mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-12 08:52:32 +00:00
craft-math-function-scripts
14
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
c31fc02ab9 |
craft-media: MXF writer identification and metadata budget; ports of FilmCraft container PRs (#1794, #4100, #4497, #2303) (#989)
* craft-media: MXF identification on every writer entry point, and a total metadata budget write_opatom_pcm_as takes the company, product and version that WriterConfig already has, and the product UID is derived from the product name, so an app that names itself writes the bytes it wrote before the move. Everything read while opening shares a 256 MiB budget: a file made of metadata sets, each under the 64 MiB value limit, is refused instead of read whole. * craft-media-testkit: hostile-input hammer Truncations, bit flips, extreme-value overwrites in both byte orders and deletions of a valid input, each run under catch_unwind with a time budget. CRAFT_MEDIA_HOSTILE_MULT multiplies the iterations for soak runs. Ported from storytold/filmcraft#1794 (filmcraft-testkit's hostile module). * craft-media: MXF hostile-input hammer The hammer over three synthetic OP1a files and over an index segment, a primer pack and a metadata set parsed directly, and the regression test for sync_before on a track without samples (the fix is already in the module). Ported from storytold/filmcraft#1794 (crates/mxf/src/tests/hostile.rs). * craft-media: MXF picture descriptors give the H.273 code points of their colour labels PictureInfo::color_codes maps the colour primaries, transfer characteristic and coding equations labels the writer uses (Rec. 709, BT.2020, PQ, HLG) to their code points, whatever the label's registry version byte. Ported from storytold/filmcraft#4100 (the crates/mxf part). * craft-media: MXF writer describes interlaced pictures, and the reader gives the field dominance PictureDesc::interlaced writes the SeparateFields frame layout with a field's stored and sampled height, the 1080i video line map and the field dominance (bottom_field_first: 2). PictureInfo::field_dominance reads it back. Ported from storytold/filmcraft#4497 (the crates/mxf part). * craft-media: AVI hostile-input hammer The hammer over the four synthetic layouts (idx1 relative and absolute, rec lists, no index, OpenDML), opened with and without the OpenDML index. Ported from storytold/filmcraft#1794 (crates/avi/src/tests/hostile.rs). * craft-media: AVI says how an H.264 or HEVC stream frames its NAL units The bytes after a video stream's format header are nothing, Annex B parameter sets (ffmpeg with global headers) or an avcC / hvcC record (a stream copied from MP4, with length-prefixed chunks). Stream::nal_framing tells them apart and gives the length-prefix size, so a caller hands the decoder the header's parameter sets and turns length prefixes into start codes. codec_params said the bytes were never a record. Ported from storytold/filmcraft#2303 (the container part of NalSetup in filmcraft-codecs; the decoder wiring stays in the app). * craft-media: MPEG-TS / PS hostile-input hammer The hammer over transport streams (188- and 192-byte packets, six stream types), program streams (MPEG-2 and MPEG-1 packs, private stream 1) and the frame-header helpers for every codec. Fewer rounds than in FilmCraft, where tests build with optimisation. Ported from storytold/filmcraft#1794 (crates/mpegts/src/tests/hostile.rs). --------- Co-authored-by: Logan Jennings <loganwjennings@gmail.com> Co-authored-by: JonRC <jonarc06@gmail.com> Co-authored-by: Michael de Meyer <249562202+oblivion8282-1337@users.noreply.github.com> Co-authored-by: tylerjenningsw <tylerjennings2@outlook.com> |
||
|
Dylan M. Taylor
|
471abca087 |
craft-media: MPEG-2 transport and program stream demuxer from FilmCraft (mpegts) (#861)
