fix(dpx): don't add to metadata any userdata that failed to read

[lgritz]

ReadUserData() returns false on a short read, having filled only part of the buffer. We previously ignored the return and added the whole thing as the "dpx:UserData" attribute, so the unread tail -- uninitialized bytes of a default_init_vector -- became part of the metadata. That is worse than a pixel leak: --info prints it, and oiiotool copies it into converted output without anyone reading a scanline, and that might contain stale heap data that could be sensitive.

The size guard only compared UserSize against the whole file size, but the block starts after the generic and industry headers, so a file can pass that check and still run off the end. Count the offset, and treat a failed read as an error instead of publishing the result.

Assisted-by: Claude Code / claude-opus-5

[Copilot]

🟡 Changes recommended

The regression test misses the short-read path, and the bounds-error diagnostic needs clarification.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR hardens DPX user-data parsing to prevent truncated or uninitialized data from being published as metadata.

Changes:

• Accounts for the 2048-byte header offset during bounds validation.
• Rejects failed user-data reads.
• Adds malformed-input regression coverage and expected output.

File summaries

File	Summary
testsuite/dpx/run.py	Adds malformed-userdata coverage. Moderate (2 votes): the fixture does not exercise the short-read failure path.
testsuite/dpx/ref/out.txt	Records the expected rejection output.
src/dpx.imageio/dpxinput.cpp	Validates bounds and read success. Nit (1 vote): the diagnostic should include the offset or required end position.

Review details

Suppressed comments (1)

src/dpx.imageio/dpxinput.cpp:563

• This condition now also rejects files where the user-data size is smaller than the file size (for example, 2000 bytes versus 2100), so the diagnostic is contradictory and omits the 2048-byte start offset that caused the failure. Include the offset or required end position in the message so the corruption is diagnosable.

            errorfmt("Corrupt userbuf: size claims {} but whole file size is {}",
                     m_dpx.header.UserSize(), m_filesize);

• Files reviewed: 3/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.