JMR-dev/LibreMediaConverter
1
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases Wiki Activity

R5 — Media3Engine builds EditedMediaItem/Composition unguarded on the HandlerThread; a picker-reachable spec throws there #14

New Issue
Closed
opened 2026-08-23 03:44:43 +00:00 by JMR-dev · 0 comments
JMR-dev commented 2026-08-23 03:44:43 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Finding R5 from the overnight max-effort review (Fable lead, Opus sub-agents). Full report: scratchpad/overnight/REVIEW.md.

R5 — Media3Engine builds EditedMediaItem/Composition unguarded on the HandlerThread; a picker-reachable spec throws there

severity: medium
verdict: CONFIRMED (reachability demonstrated on the JVM; process-death consequence read, not executed)
where: app/src/main/java/org/libremediaconverter/convert/Media3Engine.kt:80-90 (file unchanged tonight; this answers the audit's own D14 open question about the other native boundaries)
scenario: Audio-only input (MP3) + Advanced picker Container=MP4, Video=H.265, Audio=NONE: CopyPlanner yields (Drop, Drop); ContainerCapabilities.validate says Valid (the COPY form is correctly rejected, the H264/H265 form is not); router sends it to MEDIA3. EditedMediaItem's constructor checkState("Audio and video cannot both be removed") throws IllegalStateException at :83 — on the media3-transformer HandlerThread, outside both runCatching blocks, invisible to the worker's catch(Throwable) and leaving the continuation permanently unresumed; an uncaught handler-thread exception kills the process.
evidence: JVM probe in reviewer clone: plan=(Drop,Drop), validation=Valid, engine=MEDIA3 for H265+NONE and H264+NONE; Invalid for COPY+NONE. checkState read from media3-transformer-1.11.0-sources.jar EditedMediaItem.java:368-369. Lead re-read Media3Engine.kt:71-100 and confirmed lines 80-90 sit between the two runCatching blocks. FFmpegEngine and ConcatEngine checked clean (every call inside worker catch(Throwable), including FFmpegEngine's init).
fix: Widen the existing runCatching to cover the builders (backstop). Separately decide whether validate() should reject encode-video-into-a-file-with-no-video-track as it already does for COPY — that is the real defect.
risk: Guard-widening is behaviour-neutral on success. The validation change newly refuses a picker-enabled combination -> needs its own test. Plan/validate/route chain is JVM-testable; the actual throw needs an instrumented test.

Cut: below — held for manual review: product decision, CI/workflow, hardware, or PLAUSIBLE verdict.

🤖 Generated with Claude Code

_Finding **R5** from the overnight max-effort review (Fable lead, Opus sub-agents). Full report: `scratchpad/overnight/REVIEW.md`._ ### R5 — Media3Engine builds EditedMediaItem/Composition unguarded on the HandlerThread; a picker-reachable spec throws there severity: medium verdict: CONFIRMED (reachability demonstrated on the JVM; process-death consequence read, not executed) where: app/src/main/java/org/libremediaconverter/convert/Media3Engine.kt:80-90 (file unchanged tonight; this answers the audit's own D14 open question about the other native boundaries) scenario: Audio-only input (MP3) + Advanced picker Container=MP4, Video=H.265, Audio=NONE: CopyPlanner yields (Drop, Drop); ContainerCapabilities.validate says Valid (the COPY form is correctly rejected, the H264/H265 form is not); router sends it to MEDIA3. EditedMediaItem's constructor checkState("Audio and video cannot both be removed") throws IllegalStateException at :83 — on the media3-transformer HandlerThread, outside both runCatching blocks, invisible to the worker's catch(Throwable) and leaving the continuation permanently unresumed; an uncaught handler-thread exception kills the process. evidence: JVM probe in reviewer clone: plan=(Drop,Drop), validation=Valid, engine=MEDIA3 for H265+NONE and H264+NONE; Invalid for COPY+NONE. checkState read from media3-transformer-1.11.0-sources.jar EditedMediaItem.java:368-369. Lead re-read Media3Engine.kt:71-100 and confirmed lines 80-90 sit between the two runCatching blocks. FFmpegEngine and ConcatEngine checked clean (every call inside worker catch(Throwable), including FFmpegEngine's init). fix: Widen the existing runCatching to cover the builders (backstop). Separately decide whether validate() should reject encode-video-into-a-file-with-no-video-track as it already does for COPY — that is the real defect. risk: Guard-widening is behaviour-neutral on success. The validation change newly refuses a picker-enabled combination -> needs its own test. Plan/validate/route chain is JVM-testable; the actual throw needs an instrumented test. --- **Cut:** `below` — held for manual review: product decision, CI/workflow, hardware, or PLAUSIBLE verdict. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
above-cut
Worked autonomously overnight: local, JVM-verifiable, no product decision
 accessibility
Barrier affecting people with disabilities
 backlog
Held for manual review: product/UX call, CI/workflow, hardware, or unverifiable here
 bug
Something isn't working
 confirmed
Reviewer demonstrated the defect
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 plausible
Reviewer could not fully demonstrate it; treat as unproven
 question
Further information is requested
 sev:high
High severity
 sev:low
Low severity
 sev:medium
Medium severity
 wontfix
This will not be worked on
No labels backlog bug confirmed sev:medium
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
JMR-dev
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: JMR-dev/LibreMediaConverter#14