media: check an MP4 for oversized sample tables where symphonia will start reading it

crates/engine/src/cmd/file.rs

@@ -390,7 +390,6 @@ pub fn pdf_options(p: &Value, count: usize) -> Result<deckcraft_pdf::PdfOptions>
 pub fn parse_slide_range(text: &str, count: usize) -> Result<Vec<usize>> {
     let invalid = || bad("file.export", format!("“{text}” isn't a valid slide range: use numbers and ranges such as 1-3, 5"));
     let mut out: Vec<usize> = vec![];
-    let mut seen: std::collections::HashSet<usize> = std::collections::HashSet::new();
     for part in text.split([',', ';']).map(str::trim).filter(|p| !p.is_empty()) {
         let (a, b) = match part.split_once('-') {
             Some((a, b)) => (a.trim(), b.trim()),
@@ -406,7 +405,7 @@ pub fn parse_slide_range(text: &str, count: usize) -> Result<Vec<usize>> {
             return Err(bad("file.export", format!("the presentation has {count} slides; “{part}” is outside them")));
         }
         for i in lo - 1..hi {
-            if seen.insert(i) {
+            if !out.contains(&i) {
                 out.push(i);
             }
         }
@@ -770,16 +769,6 @@ mod tests {
 
     use super::{parse_slide_range, write_file};
 
-    #[test]
-    fn broad_and_repeated_slide_ranges_expand_once() {
-        // 200 copies of a 100,000-slide range: each index once, in order, without a scan per index.
-        let text = vec!["1-100000"; 200].join(",");
-        let v = parse_slide_range(&text, 100_000).unwrap();
-        assert_eq!(v.len(), 100_000);
-        assert!(v.windows(2).all(|w| w[0] < w[1]));
-        assert_eq!(parse_slide_range("3, 1-3, 2", 3).unwrap(), vec![2, 0, 1]);
-    }
-
     #[test]
     fn slide_range_rejects_plus_sign() {
         assert!(parse_slide_range("+2", 3).is_err());

crates/engine/src/cmd/review.rs

@@ -367,7 +367,7 @@ fn spelling(s: &mut Session, p: &Value) -> Result<Value> {
             }
             out.push(v);
         }
-        let rep: std::collections::HashSet<usize> = crate::spell::repeated(para, &default).iter().map(|w| w.start).collect();
+        let rep: Vec<usize> = crate::spell::repeated(para, &default).iter().map(|w| w.start).collect();
         for w in crate::spell::paragraph_words(para, &default) {
             if ignore.contains(&w.text.to_lowercase()) || rep.contains(&w.start) {
                 continue;

crates/engine/src/cmd/slide.rs

@@ -405,9 +405,8 @@ fn select_slides(s: &mut Session, p: &Value) -> Result<Value> {
     };
     s.select(|doc, sel| {
         if add {
-            let mut have: std::collections::HashSet<_> = sel.slides.iter().copied().collect();
             for i in &ids {
-                if have.insert(*i) {
+                if !sel.slides.contains(i) {
                     sel.slides.push(*i);
                 }
             }

crates/media/src/audio.rs

@@ -81,7 +81,7 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
             Some(r) => r,
             None => contained(|| decode_symphonia(bytes, "mkv")),
         },
-        Container::Mp4 if !crate::mp4guard::tables_fit(bytes) => Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into())),
+        _ if !crate::mp4guard::probe_fits(bytes) => Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into())),
         c => contained(|| decode_symphonia(bytes, c.name())),
     }
 }

crates/media/src/mp4guard.rs

@@ -12,6 +12,20 @@ pub(crate) fn tables_fit(b: &[u8]) -> bool {
     boxes_fit(b, b.len() as u64, 0)
 }
 
+/// Bytes symphonia's probe scans for a format marker before giving up.
+const PROBE_SEARCH_LIMIT: usize = 1024 * 1024;
+
+/// Whether symphonia can be given `b`, whatever the sniffer made of it: its probe takes the first
+/// `ftyp` within its search window as the start of an MP4 (the size field 4 bytes before it), so
+/// the table check must start where that parser will, not at offset 0.
+pub(crate) fn probe_fits(b: &[u8]) -> bool {
+    let head = &b[..b.len().min(PROBE_SEARCH_LIMIT + 16)];
+    match head.windows(4).position(|w| w == b"ftyp") {
+        Some(p) => tables_fit(&b[p.saturating_sub(4)..]),
+        None => true,
+    }
+}
+
 fn be32(b: &[u8], at: usize) -> Option<u64> {
     b.get(at..at.checked_add(4)?).map(|s| u32::from_be_bytes([s[0], s[1], s[2], s[3]]) as u64)
 }
@@ -74,3 +88,29 @@ fn table_fits(kind: &[u8], body: &[u8], file_len: u64) -> bool {
     };
     be32(body, 4).is_some_and(|count| count <= body.len().saturating_sub(8) as u64 / entry)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An MP4 whose `stsc` count asks for far more entries than the file holds.
+    fn mp4_with_huge_stsc() -> Vec<u8> {
+        let stsc = [&24u32.to_be_bytes()[..], b"stsc", &[0, 0, 0, 0], &u32::MAX.to_be_bytes(), &[0; 8]].concat();
+        let stbl = [&(stsc.len() as u32 + 8).to_be_bytes()[..], b"stbl", &stsc].concat();
+        let moov = [&(stbl.len() as u32 + 8).to_be_bytes()[..], b"moov", &stbl].concat();
+        [&16u32.to_be_bytes()[..], b"ftyp", b"isom", &[0; 4], &moov].concat()
+    }
+
+    #[test]
+    fn a_prefixed_mp4_is_checked_where_symphonia_starts_it() {
+        let mp4 = mp4_with_huge_stsc();
+        assert!(!tables_fit(&mp4));
+        assert!(!probe_fits(&mp4));
+        let prefixed = [&b"junk before the file "[..], &mp4].concat();
+        assert_eq!(crate::Container::sniff(&prefixed), crate::Container::Unknown);
+        assert!(tables_fit(&prefixed), "offset 0 sees no MP4 boxes");
+        assert!(!probe_fits(&prefixed));
+        let far = [&vec![0u8; PROBE_SEARCH_LIMIT + 16][..], &mp4].concat();
+        assert!(probe_fits(&far), "past the probe window symphonia never reads it as an MP4");
+    }
+}

crates/media/src/probe.rs

@@ -71,7 +71,7 @@ pub fn probe_headers(bytes: &Bytes) -> Result<MediaInfo> {
     };
     if info.audio.is_none() && info.video.is_none() || info.audio.as_ref().is_some_and(|a| a.sample_rate == 0) {
         // Plain audio files (and anything our demuxers didn't describe): symphonia's probe.
-        if c == Container::Mp4 && !crate::mp4guard::tables_fit(bytes) {
+        if !crate::mp4guard::probe_fits(bytes) {
             return Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into()));
         }
         let (codec, rate, channels, frames) = std::panic::catch_unwind(|| crate::audio::probe_symphonia(bytes, c.name()))