This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit c5f7919a2c667eb87460753710dc51ad529eb903 Author: Daniel Drake <[email protected]> AuthorDate: Sun Sep 6 20:39:11 2026 +0100 Commit: James Almer <[email protected]> CommitDate: Fri Sep 11 13:19:28 2026 -0300 avformat/movenc: avoid timescale overflow in synthetic tmcd tracks When muxing a synthetic timecode (tmcd) track (e.g. via -timecode or -map_metadata 0) for video streams that use very high timescales (such as nanosecond VUI timing from GoPro cameras with a timescale of 500,000,000), mov_create_timecode_track() blindly copied the video track's timescale to the timecode track. Unlike regular video tracks where each packet spans ~1 frame, a tmcd track contains a single sample covering the entire duration of the stream. With a 500 MHz timescale, duration * timescale exceeds INT_MAX after just ~4.29 seconds (2,147,483,647 / 500,000,000 ~= 4.295s). When calculating sample duration in get_cluster_duration(), next_dts overflows INT_MAX and triggers av_assert0(next_dts <= INT_MAX), aborting container finalization. To maintain backward compatibility with existing muxing behavior and keep FATE test outputs unchanged, source timescales <= 100,000 are still copied directly. (At <= 100,000, single-sample durations can safely span up to ~6 hours without 32-bit overflow, matching the high timebase warning threshold in mov_init). When the source timescale exceeds 100,000, derive an appropriate standard timecode timescale from the timecode rate: - For drop-frame timecode, use fps * 1000 (e.g. 30,000 for 29.97 DF) so frame duration is an integer (1001). - For fractional rates with den == 1001, use tc.rate.num (e.g. 24,000 or 30,000) to yield an integer frame duration of 1001. - For integer rates with den == 1, use tc.rate.num (e.g. 25, 30, 60) for a 1:1 timescale with frame duration 1. - Otherwise fallback to integer fps (or 30). Signed-off-by: Daniel Drake <[email protected]> --- libavformat/movenc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 4c7868c5f8..7c9e83cc3e 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -7922,7 +7922,16 @@ static int mov_create_timecode_track(AVFormatContext *s, int index, int src_inde return AVERROR(ENOMEM); *track->src_track = src_index; track->nb_src_track = 1; - track->timescale = mov->tracks[src_index].timescale; + if (mov->mode == MODE_ISM || mov->tracks[src_index].timescale <= 100000) + track->timescale = mov->tracks[src_index].timescale; + else if (tc.flags & AV_TIMECODE_FLAG_DROPFRAME) + track->timescale = tc.fps * 1000; + else if (tc.rate.den == 1001 && tc.rate.num > 0 && tc.rate.num <= 100000) + track->timescale = tc.rate.num; + else if (tc.rate.den == 1 && tc.rate.num > 0 && tc.rate.num <= 1000) + track->timescale = tc.rate.num; + else + track->timescale = tc.fps > 0 ? tc.fps : 30; if (tc.flags & AV_TIMECODE_FLAG_DROPFRAME) track->timecode_flags |= MOV_TIMECODE_FLAG_DROPFRAME; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
