Tha_14/tomato-testing
1
0
Fork 0
forked from Green-Sky/tomato
Code Pull Requests Actions Packages Releases Activity

Squashed 'external/toxcore/c-toxcore/' changes from e58eb27a8..1828c5356

Browse Source 
1828c5356 fix(toxav): remove extra copy of video frame on encode
b66b8ded6 refactor: improve group stability, moderation determinism, and DHT dual-stack handling
4fbd7c10a fix(toxav): fix heap buffer overflow in RTP video packet handling
809fe8c78 refactor(tox): make the `#define` consts int literals.
50d242a37 refactor(toxav): improve MSI safety and testability
da1c13a2f fix(toxav): harden video processing and fix large frame handling
472825288 fix(toxav): fix multiple logic bugs in audio module
dc963d9a9 fix(toxav): fix multiple bugs in bandwidth controller and add tests
3bf5778ef refactor(toxav): split out RTP module and add exhaustive unit tests
b79b7d436 fix(autotools): add tox_log_level.h to public headers list
ea2e34ff2 chore: Disable cirrus. We're out of quota again.
b449ea2ed chore(ci): update azure runner image to windows-2022 windows-2019 is EOL
e115b136d refactor: Make add_to_list non-recursive.
REVERT: e58eb27a8 fix(toxav): remove extra copy of video frame on encode Tested and works, but there might be alignment issues and other stuff.

git-subtree-dir: external/toxcore/c-toxcore
git-subtree-split: 1828c5356b2daf1d5f680854e776d74b181d268c
This commit is contained in:
Green Sky
2026-01-01 19:15:15 +01:00
parent 596ea37298
commit e95f2cbb1c
44 changed files with 4572 additions and 1137 deletions
Download Patch File Download Diff File Expand all files Collapse all files

196
toxav/video.c
View File

@@ -4,6 +4,13 @@
*/
#include "video.h"
#include <vpx/vpx_decoder.h>
#include <vpx/vpx_encoder.h>
#include <vpx/vpx_image.h>
#include <vpx/vp8cx.h>
#include <vpx/vp8dx.h>
#include <assert.h>
#include <stdlib.h>
#include <string.h>
@@ -14,6 +21,31 @@
#include "../toxcore/ccompat.h"
#include "../toxcore/logger.h"
#include "../toxcore/mono_time.h"
#include "../toxcore/util.h"
struct VCSession {
/* encoding */
vpx_codec_ctx_t encoder[1];
uint32_t frame_counter;
/* decoding */
vpx_codec_ctx_t decoder[1];
struct RingBuffer *vbuf_raw; /* Un-decoded data */
uint64_t linfts; /* Last received frame time stamp */
uint32_t lcfd; /* Last calculated frame duration for incoming video payload */
uint32_t friend_number;
/* Video frame receive callback */
vc_video_receive_frame_cb *vcb;
void *user_data;
pthread_mutex_t queue_mutex[1];
const Logger *log;
vpx_codec_iter_t iter;
};
/**
* Codec control function to set encoder internal speed settings. Changes in
@@ -33,6 +65,12 @@
#define VIDEO_BITRATE_INITIAL_VALUE 5000
#define VIDEO_DECODE_BUFFER_SIZE 5 // this buffer has normally max. 1 entry
/**
* Security limits to prevent resource exhaustion.
