pq/libfreemkv
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Audit fixes + DVD support foundation (IFO, PS demux, MPEG-2, CSS crack)

Browse Source 
Audit fixes (14 critical, 22 warnings):
- UDF: bounds checks on all ICB/FID parsing from disc data
- SCSI Linux: saturating_sub on residual, CDB length guard, buffer size guard
- SCSI macOS: SCSITaskStatus u32 (was u8 — stack corruption)
- AACS: EC mod_inv returns infinity instead of panic, key reduced mod n
- AACS: do_handshake tries all host certs (was returning on first failure)
- H.264: bounds check on SPS < 4 bytes
- ContentReader: error on missing unit key (was zero-fill)
- KEYDB: flat redirect loop (was recursive), 100MB response limit, Windows HOME fallback
- ISO writer: AVDP extent order, partition length, allocation cap
- Network: removed TCP_NODELAY on bulk stream
- MKV: guard on u64::MAX seek
- disc.rs: saturating_sub on extent offset, simplified dead region code
- cargo fmt (610 violations), cargo clippy --fix (55 auto-fixes)

DVD support (new files):
- src/ifo.rs — IFO parser (VIDEO_TS.IFO, VTS_XX_0.IFO, PGC chains, cells, streams) — 13 tests
- src/mux/ps.rs — MPEG-2 Program Stream demuxer (pack headers, PES, private stream 1) — 12 tests
- src/mux/codec/mpeg2.rs — MPEG-2 video parser (sequence headers, I-frame detection) — 15 tests
- src/css/crack.rs — split-attack algorithm (LFSR cipher needs verification — test ignored)

226 tests total (was 186), 1 ignored (CSS crack needs cipher verification).
This commit is contained in:
MattJackson
2026-04-11 16:52:22 +00:00
parent 6e771a1867
commit ff5547363b
57 changed files with 6189 additions and 1519 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scsi/linux.rs
+32 -12
View File
@@ -1,7 +1,7 @@
//! Linux SCSI transport via SG_IO ioctl.
use super::{DataDirection, ScsiResult, ScsiTransport};
use crate::error::{Error, Result};
use super::{ScsiTransport, ScsiResult, DataDirection};
use std::path::Path;
const SG_IO: u32 = 0x2285;
@@ -49,10 +49,15 @@ impl SgIoTransport {
c_path.push(0);
let fd = unsafe {
libc::open(c_path.as_ptr() as *const libc::c_char, libc::O_RDWR | libc::O_NONBLOCK)
libc::open(
c_path.as_ptr() as *const libc::c_char,
libc::O_RDWR | libc::O_NONBLOCK,
)
};
if fd < 0 {
return Err(Error::DeviceNotFound { path: device.display().to_string() });
return Err(Error::DeviceNotFound {
path: device.display().to_string(),
});
}
Ok(SgIoTransport { fd })
}
@@ -60,7 +65,9 @@ impl SgIoTransport {
impl Drop for SgIoTransport {
fn drop(&mut self) {
unsafe { libc::close(self.fd); }
unsafe {
libc::close(self.fd);
}
}
}
