c3e82f28b56c3d6a98cc1cac97f1de9a813d8644
25
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Matthew Jackson
|
47789f71bc |
Test the demux seam gates too
The same gap as the MKV muxer: DemuxSink builds its timeline with TimelineContinuity::with_clips, but no test ever handed it a title carrying usable PlayItem marks, so frames_mapped and dropped_total() were always zero and both gates in finish() were unreachable. Deleting either left the whole suite green while a demux:// export of a seamless-branching title wrote a directory of zero-byte track files beside a populated chapters document and reported success at exit 0. The test gives the title two clips with marks that exclude every frame, and was confirmed to FAIL with the gate removed. |
||
|
Matthew Jackson
|
6d9791affc |
Audit round 1: playback order, silent title drops, image durability
Four fixes from the first audit round. Every finding was verified against a pinned tree and read directly before being accepted. resolve_vts_key sorted a VTS title-VOB extents largest-first. That is the 1.5.1 garbage bug, and it grew back in a new code path: the comment claimed it "matched the scan heuristic", but that heuristic WAS the bug and had already been fixed in decrypt_keys_for_title, which documents the rule (PLAYBACK ORDER, never largest-cell-first) and pins it with a regression test. A CSS DVDs biggest cell opens with a long clear run and crack_key shares one sector budget across the extent list, so starting there can exhaust it without ever MEETING scrambled data — and CSS recovers the key from scrambled data itself. The crack then returns None, the caller falls back to the disc-wide key, and every VOB in that VTS is descrambled wrongly: corrupt PES behind an intact header, written out as a complete extract at exit 0. parse_pgcit dropped titles silently in THREE places — an unparseable PGC, an out-of-range PGC index, and a truncated entry table. The finder caught one; the other two turned up on reading the function. parse_vmg already counts and warns per skipped title SET for exactly this reason, and this was the last place a disc could quietly report fewer titles than it has. write_image called flush() and returned Ok. flush() only pushes bytes into the page cache and promises nothing about durability, so a 6-90 GB image could be reported complete while still unwritten — a crash or an unmounted volume then leaves a truncated file the caller was told was finished. Now into_inner (so a buffered-write error surfaces instead of being dropped by BufWriter::drop) followed by sync_all. timeline used abs() on a saturating_sub result. Every other comparison in that module is saturating because the timestamps come off a disc and are not trusted; abs() panics on i64::MIN, which saturating_sub can produce. |
||
|
Matthew Jackson
|
35c5eedc20 |
Round 5: fix the gates added in round 4, and two placement holes
The zero-frame check ran before the seam gate, and its error is classified as a skippable nav stub — so a title the plan dropped ENTIRELY was reported as an empty stub and an all-titles rip would omit a real feature and finish the rest at exit 0. The seam case is decided first now, with a code that is not skippable. The demux sink read a frame's track kind out of the FILTERED slot, which is empty for a class the export drops. On an audio:// or sub:// export the video track was therefore called non-video and handed the permissive crossing rule — the same defect round 4 fixed for a Dolby Vision layer, reintroduced one file over. Video tracks are now recorded before the kind filter, beside the primary-video reference that exists for this reason. Its frame counter counted frames PLACED, not written, while its name and doc claimed otherwise. Renamed and documented for what it is, including that it cannot see a single lost track among many. Placement: files in a subdirectory of VIDEO_TS were never given data. They were declared at full size with no extents, so they appeared in the tree and read as nothing. The same folder under BDMV was always placed correctly. And the duplicate title-set guard keyed on the constraint maps, so an IFO declaring no offsets inserted nothing and a colliding second IFO went undetected — it keys on the groups seen now. Display for SeamPlanDroppedMost and ShortImageRead discarded their payloads, and four new variants were missing from the code-uniqueness test. |
||
|
Matthew Jackson
|
0f61be00b7 |
Make the drop count gate the verdict, not just the log