*/
#define VIDEO_MAX_FRAME_SIZE (10 * 1024 * 1024)
#define VIDEO_MAX_RESOLUTION_LIMIT 4096
static vpx_codec_iface_t *video_codec_decoder_interface(void)
{
return vpx_codec_vp8_dx();
@@ -120,9 +158,13 @@ static void vc_init_encoder_cfg(const Logger *log, vpx_codec_enc_cfg_t *cfg, int
#endif /* 0 */
}
VCSession *vc_new(const Logger *log, const Mono_Time *mono_time, ToxAV *av, uint32_t friend_number,
toxav_video_receive_frame_cb *cb, void *cb_data)
VCSession *vc_new(const Logger *log, const Mono_Time *mono_time, uint32_t friend_number,
vc_video_receive_frame_cb *cb, void *user_data)
{
if (mono_time == nullptr) {
return nullptr;
}
VCSession *vc = (VCSession *)calloc(1, sizeof(VCSession));
vpx_codec_err_t rc;
@@ -231,9 +273,8 @@ VCSession *vc_new(const Logger *log, const Mono_Time *mono_time, ToxAV *av, uint
vc->linfts = current_time_monotonic(mono_time);
vc->lcfd = 60;
vc->vcb = cb;
vc->vcb_user_data = cb_data;
vc->user_data = user_data;
vc->friend_number = friend_number;
vc->av = av;
vc->log = log;
return vc;
@@ -285,21 +326,30 @@ void vc_iterate(VCSession *vc)
const uint16_t log_rb_size = rb_size(vc->vbuf_raw);
pthread_mutex_unlock(vc->queue_mutex);
const struct RTPHeader *const header = &p->header;
uint32_t full_data_len;
if ((header->flags & RTP_LARGE_FRAME) != 0) {
full_data_len = header->data_length_full;
LOGGER_DEBUG(vc->log, "vc_iterate:001:full_data_len=%d", (int)full_data_len);
if ((rtp_message_flags(p) & RTP_LARGE_FRAME) != 0) {
full_data_len = rtp_message_data_length_full(p);
LOGGER_DEBUG(vc->log, "vc_iterate:001:full_data_len=%u", full_data_len);
} else {
full_data_len = p->len;
full_data_len = rtp_message_len(p);
LOGGER_DEBUG(vc->log, "vc_iterate:002");
}
LOGGER_DEBUG(vc->log, "vc_iterate: rb_read p->len=%d p->header.xe=%d", (int)full_data_len, p->header.xe);
/* Security check: Ensure the reported full data length does not exceed the actual buffer size.
* rtp_message_len(p) returns the actual allocated payload size.
*/
if (full_data_len > rtp_message_len(p)) {
LOGGER_ERROR(vc->log, "vc_iterate: Malicious packet detected! Lying length: %u actual: %u",
full_data_len, (uint32_t)rtp_message_len(p));
free(p);
return;
}
LOGGER_DEBUG(vc->log, "vc_iterate: rb_read p->len=%u", full_data_len);
LOGGER_DEBUG(vc->log, "vc_iterate: rb_read rb size=%d", (int)log_rb_size);
const vpx_codec_err_t rc = vpx_codec_decode(vc->decoder, p->data, full_data_len, nullptr, 0);
const vpx_codec_err_t rc = vpx_codec_decode(vc->decoder, rtp_message_data(p), full_data_len, nullptr, 0);
free(p);
if (rc != VPX_CODEC_OK) {
@@ -314,12 +364,10 @@ void vc_iterate(VCSession *vc)
