Don't crash on CAF files that claim more data than they hold

Importing a 72-byte CAF file ended the process. symphonia allocates
whatever a CAF magic cookie, packet table or packet claims before it
reads it, and when that allocation fails Rust aborts, which no
catch_unwind can stop. A cookie claiming 54 PB, a table of 2^50
packets and a single packet of 2^50 bytes each did it, on import and
in `soundcraft-cli info`.

symph::open now runs symphonia's probe loop itself, and when the
container it finds is a CAF stream, it first walks the chunks the way
symphonia reads them. A file whose cookie, packet table or packets
claim more bytes than it holds is refused as malformed. So is a packet
table symphonia would refuse only after reserving 32 bytes per packet:
one that runs past the file, or one listing packets of a constant bit
rate stream. The probe's hint was never read by symphonia 0.5, so it is
no longer passed.

crates/audio-io/src/caf.rs

@@ -0,0 +1,87 @@
+//! Size checks on CAF chunks before symphonia reads them: it allocates whatever a magic cookie,
+//! a packet table or a packet claims, and a failed allocation aborts the process.
+
+use crate::pcm::{be_u16, be_u32, be_u64};
+use crate::{AudioError, Result};
+
+/// Refuse the CAF stream at `at` if its magic cookie, packet table or packets claim more bytes
+/// than the file holds.
+pub(crate) fn check(b: &[u8], at: usize) -> Result<()> {
+    if be_u16(b, at + 4) == Some(1) { chunks(b, at + 8) } else { Ok(()) }
+}
+
+fn malformed(what: &str) -> AudioError {
+    AudioError::Malformed(format!("CAF {what} is larger than the file"))
+}
+
+/// Walk the chunks the way symphonia 0.5 reads them: it advances by the bytes it parses, not by
+/// the declared size, and after a `data` chunk of unknown size it reads on into the audio.
+fn chunks(b: &[u8], mut pos: usize) -> Result<()> {
+    // Whether the packet table lists each packet's size and frame count (variable per packet).
+    let (mut lists_sizes, mut lists_frames, mut described) = (false, false, false);
+    while let (Some(kind), Some(size)) = (b.get(pos..pos + 4), be_u64(b, pos + 4)) {
+        let (body, size) = (pos + 12, size as i64);
+        let used = match kind {
+            b"desc" if size == 32 => {
+                lists_sizes = be_u32(b, body + 16) == Some(0);
+                lists_frames = be_u32(b, body + 20) == Some(0);
+                described = true;
+                Some(32)
+            }
+            b"data" if size == -1 => Some(4),
+            b"chan" if size >= 12 => be_u32(b, body + 8).map(|n| 12 + u64::from(n) * 20),
+            b"pakt" if size >= 24 && described => packet_table(b, body, lists_sizes, lists_frames)?,
+            b"kuki" if size >= 0 && size as u64 > b.len().saturating_sub(body) as u64 => return Err(malformed("magic cookie")),
+            b"desc" | b"pakt" | b"chan" => None,
+            _ => u64::try_from(size).ok(),
+        };
+        match used.filter(|_| described).and_then(|n| usize::try_from(n).ok()).and_then(|n| body.checked_add(n)) {
+            Some(next) if next < b.len() => pos = next,
+            _ => return Ok(()),
+        }
+    }
+    Ok(())
+}
+
+/// Check a packet table's count and packet sizes; returns the bytes symphonia reads for it, or
+/// None where symphonia stops. It reserves room for every packet before reading any, so a table
+/// it would refuse after that, or that runs past the file, is refused first.
+fn packet_table(b: &[u8], body: usize, lists_sizes: bool, lists_frames: bool) -> Result<Option<u64>> {
+    let valid = |at: usize| be_u64(b, at).filter(|&n| n as i64 >= 0);
+    let (Some(packets), Some(_)) = (valid(body), valid(body + 8)) else { return Ok(None) };
+    let mut at = body + 24;
+    if packets > b.len().saturating_sub(at) as u64 {
+        return Err(malformed("packet table"));
+    }
+    if !lists_sizes && !lists_frames {
+        return if packets == 0 { Ok(Some(24)) } else { Err(AudioError::Malformed("a constant bit rate CAF lists packets".into())) };
+    }
+    for _ in 0..packets {
+        if lists_sizes {
+            let Some((size, len)) = varint(b, at) else { return Err(malformed("packet table")) };
+            if size > b.len() as u64 {
+                return Err(malformed("packet"));
+            }
+            at += len;
+        }
+        if lists_frames {
+            let Some((_, len)) = varint(b, at) else { return Err(malformed("packet table")) };
+            at += len;
+        }
+    }
+    Ok(Some((at - body) as u64))
+}
+
+/// A CAF variable-length integer at `at` and its length in bytes.
+fn varint(b: &[u8], at: usize) -> Option<(u64, usize)> {
+    let mut v = 0u64;
+    for i in 0..9 {
+        let x = *b.get(at + i)?;
+        v |= u64::from(x & 0x7f);
+        if x & 0x80 == 0 {
+            return Some((v, i + 1));
+        }
+        v <<= 7;
+    }
+    None
+}

