Skip to content

Check for duplicates in RiffVideo::readInfoListChunk (backport #9369) - #9394

Open
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/bp/main/pr-9369
Open

Check for duplicates in RiffVideo::readInfoListChunk (backport #9369)#9394
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/bp/main/pr-9369

Conversation

@mergify

@mergify mergify Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

We've had some security reports about RiffVideo::readInfoListChunk() because it's a bit slow when you give it a long list to process. The complexity of this code is linear but the constant factor cost of inserting an element into xmpData_ is high. I got a 4x speedup by copying the elements into a std::map first (to eliminate duplicate keys). But duplicate keys probably only happen in malformed input files, so I've also added an enforce to disallow duplicates.

I don't think this is a security issue because it's just slow performance. It's not a quadratic algorithm, just constant factor slowness.


This is an automatic backport of pull request #9369 done by Mergify.

kevinbackhouse and others added 2 commits July 23, 2026 12:52
(cherry picked from commit 2fee7b3)

# Conflicts:
#	src/riffvideo.cpp
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit a3e6491)
@mergify

mergify Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Cherry-pick of 2fee7b3 has failed:

On branch mergify/bp/main/pr-9369
Your branch is up to date with 'origin/main'.

You are currently cherry-picking commit 2fee7b38.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   src/riffvideo.cpp

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant