PR #22720 opened by bird URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22720 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22720.patch
Fixes #22718 See issue for details. Mirrors the guard added in 5b98cea4 for the write path. From 0ab823b47a5bc18118c81798f3ece7e9c6702ea2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 7 Mar 2026 22:02:08 +0100 Subject: [PATCH 01/45] avcodec/bsf/extract_extradata: Check that block_size is not negative Fixes: out of array access Fixes: 490576036/clusterfuzz-testcase-minimized-ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer-4605696279904256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 248b481c337d917e0fece9555ae59b5375c725c6) Signed-off-by: James Almer <[email protected]> --- libavcodec/bsf/extract_extradata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/bsf/extract_extradata.c b/libavcodec/bsf/extract_extradata.c index 306ede5136..08293ea7e1 100644 --- a/libavcodec/bsf/extract_extradata.c +++ b/libavcodec/bsf/extract_extradata.c @@ -304,7 +304,8 @@ static int write_lcevc_nalu(AVBSFContext *ctx, PutByteContext *pbc, const H2645N while (bytestream2_get_bytes_left(&gbc) > 1) { GetBitContext gb; - int payload_size_type, payload_type, payload_size; + int payload_size_type, payload_type; + uint64_t payload_size; int block_size, raw_block_size, block_end; init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc)); @@ -317,6 +318,9 @@ static int write_lcevc_nalu(AVBSFContext *ctx, PutByteContext *pbc, const H2645N if (payload_size_type == 7) payload_size = get_mb(&gb); + if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3)) + return AVERROR_INVALIDDATA; + block_size = raw_block_size = payload_size + (get_bits_count(&gb) >> 3); if (block_size >= bytestream2_get_bytes_left(&gbc)) return AVERROR_INVALIDDATA; -- 2.52.0 From b6db764c8636410264afa40a23f3d20bcfc8b0c3 Mon Sep 17 00:00:00 2001 From: nyanmisaka <[email protected]> Date: Mon, 9 Mar 2026 21:51:03 +0800 Subject: [PATCH 02/45] fftools/ffmpeg: fix read_key() always return 255 when there was no input MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fixup 08d327e When an uchar is set to -1, it will become 255 when read as an int. Duplicate variables for two terminal types can also avoid unused variable warnings. (cherry picked from commit 3f10a054dc8e5af5aeb9450e3bdea1ffcce91dd7) Signed-off-by: nyanmisaka <[email protected]> Signed-off-by: Kacper Michajłow <[email protected]> --- fftools/ffmpeg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fftools/ffmpeg.c b/fftools/ffmpeg.c index c2c85d46bd..b394243f59 100644 --- a/fftools/ffmpeg.c +++ b/fftools/ffmpeg.c @@ -253,7 +253,6 @@ void term_init(void) /* read a key without blocking */ static int read_key(void) { - unsigned char ch = -1; #if HAVE_TERMIOS_H int n = 1; struct timeval tv; @@ -265,6 +264,7 @@ static int read_key(void) tv.tv_usec = 0; n = select(1, &rfds, NULL, NULL, &tv); if (n > 0) { + unsigned char ch; n = read(0, &ch, 1); if (n == 1) return ch; @@ -289,6 +289,7 @@ static int read_key(void) } //Read it if(nchars != 0) { + unsigned char ch; if (read(0, &ch, 1) == 1) return ch; return 0; @@ -300,7 +301,7 @@ static int read_key(void) if(kbhit()) return(getch()); #endif - return ch; + return -1; } static int decode_interrupt_cb(void *ctx) -- 2.52.0 From b1da475805bf34693ade42f6eaf8e5e29943e9c1 Mon Sep 17 00:00:00 2001 From: Lynne <[email protected]> Date: Tue, 10 Mar 2026 16:04:03 +0100 Subject: [PATCH 03/45] ffv1enc_vulkan: fix typo Fixes a segfault when host mapping is unsupported. (cherry picked from commit 215e22d1f10d171bd4acd8bf40758f930bc9062a) --- libavcodec/ffv1enc_vulkan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1enc_vulkan.c b/libavcodec/ffv1enc_vulkan.c index b836bbf0fa..0e891f0888 100644 --- a/libavcodec/ffv1enc_vulkan.c +++ b/libavcodec/ffv1enc_vulkan.c @@ -241,7 +241,7 @@ static int vulkan_encode_ffv1_submit_frame(AVCodecContext *avctx, if (maxsize < fv->max_heap_size) { out_buf_flags = VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT; /* If we can't map host memory, we can't let the GPU copy its buffer. */ - if (!fv->s.extensions & FF_VK_EXT_EXTERNAL_HOST_MEMORY) + if (!(fv->s.extensions & FF_VK_EXT_EXTERNAL_HOST_MEMORY)) out_buf_flags |= VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT; } else { out_buf_flags = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | -- 2.52.0 From d8d4a9641498bf35efc6f26e6ced23d5ce74359c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 13 Mar 2026 02:11:20 +0100 Subject: [PATCH 04/45] avcodec/bsf/extract_extradata: Replace incorrect size accounting Fixes: out of array writes Fixes: 492054712/clusterfuzz-testcase-minimized-ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer-5705993148497920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit f84c859ec54d11bd743daafd89f42bb34873d29d) --- libavcodec/bsf/extract_extradata.