Further mp4 and flv work

Author: tballison

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-audiovideo-module/src/main/java/org/apache/tika/parser/mp4/MP4Parser.java

@@ -112,6 +112,9 @@ public long getMaxBoxSize() {
     }
 
     public void setMaxBoxSize(long maxBoxSize) {
+        if (maxBoxSize <= 0) {
+            throw new IllegalArgumentException("maxBoxSize must be positive: " + maxBoxSize);
+        }
         this.maxBoxSize = maxBoxSize;
     }
 

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-audiovideo-module/src/main/java/org/apache/tika/parser/mp4/boxes/TikaUserDataBox.java

@@ -163,7 +163,9 @@ private void processIList(SequentialReader reader, long totalLen)
                     if ("covr".equals(fieldName)) {
                         //covr holds one image per data atom and may repeat the data atom
                         //for further images; the realign below consumes any leftover
-                        handleCoverArt(reader, valueType, toRead);
+                        if (reader.getPosition() + toRead <= recordEnd) {
+                            handleCoverArt(reader, valueType, toRead);
+                        }
                         while (reader.getPosition() + 16 <= recordEnd) {
                             long extraLen = reader.getUInt32();
                             String extraType =
@@ -200,7 +202,7 @@ private void processIList(SequentialReader reader, long totalLen)
                                 metadata.set(Audio.DISC_COUNT, b);
                             }
                         }
-                    } else {
+                    } else if (reader.getPosition() + toRead <= recordEnd) {
                         String val = reader.getString(toRead, StandardCharsets.UTF_8);
                         try {
                             addMetadata(fieldName, val);

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-audiovideo-module/src/main/java/org/apache/tika/parser/video/FLVParser.java

@@ -164,12 +164,18 @@ private String readAMFString(DataInputStream input) throws IOException {
 
     private Object readAMFObject(DataInputStream input, int depth) throws IOException {
         HashMap<String, Object> array = new HashMap<>();
-        while (true) {
+        //an object has no declared count (it runs to the type-9 end marker), so bound the
+        //entry count too, or a crafted flat object of cheap entries would exhaust memory
+        for (int i = 0; ; i++) {
             String key = readAMFString(input);
             int dataType = input.read();
             if (dataType == 9) { // object end marker
                 break;
             }
+            if (i >= MAX_AMF_ELEMENTS) {
+                throw new IOException("AMF object exceeds the maximum of " + MAX_AMF_ELEMENTS
+                        + " entries");
+            }
             array.put(key, readAMFData(input, dataType, depth + 1));
         }
         return array;

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-audiovideo-module/src/test/java/org/apache/tika/parser/mp4/MP4ParserTest.java

@@ -497,6 +497,28 @@ public void testNestedContainerRecursionIsBounded() throws Exception {
                         boxes.length));
     }
 
+    @Test
+    public void testLargeSizeBoxHeaderAccounting() throws Exception {
+        //a 64-bit largesize box (size field == 1) has a 16-byte header, not 8; accounting
+        //for only 8 over-reads it by 8 bytes and misparses everything after it. Put a
+        //largesize udta before a normal ftyp and confirm the ftyp's major brand still
+        //comes through, which it only does if the largesize header is 16 bytes. TIKA-4812
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        //box 1: largesize udta, 24 bytes total (16-byte header + 8-byte payload)
+        bos.write(new byte[]{0, 0, 0, 1});              //size == 1 -> a 64-bit size follows
+        bos.write("udta".getBytes(StandardCharsets.ISO_8859_1));
+        bos.write(new byte[]{0, 0, 0, 0, 0, 0, 0, 24}); //64-bit box size = 24
+        bos.write(new byte[]{0, 0, 0, 8});              //payload: a dummy 8-byte 'free' sub-box
+        bos.write("free".getBytes(StandardCharsets.ISO_8859_1));
+        //box 2: normal ftyp, 16 bytes
+        bos.write(new byte[]{0, 0, 0, 16});
+        bos.write("ftyp".getBytes(StandardCharsets.ISO_8859_1));
+        bos.write("isom".getBytes(StandardCharsets.ISO_8859_1)); //major brand
+        bos.write(new byte[]{0, 0, 0, 0});              //minor version
+
+        assertEquals("isom", majorBrand(bos.toByteArray(), 1000L));
+    }
+
     private static String majorBrand(byte[] boxes, long maxBoxSize) throws Exception {
         com.drew.metadata.Metadata mp4Metadata = new com.drew.metadata.Metadata();
         Metadata tikaMetadata = new Metadata();