[
https://issues.apache.org/jira/browse/TIKA-5051?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138400#comment-18138400
]
ASF GitHub Bot commented on TIKA-5051:
--------------------------------------
dschmidt opened a new pull request, #3547:
URL: https://github.com/apache/tika/pull/3547
`TikaMp4Reader` stopped the box walk at any box declaring more than
`Integer.MAX_VALUE` bytes, before deciding whether the box is read or only
skipped. A file with an `mdat` over 2 GB in front of `moov`, as cameras often
write them, lost all metadata after it.
The limit now only applies to boxes that are read into memory, which
`maxBoxSize` already caps. Skipped boxes are advanced past whatever their size.
Test: a stream with a 3 GB largesize `mdat` (served as virtual zeros,
nothing allocated) followed by `ftyp`; the major brand was null before and is
read now.
https://issues.apache.org/jira/browse/TIKA-5051
> MP4 metadata is lost when a box larger than 2 GB comes before moov
> ------------------------------------------------------------------
>
> Key: TIKA-5051
> URL: https://issues.apache.org/jira/browse/TIKA-5051
> Project: Tika
> Issue Type: Bug
> Components: parser
> Reporter: Dominik Schmidt
> Priority: Major
>
> {{TikaMp4Reader}} stops the box walk with "Box size too large." as soon as
> any box declares more than {{Integer.MAX_VALUE}} bytes, before it decides
> whether the box is read or only skipped.
> Boxes Tika does not read, like {{mdat}}, are skipped by a stream advance and
> never allocated, so their size does not matter. But a file with an {{mdat}}
> over 2 GB in front of {{moov}} (common for camera recordings, which write
> {{moov}} at the end) loses all metadata after it: no duration, dimensions,
> dates, location or track data.
> The size check only needs to apply to boxes Tika actually reads into memory.
> Those are already capped by {{maxBoxSize}} (100 MB by default).
> metadata-extractor's {{Mp4Reader}}, which {{TikaMp4Reader}} was copied from
> (TIKA-4812), has the same check.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