Round 3 counted frames the clip marks excluded and reported them at finish. Counting is not bounding: the only other gate was a global zero-frame check, and its error is additionally classified as a skippable nav stub, so a title whose marks do not line up with its PES clock could discard almost all of itself and still exit 0 — a two-hour feature emitting seconds, which is the defect this change set already shipped once. Dropping more than was kept is never a real join, so it now fails. The demux sink had no zero-output guard at all, so a fully-dropped title finished cleanly: a directory of zero-byte track files beside a populated chapters document. It now refuses, keyed on frames having been OFFERED — a chapters-only export, or a track class the title does not carry, legitimately writes none, and two existing tests correctly said so. A title set's placement group is the parsed number, so VTS_01_0.IFO and VTS_1_0.IFO land on one key and the second silently overwrote the first's constraint, placing a VOB where the IFO the reader uses does not point. Refused rather than resolved by arrival order. |
||
|
Matthew Jackson
|
f4fb5c65e0 |
Key the seam-crossing rule on reorder, not on driving epochs
A Dolby Vision enhancement layer is a second video track: it does not drive epochs, but it does carry B-frame reorder. The crossing rule was keyed on driving epochs, so the EL took the branch whose premise is that the track has no reorder — and its ordinary reorder dip near the end of a clip, which during an overlap also lands inside the next clip's range, was read as a join. The EL was then placed on the next clip's offset, out of step with the base-layer frame it must be co-timed with by the width of the overlap: the same desync the per-track cursor was added to remove, reintroduced for one track. The property the rule actually depends on is whether a backward step can be reorder, so it is now keyed on that. Both sinks derive it from the track kind rather than from the epoch driver. |
||
|
Matthew Jackson
|
c8fafec393 |
Keep the seam plan to Blu-ray, and stop a missed crossing truncating a title
Two findings from the same escalation, both silent-wrong-output. The plan was built for every multi-clip title. Only a Blu-ray PlayItem's IN/OUT are positions in the clock the PES PTS runs on. HD-DVD fills the same fields from the XPL's title-relative times and a DVD's come from cell tables, so a plan built from them is an identity map with a drop filter: it suppresses the layer-break rebase inference performs, and drops whatever falls outside marks the PTS was never measured against. An earlier reading of this called HD-DVD safe because its marks are contiguous and every computed offset was zero — true, and irrelevant, because they were zero in the wrong clock. Gated on the content format, with a test using an HD-DVD-shaped table that the clock check alone accepts. The crossing test was also one-shot. A table whose clips restart their own bases could miss it, and a missed crossing STRANDS the track: every later frame falls outside the stranded clip's marks and is dropped for the rest of the title. Counting drops, which is all the previous round added, does not bound them. A table that is not one advancing clock is now refused outright and falls back to inference, which is the documented safe path for those titles. Also from the same round: read_sectors added an unchecked lba + i, where callers deliberately saturate their LBAs — a wrap folds the read back to a low sector and hands the muxer another file's bytes. classify added 1 to two numbers parsed verbatim out of a filename. read_head used a single read() where a short read on a network mount silently records no placement constraint at all. And the page-cache eviction added last round released only the read that crossed its threshold rather than everything accumulated, so seven eighths of what was read stayed pinned. |
||
|
Matthew Jackson
|
60d9cc1bac |
Audit round 2 fixes: an unsafe default, four omissions, and two swallowed errors
The folder encryption probe returned "not encrypted" when it had sampled nothing at all — a title shorter than one aligned unit skipped the loop entirely. That verdict CLEARS the structural one an AACS directory raised, so a genuinely encrypted folder would have been ripped as clear and written ciphertext as video at exit 0. With no evidence it now keeps the structural verdict, and its bounds arithmetic no longer trusts disc-derived values not to wrap. Reading an IFO header swallowed every I/O error and returned an empty buffer, which sent each placement offset through unwrap_or(0) and recorded no constraint at all — a permission error on one file produced a silently misplaced VOB. The directory walk swallowed the same class while claiming to skip only vanished files. Both now propagate; only NotFound is skipped. Four things the round-1 changes left inconsistent: two new error codes had no doc comments, were absent from the io::Error mapping, printed no path in Display, and were missing from the test that proves codes are distinct. The demux sink dropped frames silently while the MKV muxer reported them. And set_clips had been inserted INTO write_frame's doc comment, leaving write_frame undocumented and its paragraphs describing the wrong function. uid/gid used 0 as "not specified"; UDF's sentinel is 0xFFFFFFFF, and 0 is root. |
