1534    ssize_t chunkSize;
1535    while ((chunkSize = getNextChunkSize(
1536                    &data[offset], size - offset)) > 0) {
1537        bool discard = false;
1538
1539        unsigned chunkType = data[offset + 3];
1540
1541        switch (state) {
1542            case SKIP_TO_VISUAL_OBJECT_SEQ_START:
1543            {
1544                if (chunkType == 0xb0) {
1545                    // Discard anything before this marker.
1546
1547                    state = EXPECT_VISUAL_OBJECT_START;
1548                } else {
1549                    discard = true;
1550                    offset += chunkSize;
1551                    ALOGW("b/74114680, advance to next chunk");
1552                    android_errorWriteLog(0x534e4554, "74114680");
1553                }
1554                break;
1555            }
1556
1557            case EXPECT_VISUAL_OBJECT_START:
1558            {
1559                if (chunkType != 0xb5) {
1560                    ALOGE("Unexpected chunkType");
1561                    return NULL;
1562                }
1563                state = EXPECT_VO_START;
1564                break;
1565            }
1566
1567            case EXPECT_VO_START:
1568            {
1569                if (chunkType > 0x1f) {
1570                    ALOGE("Unexpected chunkType");
1571                    return NULL;
1572                }
1573                state = EXPECT_VOL_START;
1574                break;
1575            }
1576
1577            case EXPECT_VOL_START:
1578            {
1579                if ((chunkType & 0xf0) != 0x20) {
1580                    ALOGE("Wrong chunkType");
1581                    return NULL;
1582                }
1583
1584                if (!ExtractDimensionsFromVOLHeader(
1585                            &data[offset], chunkSize,
1586                            &width, &height)) {
1587                    ALOGE("Failed to get dimension");
1588                    return NULL;
1589                }
1590
1591                state = WAIT_FOR_VOP_START;
1592                break;
1593            }
1594
1595            case WAIT_FOR_VOP_START:
1596            {
1597                if (chunkType == 0xb3 || chunkType == 0xb6) {
1598                    // group of VOP or VOP start.
1599
1600                    mFormat = new MetaData;
1601                    mFormat->setCString(
1602                            kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_MPEG4);
1603
1604                    mFormat->setInt32(kKeyWidth, width);
1605                    mFormat->setInt32(kKeyHeight, height);
1606
1607                    ALOGI("found MPEG4 video codec config (%d x %d)",
1608                         width, height);
1609
1610                    sp<ABuffer> csd = new ABuffer(offset);
1611                    memcpy(csd->data(), data, offset);
1612
1613                    // hexdump(csd->data(), csd->size());
1614
1615                    sp<ABuffer> esds = MakeMPEGVideoESDS(csd);
1616                    mFormat->setData(
1617                            kKeyESDS, kTypeESDS,
1618                            esds->data(), esds->size());
1619
1620                    discard = true;
1621                    state = SKIP_TO_VOP_START;
1622                }
1623
1624                break;
1625            }
1626
1627            case SKIP_TO_VOP_START:
1628            {
1629                if (chunkType == 0xb6) {
1630                    int vopCodingType = (data[offset + 4] & 0xc0) >> 6;
1631
1632                    offset += chunkSize;
1633
1634                    sp<ABuffer> accessUnit = new ABuffer(offset);
1635                    memcpy(accessUnit->data(), data, offset);
1636
1637                    memmove(data, &data[offset], size - offset);
1638                    size -= offset;
1639                    mBuffer->setRange(0, size);
1640
1641                    int64_t timeUs = fetchTimestamp(offset);
1642                    if (timeUs < 0ll) {
1643                        ALOGE("Negative timeus");
1644                        return NULL;
1645                    }
1646
1647                    offset = 0;
1648
1649                    accessUnit->meta()->setInt64("timeUs", timeUs);
1650                    if (vopCodingType == 0) {  // intra-coded VOP
1651                        accessUnit->meta()->setInt32("isSync", 1);
1652                    }
1653
1654                    ALOGV("returning MPEG4 video access unit at time %" PRId64 " us",
1655                         timeUs);
1656
1657                    // hexdump(accessUnit->data(), accessUnit->size());
1658
1659                    return accessUnit;
1660                } else if (chunkType != 0xb3) {
1661                    offset += chunkSize;
1662                    discard = true;
1663                }
1664
1665                break;
1666            }
1667
1668            default:
1669                ALOGE("Unknown state: %d", state);
1670                return NULL;
1671        }
1672
1673        if (discard) {
1674            (void)fetchTimestamp(offset);
1675            memmove(data, &data[offset], size - offset);
1676            size -= offset;
1677            offset = 0;
1678            mBuffer->setRange(0, size);
1679        } else {
1680            offset += chunkSize;
1681        }
1682    }
1683
1684    return NULL;
1685}
1686
1687void ElementaryStreamQueue::signalEOS() {
1688    if (!mEOSReached) {
1689        if (mMode == MPEG_VIDEO) {
1690            const char *theEnd = "\x00\x00\x01\x00";
1691            appendData(theEnd, 4, 0);
1692        }
1693        mEOSReached = true;
1694    } else {
1695        ALOGW("EOS already signaled");
1696    }
1697}
1698
1699sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitMetadata() {
1700    size_t size = mBuffer->size();
1701    if (!size) {
1702        return NULL;
1703    }
1704
1705    sp<ABuffer> accessUnit = new ABuffer(size);
1706    int64_t timeUs = fetchTimestamp(size);
1707    accessUnit->meta()->setInt64("timeUs", timeUs);
1708
1709    memcpy(accessUnit->data(), mBuffer->data(), size);
1710    mBuffer->setRange(0, 0);
1711
1712    if (mFormat == NULL) {
1713        mFormat = new MetaData;
1714        mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_DATA_TIMED_ID3);
1715    }
1716
1717    return accessUnit;
1718}
1719
1720void ElementaryStreamQueue::signalNewSampleAesKey(const sp<AMessage> &keyItem) {
1721    if (mSampleDecryptor == NULL) {
1722        ALOGE("signalNewSampleAesKey: Stream %x is not encrypted; keyItem: %p",
1723                mMode, keyItem.get());
1724        return;
1725    }
1726
1727    mSampleDecryptor->signalNewSampleAesKey(keyItem);
1728}
1729
1730
1731}  // namespace android
1732