crates/audio-io/src/lib.rs

@@ -14,6 +14,7 @@
 
 mod aiff;
 mod buffer;
+mod caf;
 mod flac;
 mod pcm;
 pub mod peaks;
@@ -205,16 +206,16 @@ pub fn probe(bytes: &[u8], ext_hint: Option<&str>) -> Result<AudioInfo> {
         FileFormat::Wav if wav::is_wav(bytes) => match wav::parse(bytes)? {
             wav::WavParse::Native(l) => Ok(l.info),
             wav::WavParse::Foreign { bwf } => {
-                let mut info = symph::probe(bytes, Some("wav"), format)?;
+                let mut info = symph::probe(bytes, format)?;
                 info.bwf = bwf;
                 Ok(info)
             }
         },
         FileFormat::Aiff if aiff::is_aiff(bytes) => match aiff::parse(bytes)? {
             aiff::AiffParse::Native(l) => Ok(l.info),
-            aiff::AiffParse::Foreign => symph::probe(bytes, Some("aiff"), format),
+            aiff::AiffParse::Foreign => symph::probe(bytes, format),
         },
-        _ => symph::probe(bytes, ext_hint, format),
+        _ => symph::probe(bytes, format),
     }
 }
 
@@ -230,7 +231,7 @@ pub fn decode(bytes: &[u8], ext_hint: Option<&str>) -> Result<(AudioInfo, AudioB
                 Ok((info, buf))
             }
             wav::WavParse::Foreign { bwf } => {
-                let (mut info, buf) = symph::decode(bytes, Some("wav"), format)?;
+                let (mut info, buf) = symph::decode(bytes, format)?;
                 info.bwf = bwf;
                 Ok((info, buf))
             }
@@ -242,9 +243,9 @@ pub fn decode(bytes: &[u8], ext_hint: Option<&str>) -> Result<(AudioInfo, AudioB
                 info.frames = buf.frames() as u64;
                 Ok((info, buf))
             }
-            aiff::AiffParse::Foreign => symph::decode(bytes, Some("aiff"), format),
+            aiff::AiffParse::Foreign => symph::decode(bytes, format),
         },
-        _ => symph::decode(bytes, ext_hint, format),
+        _ => symph::decode(bytes, format),
     }
 }
 

crates/audio-io/src/pcm.rs

@@ -36,6 +36,12 @@ pub(crate) fn be_u32(b: &[u8], pos: usize) -> Option<u32> {
     Some(u32::from_be_bytes(s))
 }
 
+/// Big-endian `u64` at `pos`.
+pub(crate) fn be_u64(b: &[u8], pos: usize) -> Option<u64> {
+    let s: [u8; 8] = b.get(pos..pos.checked_add(8)?)?.try_into().ok()?;
+    Some(u64::from_be_bytes(s))
+}
+
 /// Four-byte tag at `pos`.
 pub(crate) fn tag(b: &[u8], pos: usize) -> Option<[u8; 4]> {
     b.get(pos..pos.checked_add(4)?)?.try_into().ok()

crates/audio-io/src/symph.rs

@@ -12,9 +12,9 @@ use symphonia::core::codecs::{
 };
 use symphonia::core::errors::Error as SymError;
 use symphonia::core::formats::{FormatOptions, FormatReader};
-use symphonia::core::io::{MediaSourceStream, MediaSourceStreamOptions};
+use symphonia::core::io::{MediaSourceStream, MediaSourceStreamOptions, ReadBytes};
 use symphonia::core::meta::MetadataOptions;
-use symphonia::core::probe::Hint;
+use symphonia::core::probe::Instantiate;
 
 use crate::pcm::MAX_DECODE_SAMPLES;
 use crate::{AudioBuffer, AudioError, AudioInfo, FileFormat, Result, SampleFormat};
@@ -32,15 +32,25 @@ fn guarded<T>(f: impl FnOnce() -> Result<T>) -> Result<T> {
     catch_unwind(AssertUnwindSafe(f)).unwrap_or_else(|_| Err(AudioError::Malformed("decoder failed on malformed input".into())))
 }
 
