package video import ( "context" "fmt" "github.com/disintegration/imaging" "image" "image/png" "io" "os" "os/exec" "strings" "time" ) var ( ProcessingDeadline = 2 * time.Second // 75 concurrent ffmpeg processes are enough to swap the box out on their // own, bomb or no bomb. semaphore = make(chan struct{}, 16) ) func generatePreview(ctx context.Context, inp string, out string) error { // Reject decompression bombs before ffmpeg expands a frame into memory. if err := checkGeometry(ctx, inp); err != nil { return err } // -max_alloc caps a single ffmpeg allocation: a 1080p frame needs ~8 MB, a // 16383x16383 bomb needs ~1 GB. Second line of defence behind checkGeometry, // and it works even when the probe told us nothing. cmd := exec.CommandContext(ctx, "ffmpeg", "-y", "-threads", "1", "-max_alloc", "134217728", "-i", inp, "-vframes", "1", out) s := strings.Builder{} cmd.Stdout = &s cmd.Stderr = &s err := cmd.Run() if err != nil { fmt.Println(s.String()) } return err } func GeneratePreview(ctx context.Context, inp string, out string) error { select { case semaphore <- struct{}{}: ctx, cancel := context.WithTimeout(ctx, ProcessingDeadline) defer func() { cancel() <-semaphore }() return generatePreview(ctx, inp, out) case <-ctx.Done(): return ctx.Err() } } func Blur(inp string, out string) error { f, err := os.Open(inp) if err != nil { return err } defer f.Close() // Same guard on the decode side: imaging.Blur keeps several copies of the // bitmap alive, so an oversized preview is an OOM all by itself. cfg, _, err := image.DecodeConfig(f) if err != nil { return err } if cfg.Width*cfg.Height > MaxPixels { return fmt.Errorf("preview %dx%d is too large to blur", cfg.Width, cfg.Height) } if _, err := f.Seek(0, io.SeekStart); err != nil { return err } img, _, err := image.Decode(f) if err != nil { return err } outimg := imaging.Blur(img, 5) outfile, err := os.Create(out) if err != nil { return err } defer outfile.Close() return png.Encode(outfile, outimg) }