From 446367f58dbd237ca6f47427d91cbe30b29de302 Mon Sep 17 00:00:00 2001 From: imSp4rky Date: Sun, 19 Jul 2026 10:21:47 -0600 Subject: [PATCH] fix: skip decrypt on mislabeled-clear segments --- unshackle/core/drm/clearkey.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/unshackle/core/drm/clearkey.py b/unshackle/core/drm/clearkey.py index f22aa906..43f93aa7 100644 --- a/unshackle/core/drm/clearkey.py +++ b/unshackle/core/drm/clearkey.py @@ -53,7 +53,16 @@ class ClearKey: file=path.name, ) - decrypted = AES.new(self.key, AES.MODE_CBC, self.iv).decrypt(path.read_bytes()) + data = path.read_bytes() + + # Guard mislabeled-clear: EXT-X-KEY says AES-128 but the segment is plaintext MPEG-TS. + # CBC ciphertext is 16-aligned, but so are some clear TS runs (752 bytes = 4 packets), + # so also sniff the 0x47 sync byte at packet 0 and 1. + is_ts = data[:1] == b"\x47" and data[188:189] == b"\x47" + if len(data) % AES.block_size != 0 or is_ts: + return + + decrypted = AES.new(self.key, AES.MODE_CBC, self.iv).decrypt(data) try: decrypted = unpad(decrypted, AES.block_size)