* craft-media: MPEG-2 transport and program stream demuxer from FilmCraft (feature `mpegts`) Moves filmcraft-mpegts (storytold/filmcraft@4bec22b) into craft_media::mpegts. ByteSource is the crate's trait, Error is written without thiserror so the feature has no dependencies, and Codec::codec_id() and Stream::codec_params() map streams to CodecId. Adds Container::MpegTs and Container::MpegPs, an ffprobe oracle test over ten ffmpeg-made files, and hostile-input tests. * craft-media: module order after merging main |
||
|
Dylan M. Taylor
|
d3bc790aba |
craft-media: MXF demuxer and writer from FilmCraft (feature mxf) (#877)
Moves filmcraft-mxf (storytold/filmcraft@4bec22b) into craft_media::mxf. ByteSource is the crate's trait, Codec::codec_id() and EssenceTrack::codec_params() map tracks to CodecId, and the writer names craft-media as company and product unless the caller sets them. Fixes two panics: EssenceTrack::sync_before on a track without picture samples, and Timecode::format for a drop-frame start near i64::MAX. Adds Container::Mxf, an ffprobe/ffmpeg oracle test for the reader and the writer, and hostile-input tests. |
||
|
Dylan M. Taylor
|
de1daefe8c |
craft-media: AVI and OpenDML demuxer from FilmCraft (feature avi) (#856)
Moves filmcraft-avi (storytold/filmcraft@4bec22b) into craft_media::avi. ByteSource is the crate's trait, Error::Io holds the io::Error, and Stream::codec_params() maps the FourCC and the WAVEFORMATEX tag to a CodecId. Adds Container::Avi and tests for the stream, header-size, nesting and OpenDML index limits. |
||
|
|
ce31f42e76 |
craft-media: QuickTime logs box, Matroska Colour in the muxer, laced remux test (#840)
* craft-media: read and write the QuickTime logs box A video sample entry's `logs` child holds the CoreMedia log transfer-function identifier (`com.apple.rec2020.apple-log` for Apple Log). It is kept as `VideoParams::log_transfer_function`, whatever curve it names. The reader takes non-empty UTF-8 without NUL of at most 255 bytes; anything else, or a second `logs` box, reads as unknown. The writer refuses an identifier the reader would not accept. Ported from storytold/filmcraft#1764. * craft-media: the Matroska muxer writes a video track's Colour element `TrackSpec::color` takes the reader's `Color` and the muxer writes the fields that are set: matrix, range, transfer, primaries, chroma layout, light levels and mastering metadata (RFC 9559). VP9's own colour syntax carries only the matrix and range, so without the element a Rec. 2020, P3, PQ or HLG WebM reads as BT.709. Ported from storytold/effectcraft#2926, which wrote the element by hand in EffectCraft's WebM export. * craft-media: the laced remux test laces ffmpeg's Vorbis fixture again ffmpeg's Vorbis files declare a short DefaultDuration and store longer durations per block, so with the track's own default nothing laced and the test failed ("vorbis.mkv Xiph: nothing was laced", ffmpeg 9.0.2). Audio tracks now take their median packet duration as the default, and frames are written with their explicit durations, so a short last packet ends its lace. Ported from storytold/filmcraft#3622 (test-only part). --------- Co-authored-by: 20Coder <51251284+BitL8-ByteShort@users.noreply.github.com> Co-authored-by: JonRC <jonarc06@gmail.com> Co-authored-by: Michael Butler <michaelbutler75@gmail.com> |
||
|
Gerrit TimmerandDylan M. Taylor
|
5b58973bc6 |
craft-media: index a Matroska file progressively (#430)
* craft-media: index a Matroska file progressively (OpenOptions::index_limit, MkvFile::extend_index) * craft-media: Matroska element headers never read past their parent --------- Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com> |
||
|
Tex JerniganandClaude Opus 5.5
|
7480fc2ac4 |
craft-media: write and read MP4/MOV chapter lists (#526)
* craft-media: write and read MP4/MOV chapter lists
WriterOptions::chapters (Chapter { start, title }, starts in the movie
timescale) makes Mp4Writer write a chapter list in the two forms players
read:
- a QuickTime chapter track (a disabled text track referenced by
tref/chap from the first video or audio track, one UTF-8 sample with an
encd atom per chapter) for QuickTime / AVFoundation, and
- a Nero udta/chpl list (version 1, 100 ns units) for VLC and
ffprobe -show_chapters.
