Properly verify that input data is just 'pssh' boxes

media/formats/mp4/box_reader.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_FORMATS_MP4_BOX_READER_H_
 #define MEDIA_FORMATS_MP4_BOX_READER_H_
 
 #include <map>
 #include <vector>
 
@@ skipping 122 matching lines @@
   // Read at least one child. False means error or no such child present.
   template<typename T> bool ReadChildren(
       std::vector<T>* children) WARN_UNUSED_RESULT;
 
   // Read any number of children. False means error.
   template<typename T> bool MaybeReadChildren(
       std::vector<T>* children) WARN_UNUSED_RESULT;
 
   // Read all children, regardless of FourCC. This is used from exactly one box,
   // corresponding to a rather significant inconsistency in the BMFF spec.
   // Note that this method is mutually exclusive with ScanChildren().

[ddorwin, 2015/07/01 20:22:35]

and ReadAllChildrenAndCheckFourCC()

[jrummell, 2015/07/01 20:57:59]

Done.

-  template<typename T> bool ReadAllChildren(
-      std::vector<T>* children) WARN_UNUSED_RESULT;
+  template <typename T>
+  bool ReadAllChildren(std::vector<T>* children) WARN_UNUSED_RESULT {

[ddorwin, 2015/07/01 20:22:35]

Given the comment about this being called in one place, it seems we should
rename this to discourage use. Maybe in a separate CL.

[jrummell, 2015/07/01 20:57:59]

Acknowledged.

+    return ReadAllChildrenInternal(children, false);
+  }
+
+  // Read all children and verify that the FourCC matches what is expected.
+  // Note that this method is mutually exclusive with ScanChildren().

[ddorwin, 2015/07/01 20:22:35]

and ReadAllChildren()

[jrummell, 2015/07/01 20:57:59]

Done.

+  template <typename T>

[ddorwin, 2015/07/01 20:22:35]

// Returns true if all children are successfully parsed(?) and have the correct
box type for |T|.

[jrummell, 2015/07/01 20:57:59]

Done.

+  bool ReadAllChildrenAndCheckFourCC(std::vector<T>* children)
+      WARN_UNUSED_RESULT {
+    return ReadAllChildrenInternal(children, true);
+  }
 
   // Populate the values of 'version()' and 'flags()' from a full box header.
   // Many boxes, but not all, use these values. This call should happen after
   // the box has been initialized, and does not re-read the main box header.
   bool ReadFullBoxHeader() WARN_UNUSED_RESULT;
 
   FourCC type() const   { return type_; }
   uint8 version() const { return version_; }
   uint32 flags() const  { return flags_; }
 
   const LogCB& log_cb() const { return log_cb_; }
 
  private:
   // Create a BoxReader from |buf|. |is_EOS| should be true if |buf| is
   // complete stream (i.e. no additional data is expected to be appended).
   BoxReader(const uint8* buf, const int size, const LogCB& log_cb, bool is_EOS);
 
   // Must be called immediately after init. If the return is false, this
   // indicates that the box header and its contents were not available in the
   // stream or were nonsensical, and that the box must not be used further. In
   // this case, if |*err| is false, the problem was simply a lack of data, and
   // should only be an error condition if some higher-level component knows that
   // no more data is coming (i.e. EOS or end of containing box). If |*err| is
   // true, the error is unrecoverable and the stream should be aborted.
   bool ReadHeader(bool* err);
 
+  // Read all children, optionally checking FourCC. Note that this method is
+  // mutually exclusive with ScanChildren().
+  template <typename T>

[ddorwin, 2015/07/01 20:22:35]

// Returns true if all children are successfully parsed(?) and, if
|check_box_type|,  have the correct box type for |T|.

[jrummell, 2015/07/01 20:57:59]

Done.

+  bool ReadAllChildrenInternal(std::vector<T>* children, bool check_box_type);
+
   LogCB log_cb_;
   FourCC type_;
   uint8 version_;
   uint32 flags_;
 
   typedef std::multimap<FourCC, BoxReader> ChildMap;
 
   // The set of child box FourCCs and their corresponding buffer readers. Only
   // valid if scanned_ is true.
   ChildMap children_;
@@ skipping 25 matching lines @@
     RCHECK(child_itr->Parse(&itr->second));
     ++child_itr;
   }
   children_.erase(start_itr, end_itr);
 
   DVLOG(2) << "Found " << children->size() << " "
            << FourCCToString(child_type) << " boxes.";
   return true;
 }
 
-template<typename T>
-bool BoxReader::ReadAllChildren(std::vector<T>* children) {
+template <typename T>
+bool BoxReader::ReadAllChildrenInternal(std::vector<T>* children,
+                                        bool check_box_type) {
   DCHECK(!scanned_);
   scanned_ = true;
 
   bool err = false;
   while (pos_ < size_) {
     BoxReader child_reader(&buf_[pos_], size_ - pos_, log_cb_, is_EOS_);
     if (!child_reader.ReadHeader(&err)) break;
     T child;
+    RCHECK(!check_box_type || child_reader.type() == child.BoxType());
     RCHECK(child.Parse(&child_reader));
     children->push_back(child);
     pos_ += child_reader.size();
   }
 
   return !err;
 }
 
 }  // namespace mp4
 }  // namespace media
 
 #endif  // MEDIA_FORMATS_MP4_BOX_READER_H_