@@ -360,11 +360,18 @@ function parseBoxes(buf, start, end, cb) {
360360 } else if ( size < 8 ) {
361361 break
362362 }
363- if ( off + size > end ) size = end - off
364363
365364 let bodyOff = off + 8
365+ let truncated = off + size > end
366366
367- if ( type === 'stsd' ) parseSampleDesc ( buf , bodyOff , size - 8 , cb )
367+ // mdat carries raw frames — partial is fine; callers honour availability
368+ if ( type === 'mdat' ) {
369+ cb ( type , buf . subarray ( bodyOff , truncated ? end : off + size ) , bodyOff )
370+ if ( truncated ) break
371+ }
372+ // any other box must be fully present before parsing — partial tables yield garbage
373+ else if ( truncated ) break
374+ else if ( type === 'stsd' ) parseSampleDesc ( buf , bodyOff , size - 8 , cb )
368375 else if ( CONTAINERS . has ( type ) ) parseBoxes ( buf , bodyOff + ( type === 'meta' ? 4 : 0 ) , off + size , cb )
369376 else cb ( type , buf . subarray ( bodyOff , off + size ) , bodyOff )
370377
@@ -432,8 +439,10 @@ function extractFrames(buf, stsz, stco, stsc) {
432439 }
433440 let off = stco [ ci ]
434441 for ( let s = 0 ; s < spc && si < stsz . length ; s ++ ) {
435- let sz = stsz [ si ++ ]
436- if ( off + sz <= buf . length ) frames . push ( buf . subarray ( off , off + sz ) )
442+ let sz = stsz [ si ]
443+ if ( off + sz > buf . length ) return frames // sequential: first missing → rest missing
444+ frames . push ( buf . subarray ( off , off + sz ) )
445+ si ++
437446 off += sz
438447 }
439448 }
0 commit comments