Chapters are normalized (sorted, one per start, inside the movie, at most
255 chapters with 255-byte titles cut at a character boundary, control
characters replaced) and a late first chapter is placed with an empty
edit. FragmentedWriter writes chpl only. The demuxer reads both forms
back: Mp4File::chpl_chapters and Mp4File::read_chapters(src).
Ported from FilmCraft's own isobmff crate (storytold/filmcraft#2821, for
storytold/filmcraft#2747), now that FilmCraft uses craft-media.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: read chapters only from enabled tracks, inside the edit, with bounded titles
read_chapters took a tref/chap from any track, though QuickTime requires the referencing track to be
enabled. It ignored the chapter track's edit list, so a chapter before the edit start became a second
chapter at zero and samples past its end were returned. It kept titles of any length.
Now a disabled host is skipped; chapters outside the first non-empty edit are dropped, and one spanning
its start begins there; each sample read is capped at 4098 bytes and titles are cut to
MAX_CHAPTER_TITLE_BYTES, which bounds what is kept. Later edits are still ignored.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: a chapter title longer than the sample read keeps its start
A sample declaring more title than the 4096 bytes read parsed to nothing, so the
chapter lost its whole title rather than being cut to MAX_CHAPTER_TITLE_BYTES.
A sample cut by the read now decodes what it holds; one read whole but declaring
more than it has is still no title.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
||
|
el-jandFredApps
|
41ff22dcd4 |
craft-media-testkit: shared media test helpers and ffmpeg oracle discovery (#701)
* media-testkit: shared test helpers and ffmpeg oracle discovery * media-testkit: report fixture rename failure via skip; media: unlink relative craft-video path * media-testkit: failed fixture generator honours CRAFT_MEDIA_REQUIRE_ORACLES generate() returned None directly when the generator reported failure, so a required-oracle run could pass with a missing fixture. Route it through skip, like run_generator, and cover both policies with tests. --------- Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com> |
||
|
Aleksander HelgakerandClaude Opus 5.5
|
38740b43a9 |
craft-audio: core types, WAV/AIFF read and write, peaks, symphonia (#441)
* craft-audio: core types, WAV/AIFF read and write, peaks, symphonia The new crate without any codec module: what every later codec plugs into. - Shared types: `AudioBuffer`, `AudioInfo`, `ChannelLayout`/`Speaker`, `AudioError`, `EncodeOptions` (built with `new` and `with_*`), `EncodeFormat`, `BitDepth`, `BwfInfo`, `SampleFormat`. - WAV/BWF/RF64 and AIFF/AIFF-C reading and writing from SoundCraft's `soundcraft-audio-io`, kept over EffectCraft's and FilmCraft's smaller writers (only it has BWF, dither, any speaker mask and streaming without a known length). `encode` and `FileEncoder` behind `pcm-encode`; `lossless-encode` and `encode` turn it on. - `decode`, `probe`, `tracks` and the streaming, seekable `Decoder` (feature `decode-native`). The native path reads WAV, AIFF, and PCM in MP4/MOV and Matroska through craft-media's demuxers, packet by packet, with edit lists and `CodecDelay`/`DiscardPadding` applied. `TrackDecoder` decodes PCM; each codec PR adds its codec to it. - symphonia 0.6 (MPL-2.0, used unmodified) behind the `symphonia` feature, part of `decode`: the fallback for every format with no native decoder yet. Its size fields are checked before it reads, and its panics are caught where they unwind. - `peaks`: the min/max/RMS pyramid for waveform drawing. Workspace: craft-media is a workspace dependency without default features, so an encode-only craft-audio does not build the MP4 demuxer, and `symphonia-bundle-flac` builds without overflow checks in dev profiles (its 32-bit LPC restore wraps on valid input). CI: `audio.yml`, with clippy per feature, rustdoc, WASM, MSRV, and the tests with ffmpeg oracles. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: review fixes (CodeRabbit on #441) - Reading: AIFF that declares frames without an SSND chunk is Malformed; a Matroska PCM track's length counts from its first frame; seek targets saturate; an empty FLAC has one track; a failed header read is an Io error; deinterleave allocates fallibly; concealed silence is capped like a decoded packet, and symphonia's uses the damaged packet's own duration when known. - Peaks sum squares in f64, so loud float samples give a finite RMS. - Writing: .aifc maps to AIFF; BWF text is cut at a character boundary; a WAV byte rate past 32 bits is an error; the FileEncoder docs say nothing may follow the sink's position. - README: the Limits list says which codecs go through symphonia and which MP4 edit lists apply. - Tests for each, alias and dither coverage, and a FLAC case in the routing oracle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: review fixes, second round (CodeRabbit on #441) - Every header read is checked: `Native::open`, `native::tracks` and the no-symphonia error read it with `head_checked`. craft-media demuxer errors that are I/O failures (not a file ending early) are returned as `AudioError::Io` instead of sending the file to the other path. - A Matroska track's presented length runs from its first frame plus `CodecDelay` (unclamped, in timestamp ticks with the delay rounded to one) to its end. - symphonia's concealment allocates fallibly, and a damaged first packet is concealed when the demuxer gives its duration. `deinterleave` reserves its channel list fallibly too. - `TrackDecoder::conceal` documents its cap at the decode limit. - Tests: an I/O failure past the first 64 KiB, codec delay with the first block at -20, 0 and 50 ms (checked with `probe`), a seek back after an overshoot, and the loud-sample RMS value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: TrackDecoder::conceal returns a Result Concealment allocates fallibly and fails with TooLarge when the silence would pass the 2^30-sample decode limit, instead of returning less than the packet's length. The native path, the README, the packets example and the doc example pass the error on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: review fixes, third round (CodeRabbit on #441) - Concealed silence is held to the decode limit inside pcm::silence, so symphonia's path checks frames × channels too, and symphonia's decoded audio is copied into fallibly allocated planes. - TrackDecoder::reset forgets the last packet's length. - Without symphonia, a damaged MP4, Matroska or Ogg file (truncated, invalid, no moov) is Malformed instead of Unsupported; a feature the demuxer does not read still names the build. - Tests: an MP4 with no moov in a native-only build, conceal after a reset and past the limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: review fixes, fourth round (CodeRabbit on #441) - A file the native demuxers find damaged is Malformed with symphonia too, when symphonia calls it unsupported; before, an ftyp-only MP4 was Unsupported in symphonia builds. - symphonia's decoded blocks are held to the 2^30-sample decode limit before allocating. - Symph::seek forgets the last packet's length, so a lost packet after a seek is not concealed with the length of one before it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: review fixes, fifth round (CodeRabbit on #441) - The damaged-file test covers Matroska as well as MP4, and fails when either branch of native::damage is removed. - native::damage leaves out Ogg: ogg::open reports no damage (it skips damaged pages and calls a file with none it can read not Ogg), and symphonia reports damaged Ogg as malformed itself. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-audio: run the ffmpeg oracle tests on ubuntu-26.04 ubuntu-latest's apt ships ffmpeg 6.1.1, which writes MP2 and E-AC-3 in Matroska with ends a few milliseconds early, so the routing tests on the later codec PRs cannot pass on it. ubuntu-26.04 ships ffmpeg 8.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Aleksander HelgakerandClaude Opus 5.5
|
6865897f14 |
craft-media: add Ogg demuxer (#440)
* craft-media: Ogg demuxer
FilmCraft's `filmcraft-ogg` as `craft_media::ogg`, behind the opt-in
`ogg` feature: pages (CRC-32 checked, damage skipped by searching for
the next `OggS`), logical streams, packets across pages, and the Ogg
Opus, Vorbis and FLAC mappings. `OpusTiming` gives each Opus packet's
start, the pre-skip and the final page's end trimming.
`Stream::codec_params()` returns `CodecParams` like the other
containers; for FLAC each stream keeps its own header count, and an
unstated count is bounded (it ends at the first audio frame, or at
32 MiB with a warning). `ogg::ByteSource` is `craft_media::ByteSource`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg review fixes: bounded recovery, lost pages, chained links, caps
From the review of the Ogg demuxer (storytold/craft-libs#440):
- The damage scan charges the positions it examines, not a whole 1 MiB read,
reads 64 KiB at a time, and says when the 64 MiB budget runs out. A file
with many damaged pages lost its tail without a warning.