@@ -80,10 +87,20 @@ impl ScsiTransport for SgIoTransport {
DataDirection::ToDevice => SG_DXFER_TO_DEV,
};
if data.len() > u32::MAX as usize {
return Err(Error::ScsiError {
opcode: cdb[0],
status: 0xFF,
sense_key: 0,
});
}
let cmd_len = cdb.len().min(16) as u8;
let mut hdr: sg_io_hdr = unsafe { std::mem::zeroed() };
hdr.interface_id = b'S' as i32;
hdr.dxfer_direction = dxfer_direction;
hdr.cmd_len = cdb.len() as u8;
hdr.cmd_len = cmd_len;
hdr.mx_sb_len = sense.len() as u8;
hdr.dxfer_len = data.len() as u32;
hdr.dxferp = data.as_mut_ptr();
@@ -91,18 +108,22 @@ impl ScsiTransport for SgIoTransport {
hdr.sbp = sense.as_mut_ptr();
hdr.timeout = timeout_ms;
let ret = unsafe {
libc::ioctl(self.fd, SG_IO as _, &mut hdr as *mut sg_io_hdr)
};
let ret = unsafe { libc::ioctl(self.fd, SG_IO as _, &mut hdr as *mut sg_io_hdr) };
if ret < 0 {
return Err(Error::IoError { source: std::io::Error::last_os_error() });
return Err(Error::IoError {
source: std::io::Error::last_os_error(),
});
}
let bytes_transferred = (data.len() as i32 - hdr.resid) as usize;
let bytes_transferred = (data.len() as i32).saturating_sub(hdr.resid).max(0) as usize;
if hdr.status != 0 {
let sense_key = if hdr.sb_len_wr > 2 { sense[2] & 0x0F } else { 0 };
let sense_key = if hdr.sb_len_wr > 2 {
sense[2] & 0x0F
} else {
0
};
return Err(Error::ScsiError {
opcode: cdb[0],
status: hdr.status,
@@ -116,5 +137,4 @@ impl ScsiTransport for SgIoTransport {
sense,
})
}
}
src/scsi/macos.rs
+27 -30
View File
@@ -6,8 +6,8 @@
//! Requires exclusive access to the device — unmount the disc first:
//! `diskutil unmountDisk /dev/disk2`
use crate::error::{Error, Result};
use super::{DataDirection, ScsiResult, ScsiTransport};
use crate::error::{Error, Result};
use std::path::Path;
// ── IOKit / CoreFoundation type aliases ─────────────────────────────────────
@@ -40,20 +40,17 @@ const K_SENSE_DATA_SIZE: usize = 32;
/// kIOMMCDeviceUserClientTypeID — plugin type for MMC (optical) devices.
const K_IO_MMC_DEVICE_USER_CLIENT_TYPE_ID: [u8; 16] = [
0x97, 0xAB, 0xCF, 0x5C, 0x45, 0x71, 0x11, 0xD6,
0xB6, 0xA0, 0x00, 0x30, 0x65, 0xA4, 0x7A, 0xEE,
0x97, 0xAB, 0xCF, 0x5C, 0x45, 0x71, 0x11, 0xD6, 0xB6, 0xA0, 0x00, 0x30, 0x65, 0xA4, 0x7A, 0xEE,
];
/// kIOCFPlugInInterfaceID — base IOCFPlugin interface.
const K_IO_CFPLUGIN_INTERFACE_ID: [u8; 16] = [
0xC2, 0x44, 0xE8, 0x58, 0x10, 0x9C, 0x11, 0xD4,
0x91, 0xD4, 0x00, 0x50, 0xE4, 0xC6, 0x42, 0x6F,
0xC2, 0x44, 0xE8, 0x58, 0x10, 0x9C, 0x11, 0xD4, 0x91, 0xD4, 0x00, 0x50, 0xE4, 0xC6, 0x42, 0x6F,
];
/// kIOSCSITaskDeviceInterfaceID — the interface we QueryInterface for.
