mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-07 16:52:48 +00:00
Aleksander HelgakerandClaude Opus 5.5
6865897f14
* craft-media: Ogg demuxer
FilmCraft's `filmcraft-ogg` as `craft_media::ogg`, behind the opt-in
`ogg` feature: pages (CRC-32 checked, damage skipped by searching for
the next `OggS`), logical streams, packets across pages, and the Ogg
Opus, Vorbis and FLAC mappings. `OpusTiming` gives each Opus packet's
start, the pre-skip and the final page's end trimming.
`Stream::codec_params()` returns `CodecParams` like the other
containers; for FLAC each stream keeps its own header count, and an
unstated count is bounded (it ends at the first audio frame, or at
32 MiB with a warning). `ogg::ByteSource` is `craft_media::ByteSource`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg review fixes: bounded recovery, lost pages, chained links, caps
From the review of the Ogg demuxer (storytold/craft-libs#440):
- The damage scan charges the positions it examines, not a whole 1 MiB read,
reads 64 KiB at a time, and says when the 64 MiB budget runs out. A file
with many damaged pages lost its tail without a warning.
- A page whose lacing claims more bytes than the file has left is skipped
and the scan resumes, instead of ending the parse.
- A gap in a stream's page sequence numbers drops the packet the lost page
continued; its two ends were joined into one corrupted packet.
- A beginning-of-stream page for a serial already seen starts a new stream,
so a chained file whose links reuse a serial no longer hands the second
link's headers to the decoder as audio.
- The packets kept from a file are capped by its size (as Matroska caps
frames), so zero lacing values cannot make the packet lists many times the
file. FLAC metadata under an unstated header count must be a block of the
length its header states, and at most 1024 are kept.
- A packet over 4 GiB is dropped instead of overflowing its size.
- OpusTiming saturates, so hostile granule positions cannot overflow, and a
clip whose only audio page is also the last is trimmed at the end
(RFC 7845 §4.5) instead of at the start.
- Speex streams read extra_headers (offset 68) for their header count.
codec_params gives Theora its Xiph-laced headers and Speex its header,
rate and channels; the FLAC extradata flags exactly the last block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg damage recovery charges every page it reads and hashes
From CodeRabbit's review of 2308071: a page that fails its CRC was read and
hashed in full (up to about 64 KB) before the parser stepped one byte on,
and the damage scan read 64 KiB per call however near the next page was.
Neither was charged to the recovery budget, so a file packed with fake page
headers could cost gigabytes of reading and hashing.
- A failed page's bytes are charged to the recovery budget; opening stops
with a warning when it is spent.
- find_capture starts with a 256-byte read and doubles it up to 64 KiB.
- Warnings about damaged pages are capped at 1024, with a closing count of
the rest.
- Filing a completed packet as header or audio moves into Stream::add_packet,
keeping open under the cognitive-complexity limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg recovery budget in proportion to the file; stray BOS; header caps
- Damage recovery charges every byte it reads again (a high-water mark), against a budget of
twice the file's length plus 1 MiB, instead of a fixed 64 MiB that cut off large damaged
files. A page's body is read without reading its header again, so a page is not charged twice.
- A beginning-of-stream page that carries on the page sequence of a stream with no
end-of-stream page yet is a stray flag: a warning, and the stream is not split. A link that
starts again before its end-of-stream page warns.
- Header packet counts a file states (FLAC, Speex) are capped like the unstated FLAC count.
- Reserved FLAC metadata block types (7-126) are metadata blocks.
- Theora codec_params carries the picture size; the extradata table lists Theora and Speex.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* craft-media: Ogg header reads checked before they are made; scan span on 32-bit
- A header packet past the size cap is checked by its stated size and not read, and a stream's
first packet is read once (only its first 80 bytes when it is too large to be a header).
- MAX_HEADER_BYTES is 64 MiB, room for two of the largest FLAC metadata blocks with their block
headers and the rest of the headers.
- find_capture clamps the scan span in u64 before casting, so a span of 2^32 bytes cannot become
0 on 32-bit targets.
- The Recovery doc says which reads it charges, and what header packet reads add.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>