[kixelated]

Problem

moq-mux used mp4-atom 0.17.0, which lacks the upstream sgpd entry-count and zero-size iloc extent bounds. The current metadata preflight already protects these inputs; the dependency should enforce its own bounds too.

Approach

• Require mp4-atom 0.17.1 and update only its lockfile entry.
• Commit the original sgpd, iref, and iloc CMAF reproductions from the fuzz findings, plus fMP4 counterparts for streaming ingest.
• Remove the temporary local per-entry sgpd/iloc bounds now supplied upstream; keep the aggregate group budget and exercise the dependency directly in the zero-size-entry tests.
• Adapt import and synthesis to the dependency’s repeated colr boxes; preserve codec-first colour precedence and test an ICC profile followed by CICP metadata.
• Complete and remove both mp4-atom quests with quest rm, including their links.

Verified v0.17.1 contains the sgpd fix and the iloc fix: GitHub compare reports both as ancestors (behind_by=0). The crates.io index lists 0.17.1 as published on 2026-11-04 and not yanked; Cargo resolves its matching checksum.

Impact

• Public API: none.
• Wire: none.

Alternatives

Retaining 0.17.0 would rely solely on moq-mux's preflight. Use the released upstream fixes as well.

Choices made without asking

Color boxes fill missing catalog fields in input order, skipping ICC profiles that have no CICP mapping. Synthesis still writes at most one box.

The fMP4 fixtures use a zero write-size selector and wrap the original atoms in moov, because streaming ingest skips other top-level boxes. The CMAF reproductions stay byte-for-byte unchanged.

Validation

• quest check --base origin/main: 588 documents pass; both completed quests and their links are removed.
• Final quest gate just ci: all 11,691 tests pass (135 skipped), including the allocation-bounded regression corpus, direct mp4-atom zero-size-entry tests, and ICC/CICP colour test. Every selected module passes except flake.
• quest gate just rs test -p moq-mux --features fuzz: 2,061 passed, 3 skipped before removing the duplicate guards; final CI covers the updated guards and corpus.
• Pre-existing host failure: nix flake check --print-build-logs fails building github-runner because unshare cannot write /proc/self/uid_map (Operation not permitted). Reproduced unchanged on base 0eee916849a57335effff60213d0c473b0193848, with the identical failing derivation k6j6qw86x77lz6dnl2wqbxi86cjy31yw-github-runner.drv. No harness changes or checks disabled.
• Before the bump, the same regression corpus passed on 0.17.0 due to the local guards; those obsolete guards are now removed.

Follow-ups

Repair the host’s Nix runner image-test user namespace permissions so the unmodified flake check can run. This reproduces on base and is outside the dependency bump.

Review

• Claude Code, Claude Opus 5.5, medium effort, quest review --base origin/main, round 2.
• Reviewed head: cf41a5624bd3dc70ae68382cd73d7fb5769b45ae.
• Round 1 finding fixed: removed obsolete local atom-entry checks and moved their focused edge cases to direct dependency decoding.
• Round 2: no findings.

(Written by GPT-6.1 Sol with high reasoning effort)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a1d0fe30-7d07-47b7-8a66-098e8a960f11

Commits

Reviewing files that changed from the base of the PR and between ac0f04e and cf41a56.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 15

• Cargo.toml
• quest/m1/fuzz-findings/README.md
• quest/m1/fuzz-findings/mp4-atom-bump.md
• quest/m1/fuzz-findings/mp4-atom-iloc.md
• rs/moq-mux/fuzz/regressions/README.md
• rs/moq-mux/fuzz/regressions/cmaf/mp4-atom-iloc
• rs/moq-mux/fuzz/regressions/cmaf/mp4-atom-iref
• rs/moq-mux/fuzz/regressions/cmaf/mp4-atom-sgpd
• rs/moq-mux/fuzz/regressions/fmp4/mp4-atom-iloc
• rs/moq-mux/fuzz/regressions/fmp4/mp4-atom-iref
• rs/moq-mux/fuzz/regressions/fmp4/mp4-atom-sgpd
• rs/moq-mux/src/container/fmp4/import.rs
• rs/moq-mux/src/container/fmp4/import_test.rs
• rs/moq-mux/src/container/fmp4/metadata.rs
• rs/moq-mux/src/container/fmp4/mod.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed head cf41a5624bd3dc70ae68382cd73d7fb5769b45ae against base ac0f04e5dcca9a9a07d15135dc2e904215c494f3.

No actionable finding in the inspected dependency, preflight and colour-handling changes. The upstream 0.17.1 tag contains both count bounds before their affected allocations; the local aggregate sample-group budget remains. The committed CMAF inputs match the referenced reproductions, and the fMP4 variants frame the same atoms for streaming ingest. Multiple colr boxes are consumed in order while codec colour retains precedence, including the added ICC-then-CICP case. The stricter duplicate-box handling is also part of this upstream release.

Verification: GitHub-only static inspection of the upstream tag, local preflight, importer and test corpus, with an independent pass. I did not run Cargo, fuzz regression tests or media interoperability checks, or independently verify the crates.io artifact checksum.

(Written by review (OpenAI))

[pullfrog]

✅ No new issues found.

Reviewed changes

• mp4-atom 0.17.1 — workspace requirement and lockfile move to the release carrying the upstream sgpd entry-count and zero-size iloc extent bounds; the lockfile checksum matches the published crate.
• Preflight guards retired — metadata.rs drops the local per-entry sgpd/iloc checks that duplicated 0.17.1, keeps the aggregate sample-group budget, and moves the focused edge cases to direct mp4_atom::Any decoding.
• Repeated colr boxes — import walks every box in input order, letting CICP fill catalog gaps while ICC profiles are skipped and codec-supplied colour keeps precedence; synthesis still writes at most one box.
• Regression corpus — six sgpd/iref/iloc cmaf and fmp4 fixtures added under fuzz/regressions with README notes on the init-length and moov wrapping, replayed under the allocation bound.
• Quests — both mp4-atom quests removed and their links dropped from the fuzz-findings index.

I verified the crates.io artifact checksum and inspected 0.17.1's iloc and sgpd decoders: both bounds run before the affected allocations, so retiring the local guards is safe. The wrapped fmp4 fixtures still exercise those decoders because Any::decode_maybe decodes the atom before the typed Moov rejects it.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}