mathiasandClaude Sonnet 5.5
291a360a83
The upload is attacker-supplied and its CONTENT can steer ffmpeg to open other files or URLs (HLS/concat playlists). Pins -protocol_whitelist file,pipe and -format_whitelist to the containers real recordings use, before the input (after -i it would apply to the output). Verified with the real static ffmpeg 7.0.2 on koala: real AAC .m4a and WAV still probe/convert; a crafted concat file is rejected with 'Format not on whitelist'. Note ffmpeg 7.0.2 ALREADY refused the playlists tried without the whitelist, so the live check cannot prove the whitelist -- the argv unit tests do; this protects against a different ffmpeg version being put in the image. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
48 lines
1.7 KiB
Go
48 lines
1.7 KiB
Go
package audio
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"strings"
|
|
)
|
|
|
|
// FFmpeg converts any audio container to the strict format whisper wants: 16 kHz
|
|
// mono signed 16-bit PCM WAV (ADR-033). It ALWAYS transcodes, even when the input
|
|
// already is that format — a Teams export often is, and the transcode is then
|
|
// nearly free; assuming it would be the bug. This replaces whisper-server's
|
|
// --convert, whose --tmp-dir is created at process start and rots under macOS
|
|
// periodic cleanup.
|
|
type FFmpeg struct {
|
|
// Bin is the ffmpeg executable ("ffmpeg" resolves via PATH).
|
|
Bin string
|
|
}
|
|
|
|
// ToWAV writes src, converted, to dst. Video streams are dropped (-vn): by now the
|
|
// file has already been probed as audio-only, but a cover-art stream must not end
|
|
// up in the WAV.
|
|
func (f *FFmpeg) ToWAV(ctx context.Context, src, dst string) error {
|
|
bin := f.Bin
|
|
if bin == "" {
|
|
bin = "ffmpeg"
|
|
}
|
|
// Input restrictions go BEFORE -i: placed after it they would apply to the output.
|
|
args := append([]string{"-y", "-v", "error"}, inputRestrictions...)
|
|
args = append(args, "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", "-f", "wav", dst)
|
|
cmd := exec.CommandContext(ctx, bin, args...)
|
|
cmd.WaitDelay = killGrace
|
|
if out, err := cmd.CombinedOutput(); err != nil {
|
|
if ctxErr := ctx.Err(); ctxErr != nil {
|
|
return fmt.Errorf("audio: ffmpeg: %w", ctxErr)
|
|
}
|
|
return fmt.Errorf("audio: ffmpeg: %w: %s", err, strings.TrimSpace(string(out)))
|
|
}
|
|
// A zero exit that wrote nothing is still a failure: never hand whisper a
|
|
// missing file and let the error surface three layers later.
|
|
if info, err := os.Stat(dst); err != nil || info.Size() == 0 {
|
|
return fmt.Errorf("audio: ffmpeg wrote no output at %s", dst)
|
|
}
|
|
return nil
|
|
}
|