||
|
Matthew Jackson
|
3090314717 |
Cross a clip join per track, not on the video's frame
The first cut placed every track with the cursor the video had moved. At an overlap join the previous clip's audio is still arriving after video has crossed, and those tail frames sit inside both clips' mark ranges — so they took the new clip's offset, jumped forward by the overlap, and collided with the new clip's own audio, which the muxer's monotonic nudge then flattened. A remux confirmed it: the timeline length was already correct and the original symptom was still there, 169 audio packets on the tick floor. A track's PTS only runs forward inside a clip, so its own backward step to the next clip's IN is its crossing. That is per track, so the cursor is too. |
||
|
Matthew Jackson
|
dfd2f023d0 |
Place Blu-ray clips by the playlist's marks, not by guessing at PTS jumps
A seamless-branching title's PlayItems do not chain contiguously: one clip's OUT can sit after the next clip's IN, where the disc stores the join twice, or before it, where the playlist skips material. The mux never saw those marks — its own header said so — and inferred seams from PTS jumps instead. Inference cannot recover this. A forward jump is ambiguous: it means the playlist skipped, or it means frames were lost to damaged media, and compressing the latter would falsify timing on exactly the rips that most need it faithful. An overlap smaller than the B-frame reorder threshold is invisible to inference entirely, and its duplicate content then collided in the muxer, where the monotonic nudge flattened a run of audio onto the tick floor and put sound ahead of picture for the rest of the film. Measured on one 11-PlayItem title: the file declared 7893.385 s, which is what the playlist says the title is, and carried packets to 8029.298 s. Both numbers came from the same program on the same disc. Four skips totalling 135.9 s became dead timeline, and a 1.79 s overlap put audio 1.8 s ahead at the half-hour mark. Five of forty-seven titles were affected; every single-clip title was exact. So the marks are read. Each clip contributes exactly out - in, laid end to end, so the output runs as long as the playlist says and a join never rewinds. Titles without usable marks — DVD, HD-DVD, file sources — keep the inference path unchanged, and clips that already chain contiguously produce a constant offset, which is pinned by a test. |
||
|
Matthew Jackson
|
9de88969ca |
test: constrain the DiscStream loss surface and the empty-title guards
Second mutation pass over src/mux/. 26 survivors killed, no production change. Verified on HEAD before landing: each mutation below passes all 1,237 mux tests unmutated-suite. The priority item was the honest-loss-reporting surface. Both DiscStream::errors and DiscStream::lost_bytes could return a constant with nothing failing — a rip that lost sectors would report zero loss to the caller. This project has already shipped one defect of that shape (a total decryption failure reported as an empty title, exit 0). Driven now through two short-read fills so both land on values that are neither 0 nor 1 and differ from each other; no constant and no field swap survives. MkvStream::finish -> Ok(()) also survived. MkvMuxer::finish has the zero-frame MkvInvalid guard and two tests cover it, but the Stream wrapper above it could return Ok unconditionally and bypass the guard entirely — the empty-title defence was one layer thinner than it looked. au_assembly: pinned au_opener_from behaviourally to the normative byte values for all four modes, with negative cases for codes that are explicitly not openers (MPEG-2 slice 0x01..0xAF, user data 0xB2, extension 0xB5, sequence end 0xB7 per 13818-2 Table 6-1; VC-1 0x0A/0x0B/0x0C; H.264 SPS/PPS/IDR-slice). au_assembly and codec/ hold independent copies of these constants; they agree today, and comparing constants would not catch logic drifting apart, so both sides are now pinned to the spec instead of to each other. demux_sink::sanitize: every filename component demux:// writes comes from disc-controlled text, so the path-separator arm is a traversal guard. Deleting it now fails, including an end-to-end case where base = "../evil/Title" must produce exactly one file inside the chosen directory. stts_and_ctts_expand renamed to stts_expands_runs_to_per_sample_deltas_in_order and given runs with distinct deltas AND distinct lengths. Its old name claimed ctts coverage it never had, which is why the composition-time chain went unconstrained for eight rounds; the doc comment now points at the tests that do cover ctts. Correction to the previous pass: codec/truehd.rs flush -> vec![] IS equivalent. Applied it, full mux suite green. TrueHD buffers across PES but parse emits every complete unit immediately, so a residual buffer at EOF is a truncated access unit and is correctly discarded. The vec![Default::default()] variants are genuinely different and are killed. Deliberately not constrained: mkv::set_opening_capture (diagnostics behind a process-global tracing check, flaky under the parallel runner), and the three stdio.rs header paths (StdioStream holds concrete io::Stdin/Stdout and cannot be driven without a production refactor to injectable Read/Write). |
