Source: OCR_ANALYSIS_REPORT.md, OpenCode Review report generated on 2026-08-12.
Findings: M-6, L-4, L-5. Attachment preview/range paths can read whole media files into memory for partial HTTP range requests, importBuffer() writes then reads bytes back for preview generation, and MP3 frame detection is looser than it should be.
Expected fix:
- Use bounded
fs.createReadStream range reads for media protocol requests.
- Avoid unnecessary disk rereads after
importBuffer() when bytes are already available.
- Tighten MP3 frame validation.
- Add tests for partial media range reads and media type detection.
Source: OCR_ANALYSIS_REPORT.md, OpenCode Review report generated on 2026-08-12.
Findings: M-6, L-4, L-5. Attachment preview/range paths can read whole media files into memory for partial HTTP range requests,
importBuffer()writes then reads bytes back for preview generation, and MP3 frame detection is looser than it should be.Expected fix:
fs.createReadStreamrange reads for media protocol requests.importBuffer()when bytes are already available.