Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(mp4): reject ftyp and styp boxes with a payload shorter than 8 bytes

MajorBrand slices data[:4] and MinorVersion slices data[4:8] with no
guard, and CompatibleBrands computes (len(data)-8)/4, which goes
negative. A box declaring an 8-byte size therefore decoded without
error and then panicked on first access:

  $ mp4ff-info short.mp4
  [ftyp] size=8
  panic: runtime error: slice bounds out of range [:4] with capacity 0

Check the payload length at decode, the way DecodeSdtpSR, DecodeMimeSR
and DecodeFrmaSR already do.

styp needs two guards because DecodeStyp does not delegate to
DecodeStypSR the way DecodeFtyp does.