const K_IO_SCSI_TASK_DEVICE_INTERFACE_ID: [u8; 16] = [
0x61, 0x3E, 0x48, 0xB0, 0x30, 0x01, 0x11, 0xD6,
0xA4, 0xC0, 0x00, 0x0A, 0x27, 0x05, 0x28, 0x61,
0x61, 0x3E, 0x48, 0xB0, 0x30, 0x01, 0x11, 0xD6, 0xA4, 0xC0, 0x00, 0x0A, 0x27, 0x05, 0x28, 0x61,
];
// ── Scatter/gather element ──────────────────────────────────────────────────
@@ -73,10 +70,7 @@ extern "C" {
options: u32,
bsd_name: *const u8,
) -> CFMutableDictionaryRef;
fn IOServiceGetMatchingService(
master: MachPort,
matching: CFMutableDictionaryRef,
) -> IOObject;
fn IOServiceGetMatchingService(master: MachPort, matching: CFMutableDictionaryRef) -> IOObject;
fn IOObjectRelease(object: IOObject) -> IOReturn;
fn IORegistryEntryGetParentEntry(
entry: IOObject,
@@ -216,7 +210,11 @@ impl MacScsiTransport {
let hr = unsafe {
type QiFn = unsafe extern "C" fn(ComRef, *const [u8; 16], *mut ComRef) -> i32;
let qi: QiFn = vtable_fn(plugin, 1);
qi(plugin, &K_IO_SCSI_TASK_DEVICE_INTERFACE_ID, &mut device_iface)
qi(
plugin,
&K_IO_SCSI_TASK_DEVICE_INTERFACE_ID,
&mut device_iface,
)
};
com_release(plugin);
@@ -307,17 +305,15 @@ impl ScsiTransport for MacScsiTransport {
length: data.len() as u64,
};
unsafe {
type Fn = unsafe extern "C" fn(
ComRef, *const SCSITaskSGElement, u8, u64, u8,
) -> IOReturn;
type Fn =
unsafe extern "C" fn(ComRef, *const SCSITaskSGElement, u8, u64, u8) -> IOReturn;
let f: Fn = vtable_fn(task, VTIDX_SET_SG);
f(task, &sg, 1, data.len() as u64, iokit_dir);
}
} else {
unsafe {
type Fn = unsafe extern "C" fn(
ComRef, *const SCSITaskSGElement, u8, u64, u8,
) -> IOReturn;
type Fn =
unsafe extern "C" fn(ComRef, *const SCSITaskSGElement, u8, u64, u8) -> IOReturn;
let f: Fn = vtable_fn(task, VTIDX_SET_SG);
f(task, std::ptr::null(), 0, 0, K_SCSI_DATA_TRANSFER_NO_DATA);
}
@@ -332,15 +328,18 @@ impl ScsiTransport for MacScsiTransport {
// Execute synchronously
let mut sense = [0u8; K_SENSE_DATA_SIZE];
let mut task_status: u8 = 0;
let mut task_status: u32 = 0;
let mut realized_count: u64 = 0;
let kr = unsafe {
type Fn = unsafe extern "C" fn(
ComRef, *mut u8, *mut u8, *mut u64,
) -> IOReturn;
type Fn = unsafe extern "C" fn(ComRef, *mut u8, *mut u32, *mut u64) -> IOReturn;
let f: Fn = vtable_fn(task, VTIDX_EXECUTE_SYNC);
f(task, sense.as_mut_ptr(), &mut task_status, &mut realized_count)
f(
task,
sense.as_mut_ptr(),
&mut task_status,
&mut realized_count,
)
};
com_release(task);
@@ -353,22 +352,21 @@ impl ScsiTransport for MacScsiTransport {
});
}
if task_status != K_SCSI_TASK_STATUS_GOOD {
if task_status != K_SCSI_TASK_STATUS_GOOD as u32 {
let sense_key = if sense[2] != 0 { sense[2] & 0x0F } else { 0 };
return Err(Error::ScsiError {
opcode: cdb[0],
status: task_status,
status: task_status as u8,
sense_key,
});
}
Ok(ScsiResult {
status: task_status,
status: task_status as u8,
bytes_transferred: realized_count as usize,
sense,
})
}
}
// ── IOKit service discovery ─────────────────────────────────────────────────
@@ -436,9 +434,8 @@ fn walk_to_authoring_device(start: IOObject) -> Option<IOObject> {
// Walk up to 10 levels (more than enough)
for _ in 0..10 {
