Eyevinn / mp4ff

83%

master: 83%

LAST BUILD ON BRANCH feat/dref-resolver

branch: feat/dref-resolver

CHANGE BRANCH

x

Reset

• feat/dref-resolver
• aac-asc-header
• av1-crypto-rap
• av1-update
• avcc-encode-trailing-info
• avcc-preserve-trailing-bytes
• avs3
• chore-bump-min-go-1.18
• chore-bump-min-go-1.19
• chore/changelog-union-merge
• chore/codespell
• chore/go-1.24-build-version
• chore/prepare-v0.53.0
• chore/prepare-v0.56.0
• chore/prepare-v0.57.0
• chore/prepare-v0.58.0
• chore/remove-goreportcard-badge
• ci/checkout-v7
• codespell
• colr-icc-decode
• compressorname-length-clamp
• dac4
• decode-box-body-sr
• defragment-core
• defragment-hybrid
• defragment-overlaps
• docs/benchmarks
• docs/changelog-dec3-joc
• docs/claude-md-history
• docs/defragment-wording
• docs/encoding-and-changelog
• docs/fix-doc-comment-drift
• docs/fix-misleading-doc-comments
• docs/install-instructions
• docs/osc-badge-utm-2026-10-09
• docs/trim-claude-md
• elst-media-rate
• esds-vocabulary
• feat-coll-box
• feat-create-sei-nalu
• feat-hevc-encrypt
• feat-ivf
• feat-lbli-sample-group
• feat-lhvc-box
• feat-linf-oinf-sample-groups
• feat-mvhevc-builders
• feat-mvhevc-cli
• feat-trgr-track-group
• feat-vexu-spatial-video
• feat-vp-codec-sample-box
• feat-vps-multilayer-extension
• feat/av1-metadata-obu-cea608
• feat/brands-check
• feat/brands-defragmenter
• feat/brands-general-type-box
• feat/brands-generate
• feat/caller-provided-memory
• feat/clone-box
• feat/dolby-vision-dvh1-dvhe
• feat/fragment-reset
• feat/hevc-hdr-boxes
• feat/mdat-payload
• feat/motion-jpeg
• feat/mov-decoder
• feat/paint-model-subtitle-boxes
• feat/piff
• feat/rsot-box
• feat/saiz-v1-v2
• feat/stream-read-mdat-data
• feat/ttma-box
• feature-encryption-boxes
• feature/exporttfhd
• fix-611-dataparts
• fix-avcdecoderconfig
• fix-bound-more-bitstream-counts
• fix-co64-size-overflow
• fix-container-children-bounds
• fix-ftyp-styp-short-payload
• fix-goreleaser-brew
• fix-hevc-ps-dos
• fix-interleaved-sidx-boxes
• fix-mime-box
• fix-senc-panic
• fix-senc-robustness
• fix-short-esds-issue-393
• fix-sliceheader-spsid
• fix-sps-num-ref-frames-overflow
• fix-ssix-box
• fix-stsc
• fix-subs-box
• fix-trailing-avc1-bytes
• fix-typos
• fix-vps-ols0-necessary-layers
• fix/annexb-trailing-zeros
• fix/avc-deblock-offsets
• fix/avc-hrd-cpb-cnt
• fix/avc-param-set-ranges
• fix/avc-pps-scaling-lists
• fix/box-versions-above-1
• fix/cenc-encrypt-conformance
• fix/cenc-increment
• fix/container-error-bounded
• fix/container-size-underflow
• fix/decoders-exact-box-size
• fix/empty-trak-subtitle-header
• fix/external-data-references
• fix/get-sample-data-indexing
• fix/hevc-multilayer-ext-sps
• fix/hevc-slice-deblocking-inference
• fix/issyncsampleflags
• fix/leva-grouping-type
• fix/mdat-mixed-data
• fix/moov-decode-linear
• fix/nalu-length-size-checks
• fix/oob-panics
• fix/prft-decode
• fix/sample-data-inverted-interval
• fix/sdtp-entry-depends-on
• fix/segmenter-last-sample
• fix/sei-nalu-short-panic
• fix/sgpd-description-length-bound
• fix/stsc-containing-chunks
• fix/stsc-sample-description-id
• fix/stts-decode-time-bounds
• fix/top-level-box-attribution
• fix/trun-mdat-bounds
• flac
• fuzz-box
• go-releaser
• golangci-lint-v2
• handle-trailing-avc1-bytes
• hevc-ref-idx-255
• hevc-vps
• iMro0t-feature-encryption-boxes
• iMro0t-fix-avcdecoderconfig
• improve-av1
• improved-crypt-tools
• issue-492
• labl-box
• lpcm-format-flags
• master
• mdat-header-size
• mdhd-dur-info
• minimal-ac4
• more-robust-decode
• mp4-blackbox-test
• mpeg-h
• nalu-length-size
• nalu-length-size-helpers
• new-pssh-func
• normalize-quicktime
• opus
• parse-joc-dolby-atmos
• patch-1
• perf/add-full-samples
• perf/addfullsamples-always-parts
• perf/bits-av1-allocs
• perf/buffer-cmd-writers
• perf/buffer-writetofile
• perf/built-fragment-offsets
• perf/bulk-table-decode
• perf/cipher-hoist
• perf/decode-allocs
• perf/ebsp-allocs
• perf/encode-allocs
• perf/encrypt-allocs
• perf/fragment-decoder
• qt-legacy-audio-entries
• qt-sound-descriptions
• refactor/styp-delegate
• release-v0.59.0
• release/v0.51.0
• release/v0.52.0
• release/v0.54.0
• release/v0.55.0
• remove-homebrew-cask
• return-partial-files
• sampleflags-test
• sei-recovery-point
• spherical-v1-no-xml
• sphericalv1
• stream-process
• test-header-parsing
• test-visualsampleentry
• tkhd-preserve-matrix
• update-changelog
• update-coverage-job
• update-docs
• update-make
• v0.48.0
• v0.49.0
• v0.50.0
• vtpl1-master
• vvc
• vvc-nal-headers
• wave-box
• wave-box-followups
• weird-dac3

Build # 37912595356

Build Type

Pull #640

github

Committed by tobbee

Commit Message

feat(mp4): open LocalFileResolver files through os.Root

LocalFileResolver checked locations lexically with filepath.IsLocal, so a symbolic link below its directory could lead to any file. It now opens the directory as an os.Root, available since Go 1.24, and the files through it, which also rejects links that lead outside, relative or absolute. Links that stay inside are still followed. The lexical check stays for a clear error on locations such as ../x.

The root is opened on the first resolve, so NewLocalFileResolver still returns no error, and Close closes it together with the files; a resolve after Close opens it again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #640: feat(mp4): read sample data from the files that a track's dref names

Coverage Stats

181 of 210 new or added lines in 6 files covered. (86.19%)

2 existing lines in 1 file now uncovered.

24022 of 29006 relevant lines covered (82.82%)

0.83 hits per line