Broken video/audio thumbnails because of corrupted blob meta data

[superbox3000]

Was asked to make a bug report after others in forum couldn't help. Here's the issue:

When MP3 files are uploaded, they are "split" into two new files: an MP3 and a new JPEG image. The problem is that the "new" MP3 file no longer has the image embedded, and the JPEG is corrupt.

The new MP3 created still works, but no longer has the cover image. Still, this isn't the original file we've uploaded, and there are bound to be new security issues because of this.

We have confirmed this happens on latest WP update (4.9.6.2.) as well as earlier versions. Please help!

[lukecavanagh]

mp3 Media Library issue

[lukecavanagh]

@superbox3000

Just verified, uploaded a mp3 file to a local dev site running WP 4.7.3. The mp3 file did have valid album artwork saved in the mp3 file.

[SergeyBiryukov]

Related: #40085

[ocean90]

wp_kses_post_deep() shouldn't be applied on blob data. Also, wp_kses_post_deep() changes all values to strings, see #35694.

40075.patch​ is a quick patch that backups the blob data and restores it after wp_kses_post_deep().

[lukecavanagh]

@ocean90 

The patch works fine, but if the media type was mp3, why would the extra jpg file need to generate as well for the mp3 file?

[lukecavanagh]

mp3 Media Library patch fix

[shiroamada]

It also happened to version 4.3.9

PHP Fatal error:  Call to undefined function wp_kses_post_deep() in /home/mywebsite/public_html/wp-admin/includes/media.php on line 3051

[swissspidy]

Replying to shiroamada:

It also happened to version 4.3.9

PHP Fatal error:  Call to undefined function wp_kses_post_deep() in /home/mywebsite/public_html/wp-admin/includes/media.php on line 3051

See #40085 for that.

[joemcgill]

I've got another approach in 40085.diff that should avoid touching blob data altogether. Feedback and testing would be appreciated.

[swissspidy]

Given that the patch on #40085 fixes this behaviour as well, I'm inclined to close this ticket as a duplicate.

[swissspidy]

Any additional eyes on 40085.diff would be really appreciated.

[SergeyBiryukov]

Uploaded a workaround plugin for both this ticket and and #40085, so that people on support forums could use it until 4.7.4 is available: ​https://wordpress.org/plugins/correct-audio-video-uploads/

The plugin is based on 40085.diff.

[joemcgill]

In 40400:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

Fixes #40075, #40085.

[swissspidy]

In 40460:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

Fixes #40075, #40085.

Merges [40400] to the 4.7 branch.

[swissspidy]

In 40461:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.6 branch.

[swissspidy]

In 40462:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.5 branch.

[swissspidy]

In 40463:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.4 branch.

[swissspidy]

In 40464:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.3 branch.

[swissspidy]

In 40465:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.2 branch.

[swissspidy]

In 40466:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.1 branch.

[swissspidy]

In 40467:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.0 branch.

[swissspidy]

In 40468:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.9 branch.

[swissspidy]

In 40469:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.8 branch.

[swissspidy]

In 40470:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.7 branch.