Re: [websec] mimesniff feedback

[Adam Barth <[e-mail]>]

On Fri, Nov 25, 2011 at 5:37 AM, Philip Jägenstedt <[e-mail]> wrote:
> http://tools.ietf.org/html/draft-ietf-websec-mime-sniff-03
>
> The right column is misaligned for:
>
> +-------------------+-------------------+-----------------+------------+
> | FF FF FF FF FF FF | WS 3C 3f 78 6d 6c | text/xml        | Scriptable |
> | Comment: <?xml (Note the case sensitivity and lack of trailing _>)  |
> +-------------------+-------------------+-----------------+------------+
>
> +-------------------+-------------------+-----------------+------------+
> | FF FF FF FF FF    | 4F 67 67 53 00    | application/ogg | Safe       |
> | Comment: An Ogg audio or video signature.                     |
> +-------------------+-------------------+-----------------+------------+
>
> Typo: "as define in"

This appears to have already been fixed in my local copy.

> In 6.1 "Signature for MP4":
>
> * If implemented naively, it can "segfault" at step "If octets 5 through
> 8..." for n<8.

Fixed.

> * I don't know anything about the MP4 file format, but there's an off-by-one
> error in "If octets 4*i through 4*i + 3 (inclusive)". It seems likely that
> the magic bytes are aligned on 4 byte boundaries and that it should be
> "4*i+1 through 4*i+3". That'll also make the octet count 3, to match "mp4".

I've made all these indicies consistently zero-based and I've added a
note that the indicies are zero-based.

> * The initial check is for n<4, but the algorithm can only return true for
> n>=12. Adjusting that solves the "segfault" as well.

Fixed.

Thanks!
Adam