Re: Strange `IMG_E` files from an iPhone

HI,

On Sat, Jan 30, 2021 at 11:31:36AM -0800, Andrew Kvalheim wrote:
> On Fri, Jan 29, 2021 at 11:39 PM Marcus Meissner <[email protected]> wrote:
> > It should not be detected as image/jpeg ... I would need to see the part
> > of the debugtrace where this file is mentioned if there is a bug there.
> 
> Thanks, here's the debug block:
> 
>     1.383474 debug_objectinfo            (2): ObjectInfo for 'IMG_E0679.HEIC':
>     1.383494 debug_objectinfo            (2):   Object ID: 0x00000796
>     1.383509 debug_objectinfo            (2):   StorageID: 0x00010001
>     1.383521 debug_objectinfo            (2):   ObjectFormat: 0x3801

0x3801 is the standard JPEG-JFIF format type. :/

>     1.383534 debug_objectinfo            (2):   ProtectionStatus: 0x0000
>     1.383546 debug_objectinfo            (2):   ObjectCompressedSize: 3531427
>     1.383558 debug_objectinfo            (2):   ThumbFormat: 0x3808

JPEG format for the thumbnail.

>     1.383569 debug_objectinfo            (2):   ThumbCompressedSize: 65536
>     1.383581 debug_objectinfo            (2):   ThumbPixWidth: 0
>     1.383594 debug_objectinfo            (2):   ThumbPixHeight: 0
>     1.383606 debug_objectinfo            (2):   ImagePixWidth: 3024
>     1.383618 debug_objectinfo            (2):   ImagePixHeight: 4032
>     1.383629 debug_objectinfo            (2):   ImageBitDepth: 0
>     1.383641 debug_objectinfo            (2):   ParentObject: 0x00000002
>     1.383653 debug_objectinfo            (2):   AssociationType: 0x0000
>     1.383665 debug_objectinfo            (2):   AssociationDesc: 0x00000000
>     1.383677 debug_objectinfo            (2):   SequenceNumber: 0x00000000
>     1.383689 debug_objectinfo            (2):   ModificationDate: 0x5f872447
>     1.383701 debug_objectinfo            (2):   CaptureDate: 0x5cfdb49c
> 
> It looks a lot like a JPEG:
> 
>     $ xxd -l 2 IMG_E0679.HEIC
>     00000000: ffd8                                     ..

It seems the iphone pretty much "pretends" it to be a JPEG file.

We would need additional detection on the filesuffix here to supply a different mime type.

Ciao, Marcus