- A page whose lacing claims more bytes than the file has left is skipped
and the scan resumes, instead of ending the parse.
- A gap in a stream's page sequence numbers drops the packet the lost page
continued; its two ends were joined into one corrupted packet.
- A beginning-of-stream page for a serial already seen starts a new stream,
so a chained file whose links reuse a serial no longer hands the second
link's headers to the decoder as audio.
- The packets kept from a file are capped by its size (as Matroska caps
frames), so zero lacing values cannot make the packet lists many times the
file. FLAC metadata under an unstated header count must be a block of the
length its header states, and at most 1024 are kept.
- A packet over 4 GiB is dropped instead of overflowing its size.
- OpusTiming saturates, so hostile granule positions cannot overflow, and a
clip whose only audio page is also the last is trimmed at the end
(RFC 7845 §4.5) instead of at the start.
- Speex streams read extra_headers (offset 68) for their header count.
codec_params gives Theora its Xiph-laced headers and Speex its header,
rate and channels; the FLAC extradata flags exactly the last block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg damage recovery charges every page it reads and hashes
From CodeRabbit's review of
|
||
|
Aleksander HelgakerandClaude Opus 5.5
|
006b50d2ae |
craft-media: shared codec identifiers, one ByteSource, the testkit (1/10) (#439)
* craft-media: shared codec identifiers, one ByteSource, the testkit The types a codec crate needs to describe a file and configure a decoder, ahead of craft-audio: - `Container`, `CodecId`, `PcmFormat` and `CodecParams` (`id.rs`), always built, with optional serde. - `codec_params()` on `isobmff::Track` and `matroska::Track`, both returning `CodecParams` in the same form; `extradata` follows Matroska's `CodecPrivate`. - One `ByteSource` trait (`source.rs`), with `ReadSeekSource`; `isobmff::ByteSource` and `matroska::ByteSource` are that trait. - craft-media-testkit (`publish = false`): the ffmpeg oracle helpers from craft-media's tests, so the codec crates share one copy. The existing tests prove the refactor; the new types have their own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-media: APV extradata is the bare record; reseek after a poisoned lock An MP4 apvC track gave CodecParams.extradata with the 4-byte FullBox header in front, where Matroska's V_APV CodecPrivate is the bare APVDecoderConfigurationRecord. ApvConfig::record_bytes serializes the record alone and extradata uses it. ReadSeekSource kept its tracked position after recovering a poisoned lock or a failed seek, so a reader moved by a panic was read from the wrong offset with no error. Both now force a seek on the next read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-media: MP4 codec params per sample description Track::codec_params always described the first stsd entry, while each sample selects its own through description_index. It now describes the first sample's entry; codec_params_for gives the parameters of any entry, and has_mixed_descriptions says whether one set covers every sample. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-media: test file-backed ByteSources; a File read past i64::MAX is an EOF A File and a ReadSeekSource over a file now have the buffer's test: the same bytes at the same offsets, and UnexpectedEof past the end. The test found that a File read at an offset past i64::MAX failed with the OS's InvalidInput instead of the UnexpectedEof the trait promises; it now reports the end of the source like the other implementations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-media: Matroska codec params match MP4 for ALAC, DNx and Opus Matroska's codec_params gave Unknown for A_ALAC and for DNxHD/DNxHR stored as V_MS/VFW/FOURCC (AVdn, AVdh), where MP4 gives Alac and Dnxhd; ALAC's extradata is the CodecPrivate, the ALACSpecificConfig MP4's alac box holds. Opus now reports 48 kHz from Matroska as from MP4, whatever rate the muxer declared. ReadSeekSource clears the poison when it recovers the lock, so one panicked read costs one recovery instead of a seek on every later read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * craft-media: MP4 reports the MPEG audio layer the first frame names An MP4 track with MPEG audio reported CodecId::Mp3 whatever the layer, since mp4a + 0x69/0x6B names none (ffmpeg stores MP2 that way), while Matroska reports Mp1/Mp2/Mp3 from its CodecID. open() now reads the frame header of each such entry's first sample and codec_params() reports the layer it names; without a valid header, QuickTime's .mp2 gives Mp2 and anything else Mp3 as before. CodecConfig::Mp3 is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
