PR #25186 opened by Marti2203
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25186
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25186.patch
In mov mode (not mp4), metadata such as `title`, `artist` and `comment` is
written as a QuickTime-style string, whose length is a 16-bit field.
`mov_write_string_data_tag()` passes the `size_t` length to `avio_wb16()`, so
for values longer than 65535 bytes only the low 16 bits are stored while the
whole value is written:
```
ffmpeg -f lavfi -i color=black:s=16x16:d=0.04 -c:v png -metadata title=<70000
chars> -metadata artist=after -f mov out.mov
```
gives a `©nam` atom of 70012 bytes declaring a string length of 4464, and
ffprobe reads the title back as 4464 characters. (FFmpeg's own reader stays in
sync because it also uses the atom size; other readers may not.)
With the patch such values are skipped with a warning ("Metadata 'title' is too
long for a QuickTime string, skipped"), the other tags are written as before,
and values up to 65535 bytes are unchanged. This matches how the FLV muxer
change in #25169 handles over-long strings. mp4 output uses the 32-bit `data`
atom form and is not affected.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified
manually.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
From 237273fba512956ed7b2d877e5b5985ba8c1deeb Mon Sep 17 00:00:00 2001
From: Martin Mirchev <[email protected]>
Date: Sun, 18 Oct 2026 19:33:44 +0800
Subject: [PATCH] avformat/movenc: skip metadata strings too long for QuickTime
string atoms
In mov mode, metadata such as title and artist is written as a
QuickTime-style string whose length is a 16-bit field. For values longer
than 65535 bytes the length was truncated while the whole value was
written, e.g. a 70000-byte title was declared as 4464 bytes and read back
truncated. Skip such values with a warning.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavformat/movenc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 2c349ef663..89e5e35239 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -4767,6 +4767,12 @@ static int mov_write_string_metadata(AVFormatContext *s,
AVIOContext *pb,
AVDictionaryEntry *t = get_metadata_lang(s, tag, &lang);
if (!t)
return 0;
+ /* QuickTime-style strings store their length in 16 bits */
+ if (!long_style && strlen(t->value) > UINT16_MAX) {
+ av_log(s, AV_LOG_WARNING,
+ "Metadata '%s' is too long for a QuickTime string, skipped\n",
tag);
+ return 0;
+ }
return mov_write_string_tag(pb, name, t->value, lang, long_style);
}
--
2.54.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
