fix(mediaplayer): play YouTube live streams (long CDN URLs were being truncated)

Basis/Packages/com.basis.integration.ytdlp/TESTING.md

@@ -41,7 +41,7 @@ from the front page, plus a recent VOD from the same channel.
 | --- | --- |
 | YouTube VOD, >360p | Resolves to a **split stream** (capability-selected H.264/VP9/AV1 video-only + AAC or Opus-fallback audio-only), plays paced as on-demand, A/V locked |
 | YouTube VOD, ≤360p (or format-forced) | Single muxed stream, delivery auto-detected |
-| YouTube live | Single HLS playlist, plays as live |
+| YouTube live | Single HLS playlist, joining near the live edge. Worth re-running after any HLS change: unlike Twitch, the media playlist lists the entire DVR window — thousands of segments, several MB of text, segment URIs past 1 KB — so it is the lane that exercises the parser's size limits |
 | Twitch live | HLS live; join near the live edge |
 | Twitch VOD | HLS VOD |
 | Format selection, VP9-capable platform without AV1 decode | A 4K upload resolves to the **VP9 video-only rung up to 2160p** (WebM or MP4 carriage) + `mp4a` audio as a split stream; a 1080p-max upload still resolves to `avc1` (avc1 wins at equal height) |

Basis/Packages/com.basis.mediaplayer/Native~/basis_media_core.c

@@ -1271,11 +1271,16 @@ static basis_media_engine_t* open_impl(const char* url, const char* audio_url, i
     e->paced_hint = delivery_hint;
     e->paced = (delivery_hint == 2) ? 1 : 0;
     e->pace_delivery = e->paced; /* VOD paces delivery; run_hls also enables it for live HLS */
+    /* Reject an over-long URL rather than storing a prefix: e->url is what every
+     * fetch re-sends, and a clipped one is a request the origin refuses with
+     * nothing to distinguish it from a genuine authorisation failure. */
+    if (strlen(url) >= sizeof(e->url)) { free(e); return NULL; }
     strncpy(e->url, url, sizeof(e->url) - 1);
     if (basis_url_parse(url, &e->parts) != 0) { free(e); return NULL; }
 
     int has_audio = (audio_url && audio_url[0]);
     if (has_audio) {
+        if (strlen(audio_url) >= sizeof(e->url_audio)) { free(e); return NULL; }
         strncpy(e->url_audio, audio_url, sizeof(e->url_audio) - 1);
         if (basis_url_parse(audio_url, &e->parts_audio) != 0) { free(e); return NULL; }
     }

Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_url.c

@@ -71,7 +71,10 @@ int basis_url_parse(const char* url, basis_url_t* out) {
      * host:port. */
     if (*host_end) {
         size_t pathlen = strlen(host_end);
-        if (pathlen >= sizeof(out->path)) pathlen = sizeof(out->path) - 1;
+        /* Reject rather than truncate. Callers dispatch on what the path ends
+         * with, so a clipped path silently reroutes the URL to the wrong
+         * handler instead of failing where it can be reported. */
+        if (pathlen >= sizeof(out->path)) return -1;
         memcpy(out->path, host_end, pathlen);
         out->path[pathlen] = 0;
     } else {

Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_url.h

@@ -10,7 +10,11 @@ typedef struct basis_url {
     char scheme[16];   /* lowercased: rtsp, rtspt, rtmp, rtmps, http, https, rist */
     char host[256];
     int  port;         /* defaulted per scheme when absent */
-    char path[1024];   /* everything after the host, including leading '/' and query */
+    /* Everything after the host, including leading '/' and query. Sized to hold
+     * the path of any URL the engine accepts (its url buffer is 2048), because
+     * callers route on the path's content — a CDN-signed URL that overflowed
+     * here would lose its ".m3u8" tail and be dispatched as something it isn't. */
+    char path[2048];
     char user[128];
     char pass[128];
     int  tls;          /* 1 for rtmps/https */