1
0
Fork 0
mirror of https://github.com/alfg/mp4-rust.git synced 2024-05-20 01:08:06 +00:00
mp4-rust/src/mp4box/elst.rs
oftheforest 7cfdffbd71
Fix several overflows in box and track processing (#94)
* Fix several overflows in box and track processing

* Use size_of::<Type>() instead of magic numbers

* Fix a panic in Mp4Track::read_sample() for one-past-the-end

This appears to be a bug unmasked by other changes. read_sample() calls
sample_offset() then sample_size(), and assumes that if the former returns Ok
then the latter does as well. However, if the sample_id is one past the end,
sample_offset() might succeed (it only checks samples _up to_ the given
sample_id but not _including_ it) while sample_size() fails (because the sample
doesn't exist). read_sample() will then panic.

Fix this by duplicating the error propagation (that is currently done for
sample_offset) for sample_size, instead of unwrapping. This is a cautious
change that fixes the bug; alternatively, having sample_offset() call
sample_size() on the given sample_id and propagate any error might also work.

* Account for header size in box processing overflow fixes

* Ensure that boxes aren't bigger than their containers

Together with the entry_count checks, this eliminates several OOMs when reading
incorrect mp4 files.

* Fix order of arithmetic operations

This was due to an incorrect transcription when switching to checked
arithmetic, and fixes a bug that could cause attempted lookups of the wrong
chunk_id.
2023-02-18 11:46:51 -08:00

202 lines
5.9 KiB
Rust

use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
use serde::Serialize;
use std::io::{Read, Seek, Write};
use std::mem::size_of;
use crate::mp4box::*;
#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize)]
pub struct ElstBox {
pub version: u8,
pub flags: u32,
#[serde(skip_serializing)]
pub entries: Vec<ElstEntry>,
}
#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize)]
pub struct ElstEntry {
pub segment_duration: u64,
pub media_time: u64,
pub media_rate: u16,
pub media_rate_fraction: u16,
}
impl ElstBox {
pub fn get_type(&self) -> BoxType {
BoxType::ElstBox
}
pub fn get_size(&self) -> u64 {
let mut size = HEADER_SIZE + HEADER_EXT_SIZE + 4;
if self.version == 1 {
size += self.entries.len() as u64 * 20;
} else if self.version == 0 {
size += self.entries.len() as u64 * 12;
}
size
}
}
impl Mp4Box for ElstBox {
fn box_type(&self) -> BoxType {
self.get_type()
}
fn box_size(&self) -> u64 {
self.get_size()
}
fn to_json(&self) -> Result<String> {
Ok(serde_json::to_string(&self).unwrap())
}
fn summary(&self) -> Result<String> {
let s = format!("elst_entries={}", self.entries.len());
Ok(s)
}
}
impl<R: Read + Seek> ReadBox<&mut R> for ElstBox {
fn read_box(reader: &mut R, size: u64) -> Result<Self> {
let start = box_start(reader)?;
let (version, flags) = read_box_header_ext(reader)?;
let header_size = HEADER_SIZE + HEADER_EXT_SIZE;
let entry_count = reader.read_u32::<BigEndian>()?;
let other_size = size_of::<i32>(); // entry_count
let entry_size = {
let mut entry_size = 0;
entry_size += if version == 1 {
size_of::<u64>() + size_of::<i64>() // segment_duration + media_time
} else {
size_of::<u32>() + size_of::<i32>() // segment_duration + media_time
};
entry_size += size_of::<i16>() + size_of::<i16>(); // media_rate_integer + media_rate_fraction
entry_size
};
if u64::from(entry_count)
> size
.saturating_sub(header_size)
.saturating_sub(other_size as u64)
/ entry_size as u64
{
return Err(Error::InvalidData(
"elst entry_count indicates more entries than could fit in the box",
));
}
let mut entries = Vec::with_capacity(entry_count as usize);
for _ in 0..entry_count {
let (segment_duration, media_time) = if version == 1 {
(
reader.read_u64::<BigEndian>()?,
reader.read_u64::<BigEndian>()?,
)
} else {
(
reader.read_u32::<BigEndian>()? as u64,
reader.read_u32::<BigEndian>()? as u64,
)
};
let entry = ElstEntry {
segment_duration,
media_time,
media_rate: reader.read_u16::<BigEndian>()?,
media_rate_fraction: reader.read_u16::<BigEndian>()?,
};
entries.push(entry);
}
skip_bytes_to(reader, start + size)?;
Ok(ElstBox {
version,
flags,
entries,
})
}
}
impl<W: Write> WriteBox<&mut W> for ElstBox {
fn write_box(&self, writer: &mut W) -> Result<u64> {
let size = self.box_size();
BoxHeader::new(self.box_type(), size).write(writer)?;
write_box_header_ext(writer, self.version, self.flags)?;
writer.write_u32::<BigEndian>(self.entries.len() as u32)?;
for entry in self.entries.iter() {
if self.version == 1 {
writer.write_u64::<BigEndian>(entry.segment_duration)?;
writer.write_u64::<BigEndian>(entry.media_time)?;
} else {
writer.write_u32::<BigEndian>(entry.segment_duration as u32)?;
writer.write_u32::<BigEndian>(entry.media_time as u32)?;
}
writer.write_u16::<BigEndian>(entry.media_rate)?;
writer.write_u16::<BigEndian>(entry.media_rate_fraction)?;
}
Ok(size)
}
}
#[cfg(test)]
mod tests {
use super::*;
use crate::mp4box::BoxHeader;
use std::io::Cursor;
#[test]
fn test_elst32() {
let src_box = ElstBox {
version: 0,
flags: 0,
entries: vec![ElstEntry {
segment_duration: 634634,
media_time: 0,
media_rate: 1,
media_rate_fraction: 0,
}],
};
let mut buf = Vec::new();
src_box.write_box(&mut buf).unwrap();
assert_eq!(buf.len(), src_box.box_size() as usize);
let mut reader = Cursor::new(&buf);
let header = BoxHeader::read(&mut reader).unwrap();
assert_eq!(header.name, BoxType::ElstBox);
assert_eq!(src_box.box_size(), header.size);
let dst_box = ElstBox::read_box(&mut reader, header.size).unwrap();
assert_eq!(src_box, dst_box);
}
#[test]
fn test_elst64() {
let src_box = ElstBox {
version: 1,
flags: 0,
entries: vec![ElstEntry {
segment_duration: 634634,
media_time: 0,
media_rate: 1,
media_rate_fraction: 0,
}],
};
let mut buf = Vec::new();
src_box.write_box(&mut buf).unwrap();
assert_eq!(buf.len(), src_box.box_size() as usize);
let mut reader = Cursor::new(&buf);
let header = BoxHeader::read(&mut reader).unwrap();
assert_eq!(header.name, BoxType::ElstBox);
assert_eq!(src_box.box_size(), header.size);
let dst_box = ElstBox::read_box(&mut reader, header.size).unwrap();
assert_eq!(src_box, dst_box);
}
}