||
|
Matthew Jackson
|
170fd0c064 |
test: constrain MP4 composition timing, MLP substream directory, and codec-private absence
Mutation testing over src/mux/. No production change — 49 survivors killed, all proven red before green. The MP4 composition-time chain was entirely unconstrained: VideoTiming::ctts, build_ctts and parse_ctts could each return a constant and the suite stayed green. Confirmed on HEAD: build_ctts -> vec![] passes all 1,220 mux tests. A demuxed B-frame title presenting in decode order would have shipped. The cause is a test whose name asserts coverage its body does not deliver — stts_and_ctts_expand builds an stts box and never touches ctts, and write_then_read_round_trip asserts sample sizes and keyframe flags but not one PTS. Same shape as the set_speed forwarding finding, different disguise. mlp_num_substreams / mlp_substr_header_size: every TrueHD fixture in the crate uses one substream and no extraword, so both could return a constant and agree with all of them. These position mlp_parity_ok's window over the AU header, so a constant mis-windows the parity check on exactly the multi-substream AUs that carry 7.1 and Atmos. CodecPrivate absent vs empty: mkv.rs writes Some(bytes) verbatim and omits the element on None (RFC 9559 5.1.4.1.24), so a zero-length Some emits a track header asserting the config IS empty. Four parsers could return Some(vec![]) before any frame. Also: mandatory ISO/IEC 14496-12 boxes (tkhd, vmhd, smhd, dinf, mdhd) could each build empty; HEVC num_extra_slice_header_bits (H.265 7.3.2.3) was never non-zero in any fixture, so the slice-type offset skip was unexercised; chapter names from the disc go straight into <ChapterString> and the & escape must run first; a stray 0x47 in a payload must not latch a TS resync. Documented as equivalent rather than killed: CodecParser::flush and the three parser flush bodies that differ from the mutant only by a tracing call, and DropTally::log_summary. |
||
|
Matthew Jackson
|
b8fa5e74dc |
Stop the live rip path muxing Blu-ray 3D differently from the ISO path
Five defects, four of them the same shape: a local reimplementation of logic the crate already had, which had drifted from it. Each is now fixed by calling the canonical version rather than by patching the copy. DiscStream::new — the live disc:// path — built every parser through the plain codec lookup and never asked whether a video stream was an MVC dependent view, though resolve::build_demux_state does. The same 3D disc therefore muxed correctly from an ISO and incorrectly ripped live. The open-coded loop is gone; both paths now call build_demux_state. collect_psi_section reimplemented the continuity-counter gap test and disagreed with process_packet in the same file: it tolerated neither a duplicate packet nor an adaptation-field-only packet, which per ISO/IEC 13818-1 §2.4.3.3 does not increment the counter. A spec-legal PMT continuation was read as desync and the title's stream list came back empty. Both callers now share one `cc_is_gap`, and a duplicate packet's payload is no longer appended twice — doing so would have corrupted the section the check exists to protect. The json:// sink called the channel-count and sample-rate accessors unconditionally, and both fabricate a concrete value for Unknown, so it reported a confident 5.1 at 48 kHz for audio whose format was unknown while its own neighbouring string fields said "unknown". The keys are now omitted, matching mkv.rs. This matters more than it did: a sample-rate ladder fixed earlier in this audit means Unknown now reaches consumers that used to receive a wrong-but-concrete value. For an audio:// or sub:// sink the reference video track's output is filtered out, so its first PTS was never recorded and every delay was computed against zero — baking a wrong DELAY into the filename. The reference is now recorded whenever a frame is on the reference track, independent of whether that track has an output, so a normal title gets a correct delay; where no reference is ever observed the tag is omitted rather than guessed. A third copy of the channel/sample-rate mapping exists in src/diag.rs and was left alone as outside the confirmed set. It is the same drift shape and is recorded for the next round. |
||
|
Matthew Jackson
