From f1029441b470cb238ec1150c87e9ff69fde0cb76 Mon Sep 17 00:00:00 2001
From: CastagnaIT <gottardo.stefano.83@gmail.com>
Date: Wed, 14 Feb 2024 14:44:04 +0100
Subject: [PATCH] [Widevine] Fix wrong byte position of clearbytes data array

---
 wvdecrypter/wvdecrypter.cpp         | 12 ++++++++----
 wvdecrypter/wvdecrypter_android.cpp | 12 ++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/wvdecrypter/wvdecrypter.cpp b/wvdecrypter/wvdecrypter.cpp
index fbb83147f..5717f5497 100644
--- a/wvdecrypter/wvdecrypter.cpp
+++ b/wvdecrypter/wvdecrypter.cpp
@@ -1164,7 +1164,9 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
     {
       //check NAL / subsample
       const AP4_Byte *packet_in(data_in.GetData()), *packet_in_e(data_in.GetData() + data_in.GetDataSize());
-      unsigned int clrbPos = sizeof(subsample_count);
+      // Byte position of "bytesOfCleartextData" where to set the size of the data,
+      // by default starts after the subsample count data (so the size of subsample_count data type)
+      size_t clrDataBytePos = sizeof(subsample_count);
       // unsigned int nalunitcount(0);
       unsigned int nalunitsum(0);
       // unsigned int configSize(0);
@@ -1181,7 +1183,8 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
                               fragInfo.annexb_sps_pps_.GetDataSize());
           if (iv)
           {
-            AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrbPos);
+            // Update the byte containing the data size of current subsample referred to clear bytes array
+            AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrDataBytePos);
             *clrb_out += fragInfo.annexb_sps_pps_.GetDataSize();
           }
           
@@ -1197,7 +1200,8 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
 
         if (iv)
         {
-          AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrbPos);
+          // Update the byte containing the data size of current subsample referred to clear bytes array
+          AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrDataBytePos);
           *clrb_out += (4 - fragInfo.nal_length_size_);
         }
 
@@ -1215,7 +1219,7 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
             summedBytes += *bytes_of_cleartext_data + *bytes_of_encrypted_data;
             ++bytes_of_cleartext_data;
             ++bytes_of_encrypted_data;
-            ++clrbPos;
+            clrDataBytePos += sizeof(AP4_UI16); // Move to the next clear data subsample byte position
             --subsample_count;
           } while (subsample_count && nalsize + fragInfo.nal_length_size_ + nalunitsum > summedBytes);
 
diff --git a/wvdecrypter/wvdecrypter_android.cpp b/wvdecrypter/wvdecrypter_android.cpp
index 968fed2a3..943ef7a57 100644
--- a/wvdecrypter/wvdecrypter_android.cpp
+++ b/wvdecrypter/wvdecrypter_android.cpp
@@ -1125,7 +1125,9 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
     {
       //check NAL / subsample
       const AP4_Byte *packet_in(data_in.GetData()), *packet_in_e(data_in.GetData() + data_in.GetDataSize());
-      unsigned int clrbPos = sizeof(subsample_count);
+      // Byte position of "bytesOfCleartextData" where to set the size of the data,
+      // by default starts after the subsample count data (so the size of subsample_count data type)
+      size_t clrDataBytePos = sizeof(subsample_count);
       // unsigned int nalunitcount(0);
       unsigned int nalunitsum(0);
       // unsigned int configSize(0);
@@ -1142,7 +1144,8 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
                               fragInfo.annexb_sps_pps_.GetDataSize());
           if (iv)
           {
-            AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrbPos);
+            // Update the byte containing the data size of current subsample referred to clear bytes array
+            AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrDataBytePos);
             *clrb_out += fragInfo.annexb_sps_pps_.GetDataSize();
           }
 
@@ -1158,7 +1161,8 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
         
         if (iv)
         {
-          AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrbPos);
+          // Update the byte containing the data size of current subsample referred to clear bytes array
+          AP4_UI16* clrb_out = reinterpret_cast<AP4_UI16*>(data_out.UseData() + clrDataBytePos);
           *clrb_out += (4 - fragInfo.nal_length_size_);
         }
 
@@ -1176,7 +1180,7 @@ AP4_Result WV_CencSingleSampleDecrypter::DecryptSampleData(AP4_UI32 pool_id,
             summedBytes += *bytes_of_cleartext_data + *bytes_of_encrypted_data;
             ++bytes_of_cleartext_data;
             ++bytes_of_encrypted_data;
-            ++clrbPos;
+            clrDataBytePos += sizeof(AP4_UI16); // Move to the next clear data subsample byte position
             --subsample_count;
           } while (subsample_count && nalsize + fragInfo.nal_length_size_ + nalunitsum > summedBytes);