fix: YL3 frames put together from each piece's own length (bytes 2-3), not the whole datagram; jieli:// turns 90° by default; raw frames outlive the session (#187)

Author: compot-dev

android/app/src/main/java/com/openipc/decoder/DebugServer.java

@@ -217,8 +217,8 @@ void serve(OutputStream out, String path, String query) throws IOException {
             case "/jieli-dropped.bin":
                 // The toy's frames as they came (#187), to see what the picture is made from
                 Source src = source;
-                byte[] raw = src != null ? src.jieliRaw(path.startsWith("/jieli-frame")
-                        ? "frame" : "dropped") : null;
+                String which = path.startsWith("/jieli-frame") ? "frame" : "dropped";
+                byte[] raw = src != null ? src.jieliRaw(which) : Jieli.Client.lastRaw(which);
                 if (raw != null) {
                     reply(out, 200, path.endsWith(".jpg") ? "image/jpeg"
                             : "application/octet-stream", raw);

android/app/src/main/java/com/openipc/decoder/Decoder.java

@@ -1390,7 +1390,7 @@ private void removeQuadOverlay(int index) {
         @Override public byte[] snapshotJpeg(boolean labels) { return debugSnapshotJpeg(labels); }
         @Override public byte[] jieliRaw(String which) {
             RtspClient c = rtspClient;
-            return c != null ? c.jieliRaw(which) : null;
+            return c != null ? c.jieliRaw(which) : Jieli.Client.lastRaw(which);
         }
     };
     /** A cell counts as playing in a snapshot when it showed a frame this recently (#98). */

android/app/src/main/java/com/openipc/decoder/Jieli.java

@@ -56,15 +56,18 @@ final class Jieli {
     static final int RTP_PORT = 6666;
     /** The toy's own stream (#187): a YL3 sends its JPEG frames here, not as RTP to 6666. */
     static final int STREAM_PORT = 2224;
+    /** The last frame of any session, and the last dropped one, for the debug page. */
+    static volatile byte[] lastFrameAnySession;
+    static volatile byte[] lastDroppedAnySession;
     /** The port listened on for that stream; STREAM_PORT but for the tests. */
     static volatile int streamPort = STREAM_PORT;
     static final int DEFAULT_WIDTH = 640;
     static final int DEFAULT_HEIGHT = 480;
     static final int DEFAULT_FPS = 25;
     static final int FORMAT_JPEG = 0;
     static final int FORMAT_H264 = 1;
-    /** The YL3's frames come turned (portrait 240×320), as the K200's do (#187, #200). */
-    static final int DEFAULT_ROTATE = 270;
+    /** The YL3's frames come turned (portrait 240×320); 270 showed them upside down (#187). */
+    static final int DEFAULT_ROTATE = 90;
     static final int PT_JPEG = 26;
     static final int PT_H264 = 96;
 
@@ -121,7 +124,7 @@ private Jieli() {}
      * refused): w, h, fps (the stream asked for; default what the toy announces in
      * VIDEO_PARAM, else 640x480 at 25), rtp (the local UDP port for the video, 6666),
      * format (0 JPEG, the default, or 1 H.264), rotate (degrees counter-clockwise for JPEG,
-     * 0, 90, 180 or 270; default 270: the YL3's camera is mounted sideways like the K200's).
+     * 0, 90, 180 or 270; default 90: the YL3's camera is mounted sideways).
      */
     static final class Url {
         String host = DEFAULT_HOST;
@@ -582,14 +585,17 @@ static String subnetHint(InetAddress target, List<InetAddress> local) {
 
     /**
      * The toy's own video stream on UDP 2224 (#187), as a YL3 sent it: a 20-byte header,
-     * then (a piece of) a JPEG. Header as far as seen, little-endian: byte 0 the type (2 for
-     * JPEG), bytes 4–7 a packet counter, 8–11 the length of the JPEG, 12–15 the offset of
-     * this piece in it. A 640×480 frame fitted one datagram (4600 bytes, 20 more in the
-     * datagram); longer ones are put together by offset. Pure Java, for the unit tests.
+     * then a piece of a JPEG. Header, little-endian: byte 0 the type (2 for JPEG, bit 7 set
+     * on the last piece of a frame), bytes 2–3 the length of this piece, 4–7 a packet
+     * counter, 8–11 the length of the JPEG, 12–15 the offset of this piece in it. The
+     * datagram can be longer than the piece: what follows is left over from earlier frames
+     * (taking it gave a broken lower half), so only the piece is used. Pure Java, for the
+     * unit tests.
      */
     static final class RtStream {
         static final int HEADER = 20;
         static final int TYPE_JPEG = 2;
+        static final int LAST_PIECE = 0x80;
         static final int MAX_FRAME = 1 << 20;
 
         private byte[] frame = new byte[64 * 1024];
@@ -605,7 +611,10 @@ static final class RtStream {
         private void drop(String reason, int n) {
             dropped++;
             lastDropReason = reason;
-            if (n > 0) lastDropped = Arrays.copyOf(frame, n);
+            if (n > 0) {
+                lastDropped = Arrays.copyOf(frame, n);
+                lastDroppedAnySession = lastDropped;
+            }
         }
 
