mirror of
https://github.com/freemkv/libfreemkv.git
synced 2026-10-07 18:13:10 +00:00
Matthew Jackson
6e14fc0c0c
Security - Remove the unsafe Vec::set_len over recycled sector buffers — UB reachable from safe code (GHSA-j8ww-f5fg-9pmh, low). Uses Vec::resize; pooling unchanged. CI / tooling - clippy on stable with the MSRV single-sourced from Cargo.toml; cargo-deny dependency-audit gate with first-party git sources allowed (#15); audience-based comment-guard (#17). Docs - README (keydb ownership, BD-J parser count), drive-access transport/reset notes, mux timeline module-doc links.
55 lines
2.7 KiB
Markdown
55 lines
2.7 KiB
Markdown
# src/mux/select.rs — internal notes
|
|
|
|
Overflow rationale relocated here by the comment-guard so the in-file
|
|
comments can stay short. Each section is pointed to by a one-line
|
|
`// See docs/mux-select.md — <topic>` comment at the corresponding site.
|
|
|
|
## Module rationale
|
|
|
|
The demux pipeline is declaration-driven: every demux table
|
|
(`build_demux_state` in `mux/resolve.rs`, `DiscStream::new` in `mux/disc.rs`)
|
|
is built from the input `DiscTitle`'s `streams` list, and the MKV writer
|
|
builds its track headers + `codec_privates` from that same list. A PID not
|
|
declared there is never tracked, extracted, or written. So "which streams to
|
|
keep" is already a capability of the pipeline — it just has no public knob.
|
|
|
|
`StreamSelection::apply` is that knob: prune the `DiscTitle.streams` list
|
|
(video always kept) BEFORE the mux path finalizes the title, and everything
|
|
downstream — track headers, `codec_privates`, PID routing, frame emission —
|
|
follows from the pruned list by construction, with zero scattered PID
|
|
checks. This is language-agnostic: PIDs, not languages (the language→PID
|
|
mapping is the caller's/engine's policy).
|
|
|
|
## `StreamSelection::apply` rationale
|
|
|
|
The parallel `codec_privates` vec is pruned in lockstep when it is
|
|
populated (it is empty on a freshly-scanned title, non-empty only if a
|
|
caller pre-filled it) — by index, whatever its length, since it is consumed
|
|
positionally and a partial prune would attach the wrong codec-private to a
|
|
retained track.
|
|
|
|
`Error::SelectionPidUnknown` is returned rather than silently emitting an
|
|
MKV missing a requested track — fail loud on a caller bug (e.g. a stale
|
|
scan) instead.
|
|
|
|
## codec_privates length-mismatch regression (test)
|
|
|
|
A `codec_privates` vec that is NOT exactly stream-length must still be
|
|
pruned in lockstep. `m2ts.rs::create` documents a longer-than-streams vec
|
|
as a benign shape ("ignore any trailing entries that exceed the track
|
|
count"), and the vec is consumed positionally, so skipping the prune left
|
|
`codec_privates[i]` describing a stream that is no longer at index `i`.
|
|
|
|
Regression: with one trailing extra entry the prune was skipped entirely
|
|
and index 1 — the retained `fra` audio — resolved to `eng`'s record, so
|
|
the muxer attached the wrong codec-private to the track. No error, no log.
|
|
|
|
## Wrong-class filter PID regression (test)
|
|
|
|
A PID listed in the wrong class's filter must fail loud, not validate and
|
|
then quietly vanish. Validation used to scan both audio and subtitle
|
|
streams, so an audio filter naming a subtitle PID passed — and `keeps`
|
|
then matched it against audio streams only, dropping the requested track
|
|
from the output with no error. That defeats the documented "fail loud
|
|
rather than silently emit an MKV missing a requested track" contract.
|