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/libavcodec/bsf/extract_extradata.c b/libavcodec/bsf/extract_extradata.c index 08293ea7e1..5dd13013bc 100644 --- a/libavcodec/bsf/extract_extradata.c +++ b/libavcodec/bsf/extract_extradata.c @@ -411,14 +411,10 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt, return AVERROR(ENOMEM); } - *data = extradata; - *size = 0; - bytestream2_init_writer(&pb_extradata, extradata, extradata_size); if (s->remove) bytestream2_init_writer(&pb_filtered_data, filtered_buf->data, filtered_size); - filtered_size = 0; for (i = 0; i < s->h2645_pkt.nb_nals; i++) { H2645NAL *nal = &s->h2645_pkt.nals[i]; if (val_in_array(extradata_nal_types, nb_extradata_nal_types, @@ -426,33 +422,34 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt, bytestream2_put_be24(&pb_extradata, 1); //startcode ret = write_lcevc_nalu(ctx, &pb_extradata, nal, 0); if (ret < 0) { - av_freep(data); + av_freep(&extradata); av_buffer_unref(&filtered_buf); return ret; } - *size += ret; if (s->remove) { bytestream2_put_be24(&pb_filtered_data, 1); //startcode ret = write_lcevc_nalu(ctx, &pb_filtered_data, nal, 1); if (ret < 0) { - av_freep(data); + av_freep(&extradata); av_buffer_unref(&filtered_buf); return ret; } - filtered_size += ret; } } else if (s->remove) { bytestream2_put_be24(&pb_filtered_data, 1); //startcode bytestream2_put_bufferu(&pb_filtered_data, nal->raw_data, nal->raw_size); - filtered_size += nal->raw_size; } } + *data = extradata; + *size = bytestream2_tell_p(&pb_extradata); + av_assert0(*size <= extradata_size); if (s->remove) { + av_assert0(bytestream2_tell_p(&pb_filtered_data) <= filtered_size); av_buffer_unref(&pkt->buf); pkt->buf = filtered_buf; pkt->data = filtered_buf->data; - pkt->size = filtered_size; + pkt->size = bytestream2_tell_p(&pb_filtered_data); } } -- 2.52.0 From b013bbf092a5b7f2be4cf89292372c56ebb1c072 Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Sun, 8 Mar 2026 21:07:55 -0300 Subject: [PATCH 05/45] avcodec/lcevc_parser: Check that block_size is not negative Based on 248b481c337d917e0fece9555ae59b5375c725c6 Signed-off-by: James Almer <[email protected]> (cherry picked from commit 125bb2e045fda63701a0d7ec0464129d18210617) --- libavcodec/bsf/extract_extradata.c | 17 +----------- libavcodec/lcevc_parse.h | 42 ++++++++++++++++++++++++++++++ libavcodec/lcevc_parser.c | 23 +++++----------- 3 files changed, 49 insertions(+), 33 deletions(-) create mode 100644 libavcodec/lcevc_parse.h diff --git a/libavcodec/bsf/extract_extradata.c b/libavcodec/bsf/extract_extradata.c index 5dd13013bc..1532eb6a7d 100644 --- a/libavcodec/bsf/extract_extradata.c +++ b/libavcodec/bsf/extract_extradata.c @@ -30,6 +30,7 @@ #include "h2645_parse.h" #include "h264.h" #include "lcevc.h" +#include "lcevc_parse.h" #include "startcode.h" #include "vc1_common.h" #include "vvc.h" @@ -268,22 +269,6 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt, return 0; } -static inline uint64_t get_mb(GetBitContext *s) { - int more, i = 0; - uint64_t mb = 0; - - do { - int byte = get_bits(s, 8); - unsigned bits = byte & 0x7f; - more = byte & 0x80; - mb = (mb << 7) | bits; - if (++i == 10) - break; - } while (more); - - return mb; -} - /** * Rewrite the NALu stripping the unneeded blocks. * Given that length fields coded inside the NALu are not aware of any emulation_3bytes diff --git a/libavcodec/lcevc_parse.h b/libavcodec/lcevc_parse.h new file mode 100644 index 0000000000..f56758a1a5 --- /dev/null +++ b/libavcodec/lcevc_parse.h @@ -0,0 +1,42 @@ +/* + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * FFmpeg is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with FFmpeg; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#ifndef AVCODEC_LCEVC_PARSE_H +#define AVCODEC_LCEVC_PARSE_H + +#include <stdint.h> + +#include "get_bits.h" + +static inline uint64_t get_mb(GetBitContext *s) { + int more, i = 0; + uint64_t mb = 0; + + do { + int byte = get_bits(s, 8); + unsigned bits = byte & 0x7f; + more = byte & 0x80; + mb = (mb << 7) | bits; + if (++i == 10) + break; + } while (more); + + return mb; +} + +#endif /* AVCODEC_LCEVC_PARSE_H */ diff --git a/libavcodec/lcevc_parser.c b/libavcodec/lcevc_parser.c index 77888a3efc..f3338c4659 100644 --- a/libavcodec/lcevc_parser.c +++ b/libavcodec/lcevc_parser.c @@ -25,6 +25,7 @@ #include "get_bits.h" #include "h2645_parse.h" #include "lcevc.h" +#include "lcevc_parse.h" #include "parser.h" #include "parser_internal.h" @@ -100,22 +101,6 @@ static const struct { { 7680, 4800 }, }; -static inline uint64_t get_mb(GetBitContext *s) { - int more, i = 0; - uint64_t mb = 0; - - do { - int byte = get_bits(s, 8); - unsigned bits = byte & 0x7f; - more = byte & 0x80; - mb = (mb << 7) | bits; - if (++i == 10) - break; - } while (more); - - return mb; -} - static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, const H2645NAL *nal) { @@ -125,7 +110,8 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, while (bytestream2_get_bytes_left(&gbc) > 1) { GetBitContext gb; - int payload_size_type, payload_type, payload_size; + uint64_t payload_size; + int payload_size_type, payload_type; int block_size; init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc)); @@ -138,6 +124,9 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, if (payload_size_type == 7) payload_size = get_mb(&gb); + if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3)) + return AVERROR_INVALIDDATA; + block_size = payload_size + (get_bits_count(&gb) >> 3); if (block_size >= bytestream2_get_bytes_left(&gbc)) return AVERROR_INVALIDDATA; -- 2.52.0 From 680ac1aa324bc71442479c6384ed6869e2d14013 Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Tue, 10 Mar 2026 15:50:20 -0300 Subject: [PATCH 06/45] avcodec/lcevc_parser: check return value of init_get_bits8() Fixes coverity issue CID 1684198. Signed-off-by: James Almer <[email protected]> (cherry picked from commit a9984fec81f8df03e18538278a8e734881b5090f) --- libavcodec/lcevc_parser.