- Shipped
- August 27, 2026 at 5:08 PM UTC
- Author
- kamo
- Commit
- 36ed9e1
The existing cases build a header by hand, which tests the code against my belief about the format rather than against the format. These sixty-four-byte prefixes came off ffmpeg — the same libraries a browser recorder, a phone and a desktop capture tool write through. They caught nothing, and they pin the two assumptions worth pinning: WebM's DocType lands at offset 22, past where an ftyp brand would have stopped the read; and a real AVIF still carries an ftyp box, so without the brand allowlist a photo would be stored as video/mp4 and shown in a <video> element as a dead player.