-fn open(bytes: &[u8], ext_hint: Option<&str>) -> Result<Box<dyn FormatReader>> {
-    let mss = MediaSourceStream::new(Box::new(Cursor::new(bytes.to_vec())), MediaSourceStreamOptions::default());
-    let mut hint = Hint::new();
-    if let Some(ext) = ext_hint {
-        hint.with_extension(ext.trim_start_matches('.'));
-    }
+/// Symphonia's probe loop (`Probe::format`, whose hint 0.5 ignores), checking the container it
+/// finds before its reader allocates whatever the file claims.
+fn open(bytes: &[u8]) -> Result<Box<dyn FormatReader>> {
+    let mut mss = MediaSourceStream::new(Box::new(Cursor::new(bytes.to_vec())), MediaSourceStreamOptions::default());
     let fmt_opts = FormatOptions { enable_gapless: true, ..FormatOptions::default() };
-    let probed = symphonia::default::get_probe().format(&hint, mss, &fmt_opts, &MetadataOptions::default()).map_err(map_err)?;
-    Ok(probed.format)
+    loop {
+        match symphonia::default::get_probe().next(&mut mss).map_err(map_err)? {
+            Instantiate::Format(reader) => {
+                let at = usize::try_from(mss.pos()).unwrap_or(usize::MAX);
+                if bytes.get(at..at + 4) == Some(b"caff") {
+                    crate::caf::check(bytes, at)?;
+                }
+                return reader(mss, &fmt_opts).map_err(map_err);
+            }
+            Instantiate::Metadata(tag) => {
+                tag(&MetadataOptions::default()).read_all(&mut mss).map_err(map_err)?;
+            }
+        }
+    }
 }
 
 fn format_from_codec(codec: CodecType, detected: FileFormat) -> FileFormat {
@@ -115,8 +125,8 @@ fn info_of(reader: &dyn FormatReader, detected: FileFormat) -> Result<(u32, Audi
 }
 
 /// Decode the whole first audio track. When `count_only`, samples are counted but not stored.
-fn run(bytes: &[u8], ext_hint: Option<&str>, detected: FileFormat, count_only: bool) -> Result<(AudioInfo, AudioBuffer)> {
-    let mut reader = open(bytes, ext_hint)?;
+fn run(bytes: &[u8], detected: FileFormat, count_only: bool) -> Result<(AudioInfo, AudioBuffer)> {
+    let mut reader = open(bytes)?;
     let (track_id, mut info) = info_of(reader.as_ref(), detected)?;
     if let Some(n) = reader.tracks().iter().find(|t| t.id == track_id).and_then(|t| t.codec_params.n_frames) {
         let total = n.saturating_mul(u64::from(info.channels.max(1)));
@@ -206,18 +216,18 @@ fn run(bytes: &[u8], ext_hint: Option<&str>, detected: FileFormat, count_only: b
     Ok((info, AudioBuffer { sample_rate, channels: planar }))
 }
 
-pub(crate) fn probe(bytes: &[u8], ext_hint: Option<&str>, detected: FileFormat) -> Result<AudioInfo> {
+pub(crate) fn probe(bytes: &[u8], detected: FileFormat) -> Result<AudioInfo> {
     guarded(|| {
-        let reader = open(bytes, ext_hint)?;
+        let reader = open(bytes)?;
         let (_, info) = info_of(reader.as_ref(), detected)?;
         if info.frames > 0 && info.channels > 0 {
             return Ok(info);
         }
         // Length not in the header (e.g. MP3 without a Xing frame): count by decoding.
-        run(bytes, ext_hint, detected, true).map(|(i, _)| i)
+        run(bytes, detected, true).map(|(i, _)| i)
     })
 }
 
