Skip to content

QuickTimeVideo::setMediaStream() scans entire file when "hdlr" atom is missing #9285

@MarkLee131

Description

@MarkLee131

Describe the bug

In src/quicktimevideo.cpp:1129-1153, the function setMediaStream() searches for the "hdlr" atom by reading 4 bytes at a time in a while (!io_->eof()) loop. There is no size bound on this search. If the current atom does not contain an "hdlr" sub-atom, the loop scans the entire rest of the file before giving up.

On a large MOV/MP4 file without an "hdlr" atom in the expected position, this can cause exiv2 to spend a long time reading through the file.

// src/quicktimevideo.cpp:1129-1150
void QuickTimeVideo::setMediaStream() {
  // ...
  while (!io_->eof()) {          // no size bound
    io_->readOrThrow(buf.data(), 4);
    // ...
    if (equalsQTimeTag(buf, "hdlr")) {
      // found
    }
  }
  io_->seek(current_position, BasicIo::beg);
}

This is similar to the issue fixed in PR #2533, where an unbounded loop in the ASF parser was given a proper size constraint.

To Reproduce

  1. Take a large MOV file and remove or corrupt the "hdlr" atom so that it cannot be found by the sequential scan.
  2. Run exiv2 -pa large_file.mov.
  3. Observed on main branch, current HEAD.

The command completes, but it takes noticeably longer than expected because it scans the entire file.

Expected behavior

The search should be bounded by the size of the current atom. When the search exceeds that bound, the function should stop and return without finding "hdlr".

Desktop (please complete the following information):

  • OS and version: macOS (Darwin 25.3.0, arm64)
  • Exiv2 version and source: main branch, built from source
  • Compiler and version: Clang 22.1.1 (homebrew llvm)
  • Compilation mode and/or compiler flags: Debug

Additional context

The caller knows the atom's size from the box header. Passing this size to setMediaStream() and stopping the loop when the search exceeds that bound would fix the issue.

I can submit a PR if helpful.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions