fix: improve media format detection with proper ftyp-based MP4 detection

[0xsatoshi99]

Summary

Fixes incorrect MP4 format detection in C2PA verification by using proper ftyp-based detection instead of hardcoded box sizes. Also adds comprehensive support for additional media formats.

Problem

The previous implementation detected MP4 files by checking for specific ftyp box sizes:

elif data[:4] == b'\x00\x00\x00\x1c' or data[:4] == b'\x00\x00\x00\x20':
    return ".mp4"

This only catches MP4 files with ftyp box sizes of 28 or 32 bytes. Many valid MP4 files have different box sizes and would incorrectly return .bin, causing C2PA verification to fail.

Solution

Check for ftyp signature at offset 4 (the standard location per ISO base media file format):

if len(data) >= 8 and data[4:8] == b'ftyp':
    return ".mp4"

Changes

Bug Fix

• MP4 detection: Use ftyp-based detection instead of hardcoded box sizes
• JPEG detection: Improved with 3-byte signature (FF D8 FF)
• Length checks: Added bounds checking to prevent index errors on short data

New Format Support

Category	Formats Added
Images	GIF, BMP, TIFF, HEIC/HEIF, AVIF
Video	MOV, 3GP, AVI (+ improved MP4)
Audio	MP3, WAV, FLAC, OGG, M4A

Testing

Manual verification with sample files of each format type.

---

Contribution by Gittensor, learn more at https://gittensor.io/

---

Note

Low Risk
Changes are limited to magic-byte format detection used for temp file suffixes; main risk is misclassification of edge-case ftyp brands affecting which suffix is used for C2PA parsing.

Overview
Fixes C2PA temp-file suffix detection by replacing the brittle MP4 check (hardcoded box sizes) with ISO BMFF ftyp-based parsing and brand-aware handling.

Expands _detect_format to recognize additional image/video/audio types (e.g., GIF/BMP/TIFF, HEIC/AVIF, MOV/3GP/AVI, MP3/WAV/FLAC/OGG/M4A) and adds basic length guards to avoid short-buffer indexing issues, reducing false .bin fallbacks that can break verification.

^{Written by Cursor Bugbot for commit a7f2627. This will update automatically on new commits. Configure here.}

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on December 24

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[0xsatoshi99]

@dylanuys Can you plz check this PR and give me your feedback? Thanks.

[dylanuys]

@0xsatoshi99 sorry for leaving this one hanging -- this doesn't impact anything since c2pa-python under the hood extracts format from media bytes itself, but regardless this is much better than the original code! Hopefully you can still get incentive for this, but reach out to me on discord if you need me to vouch for you for Gittensor.