aiongg
|
f97c84d273 |
media: fixes from FilmCraft's copy (NAL widths, RBSP stop bits) (#245)
* media: reject NAL length prefix widths outside 1 to 4 length_prefixed_nals returns BitError::InvalidNalLengthSize for any other width before scanning, empty data included. A width of 5 or more was accepted and shifted bytes out of the length; a zero width returned Eof only for non-empty data. Width 3 still splits, since (lengthSizeMinusOne & 3) + 1 can be 3. From filmcraft#2953. * media: find the RBSP stop bit once per BitReader BitReader::new records the position of the last set bit, and more_rbsp_data compares against it instead of scanning back over the data's zero suffix on every call (once per macroblock in a slice parser). FilmCraft caches it in a Cell on first use; computing it in new keeps BitReader Sync. From filmcraft#2880. * media: test the order CodecPrivate stripped headers are restored in Header-stripping encodings with private-data scope prepend their bytes in list order, so the last one listed ends up first. Empty prefixes and frame-only scopes leave CodecPrivate as it is. From filmcraft#2911. |
||
|
aiongg
|
7474826f6f |
media: craft-media review fixes (frame budget, PCM chunks, spec names) (#196)
* media: look up the track of each traf in a hash map * media: bound Matroska indexing by a file-wide frame budget Every indexed frame claims its stored bytes and at least one, so fixed-size laces of empty frames cannot describe more frames than the file has bytes. The frame count across tracks is capped at 2^26, the TrackEntry count at 2^16, and blocks find their track through a hash map. * media: keep the spec spellings of Colour, ColourSpace and colourPrimaries * media: PCM chunks stay bounded in MOV and MP4 The writer ends a PCM chunk at 1 MiB or half a second, and returns an error past 2^32 - 1 samples in a track instead of clamping the stsz count. The reader splits a PCM chunk above 16 MiB into several samples, so files from writers without chunk limits read whole past 4 GiB. A sparse output lets the tests write past 4 GiB, which also exercises the writer's co64 path. * media: clamp max_lace_frames to 256 and round BlockDuration * media: level-1 Matroska elements read at most the file's length in all SeekHead entries pointing at nested elements made each one read the rest of the file. * media: set_sample_entry rejects a codec change * media: the mux oracle compares stream counts before streams * ci: media checkout does not persist credentials * media: README lists the renames from FilmCraft and the output that differs on valid input * media: rustfmt * media: the stream count comparison leaves out timecode streams * media: PCM chunks end at 1 MiB only, as ffmpeg's do ffmpeg's PCM chunks run past half a second, so a duration limit split remuxed chunks the source kept whole. * media: frames and samples indexed scale with the file's length Matroska indexes at most one frame per 8 bytes of file and ISO BMFF at most one sample per 4 bytes, beyond the first 2^20 of each, so the sample tables stay within about ten times the file's size. Empty fixed-size laces and one-byte constant-size samples could make them 40 to 76 times its size. * media: clamp the frame and sample allowances |
||
|
aiongg
|
07047b7221 |
Add craft-media: shared MP4/MOV, Matroska and bitstream code from FilmCraft (#182)
