format-probes: two adjacent start codes no longer panic the AVS3 probe #586

Merged

dcharlot merged 1 commit from wai/avs3-probe-panic into main 2026-11-02 20:12:45 -05:00

Conversation 0 Commits 1 Files changed 3 +44 -1

dcharlot commented 2026-11-02 14:19:09 -05:00

Owner

Copy link

A payload with a start code prefix directly after another (00 00 01 00 00 01) made the AVS3 unit split slice backwards and panic. A hostile payload could stop anything that probed it, and wai.video.avs3 and wai.audio.avs3 both go through that split.

The fix: that unit is now the empty one format-probes §8.2 reads, and the payload is refused because its first unit isn't a sequence header.

How it was found: by wai identify, still in progress, which runs every probe on whatever file it is given. Its test file happened to hold the pattern.

So that it stays found: a new test gives every probe 30,000 payloads of hostile bytes built from what their framing is made of, and another holds adjacent start codes to a refusal for AVS3 video and audio, H.265, H.266 and LCEVC. No other probe panicked. Both tests failed before the fix. format_probe_verify.py still passes.

🤖 Generated with Claude Code

A payload with a start code prefix directly after another (`00 00 01 00 00 01`) made the AVS3 unit split slice backwards and panic. A hostile payload could stop anything that probed it, and `wai.video.avs3` and `wai.audio.avs3` both go through that split. **The fix:** that unit is now the empty one format-probes §8.2 reads, and the payload is refused because its first unit isn't a sequence header. **How it was found:** by `wai identify`, still in progress, which runs every probe on whatever file it is given. Its test file happened to hold the pattern. **So that it stays found:** a new test gives every probe 30,000 payloads of hostile bytes built from what their framing is made of, and another holds adjacent start codes to a refusal for AVS3 video and audio, H.265, H.266 and LCEVC. No other probe panicked. Both tests failed before the fix. `format_probe_verify.py` still passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-11-02 14:19:09 -05:00

format-probes: two adjacent start codes no longer panic the AVS3 probe ... a924cdc8fd

A payload with a start code prefix directly after another (00 00 01 00 00 01)
made the unit split slice backwards and panic, so a hostile payload could stop
whatever probed it. It is now the empty unit §8.2 reads, and the payload is
refused as the first unit not being a sequence header.

The other probes do not have this shape, and a new test now holds that of all of
them: 30,000 payloads of hostile bytes, built from what their framing is made of.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 3d8b0e4f4a into main 2026-11-02 20:12:45 -05:00

dcharlot referenced this pull request from a commit 2026-11-02 20:12:45 -05:00

Merge pull request 'format-probes: two adjacent start codes no longer panic the AVS3 probe' (#586) from wai/avs3-probe-panic into main

dcharlot referenced this pull request 2026-11-02 22:06:44 -05:00

wai identify: what any file is, from its bytes alone #589

dcharlot referenced this pull request 2026-11-03 17:15:41 -05:00

wai identify, the carousel schedule and holdings: what a file is, when each object passes on a one-way bearer, and which neighbour holds it #605

dcharlot referenced this pull request 2026-11-04 05:21:33 -05:00

WLK1 for the link record, wai identify, the carousel schedule and holdings (replaces #604 and #605) #611

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!586

No description provided.