Converting videos produces small files that start with GIF89a

[tfs]

Hello,

I have the folowing problem.

I allowed users of my website to upload videos and I use getID3(). All vides are being converted to mp4 format. In most cases everything works perfect but every day some video fails - mp4 file does not play.

When I open the problematic file in a text editor, I see the following:

Code: Select all

GIF89a  €  ÿÿÿ   !ù    ,       „	 ;

The file size is 45 bytes.

I don't allow to upload gif files, the only allowed formats are:

Code: Select all

wmv|avi|mpg|mp4|mov|ogg|flv|3gp|3g2|m4v

I have tested and it's not possible to upload other file types .

Each file is being checked twice:
1) By a jquery script when user selects file,
2) By a php script + getID3() that checks:
- mime type, frame_rate, playtime_seconds, file type.

I tried to rename a gif file to mp4. I can not upload it and I am getting error about wrong mime type.

Do you have any idea where is the problem? What produces files that start with "GIF89a"?

Below are my avconv commands that I use in php to convert files to mp4:

Code: Select all

$thuc = exec("avconv -y -i $file -map 0 -c:v libx264 -crf 22 -c:a copy $file2");

if ($video_width > 800) {
$thuc = exec("avconv -y -i $file2 -filter:v scale=\"750:trunc(ow/a/2)*2\" -c:a copy $file3");
}

Thanks.

[James Heinrich]

If the file starts with "GIF89a" then it's a GIF (version 89a is the defacto standard that's been around for ~30 years). GIF is often a still image, but may be animated, giving one of the oldest "video" formats. A 45-byte GIF file, however, is probably very tiny and likely not-animated. getID3 should be able to give you details of it.

User-side browser/javascript type checks are easily bypassed, either unintentionally (user has javascript disabled, for example) or maliciously (bypassing your upload form entirely and posting a crafted query directly). User-side checks are good for your site's users, but your backend code needs to be prepared to handle any nonsense that may get uploaded.

You said you're already checking the file uploads for validity with getID3, so I'm not sure what else you need?