|
0bbceed985 |
Round 4: fix 26 defects across crypto, resource use and codec paths
Twenty-six confirmed findings from the fourth audit round, landed as one cluster because they were found by agents working over disjoint file sets. The one worth calling out is a pair of AACS tests that could not fail. Both asserted CBC behaviour against a hand-rolled expectation that happened to be IV-independent, so replacing AACS_IV with sixteen zero bytes left them passing — they were pinning the code's own arithmetic, not the published constant. Replaced with a literal witness of the published IV plus the NIST SP 800-38A F.2.2 CBC-AES128 vector, and verified the other way round: zeroing AACS_IV now fails three tests. The rest are allocation and correctness work on hot paths: the Annex-B writer in demux_sink allocated and freed a whole-frame Vec per frame, which for a UHD title is ~200,000 allocations over the mmap threshold plus the page faults to first-touch each one; it now reuses a buffer on the writer, and still takes the NAL prefix width from the configuration record rather than assuming four. Six findings whose real fix lives in a consumer crate are recorded for re-filing rather than patched here. |
||
|
Matthew Jackson
|
4fcd28b487 |
Parse MKV lacing, route by real TrackNumber, honour NAL length size and edit lists
Four conformance defects in the read paths, two of them silent corruption. **Lacing was ignored entirely.** RFC 9559 §10.2 defines Xiph, EBML and fixed-size lacing, where one Block carries several frames; the reader took the Block payload verbatim, so a laced Block became a single "frame" consisting of a lacing header followed by concatenated frames — garbage to the codec parser, no error. Audio tracks from other muxers commonly use lacing, so an ordinary foreign MKV was silently mangled. All three modes are now parsed: Xiph 255-run sizes including the trailing-zero rule for exact multiples of 255, EBML unsigned first size plus SIGNED VINT deltas with the 2^((7*n)-1)-1 bias of §10.3.3, and fixed-size even division, with the last frame's size deduced from the remainder. Laced timestamps follow §10.3.5: the first frame takes the Block timestamp and the rest are spaced by the track's DefaultDuration, else BlockDuration/count, else shared with a warn. Parsing was chosen over refusing because refusal would leave freemkv unable to remux common foreign audio at all, and each mode is about fifteen lines. A malformed lacing header now raises a NEW code, E_MKV_LACING_INVALID = 9052, deliberately NOT MkvInvalid — because is_skippable_title_stub classifies MkvInvalid as a skippable nav stub, so reusing it would have recreated the exact conflation that is still open as a separate finding. A test asserts the new code is not skippable. **TrackNumber was assumed to be 1..N in TrackEntry order.** RFC 9559 §5.1.4.1.1 only requires it to be non-zero and unique, so sparse or unordered numbers are legal. Block routing and codec_private both computed track + 1. A real TrackNumber map is now built, recorded only for TrackEntries that yield a stream so dropped track types no longer shift the mapping. Verified red here independently, and the failure mode is worse than mis-routing: with track + 1 restored, a buttons track's payload was attributed to the AUDIO stream — wrong payload into the wrong codec parser. **The NAL length prefix was hardcoded to 4 bytes.** lengthSizeMinusOne lives in avcC byte 4 and hvcC byte 21 (ISO/IEC 14496-15 §5.3.3.1.2, §8.3.3.1.2) and was never read, so a source declaring 1- or 2-byte prefixes had its raw prefixed bytes emitted verbatim with no start codes. All four conversion sites now derive the width from the track's own configuration record. **Edit lists were ignored.** No edts/elst was parsed, so the presentation timeline an edit list defines (ISO/IEC 14496-12 §8.6.5/§8.6.6) was dropped — which is how encoder delay is normally expressed. Leading empty edits and the first media edit's media_time are now applied to both dts and pts, with the movie vs media timescale distinction respected. A list needing more than a constant shift applies the leading edit and warns rather than presenting the result as faithful. 17 tests. I reproduced the lacing mutant independently: returning the body whole kills five of them, including the exact-payload and malformed-header cases. Still open and deliberately untouched: the MkvInvalid / is_skippable_title_stub conflation across ~20 reader raise sites. It is a cross-cutting error.rs change and E_MKV_LACING_INVALID is the template for it. |
||
|
Matthew Jackson
|
1eb6910bdb |
Harden mux + decrypt paths; fail-loud on unresolvable keys