dest != nullptr;
dest = vpx_codec_get_frame(vc->decoder, &iter)) {
if (vc->vcb != nullptr) {
vc->vcb(vc->av, vc->friend_number, dest->d_w, dest->d_h,
vc->vcb(vc->friend_number, dest->d_w, dest->d_h,
dest->planes[0], dest->planes[1], dest->planes[2],
dest->stride[0], dest->stride[1], dest->stride[2], vc->vcb_user_data);
dest->stride[0], dest->stride[1], dest->stride[2], vc->user_data);
}
vpx_img_free(dest); // is this needed? none of the VPx examples show that
}
}
@@ -337,24 +385,29 @@ int vc_queue_message(const Mono_Time *mono_time, void *cs, struct RTPMessage *ms
return -1;
}
const struct RTPHeader *const header = &msg->header;
if (msg->header.pt == (RTP_TYPE_VIDEO + 2) % 128) {
if (rtp_message_pt(msg) == (RTP_TYPE_VIDEO + 2) % 128) {
LOGGER_WARNING(vc->log, "Got dummy!");
free(msg);
return 0;
}
if (msg->header.pt != RTP_TYPE_VIDEO % 128) {
LOGGER_WARNING(vc->log, "Invalid payload type! pt=%d", (int)msg->header.pt);
if (rtp_message_pt(msg) != RTP_TYPE_VIDEO % 128) {
LOGGER_WARNING(vc->log, "Invalid payload type! pt=%d", (int)rtp_message_pt(msg));
free(msg);
return -1;
}
/* Security check: Sanitize message size to prevent memory exhaustion */
if (rtp_message_data_length_full(msg) > VIDEO_MAX_FRAME_SIZE) {
LOGGER_ERROR(vc->log, "Message too large! size=%u", (uint32_t)rtp_message_data_length_full(msg));
free(msg);
return -1;
}
pthread_mutex_lock(vc->queue_mutex);
if ((header->flags & RTP_LARGE_FRAME) != 0 && header->pt == RTP_TYPE_VIDEO % 128) {
LOGGER_DEBUG(vc->log, "rb_write msg->len=%d b0=%d b1=%d", (int)msg->len, (int)msg->data[0], (int)msg->data[1]);
if ((rtp_message_flags(msg) & RTP_LARGE_FRAME) != 0 && rtp_message_pt(msg) == RTP_TYPE_VIDEO % 128) {
LOGGER_DEBUG(vc->log, "rb_write msg->len=%d b0=%d b1=%d", (int)rtp_message_len(msg), (int)rtp_message_data(msg)[0], (int)rtp_message_data(msg)[1]);
}
free(rb_write(vc->vbuf_raw, msg));
@@ -373,6 +426,12 @@ int vc_reconfigure_encoder(VCSession *vc, uint32_t bit_rate, uint16_t width, uin
return -1;
}
/* Security check: Sanitize resolution to prevent resource exhaustion */
if (width == 0 || height == 0 || width > VIDEO_MAX_RESOLUTION_LIMIT || height > VIDEO_MAX_RESOLUTION_LIMIT) {
LOGGER_ERROR(vc->log, "Invalid resolution requested: %ux%u", (uint32_t)width, (uint32_t)height);
return -1;
}
vpx_codec_enc_cfg_t cfg2 = *vc->encoder->config.enc;
if (cfg2.rc_target_bitrate == bit_rate && cfg2.g_w == width && cfg2.g_h == height && kf_max_dist == -1) {
@@ -394,15 +453,16 @@ int vc_reconfigure_encoder(VCSession *vc, uint32_t bit_rate, uint16_t width, uin
* reconfiguring encoder to use resolutions greater than initially set.