let mut parent: IOObject = 0;
let kr = unsafe {
IORegistryEntryGetParentEntry(current, b"IOService\0".as_ptr(), &mut parent)
};
let kr =
unsafe { IORegistryEntryGetParentEntry(current, b"IOService\0".as_ptr(), &mut parent) };
if current != start {
unsafe { IOObjectRelease(current) };
src/scsi/mod.rs
+65 -26
View File
@@ -18,16 +18,16 @@ use std::path::Path;
// ── SCSI opcodes (SPC-4, MMC-6) ────────────────────────────────────────────
pub const SCSI_INQUIRY: u8 = 0x12;
pub const SCSI_READ_CAPACITY: u8 = 0x25;
pub const SCSI_READ_10: u8 = 0x28;
pub const SCSI_READ_BUFFER: u8 = 0x3C;
pub const SCSI_READ_TOC: u8 = 0x43;
pub const SCSI_GET_CONFIGURATION: u8 = 0x46;
pub const SCSI_SET_CD_SPEED: u8 = 0xBB;
pub const SCSI_SEND_KEY: u8 = 0xA3;
pub const SCSI_REPORT_KEY: u8 = 0xA4;
pub const SCSI_READ_12: u8 = 0xA8;
pub const SCSI_INQUIRY: u8 = 0x12;
pub const SCSI_READ_CAPACITY: u8 = 0x25;
pub const SCSI_READ_10: u8 = 0x28;
pub const SCSI_READ_BUFFER: u8 = 0x3C;
pub const SCSI_READ_TOC: u8 = 0x43;
pub const SCSI_GET_CONFIGURATION: u8 = 0x46;
pub const SCSI_SET_CD_SPEED: u8 = 0xBB;
pub const SCSI_SEND_KEY: u8 = 0xA3;
pub const SCSI_REPORT_KEY: u8 = 0xA4;
pub const SCSI_READ_12: u8 = 0xA8;
pub const SCSI_READ_DISC_STRUCTURE: u8 = 0xAD;
/// AACS key class for REPORT KEY / SEND KEY commands.
@@ -58,7 +58,6 @@ pub trait ScsiTransport {
data: &mut [u8],
timeout_ms: u32,
) -> Result<ScsiResult>;
}
// ── Platform-agnostic open ──────────────────────────────────────────────────
@@ -67,16 +66,26 @@ pub trait ScsiTransport {
/// Selects the right backend for the current platform.
pub fn open(device: &Path) -> Result<Box<dyn ScsiTransport>> {
#[cfg(target_os = "linux")]
{ Ok(Box::new(linux::SgIoTransport::open(device)?)) }
{
Ok(Box::new(linux::SgIoTransport::open(device)?))
}
#[cfg(target_os = "macos")]
{ Ok(Box::new(macos::MacScsiTransport::open(device)?)) }
{
Ok(Box::new(macos::MacScsiTransport::open(device)?))
}
#[cfg(target_os = "windows")]
{ Ok(Box::new(windows::SptiTransport::open(device)?)) }
{
Ok(Box::new(windows::SptiTransport::open(device)?))
}
#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
{ Err(Error::DeviceNotFound { path: format!("{}: unsupported platform", device.display()) }) }
{
Err(Error::DeviceNotFound {
path: format!("{}: unsupported platform", device.display()),
})
}
}
// ── CDB builders (platform-agnostic) ────────────────────────────────────────
@@ -106,7 +115,18 @@ pub fn inquiry(scsi: &mut dyn ScsiTransport) -> Result<InquiryResult> {
/// Send GET CONFIGURATION for feature 0x010C (Firmware Information).
pub fn get_config_010c(scsi: &mut dyn ScsiTransport) -> Result<Vec<u8>> {
let cdb = [SCSI_GET_CONFIGURATION, 0x02, 0x01, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00];
let cdb = [
SCSI_GET_CONFIGURATION,
0x02,
0x01,
0x0C,
0x00,
0x00,
0x00,
0x00,
0x10,
0x00,
];
let mut buf = [0u8; 16];
scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000)?;
Ok(buf.to_vec())
@@ -115,9 +135,15 @@ pub fn get_config_010c(scsi: &mut dyn ScsiTransport) -> Result<Vec<u8>> {
/// Build a READ BUFFER CDB.
pub fn build_read_buffer(mode: u8, buffer_id: u8, offset: u32, length: u32) -> [u8; 10] {
[
SCSI_READ_BUFFER, mode, buffer_id,
(offset >> 16) as u8, (offset >> 8) as u8, offset as u8,
(length >> 16) as u8, (length >> 8) as u8, length as u8,
SCSI_READ_BUFFER,
mode,
buffer_id,
(offset >> 16) as u8,
(offset >> 8) as u8,
offset as u8,
(length >> 16) as u8,
(length >> 8) as u8,
length as u8,
0x00,
]
}
@@ -125,20 +151,33 @@ pub fn build_read_buffer(mode: u8, buffer_id: u8, offset: u32, length: u32) -> [
/// Build a SET CD SPEED CDB.
pub fn build_set_cd_speed(read_speed: u16) -> [u8; 12] {
[
SCSI_SET_CD_SPEED, 0x00,
(read_speed >> 8) as u8, read_speed as u8,
0xFF, 0xFF,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
SCSI_SET_CD_SPEED,
0x00,
(read_speed >> 8) as u8,
read_speed as u8,
0xFF,
0xFF,
0x00,
0x00,
0x00,
0x00,
0x00,
0x00,
]
}
/// Build a READ(10) CDB with the raw read flag.
pub fn build_read10_raw(lba: u32, count: u16) -> [u8; 10] {
[
SCSI_READ_10, 0x08,
(lba >> 24) as u8, (lba >> 16) as u8, (lba >> 8) as u8, lba as u8,
SCSI_READ_10,
0x08,
(lba >> 24) as u8,
(lba >> 16) as u8,
(lba >> 8) as u8,
lba as u8,
0x00,
(count >> 8) as u8, count as u8,
(count >> 8) as u8,
count as u8,
0x00,
]
}
src/scsi/windows.rs
+17 -6
View File
@@ -5,8 +5,8 @@
//!
//! Requires administrator privileges for raw SCSI access.
use crate::error::{Error, Result};
use super::{DataDirection, ScsiResult, ScsiTransport};
use crate::error::{Error, Result};
use std::path::Path;
// ── Windows constants ──────────────────────────────────────────────────────
@@ -89,7 +89,9 @@ pub struct SptiTransport {
/// Normalize a device path to Windows \\.\X: format.
fn normalize_device_path(path: &str) -> String {
if path.starts_with("\\\\.\\") { return path.to_string(); }
if path.starts_with("\\\\.\\") {
return path.to_string();
}
let trimmed = path.trim_end_matches('\\');
if trimmed.len() == 2 && trimmed.as_bytes()[1] == b':' {
return format!("\\\\.\\{}", trimmed);
@@ -134,7 +136,9 @@ impl SptiTransport {
impl Drop for SptiTransport {
fn drop(&mut self) {
unsafe { CloseHandle(self.handle); }
unsafe {
CloseHandle(self.handle);
}
}
}
@@ -159,7 +163,11 @@ impl ScsiTransport for SptiTransport {
};
sptwb.spt.DataTransferLength = data.len() as u32;
sptwb.spt.TimeOutValue = (timeout_ms / 1000).max(1) as u32;
sptwb.spt.DataBuffer = if data.is_empty() { std::ptr::null_mut() } else { data.as_mut_ptr() };
sptwb.spt.DataBuffer = if data.is_empty() {
std::ptr::null_mut()
} else {
data.as_mut_ptr()
};
sptwb.spt.SenseInfoOffset = std::mem::offset_of!(SptwbDirect, sense) as u32;
sptwb.spt.Cdb[..cdb_len].copy_from_slice(&cdb[..cdb_len]);
@@ -188,7 +196,11 @@ impl ScsiTransport for SptiTransport {
}
if sptwb.spt.ScsiStatus != 0 {
let sense_key = if sptwb.sense[2] != 0 { sptwb.sense[2] & 0x0F } else { 0 };
let sense_key = if sptwb.sense[2] != 0 {
sptwb.sense[2] & 0x0F
} else {
0
};
return Err(Error::ScsiError {
opcode: cdb[0],
status: sptwb.spt.ScsiStatus,
@@ -206,4 +218,3 @@ impl ScsiTransport for SptiTransport {
})
}
}