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/lcevc_parser.c b/libavcodec/lcevc_parser.c index f3338c4659..1de44a8bda 100644 --- a/libavcodec/lcevc_parser.c +++ b/libavcodec/lcevc_parser.c @@ -114,7 +114,9 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, int payload_size_type, payload_type; int block_size; - init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc)); + int ret = init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc)); + if (ret < 0) + return ret; payload_size_type = get_bits(&gb, 3); payload_type = get_bits(&gb, 5); -- 2.52.0 From c9a5f7c6cae515e4ee5dc6839538cbff24b664f4 Mon Sep 17 00:00:00 2001 From: Lynne <[email protected]> Date: Sat, 14 Mar 2026 17:32:55 +0100 Subject: [PATCH 07/45] hwcontext_vulkan: deprecate AVVulkanDeviceContext.lock/unlock_queue Without replacement, as VK_KHR_internally_synchronized_queues will be required. (cherry picked from commit c102e89448a06d9920920923a4008fee3db4ea37) --- doc/APIchanges | 4 ++++ fftools/ffplay_renderer.c | 21 +++++++++++++++++++++ libavfilter/vf_libplacebo.c | 8 ++++++++ libavutil/hwcontext_vulkan.c | 4 ++++ libavutil/hwcontext_vulkan.h | 8 ++++++++ libavutil/version.h | 1 + libavutil/vulkan.c | 8 ++++++++ 7 files changed, 54 insertions(+) diff --git a/doc/APIchanges b/doc/APIchanges index c59b82f107..bfba2c95b3 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -2,6 +2,10 @@ The last version increases of all libraries were on 2025-03-28 API changes, most recent first: +2026-03-14 - xxxxxxxxxx - lavu 60.26.100 - hwcontext_vulkan.h + Deprecate AVVulkanDeviceContext.lock_queue and + AVVulkanDeviceContext.unlock_queue without replacement. + 2026-03-07 - c23d56b173a - lavc 62.26.100 - codec_desc.h Add AV_CODEC_PROP_ENHANCEMENT. diff --git a/fftools/ffplay_renderer.c b/fftools/ffplay_renderer.c index 335c286c65..e7fa7197cb 100644 --- a/fftools/ffplay_renderer.c +++ b/fftools/ffplay_renderer.c @@ -43,6 +43,7 @@ #include "libavutil/bprint.h" #include "libavutil/mem.h" +#include "libavutil/internal.h" #endif @@ -115,14 +116,22 @@ static void hwctx_lock_queue(void *priv, uint32_t qf, uint32_t qidx) { AVHWDeviceContext *avhwctx = priv; const AVVulkanDeviceContext *hwctx = avhwctx->hwctx; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS hwctx->lock_queue(avhwctx, qf, qidx); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } static void hwctx_unlock_queue(void *priv, uint32_t qf, uint32_t qidx) { AVHWDeviceContext *avhwctx = priv; const AVVulkanDeviceContext *hwctx = avhwctx->hwctx; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS hwctx->unlock_queue(avhwctx, qf, qidx); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } static int add_instance_extension(const char **ext, unsigned num_ext, @@ -283,7 +292,11 @@ static void placebo_lock_queue(struct AVHWDeviceContext *dev_ctx, { RendererContext *ctx = dev_ctx->user_opaque; pl_vulkan vk = ctx->placebo_vulkan; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS vk->lock_queue(vk, queue_family, index); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } static void placebo_unlock_queue(struct AVHWDeviceContext *dev_ctx, @@ -292,7 +305,11 @@ static void placebo_unlock_queue(struct AVHWDeviceContext *dev_ctx, { RendererContext *ctx = dev_ctx->user_opaque; pl_vulkan vk = ctx->placebo_vulkan; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS vk->unlock_queue(vk, queue_family, index); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } static int get_decode_queue(VkRenderer *renderer, int *index, int *count) @@ -386,8 +403,12 @@ static int create_vk_by_placebo(VkRenderer *renderer, device_ctx->user_opaque = ctx; vk_dev_ctx = device_ctx->hwctx; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS vk_dev_ctx->lock_queue = placebo_lock_queue; vk_dev_ctx->unlock_queue = placebo_unlock_queue; +FF_ENABLE_DEPRECATION_WARNINGS +#endif vk_dev_ctx->get_proc_addr = ctx->placebo_instance->get_proc_addr; diff --git a/libavfilter/vf_libplacebo.c b/libavfilter/vf_libplacebo.c index 48bf37fb2e..316eca37ec 100644 --- a/libavfilter/vf_libplacebo.c +++ b/libavfilter/vf_libplacebo.c @@ -667,14 +667,22 @@ static void lock_queue(void *priv, uint32_t qf, uint32_t qidx) { AVHWDeviceContext *avhwctx = priv; const AVVulkanDeviceContext *hwctx = avhwctx->hwctx; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS hwctx->lock_queue(avhwctx, qf, qidx); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } static void unlock_queue(void *priv, uint32_t qf, uint32_t qidx) { AVHWDeviceContext *avhwctx = priv; const AVVulkanDeviceContext *hwctx = avhwctx->hwctx; +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS hwctx->unlock_queue(avhwctx, qf, qidx); +FF_ENABLE_DEPRECATION_WARNINGS +#endif } #endif diff --git a/libavutil/hwcontext_vulkan.c b/libavutil/hwcontext_vulkan.c index 6c104b7204..65e2256e2d 100644 --- a/libavutil/hwcontext_vulkan.c +++ b/libavutil/hwcontext_vulkan.c @@ -2119,10 +2119,14 @@ FF_ENABLE_DEPRECATION_WARNINGS p->img_qfs[p->nb_img_qfs++] = hwctx->qf[i].idx; } +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS if (!hwctx->lock_queue) hwctx->lock_queue = lock_queue; if (!hwctx->unlock_queue) hwctx->unlock_queue = unlock_queue; +FF_ENABLE_DEPRECATION_WARNINGS +#endif /* Re-query device capabilities, in case the device was created externally */ vk->GetPhysicalDeviceMemoryProperties(hwctx->phys_dev, &p->mprops); diff --git a/libavutil/hwcontext_vulkan.h b/libavutil/hwcontext_vulkan.h index 77d53289b4..b9a841a197 100644 --- a/libavutil/hwcontext_vulkan.h +++ b/libavutil/hwcontext_vulkan.h @@ -168,18 +168,26 @@ typedef struct AVVulkanDeviceContext { int nb_decode_queues; #endif +#if FF_API_VULKAN_SYNC_QUEUES /** * Locks a queue, preventing other threads from submitting any command * buffers to this queue. * If set to NULL, will be set to lavu-internal functions that utilize a * mutex. + * + * Deprecated: use VK_KHR_internally_synchronized_queues. */ + attribute_deprecated void (*lock_queue)(struct AVHWDeviceContext *ctx, uint32_t queue_family, uint32_t index); /** * Similar to lock_queue(), unlocks a queue. Must only be called after locking. + * + * Deprecated: use VK_KHR_internally_synchronized_queues. */ + attribute_deprecated void (*unlock_queue)(struct AVHWDeviceContext *ctx, uint32_t queue_family, uint32_t index); +#endif /** * Queue families used. Must be preferentially ordered. List may contain diff --git a/libavutil/version.h b/libavutil/version.h index 432622ddbf..5d69f4451b 100644 --- a/libavutil/version.h +++ b/libavutil/version.h @@ -113,6 +113,7 @@ #define FF_API_CPU_FLAG_FORCE (LIBAVUTIL_VERSION_MAJOR < 61) #define FF_API_DOVI_L11_INVALID_PROPS (LIBAVUTIL_VERSION_MAJOR < 61) #define FF_API_ASSERT_FPU (LIBAVUTIL_VERSION_MAJOR < 61) +#define FF_API_VULKAN_SYNC_QUEUES (LIBAVUTIL_VERSION_MAJOR < 62) /** * @} diff --git a/libavutil/vulkan.c b/libavutil/vulkan.c index b6cbdf73a7..ff24b956cd 100644 --- a/libavutil/vulkan.c +++ b/libavutil/vulkan.c @@ -928,9 +928,17 @@ int ff_vk_exec_submit(FFVulkanContext *s, FFVkExecContext *e) return AVERROR_EXTERNAL; } +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS s->hwctx->lock_queue(s->device, e->qf, e->qi); +FF_ENABLE_DEPRECATION_WARNINGS +#endif ret = vk->QueueSubmit2(e->queue, 1, &submit_info, e->fence); +#if FF_API_VULKAN_SYNC_QUEUES +FF_DISABLE_DEPRECATION_WARNINGS s->hwctx->unlock_queue(s->device, e->qf, e->qi); +FF_ENABLE_DEPRECATION_WARNINGS +#endif if (ret != VK_SUCCESS) { av_log(s, AV_LOG_ERROR, "Unable to submit command buffer: %s\n", -- 2.52.0 From 511387e49a1a232b719e579e0a8ac77458914958 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 7 Mar 2026 12:22:35 +0100 Subject: [PATCH 08/45] avformat/aiffdec: Check for partial read Fixes: read of uninitialized memory Fixes: 490305404/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6406386140643328 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit ba0f8083fd630480df873a2bead96e5b2e211dc7) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/aiffdec.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c index ff47d8dc7b..8ae577cb71 100644 --- a/libavformat/aiffdec.c +++ b/libavformat/aiffdec.c @@ -23,6 +23,7 @@ #include "libavutil/dict.h" #include "libavutil/mem.h" #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" #include "pcm.h" @@ -368,9 +369,10 @@ static int aiff_read_header(AVFormatContext *s) if (len == 11 && size > 11) { uint8_t chunk[11]; - ret = avio_read(pb, chunk, 11); - if (ret > 0) - size -= ret; + ret = ffio_read_size(pb, chunk, 11); + if (ret < 0) + return ret; + size -= ret; if (!memcmp(chunk, "VADPCMCODES", sizeof(chunk))) { if ((ret = ff_get_extradata(s, st->codecpar, pb, size)) < 0) return ret; -- 2.52.0 From 711b69c6158d27da878e29d681b4f0680374b645 Mon Sep 17 00:00:00 2001 From: Olivier Laflamme <[email protected]> Date: Thu, 12 Mar 2026 16:42:06 +0100 Subject: [PATCH 09/45] fftools/ffprobe: Initialize data_dump_format_id This was used uninitialized previously Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 10d36e5d3d1b930ee9efc3840a8c72832f5ca404) Signed-off-by: Michael Niedermayer <[email protected]> --- fftools/ffprobe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fftools/ffprobe.c b/fftools/ffprobe.c index c02df4b45f..3c29fc2557 100644 --- a/fftools/ffprobe.c +++ b/fftools/ffprobe.c @@ -3238,7 +3238,7 @@ int main(int argc, char **argv) char *buf; char *f_name = NULL, *f_args = NULL; int ret, input_ret; - AVTextFormatDataDump data_dump_format_id; + AVTextFormatDataDump data_dump_format_id = AV_TEXTFORMAT_DATADUMP_XXD; init_dynload(); -- 2.52.0 From c88ae59e31f99266aa8a785ccc3e7ee968ee4728 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 7 Mar 2026 13:41:38 +0100 Subject: [PATCH 10/45] avcodec/lcldec: Fixes uqvq overflow Fixes: integer overflow Fixes: 490241717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZLIB_DEC_fuzzer-4560518961758208 