From d8a25eec24219c0f6c1dddaa9c5e1324d19c85ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=99=BA=E6=9D=B0=20=E6=AD=A6?= <2037874602@qq.com>
Date: Fri, 5 Jun 2026 18:34:31 +0800
Subject: [PATCH] libobs: Prevent loading Mouse1/Mouse2 as hotkeys

The frontend already prevents users from setting Mouse1 or Mouse2 as
hotkeys via the UI, but if someone manually edits their scene collection
JSON file to add these keys, OBS would still load them, causing
unexpected behavior.

Add a guard in create_binding() to filter out OBS_KEY_MOUSE1 and
OBS_KEY_MOUSE2. This placement ensures the protection also covers
third-party plugins that call the public API function
obs_hotkey_load_bindings().

Closes #13403
---
 libobs/obs-hotkey.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/libobs/obs-hotkey.c b/libobs/obs-hotkey.c
index 0503b303390409..a3f685fd6af651 100644
--- a/libobs/obs-hotkey.c
+++ b/libobs/obs-hotkey.c
@@ -457,6 +457,19 @@ static inline void load_modifier(uint32_t *modifiers, obs_data_t *data, const ch
 
 static inline void create_binding(obs_hotkey_t *hotkey, obs_key_combination_t combo)
 {
+	/*
+	 * Prevent loading Mouse1 and Mouse2 as hotkeys. The frontend
+	 * already prevents users from setting these keys via the UI,
+	 * but they could still be loaded from a manually modified scene
+	 * collection JSON file, causing unexpected behavior.
+	 *
+	 * Placed in create_binding() rather than load_binding() so
+	 * this also covers third-party plugins using the public API
+	 * obs_hotkey_load_bindings().
+	 */
+	if (combo.key == OBS_KEY_MOUSE1 || combo.key == OBS_KEY_MOUSE2)
+		return;
+
 	obs_hotkey_binding_t *binding = da_push_back_new(obs->hotkeys.bindings);
 	if (!binding)
 		return;