Module video_decode_ffmpeg 

Frame extraction for real-world containers, via ffmpeg.

Why a subprocess and not a linked decoder

The alternative evaluated was openh264 plus a pure-Rust MP4 demuxer. It builds quickly (~9 s on aarch64) and needs no runtime dependency, but it covers H.264 only — no H.265, VP9 or AV1, which is a large share of what people actually send — and Cisco’s royalty-free patent grant covers the binaries Cisco distributes, not a source build redistributed by a third party. That is a licensing question for the project to answer deliberately, not one to settle by adding a dependency.

ffmpeg as a subprocess needs no build or link dependency, decodes everything, and can be swapped for an in-process decoder later without changing this module’s signature. The cost is a runtime binary and a process spawn per request, so it is OPT-IN and the absence of the binary is reported by name rather than as a decode failure.

What is bounded

Everything the caller controls, because the input is an untrusted byte blob from an HTTP request:

• No shell. Arguments are passed as argv. Nothing is interpolated into a command string, so no input can become a flag or a second command.
• No temp file. The container goes in over stdin, so there is no path to traverse, collide on, or leave behind.
• -nostdin, and stdin is the pipe — ffmpeg cannot reach for a terminal or block waiting on one.
• Frame count capped with -frames:v, so a long clip cannot decode forever.
• Output size capped while reading, and the child is killed the moment the cap is passed.
• Wall clock capped by a watchdog that kills the child; a decoder that hangs must not hold a request thread indefinitely.
• Protocol whitelist is moot because the input is a pipe, but -f image2pipe output and a pipe:0 input mean ffmpeg is never asked to open a URL — the SSRF path that remote_image guards for stills simply does not exist here.

Structs

FfmpegPolicy

Operator policy for subprocess decoding.

Enums

Availability

What a startup probe found.

Functions

decode_frames

Decode bytes to RGB frames sampled at target_fps.

probe

Check at BOOT whether the configured decoder can actually run.