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 7241b80422f4c477b0ad2112f9a4d99de9b70a98) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lcldec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index b439dbe25e..e9d4283eef 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -175,7 +175,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, int height = avctx->height; // Real image height unsigned int mszh_dlen; unsigned char yq, y1q, uq, vq; - int uqvq, ret; + int ret; unsigned int mthread_inlen, mthread_outlen; unsigned int len = buf_size; int linesize, offset; @@ -306,7 +306,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, for (row = 0; row < height; row++) { pixel_ptr = row * width * 3; yq = encoded[pixel_ptr++]; - uqvq = AV_RL16(encoded+pixel_ptr); + unsigned uqvq = AV_RL16(encoded+pixel_ptr); pixel_ptr += 2; for (col = 1; col < width; col++) { encoded[pixel_ptr] = yq -= encoded[pixel_ptr]; -- 2.52.0 From b8422184027ff6ed2c61d602a65c75f21c7797da Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 5 Mar 2026 17:18:18 +0100 Subject: [PATCH 11/45] swscale/output: fix integer overflows in chroma in yuv2rgba64_X_c_template() Fixes: signed integer overflow: 130489 * 16525 cannot be represented in type 'int' Fixes: 488950053/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4627272670969856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 3b98e29da87c85396b55bbd86be289a16d07be16) Signed-off-by: Michael Niedermayer <[email protected]> --- libswscale/output.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libswscale/output.c b/libswscale/output.c index 0561e5736d..1494b06bf5 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -1128,8 +1128,8 @@ yuv2rgba64_X_c_template(SwsInternal *c, const int16_t *lumFilter, int j; unsigned Y1 = -0x40000000; unsigned Y2 = -0x40000000; - int U = -(128 << 23); // 19 - int V = -(128 << 23); + unsigned U = -(128 << 23); // 19 + unsigned V = -(128 << 23); int R, G, B; for (j = 0; j < lumFilterSize; j++) { @@ -1159,8 +1159,8 @@ yuv2rgba64_X_c_template(SwsInternal *c, const int16_t *lumFilter, Y1 += 0x10000; Y2 = (int)Y2 >> 14; Y2 += 0x10000; - U >>= 14; - V >>= 14; + U = (int)U >> 14; + V = (int)V >> 14; // 8 bits: 27 -> 17 bits, 16 bits: 31 - 14 = 17 bits Y1 -= c->yuv2rgb_y_offset; -- 2.52.0 From 21719ece26b1cfdc4063f061d41fc53f17d83f57 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 5 Mar 2026 16:38:03 +0100 Subject: [PATCH 12/45] avformat/hxvs: Do not allow backward steps in hxvs_probe() Fixes: infinite loop Fixes: 487632033/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-4565877872984064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 4ccad70d5797f13de4f6c249065e83d4130da268) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/hxvs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/hxvs.c b/libavformat/hxvs.c index ed827c8d97..998faed803 100644 --- a/libavformat/hxvs.c +++ b/libavformat/hxvs.c @@ -118,6 +118,10 @@ static int hxvs_probe(const AVProbeData *p) i += 4; if (tag == HXVF || tag == HXAF) { bytes = AV_RL32(&p->buf[i]); + + if (12 + bytes > INT_MAX - i) + return 0; + i += 12 + bytes; flag |= (tag == HXVF) ? 2 : 4; continue; -- 2.52.0 From c9cf8cf9c370d515665df434198173d9687075c2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Feb 2026 03:27:20 +0100 Subject: [PATCH 13/45] avcodec/aom_film_grain: avoid duplicate indexes in ff_aom_parse_film_grain_sets() Fixes: use after free Fixes: 478301106/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-6155792247226368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit ebb6ac1bc7a6124ab130d9b4e679452ac94cde92) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aom_film_grain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c index a5b692562d..5919d99c30 100644 --- a/libavcodec/aom_film_grain.c +++ b/libavcodec/aom_film_grain.c @@ -152,8 +152,9 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, payload_4byte = get_bits1(gb); payload_size = get_bits(gb, payload_4byte ? 2 : 8); set_idx = get_bits(gb, 3); + fgp = av_film_grain_params_alloc(&fgp_size); - if (!fgp) + if (!fgp || s->sets[set_idx]) goto error; aom = &fgp->codec.aom; -- 2.52.0 From 2cf15d3fc06c7e7709ece4a3955e100bab3540e3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 6 Feb 2026 03:49:30 +0100 Subject: [PATCH 14/45] avcodec/aom_film_grain: Remove impossible check fgp is freshly allocated so it cannot be equal to ref Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit b4b569f9226168c59cc5b101580203624703a8ee) --- libavcodec/aom_film_grain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c index 5919d99c30..bb60c55774 100644 --- a/libavcodec/aom_film_grain.c +++ b/libavcodec/aom_film_grain.c @@ -213,7 +213,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, } predict_scaling = get_bits1(gb); - if (predict_scaling && (!ref || ref == fgp)) + if (predict_scaling && !ref) goto error; // prediction must be from valid, different set predict_y_scaling = predict_scaling ? get_bits1(gb) : 0; -- 2.52.0 From 2803bcd5d568ab57eee9b020c40ebb7aaf895e7f Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 11 Mar 2026 21:48:33 +0800 Subject: [PATCH 15/45] avformat/rtmpproto: fix listen_timeout conversion for special negative values rtmpproto converts listen_timeout to milliseconds by multiplying it by 1000 before passing it to TCP. However, negative values are special sentinels (e.g., -1 for infinite wait) and should not be multiplied. This worked prior to commit 49c6e6cc44f because there was no range validation. Since that commit, ff_parse_opts_from_query_string validates option values against their declared ranges, causing these multiplied negative values to fail. Fixes ticket #22469. Signed-off-by: Zhao Zhili <[email protected]> (cherry picked from commit f189657ec67cfae78dc7fdf44754aa1633e24be0) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/rtmpproto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index d4c9047266..2fa2843c03 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2736,7 +2736,8 @@ static int rtmp_open(URLContext *s, const char *uri, int flags, AVDictionary **o if (rt->listen) ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?listen&listen_timeout=%d&tcp_nodelay=%d", - rt->listen_timeout * 1000, rt->tcp_nodelay); + rt->listen_timeout < 0 ? -1 : rt->listen_timeout * 1000, + rt->tcp_nodelay); else ff_url_join(buf, sizeof(buf), "tcp", NULL, hostname, port, "?tcp_nodelay=%d", rt->tcp_nodelay); } -- 2.52.0 From 0ce7bd66a725a25d93cbb045309f06ec716d52f5 Mon Sep 17 00:00:00 2001 From: Karl Mogensen <[email protected]> Date: Sun, 8 Mar 2026 18:07:35 +0100 Subject: [PATCH 16/45] avfilter/af_lv2: call lilv_instance_activate before lilv_instance_run Why: the change is done to comply with lilv expectations of hosts. Added call lilv_instance_activate in the config_output function to abide by lilv documentation that states it must be called before lilv_instance_run: "This MUST be called before calling lilv_instance_run()" - documentation source (https://github.com/lv2/lilv/blob/main/include/lilv/lilv.h) Added call lilv_instance_deactivate in the uninit function to abide by lv2 documentation: "If a host calls activate(), it MUST call deactivate() at some point in the future" - documentation source (https://gitlab.com/lv2/lv2/-/blob/main/include/lv2/core/lv2.h) Added instance_activated integer to LV2Context struct to track if instance was activated and only do lilv_instance_deactivate if was activated to abide by lv2 documentation: "Hosts MUST NOT call deactivate() unless activate() was previously called." - documentation source (https://gitlab.com/lv2/lv2/-/blob/main/include/lv2/core/lv2.h) Regarding the patcheck warning (possibly constant :instance_activated): This is a false positive since the struct member is zero-initialized. Fixes: trac issue #11661 (https://trac.ffmpeg.org/ticket/11661) Reported-by: Dave Flater Signed-off-by: Karl Mogensen <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit fa281d139453ca43ef6054b1c5b829141405c80d) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/af_lv2.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavfilter/af_lv2.c b/libavfilter/af_lv2.c index e7f3f9c588..c34f6eb30c 100644 --- a/libavfilter/af_lv2.c +++ b/libavfilter/af_lv2.c @@ -74,6 +74,7 @@ typedef struct LV2Context { float *controls; LilvInstance *instance; + int instance_activated; LilvNode *atom_AtomPort; LilvNode *atom_Sequence; @@ -387,6 +388,9 @@ static int config_output(AVFilterLink *outlink) inlink->min_samples = inlink->max_samples = 4096; } + lilv_instance_activate(s->instance); + s->instance_activated = 1; + return 0; } @@ -562,6 +566,8 @@ static av_cold void uninit(AVFilterContext *ctx) { LV2Context *s = ctx->priv; + if (s->instance_activated) + lilv_instance_deactivate(s->instance); lilv_node_free(s->powerOf2BlockLength); lilv_node_free(s->fixedBlockLength); lilv_node_free(s->boundedBlockLength); -- 2.52.0 From 1f217b4b7dbfe16da99d03dee81b6eba3fe023d3 Mon Sep 17 00:00:00 2001 From: Ted Meyer <[email protected]> Date: Thu, 5 Mar 2026 17:33:36 -0800 Subject: [PATCH 17/45] avformat/mov: do not allocate out-of-range buffers There's a possibility here with a well-crafted MP4 file containing only the nested boxes in order: MOOV.TRAK.MDIA.MINF.STBL.SDTP where the header size uses the 64 bit large size, and the ending stdp box has some size value >= 0x100000014. On a 32 bit build of ffmpeg, av_malloc's size parameter drops the high order bits of `entries`, and and the allocation is now a controlled size that is significantly smaller than `entries`. The following loop will then write off the ended of allocated memory with data that follows the box fourcc. (cherry picked from commit 86f53f9ffb779524085ead799b57da87c0c1cf7f) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mov.