mp4 demuxer (untrusted input): bound every allocation sized from a box field (stsz/stco/stsc counts, stts/ctts run-lengths, per-sample and moov sizes, plus an absolute cap so a sparse file can't inflate file_len); guard the parse_stsd slice and a zero mdhd timescale; cap track count so the per-track PID can't overflow; rewrite read_moov to handle size==0 / size<8 / 64-bit largesize; parse esds/AudioSpecificConfig for AAC; write tkhd duration in the movie timescale. decrypt: resolve_mux_key_map now fails loud on an extent no key can classify instead of inheriting the previous extent's key, so a keymap never silently carries a wrong key; the sweep/patch key-fetch recovery fails loud when a unit is still unresolved after the retry. AACS: reject inverted forensic segments in both range builders; compare the forensic index in u16 space so an out-of-range value can't truncate onto a valid u8 index. RECOVERED_ERROR no longer latches the damage zone, preserving the 30s wedge cooldown for a following hard error. audio: AAC/MP2/MP3/FLAC carry the last PTS across a PES with no timestamp; the DTS-HD extension-sync search is bounded to after the core; the MP4 16.16 sample-rate field saturates. demux_sink records the video reference before the kind filter so audio:// / sub:// keep multi-clip PTS continuity and the DELAY tag. Remove a dead error variant and the AACS-unsupported-video code; codec comments cite the primary format specs; assorted doc/naming fixes and regression tests throughout. |
||
|
Matthew Jackson
|
63f6909ff0 |
mux: chapters:// and json:// metadata sinks
Two write-only file sinks that ignore the PES stream and emit the title metadata at construction (fvi-style, wired through output()): - chapters:// — chapter markers in the format the extension picks: .xml (Matroska, default), .txt/.ogm (OGM simple), .vtt (WebVTT). Reuses the existing chapters_xml/chapters_ogm writers; adds a WebVTT writer. - json:// — one title's model (playlist, duration, size, format, streams, chapters) as pretty JSON via serde_json. New mux/meta_sink.rs; StreamUrl gains Chapters/Json; codec_label + chapters_xml/ogm promoted to pub(crate) for reuse. Tests: chapters_format_selected_by_extension, title_json_carries_streams_and_chapters. |
||
|
Matthew Jackson
|
9f33306a0a |
mux: audio:// and sub:// sinks (demux filtered by track class)
Two extraction sinks built on the existing demux machinery: audio:// keeps only audio tracks (native containers .thd/.dts/.ac3/.eac3/.pcm...), sub:// only subtitle tracks (PGS .sup, VobSub .idx+.sub, text .srt) — one file per track, no video, no chapters sidecar. DemuxOptions gains a kind_filter; the DemuxSink writers (already complete) are reused verbatim. StreamUrl gains Audio/Sub variants; output() builds the filtered DemuxSink. Test: kind_filter_keeps_only_the_selected_class. |
||
|
Matthew Jackson
|
9dbfb70f7e |
narrow leaked-internal pub surface to pub(crate)
Verified zero callers across all consumer crates AND libfreemkv integration tests:
MUX_APP, Disc::{aacs_disc_hash,encrypted_content_ranges,inject_unit_keys},
locate_ranges, mapfile::{MapEntry,entries}, diag::dump_mkv_track,
DiscStream::{errors,lost_bytes} (read via accessors). Removed the unused mux
DemuxSink/FviSink crate-root re-exports (constructed internally by output() via
the direct module path). Staged demux option variants marked allow(dead_code).
|
||
|
Matthew Jackson
|
830d1e360c |
Mux decrypt/verify redesign, HD DVD first-class, MVC 3D
decrypt: - decrypt_sectors is now a pure decrypt (apply key, leave plaintext, report unverified bytes); TS-structure is a separate primitive (is_clean_ts/ps) used only for key selection and read-verify. The mux passes decrypted bytes through (the demuxer drops non-conforming packets), ending the NULL-TS conceal loop and the per-unit key-server refetch storm. Key-proof floor replaces the 75% supermajority. recovery: - Removed the post-read decrypt-verify gate (verify.rs) that mis-aligned the disc-absolute unit grid against clip-anchored AACS units and false-failed good clips (e.g. Dunkirk's orphan-CPS clip). Bad sectors are marked by physical read result; decryptability is proven at scan + mux time. HD DVD (first-class AACS): - Role-based candidate-list file sourcing so an HD DVD's /ANY!/ files (MKBROM.AACS, VTKF000.AACS, CONTENT_CERT.AACS) are found with no disc-type branch. parse_vtkf parses VTKF000.AACS into the same UnitKeyFile as a BD Unit_Key_RO.inf, so the shared VUK unwrap applies unchanged. set_unit_base clip-anchoring. Two decrypt-axis assumptions remain UNVERIFIED-HDDVD-DECRYPT (no encrypted disc to test). mux: - MVC (Blu-ray 3D) track signals unified into one MVCDecoderConfigurationRecord; release-safe track_vint (3-byte VINT) and pid_index (i32) guards. hardening: - Container-aware is_clean / encryption detection; bytes_bad_in_title fail-safe on a corrupt mapfile; CSS crack gated on DiscFormat::Dvd (HD DVD excluded); non-vacuous CSS tests; patch NOT_READY/HARDWARE/ILLEGAL_REQUEST/ABORTED sense-path tests. |
||
|
Matthew Jackson
|
835cc990ad |
DVD vob_start absolute rebase + rc.5.3 audit fixes
- ifo.rs: rebase VTS title VOBS to absolute disc LBA (file_start_lba + vtstt_vobs); fixes DVD rips opening on the menu region instead of the movie (e.g. SOTL). Adds absolute-placement regression test. - aacs/boil.rs: add mk_from_pk primitive (PK -> MK via MKB walk). - dvdnav/: nav-VM command decoder + start-cell resolver seam, parked behind USE_NAV_RESOLVER (kept compiled, never executed). - mux: FVI src.byte within-sector per spec; Unknown colour -> CICP unspecified (2,2,2,1); demux clear PCS -> NORMAL; ts.rs feed() base reset + boundary provenance fix. - Assorted audit fixes (doc/comment/test accuracy) across the crate. |
||
|
Matthew Jackson
|
05729f5dfe |
fix(libfreemkv): rc6 hardening pass — mux timeline/colour/PCR, demux panic sentinel, parser robustness + doc accuracy
Surgical fixes (each with a regression test that fails without the change): mux/mkv.rs, mux/demux_sink.rs: drive the clip-boundary timeline epoch off the resolved PRIMARY VIDEO track, not the literal stream index 0. An M2TS/PMT title can list an audio ES before video, so streams[0] may be audio; a non-video epoch driver ratchets the frontier and inflates the timeline. mkv cluster-opening falls back to track 0 for audio-only titles so they still open clusters. mux/codec/ac3.rs: correct ACMOD_CHANNELS — acmod=5 (3/1) is 4 channels, not 3 (was undercounting a 3/1 stream); fix the A/52 Table 5.8 doc. disc/mod.rs: HDMV coding_type 0x91 (Interactive Graphics / menus) no longer maps to PGS subtitle — it falls through to Unknown so the PMT/STN walker drops it instead of surfacing a bogus subtitle track. mux/videomap.rs + mux/mkv.rs: FVI colour now mirrors the MKV muxer's CICP precedence (measured CICP authoritative; HDR-driven PQ/HLG transfer override) via a shared cicp_for_video helper, so the two sinks can't disagree (HDR10 BT.2020 no longer emits SDR transfer 14). mux/mkvstream.rs: saturating_add on cluster_ts + rel_ts so an adversarial CLUSTER_TIMESTAMP near i64::MAX can't overflow/panic before the existing saturating_mul. mux/timeline.rs: tighten the tail-straggler clamp so a normal new-epoch non-video frame leading the sparse video frontier by >3s is not demoted into the previous clip's epoch. mux/m2ts_mux/mod.rs: re-stamp PCR per video TS packet (mid-PES), not only at PES boundaries, so a large UHD I-frame can't open a multi-second PCR gap; modular 33-bit PTS rebasing so a real 90 kHz clock wrap is not collapsed to PTS 0 (pre-base frames still floor to 0). io/byte_prefetcher.rs, sector/prefetched.rs: wrap the producer feed loop in catch_unwind and emit a typed error sentinel on panic, so a mid-stream producer panic is not read as a clean EOF at the demux boundary (which would silently truncate the mux). mux/codec/h264.rs: extend HIGH_PROFILES to the full ISO/IEC 14496-15 set that mandates the avcC chroma/bit-depth extension (adds 244 et al.). Doc/comment accuracy: css/mod.rs (50000 sectors, not scrambled-sectors), aacs/decrypt.rs (decrypt_unit already-clear path), ifo.rs (TT_SRPT at 0xC4), css/lfsr.rs (LFSR0 24-bit; TAB1-then-XOR cipher; real scramble-flag predicate), disc/read_error.rs (for_sweep does bounded transient retries). Skipped: keydb.rs SSRF guard (low/latent, no live caller) — a hard loopback block breaks an existing behavioral test that exercises the header-EOF path over a loopback server; a clean fix needs a resolver test seam beyond this surgical pass. The sibling keydb_fetch.rs comment fix is out of scope (freemkv crate). |
||
|
Matthew Jackson
|
e3dbafcebd |
mux: codec-agnostic PictureInfo + provenance; measure field order, never guess
Carry per-picture truth and byte-exact source provenance THROUGH the stream so the muxer (and the upcoming video index) read MEASURED facts instead of assuming them. Honest data in, honest data out. - codec/coding.rs: codec-agnostic PictureInfo (CodingType / FieldOrder + the accessors field_order/coding_type/nb_fields/progressive/keyframe). Each codec folds its raw signals in; consumers use only accessors, never branch on codec. - mpeg2: builds PictureInfo from the picture coding extension and carries it + SourcePos (source_marks, parallel to pts_marks) on every emitted frame. - pes / codec::Frame: additive `coding` + `source`, forwarded through the highway; None for audio/subtitle and the network/stdio deserialize hop. - mkvstream: DEFER muxer construction until the first coded picture, set the video track's FieldOrder from the MEASURED value, THEN write the header — right the first time, no guess, no seek-back. An interlaced track that arrives with no measured order is LOGGED loudly and left UNDETERMINED, never faked. - mkv: MkvTrack::video no longer guesses TFF (a bitstream property the scan cannot know is UNDETERMINED at build). Removed VideoStream::top_field_first (the dead scan-time guess) crate-wide. - Tests: parser population (every PictureInfo facet + per-PES source carry) and mux-stream consumption (measured -> correct; missing -> UNDETERMINED, not faked). Two obsolete tests updated only after confirming (their own comments) they existed to enforce the deleted hardcoded-TFF. |