* media: add craft-media with bitstream and isobmff from FilmCraft Moves filmcraft-bitstream and filmcraft-isobmff (storytold/filmcraft@6c3948a) into one crate with a feature per module. The public API matches FilmCraft's so its crates can become re-exports. Tests, oracle tests and fuzzing come along; the ffmpeg discovery helpers replace filmcraft-testkit. Out-of-contract inputs no longer panic: bit widths above 32, a zero NAL length prefix width, and PCM frame sizes that overflow u32. Adds BitReader::read_ue_plus from DeckCraft's copy. * media: public ISO BMFF box reader (isobmff::boxes) Make the demuxer's box iterator and big-endian reader public as isobmff::boxes::{BoxIter, BoxRef, BoxHeader, Reader}, for walkers of boxes the demuxer does not model (CR3 uuid boxes, HEIF meta items, JPEG 2000). BoxIter::within keeps offsets relative to the outer slice, and allow_truncated yields a cut last box. The fuzz test walks every box of each mutated file. * media: matroska feature from FilmCraft's filmcraft-matroska Port storytold/filmcraft@6c3948a crates/matroska as craft_media::matroska behind the opt-in feature matroska, with the same public API so FilmCraft can make filmcraft-matroska a re-export. Its unit and ffprobe oracle tests come with it, on craft-media's test helpers. From DeckCraft's copy: cluster and block timestamps no longer overflow; they saturate at i64::MAX. MuxingApp and the default WritingApp name craft-media. New tests: block additions and mutation fuzzing. The oracle skips the duration of a track's last packet when ffmpeg 8 shortened it. * media: MOV PCM uses lpcm v2 above 16.16 rates and for unsigned 16-bit; signed 8-bit as twos Version 0 sound descriptions store the rate as 16.16 fixed point, so 88.2 kHz and higher were written as 0 Hz. 8-bit signed PCM was labelled raw (unsigned) and 16-bit unsigned as twos/sowt (signed). The reader also took raw under a sound handler for uncompressed video. * media: stop the top-level box scan at a box that runs past the end of the file A 64-bit box size near u64::MAX saturated the scan offset, and the next offset + 8 overflowed. * media: one sample budget for the whole ISO BMFF file The sample cap and the file-length bound on samples without table entries (constant-size stsz, trun without per-sample fields) applied per track or per trun, so repeating a small trak or trun multiplied the allocation. Both are now shared by all tracks and fragments. * media: set_sample_entry rejects entries that change the track's media type or PCM frame size The handler, stsz constant size and PCM timescale check are fixed at add_track; a replacement that changed them produced a corrupt file. A bad track index returns NoSuchTrack like the other writer methods. * media: saturate the sample end in MkvFile::duration_ns Cluster timestamps saturate at i64::MAX, so pts + duration could overflow for files without Info/Duration. * media: checked add for the Matroska cue cluster position CueClusterPosition comes from the file; an add past u64::MAX panicked in debug builds and wrapped in release. Such a cue now falls back to the index. * media: cap the Matroska TimestampScale at 2^32 and saturate tick conversions A scale near 2^64 overflowed u128/i128 in the per-lace split and in Track::ticks_to_ns. A BlockDuration near u64::MAX also overflowed the tick difference at the default scale. Larger scales are ignored like a zero scale, and tick and nanosecond values outside i64 saturate. * media: Matroska fixture generation no longer truncates the shared subtitle inputs Parallel tests generating subs.mkv or webvtt.webm could read in.srt or in.vtt while another thread rewrote it, and cache a fixture with missing packets. * media: rustfmt parse_moof signature * ci: add craft-media workflow covering feature sets, WASM and ffmpeg oracles The lint job runs fmt, clippy for each feature set (none, bitstream, isobmff, matroska, all) and a wasm32 check. The test job runs the all-features tests with Ubuntu's ffmpeg and CRAFT_MEDIA_REQUIRE_ORACLES=1, installing ffmpeg while the tests compile. * media: Matroska lacing keeps timestamp gaps A laced frame's timestamp is implied by the block's and the track's DefaultDuration, so lacing collapsed gaps in the input. A frame now joins a lace only when that implied tick equals its own, and tracks without a DefaultDuration do not lace. The laced remux oracle compares timestamps. * media: required oracles fail on fixture generator and ffprobe failures Every path that gave up on an oracle check (missing tool, failed fixture generator, failed ffprobe run) goes through one helper that prints SKIPPED, or fails the test with CRAFT_MEDIA_REQUIRE_ORACLES=1. Fixture generators of both containers share run_generator, which takes the required flag explicitly so tests can exercise it without changing the process environment. * media: use US spelling * media: a failed ffprobe probe skips the optional oracle check * media: the Matroska oracle compares the last subtitle cue's duration |