         /**
@@ -614,12 +623,15 @@ private void drop(String reason, int n) {
          */
         int feed(byte[] b, int off, int len) {
             if (len <= HEADER) return 0;
-            if ((b[off] & 0xFF) != TYPE_JPEG) {
+            if ((b[off] & 0x7F) != TYPE_JPEG) {
                 otherTypes++;
                 return 0;
             }
+            boolean last = (b[off] & LAST_PIECE) != 0;
             int total = le32(b, off + 8);
             int at = le32(b, off + 12);
+            int length = (b[off + 2] & 0xFF) | (b[off + 3] & 0xFF) << 8;
+            if (length == 0 || length > len - HEADER) length = len - HEADER;
             if (total < 4 || total > MAX_FRAME || at < 0 || at >= total) {
                 drop("bad header: length " + total + ", offset " + at, 0);
                 return 0;
@@ -633,10 +645,17 @@ int feed(byte[] b, int off, int len) {
             } else if (size != total) {
                 return 0; // a piece of a frame whose start was lost
             }
-            int piece = Math.min(len - HEADER, total - at);
+            int piece = Math.min(length, total - at);
             System.arraycopy(b, off + HEADER, frame, at, piece);
             filled += piece;
-            if (filled < size) return 0;
+            if (filled < size) {
+                if (last) {
+                    drop("incomplete: " + filled + " of " + size + " bytes at the last piece",
+                            filled);
+                    size = -1;
+                }
+                return 0;
+            }
             int n = size;
             size = -1;
             int end = jpegEnd(frame, n);
@@ -1247,6 +1266,7 @@ private void stream(DatagramPacket p, Listener listener) {
             int jpeg = rtStream.feed(b, 0, len);
             if (jpeg > 0) {
                 lastStreamFrame = Arrays.copyOf(rtStream.frame(), jpeg);
+                lastFrameAnySession = lastStreamFrame;
                 lastSource = from;
                 if (listener.onJpeg(rtStream.frame(), 0, jpeg)) {
                     videoPort = streamPort;
@@ -1300,6 +1320,15 @@ byte[] raw(String which) {
                     : "dropped".equals(which) ? rtStream.lastDropped : null;
         }
 
+        /**
+         * As {@link #raw} after the session ended too: opening the browser on the same phone
+         * pauses the app and ends the session (#187), the frames must outlive it.
+         */
+        static byte[] lastRaw(String which) {
+            return "frame".equals(which) ? lastFrameAnySession
+                    : "dropped".equals(which) ? lastDroppedAnySession : null;
+        }
+
         /** For /stats.json. */
         Map<String, Object> stats() {
             Map<String, Object> m = new LinkedHashMap<>();

android/app/src/main/java/com/openipc/decoder/RtspSession.java

@@ -783,7 +783,8 @@ Map<String, Object> jieliStats() {
     /** Raw bytes of a jieli:// slot for the debug page (#187), see Jieli.Client.raw(). */
     byte[] jieliRaw(String which) {
         Jieli.Client c = jieli;
-        return c != null ? c.raw(which) : null;
+        byte[] b = c != null ? c.raw(which) : null;
+        return b != null ? b : Jieli.Client.lastRaw(which);
     }
 
     /**

android/app/src/test/java/com/openipc/decoder/JieliTest.java

@@ -73,9 +73,10 @@ private static int freeUdpPortOrZero() {
     /** A datagram of the toy's stream on UDP 2224 as a YL3 sent it (#187). */
     private static byte[] streamPacket(int counter, int total, int offset, byte[] piece, int tail) {
         byte[] b = new byte[Jieli.RtStream.HEADER + piece.length + tail];
-        b[0] = 2;
-        b[2] = (byte) 0x94;
-        b[3] = 0x0B;
+        // Type 2, bit 7 on the last piece; bytes 2-3 the length of this piece
+        b[0] = (byte) (offset + piece.length >= total ? 0x82 : 0x02);
+        b[2] = (byte) piece.length;
+        b[3] = (byte) (piece.length >>> 8);
         le32(b, 4, counter);
         le32(b, 8, total);
         le32(b, 12, offset);
@@ -127,6 +128,40 @@ public void rtStreamFrameInPieces() {
         assertArrayEquals(j, Arrays.copyOf(st.frame(), n));
     }
 