-pub(crate) fn decode(bytes: &[u8], ext_hint: Option<&str>, detected: FileFormat) -> Result<(AudioInfo, AudioBuffer)> {
-    guarded(|| run(bytes, ext_hint, detected, false))
+pub(crate) fn decode(bytes: &[u8], detected: FileFormat) -> Result<(AudioInfo, AudioBuffer)> {
+    guarded(|| run(bytes, detected, false))
 }

crates/audio-io/tests/malformed.rs

@@ -153,6 +153,63 @@ fn absurd_chunk_sizes() {
     assert_eq!(decode(&aiff, None).unwrap().1.frames(), 0);
 }
 
+fn caf(chunks: &[(&[u8; 4], i64, Vec<u8>)]) -> Vec<u8> {
+    let mut out = b"caff\0\x01\0\0".to_vec();
+    for (kind, size, body) in chunks {
+        out.extend_from_slice(*kind);
+        out.extend_from_slice(&size.to_be_bytes());
+        out.extend_from_slice(body);
+    }
+    out
+}
+
+fn caf_desc(format: &[u8; 4], bytes_per_packet: u32, frames_per_packet: u32, channels: u32, bits: u32) -> (&'static [u8; 4], i64, Vec<u8>) {
+    let mut d = 48_000f64.to_be_bytes().to_vec();
+    d.extend_from_slice(format);
+    for v in [0, bytes_per_packet, frames_per_packet, channels, bits] {
+        d.extend_from_slice(&v.to_be_bytes());
+    }
+    (b"desc", 32, d)
+}
+
+fn packet_table(packets: i64, frames: i64, entries: &[u8]) -> Vec<u8> {
+    [&packets.to_be_bytes()[..], &frames.to_be_bytes(), &[0; 8], entries].concat()
+}
+
+#[test]
+fn caf_sizes_beyond_the_file_are_errors_not_aborts() {
+    let aac = || caf_desc(b"aac ", 0, 1024, 2, 0);
+    let huge = 1i64 << 50;
+    let cookie = caf(&[aac(), (b"kuki", huge, vec![0; 8])]);
+    let files = [
+        cookie.clone(),
+        [vec![0; 100], cookie].concat(),
+        caf(&[aac(), (b"data", -1, [&[0; 4][..], b"kuki", &huge.to_be_bytes()].concat())]),
+        caf(&[aac(), (b"pakt", 24, packet_table(huge, 1024, &[])), (b"data", -1, vec![0; 16])]),
+        caf(&[aac(), (b"pakt", 32, packet_table(1, 1024, &[0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0])), (b"data", -1, vec![0; 64])]),
+        caf(&[aac(), (b"pakt", 25, packet_table(1, 1024, &[0x80]))]),
+    ];
+    for f in files {
+        assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
+        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
+    }
+    let constant = caf(&[caf_desc(b"lpcm", 2, 1, 1, 16), (b"pakt", 25, packet_table(1, 1, &[1])), (b"data", -1, vec![0; 16])]);
+    assert!(matches!(decode(&constant, None), Err(AudioError::Malformed(m)) if m.contains("lists packets")));
+}
+
+#[test]
+fn well_formed_caf_still_reads() {
+    let pcm: Vec<u8> = (0..480i16).flat_map(|i| (i * 50).to_be_bytes()).collect();
+    let chan = [((100u32 << 16) | 1).to_be_bytes(), [0; 4], [0; 4]].concat();
+    let data = [vec![0; 4], pcm].concat();
+    let lpcm = caf(&[caf_desc(b"lpcm", 2, 1, 1, 16), (b"chan", 12, chan), (b"free", 8, vec![0; 8]), (b"data", data.len() as i64, data)]);
+    let (info, buf) = decode(&lpcm, None).unwrap();
+    assert_eq!((info.format, buf.frames()), (FileFormat::Caf, 480));
+    let table = packet_table(3, 3072, &[10, 0x81, 0x48, 5]);
+    let aac = caf(&[caf_desc(b"aac ", 0, 1024, 2, 0), (b"pakt", table.len() as i64, table), (b"data", 219, vec![0; 219])]);
+    assert_eq!(probe(&aac, None).unwrap().frames, 3072);
+}
+
 #[test]
 fn many_tiny_chunks_terminate() {
     let mut chunks: Vec<(&[u8; 4], Vec<u8>)> = vec![(b"fmt ", fmt(1, 1, 8_000, 16))];