Describe the bug
In src/quicktimevideo.cpp:1129-1153, the function setMediaStream() searches for the "hdlr" atom by reading 4 bytes at a time in a while (!io_->eof()) loop. There is no size bound on this search. If the current atom does not contain an "hdlr" sub-atom, the loop scans the entire rest of the file before giving up.
On a large MOV/MP4 file without an "hdlr" atom in the expected position, this can cause exiv2 to spend a long time reading through the file.
// src/quicktimevideo.cpp:1129-1150
void QuickTimeVideo::setMediaStream() {
// ...
while (!io_->eof()) { // no size bound
io_->readOrThrow(buf.data(), 4);
// ...
if (equalsQTimeTag(buf, "hdlr")) {
// found
}
}
io_->seek(current_position, BasicIo::beg);
}
This is similar to the issue fixed in PR #2533, where an unbounded loop in the ASF parser was given a proper size constraint.
To Reproduce
- Take a large MOV file and remove or corrupt the "hdlr" atom so that it cannot be found by the sequential scan.
- Run
exiv2 -pa large_file.mov.
- Observed on
main branch, current HEAD.
The command completes, but it takes noticeably longer than expected because it scans the entire file.
Expected behavior
The search should be bounded by the size of the current atom. When the search exceeds that bound, the function should stop and return without finding "hdlr".
Desktop (please complete the following information):
- OS and version: macOS (Darwin 25.3.0, arm64)
- Exiv2 version and source: main branch, built from source
- Compiler and version: Clang 22.1.1 (homebrew llvm)
- Compilation mode and/or compiler flags: Debug
Additional context
The caller knows the atom's size from the box header. Passing this size to setMediaStream() and stopping the loop when the search exceeds that bound would fix the issue.
I can submit a PR if helpful.
Describe the bug
In
src/quicktimevideo.cpp:1129-1153, the functionsetMediaStream()searches for the "hdlr" atom by reading 4 bytes at a time in awhile (!io_->eof())loop. There is no size bound on this search. If the current atom does not contain an "hdlr" sub-atom, the loop scans the entire rest of the file before giving up.On a large MOV/MP4 file without an "hdlr" atom in the expected position, this can cause
exiv2to spend a long time reading through the file.This is similar to the issue fixed in PR #2533, where an unbounded loop in the ASF parser was given a proper size constraint.
To Reproduce
exiv2 -pa large_file.mov.mainbranch, current HEAD.The command completes, but it takes noticeably longer than expected because it scans the entire file.
Expected behavior
The search should be bounded by the size of the current atom. When the search exceeds that bound, the function should stop and return without finding "hdlr".
Desktop (please complete the following information):
Additional context
The caller knows the atom's size from the box header. Passing this size to
setMediaStream()and stopping the loop when the search exceeds that bound would fix the issue.I can submit a PR if helpful.