Matthew Jackson
6e14fc0c0c
Security - Remove the unsafe Vec::set_len over recycled sector buffers — UB reachable from safe code (GHSA-j8ww-f5fg-9pmh, low). Uses Vec::resize; pooling unchanged. CI / tooling - clippy on stable with the MSRV single-sourced from Cargo.toml; cargo-deny dependency-audit gate with first-party git sources allowed (#15); audience-based comment-guard (#17). Docs - README (keydb ownership, BD-J parser count), drive-access transport/reset notes, mux timeline module-doc links.
1.6 KiB
fMP4 muxer (src/mux/fmp4/mod.rs) — stub status and design notes
Status
STUB. The muxer can emit the init segment (ftyp + a minimal HEVC
moov skeleton with one video track) via
[Fmp4Mux::write_init_segment], so the shape and call site are
validated, but media fragments (moof/mdat) are NOT emitted.
[Fmp4Mux::write_video] therefore returns
Error::Fmp4Unimplemented
rather than silently accepting and discarding frames. It buffers
nothing, so it cannot accumulate memory.
Not yet implemented
moofbox:mfhd(sequence_number) +traf(tfhd+tfdttrunwith sample sizes, durations, flags, composition offsets).
mdatbox: concatenated sample data.- Fragment cadence: one fragment per GOP or every N seconds, whichever comes first.
- HEVC
hvcCbox insidemoov.trak.mdia.minf.stbl.stsdso the init segment is self-describing (stsdcurrently has zero entries). - Sample-flags computation (sync vs. delta, depends_on, etc.).
- Edit lists / fragment_duration for accurate seeking.
Reference: ISO/IEC 14496-12 §8 (Movie Fragments).
wrap_box size-cast rationale
All callers build tiny init-segment boxes (kilobytes at most), so the
u32 size never overflows; the saturating cast plus the debug assert
documents and guards that invariant rather than silently emitting a
truncated, structurally corrupt size field. body is always
internally constructed here, never untrusted input — a future caller
feeding a multi-gigabyte body trips the debug assert instead of
writing a malformed box.