[PR] avformat/mov: scope metadata keys to each meta box (PR #24127)

PR #24127 opened by jiangjie
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24127
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24127.patch

Use temporary key state while parsing a meta box and restore the previous state afterwards, preventing key tables from leaking across separate or nested metadata boxes.

Fixes issue #24106.



>From d12997c2cbaa02f46795b43ea39d8a1342d98131 Mon Sep 17 00:00:00 2001
From: jiangjie <[email protected]>
Date: Wed, 12 Aug 2026 13:01:00 +0800
Subject: [PATCH] avformat/mov: scope metadata keys to each meta box

Use temporary key state while parsing a meta box and restore the previous state afterwards, preventing key tables from leaking across separate or nested metadata boxes.

Fixes issue #24106.
---
 libavformat/mov.c | 43 +++++++++++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 5a66d572ee..0b597b599c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5763,6 +5763,16 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     return 0;
 }
 
+static void mov_free_meta_keys(MOVContext *c)
+{
+    if (c->meta_keys) {
+        for (unsigned i = 1; i < c->meta_keys_count; i++)
+            av_freep(&c->meta_keys[i]);
+        av_freep(&c->meta_keys);
+    }
+    c->meta_keys_count = 0;
+}
+
 static int mov_read_custom(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
     int64_t end = av_sat_add64(avio_tell(pb), atom.size);
@@ -5924,19 +5934,37 @@ fail:
 
 static int mov_read_meta(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 {
+    char **meta_keys = c->meta_keys;
+    unsigned meta_keys_count = c->meta_keys_count;
+    int found_hdlr_mdta = c->found_hdlr_mdta;
+    int ret = 0;
+
+    c->meta_keys = NULL;
+    c->meta_keys_count = 0;
+    c->found_hdlr_mdta = 0;
+
     while (atom.size > 8) {
         uint32_t tag;
-        if (avio_feof(pb))
-            return AVERROR_EOF;
+        if (avio_feof(pb)) {
+            ret = AVERROR_EOF;
+            break;
+        }
         tag = avio_rl32(pb);
         atom.size -= 4;
         if (tag == MKTAG('h','d','l','r')) {
             avio_seek(pb, -8, SEEK_CUR);
             atom.size += 8;
-            return mov_read_default(c, pb, atom);
+            ret = mov_read_default(c, pb, atom);
+            break;
         }
     }
-    return 0;
+
+    mov_free_meta_keys(c);
+    c->meta_keys = meta_keys;
+    c->meta_keys_count = meta_keys_count;
+    c->found_hdlr_mdta = found_hdlr_mdta;
+
+    return ret;
 }
 
 // return 1 when matrix is identity, 0 otherwise
@@ -10610,12 +10638,7 @@ static int mov_read_close(AVFormatContext *s)
     avformat_free_context(mov->dv_fctx);
     mov->dv_fctx = NULL;
 
-    if (mov->meta_keys) {
-        for (i = 1; i < mov->meta_keys_count; i++) {
-            av_freep(&mov->meta_keys[i]);
-        }
-        av_freep(&mov->meta_keys);
-    }
+    mov_free_meta_keys(mov);
 
     av_freep(&mov->trex_data);
     av_freep(&mov->bitrates);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]