Commit bc2316e2d1 for ffmpeg

commit bc2316e2d1dcc3a6687b7d46a3ed6bae42b8a9ba
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 07:10:10 2026 +0200

    avformat/webmdashenc: Escape the language in the lang attribute

    Escaping the language was suggested in the report.

    Fixes: XML injection
    Fixes: f81gsd1fPSfe
    Fixes: AISLE-2026-0111-00553
    XML injection Replicated through UnModified FFmpeg
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 3d9badc0d3..54fac45cae 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -333,8 +333,15 @@ static int write_adaptation_set(AVFormatContext *s, int as_index)
     avio_printf(pb, " codecs=\"%s\"", get_codec_name(par->codec_id));

     lang = av_dict_get(st->metadata, "language", NULL, 0);
-    if (lang)
-        avio_printf(pb, " lang=\"%s\"", lang->value);
+    if (lang) {
+        char *escaped;
+        int ret = av_escape(&escaped, lang->value, NULL, AV_ESCAPE_MODE_XML,
+                            AV_ESCAPE_FLAG_XML_DOUBLE_QUOTES);
+        if (ret < 0)
+            return ret;
+        avio_printf(pb, " lang=\"%s\"", escaped);
+        av_free(escaped);
+    }

     if (par->codec_type == AVMEDIA_TYPE_VIDEO && width_in_as)
         avio_printf(pb, " width=\"%d\"", par->width);