*/
LOGGER_DEBUG(vc->log, "Have to reinitialize vpx encoder on session %p", (void *)vc);
vpx_codec_ctx_t new_c;
vpx_codec_enc_cfg_t cfg;
vc_init_encoder_cfg(vc->log, &cfg, kf_max_dist);
cfg.rc_target_bitrate = bit_rate;
cfg.g_w = width;
cfg.g_h = height;
/* Atomic reconfiguration: Initialize new encoder first */
vpx_codec_ctx_t new_encoder;
LOGGER_DEBUG(vc->log, "Using VP8 codec for encoder");
vpx_codec_err_t rc = vpx_codec_enc_init(&new_c, video_codec_encoder_interface(), &cfg, VPX_CODEC_USE_FRAME_THREADING);
vpx_codec_err_t rc = vpx_codec_enc_init(&new_encoder, video_codec_encoder_interface(), &cfg, VPX_CODEC_USE_FRAME_THREADING);
if (rc != VPX_CODEC_OK) {
LOGGER_ERROR(vc->log, "Failed to initialize encoder: %s", vpx_codec_err_to_string(rc));
@@ -411,17 +471,99 @@ int vc_reconfigure_encoder(VCSession *vc, uint32_t bit_rate, uint16_t width, uin
const int cpu_used_value = VP8E_SET_CPUUSED_VALUE;
rc = vpx_codec_control(&new_c, VP8E_SET_CPUUSED, cpu_used_value);
rc = vpx_codec_control(&new_encoder, VP8E_SET_CPUUSED, cpu_used_value);
if (rc != VPX_CODEC_OK) {
LOGGER_ERROR(vc->log, "Failed to set encoder control setting: %s", vpx_codec_err_to_string(rc));
vpx_codec_destroy(&new_c);
vpx_codec_destroy(&new_encoder);
return -1;
}
/* Swap only on success */
vpx_codec_destroy(vc->encoder);
memcpy(vc->encoder, &new_c, sizeof(new_c));
*vc->encoder = new_encoder;
return 0;
}
return 0;
}
int vc_encode(VCSession *vc, uint16_t width, uint16_t height, const uint8_t *y,
const uint8_t *u, const uint8_t *v, int encode_flags)
{
vpx_image_t img;
// TODO(Green-Sky): figure out stride_align
// TODO(Green-Sky): check memory alignment?
if (vpx_img_wrap(&img, VPX_IMG_FMT_I420, width, height, 0, (uint8_t *)y) != nullptr) {
// vpx_img_wrap assumes contigues memory, so we fix that
img.planes[VPX_PLANE_U] = (uint8_t *)u;
img.planes[VPX_PLANE_V] = (uint8_t *)v;
} else {
// call to wrap failed, falling back to copy
if (vpx_img_alloc(&img, VPX_IMG_FMT_I420, width, height, 0) == nullptr) {
LOGGER_ERROR(vc->log, "Could not allocate image for frame");
return -1;
}
/* I420 "It comprises an NxM Y plane followed by (N/2)x(M/2) V and U planes."
* http://fourcc.org/yuv.php#IYUV
*/
memcpy(img.planes[VPX_PLANE_Y], y, width * height);
memcpy(img.planes[VPX_PLANE_U], u, (width / 2) * (height / 2));
memcpy(img.planes[VPX_PLANE_V], v, (width / 2) * (height / 2));
}
int vpx_flags = 0;
if ((encode_flags & VC_EFLAG_FORCE_KF) != 0) {
vpx_flags |= VPX_EFLAG_FORCE_KF;
}
const vpx_codec_err_t vrc = vpx_codec_encode(vc->encoder, &img,
vc->frame_counter, 1, vpx_flags, VPX_DL_REALTIME);
vpx_img_free(&img);
if (vrc != VPX_CODEC_OK) {
LOGGER_ERROR(vc->log, "Could not encode video frame: %s", vpx_codec_err_to_string(vrc));
return -1;
}
vc->iter = nullptr;
return 0;
}
int vc_get_cx_data(VCSession *vc, uint8_t **data, uint32_t *size, bool *is_keyframe)
{
const vpx_codec_cx_pkt_t *pkt = vpx_codec_get_cx_data(vc->encoder, &vc->iter);
while (pkt != nullptr && pkt->kind != VPX_CODEC_CX_FRAME_PKT) {
pkt = vpx_codec_get_cx_data(vc->encoder, &vc->iter);
}
if (pkt == nullptr) {
return 0;
}
*data = (uint8_t *)pkt->data.frame.buf;
*size = (uint32_t)pkt->data.frame.sz;
*is_keyframe = (pkt->data.frame.flags & VPX_FRAME_IS_KEY) != 0;
return 1;
}
uint32_t vc_get_lcfd(const VCSession *vc)
{
return vc->lcfd;
}
pthread_mutex_t *vc_get_queue_mutex(VCSession *vc)
{
return &vc->queue_mutex[0];
}
void vc_increment_frame_counter(VCSession *vc)
{
++vc->frame_counter;
}