Properly verify that input data is just 'pssh' boxes

media/formats/mp4/box_definitions.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/box_definitions.h"
 
 #include "base/logging.h"
 #include "media/formats/mp4/es_descriptor.h"
 #include "media/formats/mp4/rcheck.h"
 
 namespace media {
 namespace mp4 {
 
 FileType::FileType() {}
 FileType::~FileType() {}
 FourCC FileType::BoxType() const { return FOURCC_FTYP; }
 
 bool FileType::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFourCC(&major_brand) && reader->Read4(&minor_version));
   size_t num_brands = (reader->size() - reader->pos()) / sizeof(FourCC);
   return reader->SkipBytes(sizeof(FourCC) * num_brands);  // compatible_brands
 }
 
 ProtectionSystemSpecificHeader::ProtectionSystemSpecificHeader() {}
 ProtectionSystemSpecificHeader::~ProtectionSystemSpecificHeader() {}
 FourCC ProtectionSystemSpecificHeader::BoxType() const { return FOURCC_PSSH; }
 
 bool ProtectionSystemSpecificHeader::Parse(BoxReader* reader) {
-  // Don't bother validating the box's contents.
+  // Don't bother validating the box's contents other than type().

[ddorwin, 2015/06/25 23:08:17]

It's not "don't bother" - it's Fail if not the correct type.

This seems like something that should be consistent for all box parsers.

Should they all contain this? Would that be a DCHECK in most cases? (We would do
that in a separate CL after branch cut.) It seems odd to have PSSH be the
exception as appears to currently be the case.

[jrummell, 2015/06/30 00:06:03]

The "don't bother" is in relation to all the other fields in the pssh box that
could be validated but aren't -- version, flags, KID_count, KIDs, datasize,
data.

There are a few places where it reads boxes that can have different types (see
SampleDescription::Parse, line 291 below that calls
ReadAllChildren(&audio_entries) and then AudioSampleEntry::Parse @ 568). So
adding the test in ReadAllChildren() (or all Boxes) would possibly break them.

Most of the parsing is done by calling ScanChildren() and then using ReadChild()
to read a particular type. So ReadAllChildren() is different. I could make a
variation (or add an additional parameter) for the validation case -- would that
be clearer?

+  RCHECK(reader->type() == BoxType());
+
   // Copy the entire box, including the header, for passing to EME as initData.
   DCHECK(raw_box.empty());
   raw_box.assign(reader->data(), reader->data() + reader->size());
   return true;
 }
 
 FullProtectionSystemSpecificHeader::FullProtectionSystemSpecificHeader() {}
 FullProtectionSystemSpecificHeader::~FullProtectionSystemSpecificHeader() {}
 FourCC FullProtectionSystemSpecificHeader::BoxType() const {
   return FOURCC_PSSH;
@@ skipping 959 matching lines @@
 SampleDependsOn IndependentAndDisposableSamples::sample_depends_on(
     size_t i) const {
   if (i >= sample_depends_on_.size())
     return kSampleDependsOnUnknown;
 
   return sample_depends_on_[i];
 }
 
 }  // namespace mp4
 }  // namespace media