||
|
Matthew Jackson
|
43fb97f71f |
mux/mkv: spec-conformance fixes (field order, CICP, VobSub idx, SeekHead, AC-3)
- FieldOrder now derives from the bitstream's measured top_field_first (Some(true)→TFF, Some(false)→BFF) instead of hardcoding TFF for all interlaced content; falls back to TFF when unmeasured. Adds VideoStream::top_field_first; DVD/BD scan sets None with a precise TODO(spec) for parser→title plumbing. - CICP (matrix/transfer/primaries/range) now prefers measured CICP from the bitstream (VideoStream::measured_cicp) over the coarse ColorSpace enum, so the container stops assuming a colour space the stream may contradict. Enum remains the fallback. - VobSub S_VOBSUB CodecPrivate now emits a `size: WxH` line ahead of the palette per the .idx format so players place/scale subs correctly. - SeekHead: when zero cues are written, the CUES Seek entry is Voided instead of leaving a dangling pointer to the Cues offset (now Tags/EOF). - AC-3 Channels back-patch offset is captured from the writer instead of the hardcoded chan_elem_pos+2 (decoupled from the VINT width choice). - Hoisted inline CICP codes and the dvcC fourcc to named constants citing ITU-T H.273 / RFC 9559; fixed the stale FieldOrder comment. - DefaultDuration vs pulldown: precise TODO(spec) left (needs the same parser→title channel as top_field_first). Tests: BFF-from-measured-flag, measured-CICP-overrides-enum, VobSub size: line present/omitted, zero-cue SeekHead Void. precommit (1.86) green. |
||
|
Matthew Jackson
|
9b6a48e9d9 |
demux: solidify sink — reuse canonical primitives, fix 3 bugs
Delete re-implementations in the demux:// sink and wire to proven helpers; keep only genuinely-new functionality. - AnnexB reframing: delete the sink's local length_prefixed_to_annexb (it break'd on a zero-length NAL, dropping the rest of the access unit) and call the canonical append_length_prefixed_as_annex_b in mux::hevc, which skips just the empty NAL. - HEVC param sets: delete hvcc_param_sets; reuse hvcc_to_annex_b. - avcC param sets: hoist as the new canonical avcc_to_annex_b in mux::hevc, next to hvcc_to_annex_b (the symmetry point); the sink calls it. - PGS .sup: emit a synthetic clear display set (empty PCS + END) at pts + duration_ns so subtitles time out instead of lingering to EOF. - TimelineContinuity: move verbatim into the shared mux::timeline module (with the prev_offset straggler-remap intact) and use it from both the MKV muxer and the demux sink; delete the sink's drifted TimelineRebase copy (which lacked the straggler branch). - VobSub .idx: emit the conventional 'id: <lang2>, index: 0' line mkvmerge reads to assign the subtitle language; palette reuse unchanged. - output(): seed DemuxOptions.base from title.playlist when non-empty. New constants for the PGS clear-segment framing and avcC header cite the public HDMV PGS (BD-ROM Part 3) and ISO/IEC 14496-15 specs. Tests: a zero-length NAL mid-frame no longer truncates the AU; a frame with duration_ns produces a .sup clear segment; existing demux tests stay green. |
||
|
Matthew Jackson
|
730af6b1d9 |
demux: add demux:// per-track elementary-stream sink
New write-only pes::Stream sink that taps the per-track PesFrame stream
(the seam right before MKV muxing) and writes each track to its own
elementary-stream file, plus chapters and per-audio-track delay metadata.
Purely additive — the MKV mux path is untouched.
- mux/demux_sink.rs: DemuxSink + EsWriter dispatch. Pass-through for
codecs whose Frame.data is already standalone ES (MPEG-2, VC-1, AC3/
E-AC3, DTS/DTS-HD, TrueHD, LPCM). Non-trivial writers:
- AnnexBWriter: reframes hvcC/avcC 4-byte-length-prefixed NALs to
Annex-B and prepends VPS/SPS/PPS parsed out of the codec_private
configuration record (HEVC .hevc / H.264 .h264).
- PgsSupWriter: rebuilds the HDMV 'PG' segment framing the parser
strips, with 90kHz PTS/DTS (.sup).
- VobSubWriter: writes raw SPUs to .sub and synthesizes the .idx
sidecar (palette + per-SPU timestamp/filepos).
- Delay-in-filename (mkvmerge-readable 'DELAY <n>ms') + chapter XML/OGM
export. TimelineRebase ports the MKV muxer's seamless-branch epoch
logic so per-track ES timestamps stay continuous across clip joins.
- mux/resolve.rs: StreamUrl::Demux variant + scheme/path_str/parse_url/
input(write-only)/output arms.
- mux/mod.rs: module + public type re-exports.
16 unit tests: Annex-B reframing, hvcC/avcC param extraction, delay
sign/rounding + mkvmerge-regex match, PGS .sup framing, VobSub .idx
synthesis, chapter XML/OGM, timeline rebase, and end-to-end file-keying
by track + track selection.
|