[Libquicktime-devel] mdhd-atom, version 1

[Erik J. <eri...@gm...>]

Hi,

I captured a screen recording in iOS 11, which created a file that
could not be read using libquicktime. The issue is that the mdhd-atom
is 44 bytes rather than 32.

It appears from looking at the data that the two timestamps and the
duration has changed from 32-bit to 64-bit, and that this change is
indicated by the value 0x01 in the first byte rather than 0x00.

Sample mdhd atom:

0x7fff5fbab930: 01 00 00 00 00 00 00 00 d5 ed 2e fa 00 00 00 00
........??.?....
0x7fff5fbab940: d5 ed 2e fa 00 00 75 30 00 00 00 00 00 48 c9 85
??.?..u0.....H?.
0x7fff5fbab950: 55 c4 00 00

Translating this into code from mdhd.c, with new data appended as comments:

void quicktime_read_mdhd(quicktime_t *file, quicktime_mdhd_t *mdhd)
{
        mdhd->version = quicktime_read_char(file);
        mdhd->flags = quicktime_read_int24(file);
        // 0x00 00 00 00
        mdhd->creation_time = quicktime_read_int32(file);
        // 0x00 00 00 00
       mdhd->modification_time = quicktime_read_int32(file);
        mdhd->time_scale = quicktime_read_int32(file);
        // 0x00 00 00 00
       mdhd->duration = quicktime_read_int32(file);
        mdhd->language = quicktime_read_int16(file);
        mdhd->quality = quicktime_read_int16(file);
}

I have no further info on this other than sample files, but seeing how
the mac timestamps are nearing the end of the 32-bit range, it seems
plausible they've expanded them to 64-bits.

No patch as this is all anecdotal at this point.

Thanks,
// Erik