Subject: [websec] mimesniff feedback

From: Philip Jägenstedt <[email-masked]>
Date: Fri, 25 Nov 2011 14:37:50 +0100

http://tools.ietf.org/html/draft-ietf-websec-mime-sniff-03

The right column is misaligned for:

+-------------------+-------------------+-----------------+------------+
| FF FF FF FF FF FF | WS 3C 3f 78 6d 6c | text/xml        | Scriptable |
| Comment: <?xml (Note the case sensitivity and lack of trailing _>)  |
+-------------------+-------------------+-----------------+------------+

+-------------------+-------------------+-----------------+------------+
| FF FF FF FF FF    | 4F 67 67 53 00    | application/ogg | Safe       |
| Comment: An Ogg audio or video signature.                     |
+-------------------+-------------------+-----------------+------------+

Typo: "as define in"

In 6.1 "Signature for MP4":

* If implemented naively, it can "segfault" at step "If octets 5 through  
8..." for n<8.

* I don't know anything about the MP4 file format, but there's an  
off-by-one error in "If octets 4*i through 4*i + 3 (inclusive)". It seems  
likely that the magic bytes are aligned on 4 byte boundaries and that it  
should be "4*i+1 through 4*i+3". That'll also make the octet count 3, to  
match "mp4".

* The initial check is for n<4, but the algorithm can only return true for  
n>=12. Adjusting that solves the "segfault" as well.

-- 
Philip Jägenstedt
Core Developer
Opera Software

---

From: Adam Barth <[email-masked]>
Date: Fri, 25 Nov 2011 17:41:40 -0800

> The right column is misaligned for:

This appears to have already been fixed in my local copy.

> * If implemented naively, it can "segfault" at step "If octets 5 through

Fixed.

> * I don't know anything about the MP4 file format, but there's an off-by-one
> error in "If octets 4*i through 4*i + 3 (inclusive)". It seems likely that
> the magic bytes are aligned on 4 byte boundaries and that it should be
> "4*i+1 through 4*i+3". That'll also make the octet count 3, to match "mp4".

I've made all these indicies consistently zero-based and I've added a
note that the indicies are zero-based.

> n>=12. Adjusting that solves the "segfault" as well.

Fixed.

Thanks!
Adam