+    @Test
+    public void rtStreamUsesOnlyThePiece() {
+        // As test build 3 showed it: 2964 of 4600 bytes in a 4640-byte datagram whose rest is
+        // left over from an earlier frame (even with an FFD9); the rest comes at offset 2964
+        Jieli.RtStream st = new Jieli.RtStream();
+        byte[] j = jpeg(4600);
+        byte[] first = streamPacket(1, 4600, 0, Arrays.copyOfRange(j, 0, 2964), 0);
+        byte[] dgram = Arrays.copyOf(first, 4640);
+        byte[] stale = jpeg(4600 - 2964 + 20);
+        System.arraycopy(stale, 0, dgram, first.length, stale.length);
+        assertEquals(0, st.feed(dgram, 0, dgram.length));
+        byte[] second = streamPacket(2, 4600, 2964, Arrays.copyOfRange(j, 2964, 4600), 40);
+        int n = st.feed(second, 0, second.length);
+        assertEquals(4600, n);
+        assertArrayEquals(j, Arrays.copyOf(st.frame(), n));
+        assertEquals(0, st.dropped);
+    }
+
+    @Test
+    public void rtStreamDropsAFrameWithAPieceMissing() {
+        Jieli.RtStream st = new Jieli.RtStream();
+        byte[] j = jpeg(6000);
+        byte[] first = streamPacket(1, 6000, 0, Arrays.copyOfRange(j, 0, 2000), 0);
+        assertEquals(0, st.feed(first, 0, first.length));
+        // The middle piece is lost; the last one ends the frame
+        byte[] last = streamPacket(3, 6000, 4000, Arrays.copyOfRange(j, 4000, 6000), 0);
+        assertEquals(0, st.feed(last, 0, last.length));
+        assertEquals(1, st.dropped);
+        assertTrue(st.lastDropReason, st.lastDropReason.startsWith("incomplete"));
+        // The next frame plays
+        byte[] next = streamPacket(4, 3000, 0, jpeg(3000), 0);
+        assertEquals(3000, st.feed(next, 0, next.length));
+    }
+
     @Test
     public void rtStreamDropsBrokenFrames() {
         Jieli.RtStream st = new Jieli.RtStream();
@@ -328,7 +363,7 @@ public void urls() throws Exception {
         assertEquals("192.168.80.1", u.host);
         assertEquals(3333, u.port);
         assertEquals(6666, u.rtpPort);
-        assertEquals(270, u.rotate);
+        assertEquals(90, u.rotate);
         assertEquals(0, Jieli.Url.parse("jieli://?rotate=0").rotate);
         assertEquals(90, Jieli.Url.parse("jieli://?rotate=90").rotate);
         assertEquals(0, u.width);

docs/toys.md

@@ -44,7 +44,7 @@ The Wi‑Fi name and the address the phone gets usually tell the family. The toy
 |----------------------------------------------------------------|-----------------|----------------------------------------------------------|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
 | `FLOW-UFO-xxxxxx`, `FLOW_xxxxxx`                               | `192.168.169.x` | FLOW-UFO (BL60x camera; turbodrone calls it `wifi_uav`)  | `flowufo://192.168.169.1` (UDP 8800 and 8801)                                   | in testing ([#187](https://github.com/OpenIPC/decoder/issues/187))                                                                   |
 | `FLY-UFO-xxxxxx` and other cooingdv toys (KY UFO, RC UFO apps) | `192.168.1.x`   | KY UFO RTSP                                              | `rtsp://192.168.1.1:7070/webcam` (with the heartbeat to UDP 7099)               | in testing ([#187](https://github.com/OpenIPC/decoder/issues/187))                                                                   |
-| `HF_xxxxxxxx`                                                  | `192.168.80.x`  | Jieli / HF (Jieli AC79 camera, vendor app *DVRunning 2*) | `jieli://192.168.80.1` (CTP on TCP 3333, video to the phone's UDP 2224 or 6666) | test build 4: YL3 video on UDP 2224 plays, lower half broken in test build 3 ([#187](https://github.com/OpenIPC/decoder/issues/187)) |
+| `HF_xxxxxxxx`                                                  | `192.168.80.x`  | Jieli / HF (Jieli AC79 camera, vendor app *DVRunning 2*) | `jieli://192.168.80.1` (CTP on TCP 3333, video to the phone's UDP 2224 or 6666) | test build 5: YL3 video on UDP 2224, pieces put together by their own length ([#187](https://github.com/OpenIPC/decoder/issues/187)) |
 
 When a `flowufo://` or `jieli://` slot points at the phone itself, or at the network of another family, its status says so (for example *192.168.1.100 is this phone; the toy is usually 192.168.1.1*, *This network looks like a KY UFO RTSP toy: try rtsp://192.168.1.1:7070/webcam* or, on a `192.168.80.x` network, *try jieli://192.168.80.1*).
 
