Transaction Science c3f833ab99 wai-pack: the WAV reader forms 2 x channels without wrapping, and no header sizes a buffer ...

Fix round, item 1. align != 2 * channels was u16 arithmetic: 32768 channels
panicked a debug build and, with an alignment of 0, a release build accepted
it; 32769 with 2 likewise. The check is now channels.checked_mul(2) ==
Some(align), as the spec and pack_verify.py read it. A block and a Y4M frame
grow with the bytes read, never to a size the file declares, and the corpus
check reads WAV data in bounded blocks: a 4 GiB data claim over 4 bytes
allocates about 4 bytes.

- Corpus: channels 32768 (alignment 0) and 32769 (alignment 2), and a
  4 GiB data claim.
- Release builds of wai-pack check overflow (profile.release), so CI's
  release tests catch this class.
- tests/source_alloc.rs bounds what a reader allocates for such files.
- source_diff.py (from the review's differential, seeded): Y4M and WAV
  mutations, every verdict of wai-pack source-verdict equal to
  pack_verify.py's; CI runs it against debug and release builds.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-05 09:03:36 -04:00

48 B

Raw Permalink History