fix: make senc parsing more robust

[tobbee]

Added checks that values are OK in initial decode of SencBox.

Fixes #400, and makes the mentioned fuzz test obsolete.

[eric]

Thanks for doing this!

[eric]

Doing more fuzzing with these fixes I found the Size() method:

mp4ff/mp4/senc.go

Lines 285 to 298 in 7bb380f

	func (s *SencBox) Size() uint64 {
	if s.readButNotParsed {
	return boxHeaderSize + 8 + uint64(len(s.rawData)) // read 8 bytes after header
	}
	totalSize := boxHeaderSize + 8
	perSampleIVSize := s.GetPerSampleIVSize()
	for i := 0; i < int(s.SampleCount); i++ {
	totalSize += perSampleIVSize
	if s.Flags&UseSubSampleEncryption != 0 {
	totalSize += 2 + 6*len(s.SubSamples[i])
	}
	}
	return uint64(totalSize)
	}

was using a lot of CPU and it wasn't going into the s.Flags&UseSubSampleEncryption != 0 branch, so I assume it was 0.

You can replicate it by making mp4/testdata/fuzz/FuzzDecodeBox/0881196294cc083f containing:

go test fuzz v1
[]byte("\x00\x00\x00\x10senc\x00000\xfd\xfd\xfd\xbc")

and run:

$ go test -v -cpuprofile=cpu.pprof -run=FuzzDecodeBox/0881196294cc083f ./mp4

once this branch has been rebased off of the latest master.

github.com/Eyevinn/mp4ff/mp4.(*SencBox).Size
mp4/senc.go

  Total:       1.25s      1.26s (flat, cum) 96.18%
    291            .          .           		return boxHeaderSize + 8 + uint64(len(s.rawData)) // read 8 bytes after header 
    292            .          .           	} 
    293            .          .           	totalSize := uint64(boxHeaderSize + 8) 
    294            .          .            
    295            .          .           	perSampleIVSize := uint64(s.GetPerSampleIVSize()) 
    296        1.09s      1.10s           	for i := uint32(0); i < s.SampleCount; i++ { 
    297            .          .           		totalSize += perSampleIVSize 
    298        160ms      160ms           		if s.Flags&UseSubSampleEncryption != 0 { 
    299            .          .           			totalSize += 2 + 6*uint64(len(s.SubSamples[i])) 
    300            .          .           		} 
    301            .          .           	} 
    302            .          .           	return totalSize 
    303            .          .           } 

[tobbee]

OK. Thanks for the input. The senc box is a terrible box to parse since it is not self-contained but depends on field-sizes defined in other boxes. Anyway, I now store the read box size and use it for all parsing, while calculating the size when encoding the box. That gets rid of the loop for malformed boxes.

[eric]

Looks like you accidentally duplicated this condition.

[tobbee]

ok. thanks for pointing that out.

[eric]

I've run the fuzzer on this for 40 minutes and not found any additional issues with this box.