@@ -109,7 +109,7 @@ What the app does, as a capture of the vendor app shows it ([#196](https://githu
 - It connects to TCP port 3333 and talks **CTP**: each message is `CTP:`, the length of a topic name, the topic (e.g. `OPEN_RT_STREAM`), the length of a JSON text and the JSON.
 - `APP_ACCESS` first; the toy answers with `KEEP_ALIVE_INTERVAL` (a timeout, 60 s), its battery and SD card state and `VIDEO_PARAM` (the size, e.g. 640×480 at 25 fps). Then `DATE_TIME` (the phone's time), a `CTP_KEEP_ALIVE` every 7.5 s (a quarter of a shorter timeout), and `OPEN_RT_STREAM` with the size from `VIDEO_PARAM` (640×480 at 25 if the toy sent none). When the slot stops: `CLOSE_RT_STREAM`.
 - The video was **not** in the capture (PCAPdroid without root cannot see it). After turbodrone's research on the same Jieli SDK it is **RTP/JPEG** (payload type 26) or H.264 (96) to the phone's **UDP port 6666**. The app listens there and plays payload type 26 through its RTP/JPEG path and 96 through its H.264 path; a whole JPEG in a datagram without RTP is shown too.
-- A YL3 sent nothing to 6666 but its own stream to the phone's **UDP port 2224**: per datagram a 20-byte header, then the JPEG (seen: byte 0 = 2, a packet counter in bytes 4–7, the JPEG's length in 8–11, an offset in 12–15, little-endian; frames of 4–8 KB in one datagram, 40–60 zero bytes after the JPEG). Its frames are portrait (240×320 when 640×480 was asked for): the camera is mounted sideways, so `jieli://` turns them 270° counter-clockwise like the K200's, `?rotate=` overrides it. The app listens on 2224 as well and shows those JPEGs; longer frames are put together by the offset. The first five datagrams go to the log with the whole header, `/stats.json` has a `stream` object (`packets`, `frames`, `dropped`, `last_drop`) and `video_port`; why a frame was dropped is in the log for the first three. The debug page serves the last frame as it came, `/jieli-frame.jpg`, and the last dropped one, `/jieli-dropped.bin`.
+- A YL3 sent nothing to 6666 but its own stream to the phone's **UDP port 2224**: per datagram a 20-byte header, then a piece of a JPEG. Header, little-endian: byte 0 the type (2 for JPEG, bit 7 set on the last piece of a frame), bytes 2–3 the length of this piece, 4–7 a packet counter, 8–11 the length of the JPEG, 12–15 the offset of the piece in it. The datagram can be longer than the piece; what follows is left over from earlier frames and is ignored (test build 3 took it, which broke the lower half of the picture). Its frames are portrait (240×320 or 320×240 rotated): the camera is mounted sideways, so `jieli://` turns them 90° counter-clockwise; 270° showed them upside down; `?rotate=` overrides it. The app listens on 2224 as well as 6666; the first five datagrams go to the log with the whole header, `/stats.json` has a `stream` object (`packets`, `frames`, `dropped`, `last_drop`) and `video_port`; why a frame was dropped is in the log for the first three. The debug page serves the last frame as it came, `/jieli-frame.jpg`, and the last dropped one, `/jieli-dropped.bin`, also after the session ended (the app pauses while the phone's browser is open).
 - If nothing arrives on 6666 or 2224 for 5 s after `OPEN_RT_STREAM`, the status says so and the app also listens on UDP 1234 (audio in the vendor SDK), **only to log** what arrives there, for 30 s or 20 packets, then frees the port; it asks for the stream again every 10 s without video.
 - **No flight command is ever sent**: no `FLIGHT_CONTROL` over CTP, nothing to the toy's UDP port 3456 (where the vendor app sends the sticks).
 - Ports 6666 and 2224 can be used by one slot at a time: one `jieli://` slot in a grid.
@@ -121,7 +121,7 @@ URL options (as with `udp://`, separated by `?` and `&`):
 | `w`, `h`, `fps` | numbers                 | from `VIDEO_PARAM`, else 640, 480, 25 | the stream asked for in `OPEN_RT_STREAM`                                                    |
 | `rtp`           | a UDP port              | `6666`                                | the local port the video is expected on                                                     |
 | `format`        | `0`, `1`                | `0`                                   | `0` asks for JPEG (as the vendor app does), `1` for H.264                                   |
-| `rotate`        | `0`, `90`, `180`, `270` | `270`                                 | degrees counter-clockwise the JPEG frames are turned (the YL3's camera is mounted sideways) |
+| `rotate`        | `0`, `90`, `180`, `270` | `90`                                  | degrees counter-clockwise the JPEG frames are turned (the YL3's camera is mounted sideways) |
 
 Examples: `jieli://192.168.80.1`, `jieli://192.168.80.1?w=1280&h=720`, `jieli://192.168.80.1?format=1`.