demux: grow MJPEG MP4 sample buffer

[yanyongxian]

Purpose

Prevent valid high-resolution MJPEG recordings from ending early when a
compressed sample exceeds the old 512 KiB MP4 read buffer. The reader returned
the same status as EOF, hiding the remaining frames from replay consumers.

Changes

• Grow and reuse a demuxer-owned heap buffer, with a 64 MiB allocation guard.
• Preserve the buffer and sample index on allocation failure; free it on close.
• Keep the existing Annex-B output limit and explicitly reject oversized
  non-JPEG samples rather than returning partial output.
• Add a hardware-independent sample-reader test and reproducible validation
  notes in docs/mp4_mjpeg_read_buffer.md.
• Base this focused fix on upstream 2a2dacd, without PR sys: add fixed DMA-BUF VDEC input pool #51, global stream
  payload changes, camera-sdk pins, or UAV changes.

Validation

• Host: cc -std=c11 -D_GNU_SOURCE -Wall -Wextra -Wno-unused-parameter -Werror
  -g -fsanitize=address,undefined -Iinclude test/test_mp4_read_buffer.c
  -o /tmp/test_mp4_read_buffer; ASAN_OPTIONS=detect_leaks=1
  /tmp/test_mp4_read_buffer: PASS.
• X86 cross build, SpacemiT v1.2.4 / GCC 15.2, Release:
  cmake --build .cross/build/mpp-mp4-mjpeg-read-buffer --parallel 4 --target
  mpp test_mp4_read_buffer test_sys_stream_ref test_vdec_stream_ref: PASS.
• K3 10.0.91.119, taskset -c 0-7: five sample-reader test runs plus existing
  SYS/VDEC reference-handoff unit tests: PASS.
• Existing 4000x1200 MJPEG MP4 (~45.49 seconds): unpatched upstream reader
  stopped at 794 packets; patched libmpp returned all 1363. First formerly
  rejected sample: 525556 bytes; maximum: 649848 bytes. Common packet sizes
  and PTS match; final PTS 45459474 us.
• ldd confirmed the isolated patched libmpp.so.1; binary SHA-256 and exact
  commands are documented. Initial wrong-SONAME harness run was rejected.
• git diff --check: PASS. New test formatted with clang-format.

Configuration and compatibility

No public API, SYS/VB layout, decoder input pool, or timestamp changes. Buffer
growth is ordinary heap allocation, not CMA. The 64 MiB low-level reader guard
does not change bind-mode DEMUX's independent 1 MiB stream limit. No large
H.264/H.265 support is claimed. Full camera/VDEC/VIO/LAS2/mapping/DRM integration
on the newly merged SYS ABI was not rerun; formal runtime and dependency pins
remain unchanged. This branch is for review, not an automatic SDK upgrade.

[spacemit-robot-ci]

Robot CI AI Review

• PR: demux: grow MJPEG MP4 sample buffer #55 demux: grow MJPEG MP4 sample buffer
• Project: components/multimedia/mpp
• Commit: 7661c1d3a11a

结论：暂无明确问题。

备注：worker-cache review 失败，已回退 baseline review：worker-cache review failed: snode5: fetch base failed: From github.com:spacemit-com/mpp
! [rejected] main -> refs/robot-ci/base/main (non-fast-forward); From github.com:spacemit-com/mpp
! [rejected] main -> refs/robot-ci/base/main (non-fast-forward); hp-probook: sync worker helper failed: ssh: connect to host 10.0.91.193 port 22: No route to host

[yanyongxian]

CI follow-up for 91f282c

Board CI now reports SUCCESS: shell/C++/Python style, package build and
package tests all passed (2m56s). The actual failed gate on the previous head
was CHECK(a >= b); this is now CHECK_GE(a, b).

I checked the remaining automated review statements against this exact head:

• Annex-B output capacity: the per-NAL output check requested by the
  review is already present in mpi/demux/container/mp4/mp4_demuxer.c, before
  both output memcpy calls:

  if (u32OutLen + 4 + nalLen > u32MaxOut)
      break;

  Thus the new raw-sample size guard is not the only capacity check. The
  existing converter replaces a length prefix (nls bytes) with a four-byte
  start code; it does not always add four bytes to the original NAL record.
  This MJPEG patch does not redesign the existing non-JPEG converter or
  claim general support for larger H.264/H.265 output.
• Standalone command: the document explicitly says "Run these commands
  from the MPP repository root" immediately before the command. Its quoted
  private-header include resolves beside the included implementation. The
  original command with only -Iinclude was actually rebuilt and run under
  ASan/UBSan with leak checking, both before and after the style fix: PASS.
  No extra installed MPP library or generated header was used.
• The review withdrew its ensure_read_buffer initialization/null-pointer
  finding after checking the guards. Likewise, the earlier review withdrew
  its sample-index and Close/Destroy ownership findings.
• 2026-09-22 is the actual validation date, consistent with the CI check's
  own UTC timestamps; it was not replaced with an invented 2025 date.

Revalidation also passed on K3 10.0.91.119: five reader regression runs,
mock SYS/VDEC reference tests, and the existing MP4 ledger comparison
(baseline 794 packets versus fixed 1363, common sizes/PTS identical).
Production libmpp.so is byte-identical to the previous PR head; this
follow-up changes only test assertions and explanatory documentation.
No full camera/decode/VIO/LAS2/mapping/display integration is claimed here.