fix: harden playback and security edge cases

internal/service/ffmpeg_security.go

@@ -38,9 +38,9 @@ func EvaluateFFmpegSecurity(versionLine string) FFmpegSecurityStatus {
 		FixedVersion:  ffmpegPixelSmashFixedVersion,
 		ParsedVersion: fmt.Sprintf("%d.%d.%d", major, minor, patch),
 	}
-	if major == 8 && minor == 1 && patch < 2 {
+	if major == 8 && ffmpegVersionLess(major, minor, patch, 8, 1, 2) {
 		status.Status = "vulnerable"
-		status.Message = "当前 FFmpeg 8.1.x 版本低于 8.1.2，可能受 PixelSmash 解码漏洞影响；请升级 ffmpeg/ffprobe"
+		status.Message = "当前 FFmpeg 8.x 版本低于 8.1.2，可能受 PixelSmash 解码漏洞影响；请升级 ffmpeg/ffprobe"
 		return status
 	}
 	if major < 8 {
@@ -50,6 +50,16 @@ func EvaluateFFmpegSecurity(versionLine string) FFmpegSecurityStatus {
 	return status
 }
 
+func ffmpegVersionLess(major, minor, patch, fixedMajor, fixedMinor, fixedPatch int) bool {
+	if major != fixedMajor {
+		return major < fixedMajor
+	}
+	if minor != fixedMinor {
+		return minor < fixedMinor
+	}
+	return patch < fixedPatch
+}
+
 func parseFFmpegVersionLine(versionLine string) (major, minor, patch int, ok bool) {
 	match := ffmpegVersionRE.FindStringSubmatch(strings.TrimSpace(versionLine))
 	if len(match) < 3 {

internal/service/ffmpeg_security_test.go

@@ -0,0 +1,45 @@
+package service
+
+import "testing"
+
+func TestEvaluateFFmpegSecurityClassifiesPixelSmashFixedVersion(t *testing.T) {
+	tests := []struct {
+		name        string
+		versionLine string
+		want        string
+	}{
+		{
+			name:        "ffmpeg 8.0 is vulnerable",
+			versionLine: "ffmpeg version 8.0 Copyright",
+			want:        "vulnerable",
+		},
+		{
+			name:        "ffmpeg 8.1.1 is vulnerable",
+			versionLine: "ffmpeg version 8.1.1 Copyright",
+			want:        "vulnerable",
+		},
+		{
+			name:        "ffmpeg 8.1.2 is ok",
+			versionLine: "ffmpeg version 8.1.2 Copyright",
+			want:        "ok",
+		},
+		{
+			name:        "older major needs distro review",
+			versionLine: "ffmpeg version 7.1.2 Copyright",
+			want:        "review",
+		},
+		{
+			name:        "unrecognized is unknown",
+			versionLine: "not ffmpeg",
+			want:        "unknown",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := EvaluateFFmpegSecurity(tt.versionLine); got.Status != tt.want {
+				t.Fatalf("status = %q, want %q (%+v)", got.Status, tt.want, got)
+			}
+		})
+	}
+}