Media Decoding

Overview

Some PCC Agent workflows operate on compressed media, such as the HomeKit Secure Video Analysis workflow. Decoding compressed video and images means parsing byte streams with system code that implements a codec (coder/decoder) defined by a complex specification. That complexity gives an attacker an opportunity to exploit vulnerabilities in the codec implementation. To contain that risk, PCC does not decode media inside the workflow process. Instead, a workflow hands the compressed bytes to a dedicated media decode worker through a Delegated tool calls and receives back uncompressed pixel buffers or other safe formats.

Media decoder in PCC architecture

PCC Agent provides two tools for media decoding: VideoDecodingTool for video and ImageDecodingTool for images. The decoder runs on dedicated PCC nodes as the PCCMediaDecoder cloud application.

Supported formats

The decoder currently accepts:

Video

H.264 (AVC) and H.265 (HEVC) streams in MP4 or QuickTime containers. The caller requests a target number of frames; the decoder samples frames uniformly across the clip and, when the caller specifies a target size, downscales them with aspect-fit. The decoder returns uncompressed frames in a format such as 32-bit BGRA, each tagged with its presentation timestamp.

Images

HEIC images encoded with HEVC. The decoder returns pixel buffers in a supported non-YCbCr format such as 32-bit BGRA.

Security properties

The compressed media that a workflow hands to the decoder is untrusted input. We treat this decode step as its own attack surface and apply multiple defenses to hinder exploitation and contain any compromise:

Out-of-process decode

The decoder runs on a dedicated worker node reached only through a Delegated tool calls. The calling workflow never executes codec code; it sends compressed bytes and receives back pixel buffers.

Software-only decode

The worker decodes in software rather than using hardware accelerators. Keeping the codec implementation in software holds it within the same memory-safety and sandboxing regime as the rest of PCC user space, at the cost of GPU acceleration for the decode stage.

Enhanced-security sandbox

The decoder runs under the same class of enhanced security sandbox that is available to app extensions for parsing untrusted input, similar to the sandbox used by BlastDoor. The system calls and inter-process (Mach) services the decoder can use are confined to an explicit allow list, narrowing the kernel attack surface reachable from a compromised decoder.

Bounded inputs

Before decoding, the decoder validates video against a maximum-dimensions limit and images against a maximum pixel area, and rejects media that exceeds them, bounding the work a malformed or oversized input can induce.

Per-request process

The decoder is a Per-request isolation that terminates when the request completes. Each request gets a fresh decode session, and the worker retains no media or pixel state across requests, so an attacker who gains code execution inside the decoder loses that foothold at the end of the request.