[Bugfix][Multimodal] Reject malformed base64 audio with 400 instead of 500

[mhuzaifa3]

Purpose

A malformed base64 audio payload returns HTTP 500. The same payload sent as an image returns 400.

AudioMediaIO.load_base64 decodes without strict validation:

return self.load_bytes(pybase64.b64decode(data))

pybase64 then drops any character outside the base64 alphabet and decodes whatever is left. The mangled bytes reach libsndfile, which raises LibsndfileError. That inherits from RuntimeError, so create_error_response falls through to its else branch and answers 500.

The other three media loaders pass validate=True, so a bad payload raises binascii.Error, which inherits from ValueError and maps to 400.

Running the same malformed string through both loaders on current main:

malformed base64 audio : LibsndfileError -> HTTP 500
malformed base64 image : Error           -> HTTP 400

A client sending a corrupt upload should not see a server error, and it should not differ by media type.

ImageMediaIO, ImageEmbeddingMediaIO and AudioEmbeddingMediaIO already pass validate=True. VideoMediaIO delegates to ImageMediaIO. Audio was the only loader left.

Related, not fixed here

A genuinely corrupt audio or image file, where the base64 is valid but the decoded bytes are not media, still returns 500: LibsndfileError and PIL's UnidentifiedImageError are neither ValueError nor VLLMError. Mapping decode failures to a client error means deciding between 400 and 422 and touching the connector, so I left it out. Happy to open an issue if that is worth tracking.

Test Plan

pytest tests/multimodal/media/test_audio.py
pytest tests/multimodal/media/ --ignore=tests/multimodal/media/test_video.py
ruff check <changed files>
ruff format --check <changed files>

test_audio_media_io_load_base64_rejects_malformed builds a valid payload, splices non-alphabet characters into it, and asserts the loader raises ValueError.

Test Result

test_audio.py with the fix:

11 passed, 1 failed

The failure is test_audio_media_io_from_video, which needs video assets my machine does not have. It fails the same way on an unmodified checkout.

The new test with audio.py reverted to main:

E  Failed: DID NOT RAISE ValueError

Wider media suite, with the fix:

71 failed, 43 passed

Unmodified checkout, same command:

71 failed, 42 passed

Same failures either way, from missing cv2 and from tests that reach the network. The extra pass is the new test.

ruff check and ruff format --check pass on both files.

I ran no accuracy or performance tests. This rejects input that already failed, one step earlier and with the right status code.

Note

AI assistance was used for this change. I reviewed every changed line, ran the tests above, and can explain the change.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[Isotr0py]

/ci run

[github-actions]

✅ Triggered Buildkite CI #85522 for commit 1647b2e0e827.