Media parser tests

Each file targets a parser reachable from web content or system apps. When a file crashes an app, the page cannot see it — so confirm manually and tap Crash to log it. On the jailbroken handset, correlate with MobileSlideShow / mediaserverd / webcontent crash reports.

ImageIOihuge.png — absurd IHDR dimensions (allocator stress)

Open in Safari · Download

① Opens inline — Safari decodes via ImageIO.
② Long-press → Add to Photos, then open Photos app → thumbnail render hits ImageIO again.
Crash = Photos/Safari dies, spinner forever, or respring.

ImageIOiccp_big.png — iCCP size-field inconsistency

Open

Same flow as above. Profile parsing runs even when the pixel data is trivial.

ImageIOjsof0_huge.jpg — SOF0 with 0xFFFF dims, truncated scan

Open

Save to Photos; JPEG dims/metadata parsed on import → crash during import or thumbnail.

ImageIOtiff_loop.tiff — self-referential IFD

Open

TIFF IFD walking is a classic ImageIO crash surface; metadata parse on load.

ImageIO · RawCameradng_poc.dng — DNG / JPEG-lossless inconsistency (CVE-2025-43300 class)

Open · variant 2

① Safari may preview via ImageIO directly.
② Save to Files, then share sheet → Print or open in Photos — RAW decode path.
Crash = sudden app exit on the decode step. On iOS 16 the parse path exists but predates the 18.6.2 fix — behavior may differ; report whatever happens.

CoreAudiomp3_trunc.mp3 — truncated frame after valid sync

Play in page · Download

① The in-page player decodes via WebKit → CoreAudio.
② After download: Files → share → GarageBand/Music-capable app; or re-import via iTunes-style app. Crash on parse = confirmed.

CoreAudiom4a_trunc.m4a — moov box truncation

Play in page

AudioFileStream parse in WebKit; a crash shows as the player tab dying.

in-pageAuto-decode all — fetches every file and decodes in this tab

Uses <img>/<audio>/decode paths inside WebContent — any crash stops the heartbeat.