vicrodh
62dc3f55aa
Merge branch 'pr/601' into integration/pr-review-smoke-2026-07-13
2026-07-13 14:08:28 -06:00
Afonso Jorge Ramos
e153673acf
fix(cmaf): fail init parse when raw_data length exceeds payload
...
Do not advance the cursor by an unclamped raw_len after a truncated slice.
2026-07-13 13:48:40 +02:00
Afonso Jorge Ramos
19b1c2bead
fix(cmaf): fail closed on invalid session-key seed hex
...
Reject odd length and non-hex digits instead of zero-filling bad nibbles.
2026-07-12 23:33:14 +02:00
vicrodh
4505312280
fix(security): remove hardcoded crypto seed from cmaf crate
...
Move the CMAF app seed from a hardcoded constant in qbz-cmaf to a
parameter passed by callers. The seed now lives in qbz-qobuz::auth
where other app-level constants are defined. This resolves CodeQL
alerts for hard-coded cryptographic values.
Also truncate session_id in logs to avoid cleartext logging of
sensitive session identifiers.
cc
2026-04-07 07:04:33 -06:00
vicrodh
b3a9069712
feat(cmaf): add CMAF segment parser
...
Parse init segment (FLAC header + segment table) and audio segments
(frame entries with IVs for AES-CTR decryption).
cc
2026-04-06 13:12:55 -06:00
vicrodh
794dd9f24c
feat(cmaf): add qbz-cmaf crate with crypto module
...
HKDF-SHA256 session key derivation, AES-128-CBC content key unwrap,
AES-128-CTR frame decryption, and MD5 request signing for Qobuz
CMAF segmented streaming.
cc
2026-04-06 13:10:00 -06:00
vicrodh