fix(mux)!: stream fMP4 media payloads and bound held metadata

doc/lib/rs/moq-mux.md

@@ -13,7 +13,7 @@ back. This is what `moq import` / `export` and the gateways are built on.
 
 | Format | Import | Export | Notes |
 | --- | --- | --- | --- |
-| fMP4 / CMAF | yes | yes | Audio/video unwrapped to `legacy` by default, or passed through as `cmaf` with `with_passthrough`; `wvtt` subtitles import as timed WebVTT text and `stpp` TTML (IMSC timing profile) as `ttml` documents on the broadcast clock, preserving source language and label when present; other subtitle codecs are skipped. |
+| fMP4 / CMAF | yes | yes | Audio/video unwrapped to `legacy` by default, or passed through as `cmaf` with `with_passthrough`; `wvtt` subtitles import as timed WebVTT text and `stpp` TTML (IMSC timing profile) as `ttml` documents on the broadcast clock, preserving source language and label when present; other subtitle codecs are skipped. Import streams media samples as they arrive; each track's samples must be in forward byte order, and a `moov`, `moof`, or text sample over 32 MiB is refused. |
 | MPEG-TS | yes | yes | H.264/H.265; AAC, MP2, AC-3, E-AC-3, Opus up to 7.1; SCTE-35 sections and every other undecoded PES stream (KLV, subtitles, DVB AC-3) as tracks; service tables round-trip. |
 | FLV / RTMP | yes | yes | Legacy H.264 + AAC + MP3, plus enhanced-RTMP HEVC, AV1, VP9, Opus, AC-3, E-AC-3, and multitrack. |
 | Matroska / WebM | yes | yes | Import streams each block into its frame in one pass, retaining no declared size. It refuses subtitle tracks, CMAF output, and video `BlockGroup`s with fields after their `Block`: remux video as `SimpleBlock`s and extract subtitles separately. |

quest/m1/security-audit/README.md

@@ -54,6 +54,5 @@ Dropped, with reasons:
 
 ## Required
 
-- [fMP4 import streams mdat](/quest/m1/security-audit/fmp4-stream-mdat.md) - a box header declaring a huge size cannot pin importer memory across segments
 - [Browser input checks](/quest/m1/security-audit/js-input.md) - room metadata is schema-validated and the http:// fingerprint fetch is aborted and length-checked
 - [CI tool pins](/quest/m1/security-audit/ci-pins.md) - binding generators are pinned by commit in one place, and the remaining unpinned installs and broad token grants are fixed

rs/moq-mux/benches/containers.rs

@@ -132,10 +132,20 @@ fn cmaf_import(passthrough: bool) -> (moq_mux::catalog::Producer, moq_mux::conta
 }
 
 fn import_cmaf(
+	import: (moq_mux::catalog::Producer, moq_mux::container::fmp4::Import),
+	data: &Bytes,
+) -> (moq_mux::catalog::Producer, moq_mux::container::fmp4::Import) {
+	import_cmaf_chunks(import, data, data.len())
+}
+
+fn import_cmaf_chunks(
 	(catalog, mut import): (moq_mux::catalog::Producer, moq_mux::container::fmp4::Import),
 	data: &Bytes,
+	chunk: usize,
 ) -> (moq_mux::catalog::Producer, moq_mux::container::fmp4::Import) {
-	import.decode(data).unwrap();
+	for chunk in data.chunks(chunk) {
+		import.decode(chunk).unwrap();
+	}
 	import.finish().unwrap();
 	(catalog, import)
 }
@@ -272,16 +282,22 @@ fn interleaved_runs(c: &mut Criterion) {
 				for (direction, passthrough) in [("import", true), ("unwrap", false)] {
 					let mut group = c.benchmark_group(format!("cmaf-interleaved-{direction}"));
 					group.throughput(Throughput::Bytes(data.len() as u64));
-					group.bench_function(
-						BenchmarkId::new(format!("{tracks}tracks"), format!("{runs}runs-{size}bytes")),
-						|b| {
-							b.iter_batched(
-								|| cmaf_import(passthrough),
-								|import| import_cmaf(import, std::hint::black_box(&data)),
-								BatchSize::PerIteration,
-							);
-						},
-					);
+					for chunk in [1, 1024, data.len()] {
+						group.bench_function(
+							BenchmarkId::new(
+								format!("{tracks}tracks"),
+								format!("{runs}runs-{size}bytes-{chunk}chunk"),
+							),
+							|b| {
+								b.iter_batched(
+									|| cmaf_import(passthrough),
+									|import| import_cmaf_chunks(import, std::hint::black_box(&data), chunk),
+									BatchSize::PerIteration,
+								);
+							},
+						);
+					}
+
 					group.finish();
 				}
 			}