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 9b7df252b2..f026c0fb4c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3697,6 +3697,9 @@ static int mov_read_sdtp(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_freep(&sc->sdtp_data); sc->sdtp_count = 0; + if (entries < 0 || entries > SIZE_MAX) + return AVERROR(ERANGE); + sc->sdtp_data = av_malloc(entries); if (!sc->sdtp_data) return AVERROR(ENOMEM); -- 2.52.0 From 4f72addce10b8dc2b08b7ebfdcc261a543a768fe Mon Sep 17 00:00:00 2001 From: Gil Portnoy <[email protected]> Date: Wed, 11 Mar 2026 04:00:15 +0100 Subject: [PATCH 18/45] avcodec/cbs_h266_syntax_template: Fix rows vs columns Fixes: out of array access Fixes: vvc_poc_cbs_divergence_max.h266 Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 51606de0e92867b62abef42509de38181aa25b3e) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 0ff7459f5c..f2003d8bac 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -3506,7 +3506,7 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw, tile_idx <= current->sh_slice_address + current->sh_num_tiles_in_slice_minus1; tile_idx++) { - tile_y = tile_idx / pps->num_tile_rows; + tile_y = tile_idx / pps->num_tile_columns; height = pps->row_height_val[tile_y]; current->num_entry_points += (entropy_sync ? height : 1); } -- 2.52.0 From 56217dccd61fed5faecb2db58dfa4516bf0137af Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 14 Aug 2025 02:12:26 +0200 Subject: [PATCH 19/45] avutil/timecode: Check for integer overflow in av_timecode_init_from_components() Fixes: integer overflow Fixes: testcase that calls av_timecode_init_from_components() with hh set explicitly to INT_MAX Found-by: Youngjae Choi, Mingyoung Ban, Seunghoon Woo Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit eb5d60786121249f35499c160f9937a1c7fd9c55) Signed-off-by: Michael Niedermayer <[email protected]> --- libavutil/timecode.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavutil/timecode.c b/libavutil/timecode.c index b5352a3961..316100759e 100644 --- a/libavutil/timecode.c +++ b/libavutil/timecode.c @@ -211,6 +211,7 @@ int av_timecode_init(AVTimecode *tc, AVRational rate, int flags, int frame_start int av_timecode_init_from_components(AVTimecode *tc, AVRational rate, int flags, int hh, int mm, int ss, int ff, void *log_ctx) { int ret; + int64_t s; memset(tc, 0, sizeof(*tc)); tc->flags = flags; @@ -221,7 +222,15 @@ int av_timecode_init_from_components(AVTimecode *tc, AVRational rate, int flags, if (ret < 0) return ret; - tc->start = (hh*3600 + mm*60 + ss) * tc->fps + ff; + s = hh*3600LL + mm*60LL + ss; + if (s != (int32_t)s) + return AVERROR(EINVAL); + + s = s * tc->fps + ff; + if (s != (int32_t)s) + return AVERROR(EINVAL); + tc->start = s; + if (tc->flags & AV_TIMECODE_FLAG_DROPFRAME) { /* adjust frame number */ int tmins = 60*hh + mm; tc->start -= (tc->fps / 30 * 2) * (tmins - tmins/10); -- 2.52.0 From 60f39047184d2ca2ba8e24ed0f375ab7f7476ced Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 7 Mar 2026 13:48:49 +0100 Subject: [PATCH 20/45] avformat/dhav: Fix handling or slightly larger files Fixes: integer overflow Fixes: 490241718/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-4902512932225024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit c5d5fb2309cd93953e137dacb09ee0ceb8494733) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/dhav.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 84a203ef6f..b9adfc1296 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -252,7 +252,7 @@ static int64_t get_duration(AVFormatContext *s) int64_t size = avio_size(s->pb); int64_t ret = 0; - if (start_pos + 20 > size) + if (start_pos < 0 || start_pos > size - 20) return 0; avio_skip(s->pb, 16); -- 2.52.0 From f851191ce675aebe0306ecf679e0d1f0234ec18c Mon Sep 17 00:00:00 2001 From: Oliver Chang <[email protected]> Date: Tue, 24 Feb 2026 02:41:27 -0800 Subject: [PATCH 21/45] aacdec_usac: skip FD-specific decoding for LPD channels `spectrum_decode` currently executes Frequency Domain (FD) decoding steps for all channels, regardless of their `core_mode`. When a channel is in Linear Prediction Domain (LPD) mode (`core_mode == 1`), FD-specific parameters such as scalefactor offsets (`sfo`) and individual channel stream (`ics`) information are not parsed. This causes a global-buffer-overflow in `dequant_scalefactors`. Because `spectrum_scale` is called on LPD channels, it uses stale or uninitialized `sfo` values to index `ff_aac_pow2sf_tab`. In the reported crash, a stale `sfo` value of 240 resulted in an index of 440 (240 + POW_SF2_ZERO), exceeding the table's size of 428. Fix this by ensuring `spectrum_scale` and `imdct_and_windowing` are only called for channels where `core_mode == 0` (FD). Co-authored-by: CodeMender <[email protected]> Fixes: https://issues.oss-fuzz.com/486160985 (cherry picked from commit d519ab89931212b4137e65b1530ebfca1d1fbbf9) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index bed9747e9c..74a3badaf4 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -1293,7 +1293,8 @@ static void spectrum_decode(AACDecContext *ac, AACUSACConfig *usac, SingleChannelElement *sce = &cpe->ch[ch]; AACUsacElemData *ue = &sce->ue; - spectrum_scale(ac, sce, ue); + if (!ue->core_mode) + spectrum_scale(ac, sce, ue); } if (nb_channels > 1 && us->common_window) { @@ -1343,8 +1344,9 @@ static void spectrum_decode(AACDecContext *ac, AACUSACConfig *usac, if (sce->tns.present && ((nb_channels == 1) || (us->tns_on_lr))) ac->dsp.apply_tns(sce->coeffs, &sce->tns, &sce->ics, 1); - ac->oc[1].m4ac.frame_length_short ? ac->dsp.imdct_and_windowing_768(ac, sce) : - ac->dsp.imdct_and_windowing(ac, sce); + if (!sce->ue.core_mode) + ac->oc[1].m4ac.frame_length_short ? ac->dsp.imdct_and_windowing_768(ac, sce) : + ac->dsp.imdct_and_windowing(ac, sce); } } -- 2.52.0 From ca6e0ee7aa12504fae1dd02717b92fcf8352cf24 Mon Sep 17 00:00:00 2001 From: Gil Portnoy <[email protected]> Date: Wed, 11 Mar 2026 04:39:06 +0100 Subject: [PATCH 22/45] avcodec/cbs_h266_syntax_template: Fix w/h typo Fixes: out of array access Fixes: vvc_poc_subpic_wh_bug.h266 Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 26dd9f9b5610b2c0313166c53d3964cde13db119) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_h266_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index f2003d8bac..b411382aa7 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1216,7 +1216,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, int num_subpic_cols = tmp_width_val / (current->sps_subpic_width_minus1[0] + 1); if (tmp_width_val % (current->sps_subpic_width_minus1[0] + 1) || - tmp_height_val % (current->sps_subpic_width_minus1[0] + 1) || + tmp_height_val % (current->sps_subpic_height_minus1[0] + 1) || current->sps_num_subpics_minus1 != (num_subpic_cols * tmp_height_val / (current->sps_subpic_height_minus1[0] + 1) - 1)) -- 2.52.0 From b6faea362a4c5b6798b9322714956b8e8e4a4f39 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 12 Mar 2026 22:58:18 +0100 Subject: [PATCH 23/45] avcodec/wmv2dec: More Checks about reading skip bits Fixes: out of array read with --disable-safe-bitstream-reader Fixes: poc_wmv2.avi Note, this requires the safe bitstream reader to be turned off by the user and the user disregarding the security warning Change suggested by: Guanni Qu <[email protected]> Found-by: Guanni Qu <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit f73849887cb9c0d966eb9d27262890be82c2fd10) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/wmv2dec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/wmv2dec.c b/libavcodec/wmv2dec.c index 22b9b15e44..8a3239fe7a 100644 --- a/libavcodec/wmv2dec.c +++ b/libavcodec/wmv2dec.c @@ -343,6 +343,8 @@ static int parse_mb_skip(WMV2DecContext *w) mb_type[mb_y * h->c.mb_stride + mb_x] = MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV; } else { + if (get_bits_left(&h->gb) < h->c.mb_width) + return AVERROR_INVALIDDATA; for (int mb_x = 0; mb_x < h->c.mb_width; mb_x++) mb_type[mb_y * h->c.mb_stride + mb_x] = (get_bits1(&h->gb) ? MB_TYPE_SKIP : 0) | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV; @@ -358,6 +360,8 @@ static int parse_mb_skip(WMV2DecContext *w) mb_type[mb_y * h->c.mb_stride + mb_x] = MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV; } else { + if (get_bits_left(&h->gb) < h->c.mb_height) + return AVERROR_INVALIDDATA; for (int mb_y = 0; mb_y < h->c.mb_height; mb_y++) mb_type[mb_y * h->c.mb_stride + mb_x] = (get_bits1(&h->gb) ? MB_TYPE_SKIP : 0) | MB_TYPE_16x16 | MB_TYPE_FORWARD_MV; -- 2.52.0 From 5bc4a9898c806c1d532ac11712a26537acb96734 Mon Sep 17 00:00:00 2001 From: Jun Zhao <[email protected]> Date: Sun, 25 Jan 2026 10:31:48 +0800 Subject: [PATCH 24/45] lavfi/bwdif: fix heap-buffer-overflow with small height videos Reproduce: ffmpeg -i /tmp/bwdif_test_input_160x4_gray16.jpg -vf "bwdif" -f null - filter_intra accesses rows 3 lines away via cur[mrefs3] and cur[prefs3]. For small height videos (h <= 4), this causes heap-buffer-overflow. Add boundary check for filter_intra when YADIF_FIELD_END is set. The boundary condition (y < 3) or (y + 3 >= td->h) precisely matches filter_intra's 3-line context requirement. Test file: 160x4 gray16 JPEG https://code.ffmpeg.org/attachments/db2ace24-bc00-4af6-a53a-5df6b0d51b15 fix #21570 Reviewed-by: Thomas Mundt <[email protected]> Signed-off-by: Jun Zhao <[email protected]> (cherry picked from commit 795bccdaf57772b1803914dee2f32d52776518e2) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_bwdif.c | 19 ++++++++++++++----- tests/ref/fate/filter-bwdif-mode0 | 2 +- tests/ref/fate/filter-bwdif-mode1 | 2 +- tests/ref/fate/filter-bwdif10 | 2 +- 4 files changed, 17 insertions(+), 8 deletions(-) diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c index d49f3f66d6..67efc3a8c3 100644 --- a/libavfilter/vf_bwdif.c +++ b/libavfilter/vf_bwdif.c @@ -77,11 +77,20 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) uint8_t *next = &yadif->next->data[td->plane][y * linesize]; uint8_t *dst = &td->frame->data[td->plane][y * td->frame->linesize[td->plane]]; if (yadif->current_field == YADIF_FIELD_END) { - s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs, - y > (df - 1) ? -refs : refs, - (y + 3*df) < td->h ? 3 * refs : -refs, - y > (3*df - 1) ? -3 * refs : refs, - td->parity ^ td->tff, clip_max); + if ((y < 3) || ((y + 3) >= td->h)) { + s->dsp.filter_edge(dst, prev, cur, next, td->w, + (y + df) < td->h ? refs : -refs, + y > (df - 1) ? -refs : refs, + refs << 1, -(refs << 1), + td->parity ^ td->tff, clip_max, + (y < 2) || ((y + 3) > td->h) ? 0 : 1); + } else { + s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs, + y > (df - 1) ? -refs : refs, + (y + 3*df) < td->h ? 3 * refs : -refs, + y > (3*df - 1) ? -3 * refs : refs, + td->parity ^ td->tff, clip_max); + } } else if ((y < 4) || ((y + 5) > td->h)) { s->dsp.filter_edge(dst, prev, cur, next, td->w, (y + df) < td->h ? refs : -refs, diff --git a/tests/ref/fate/filter-bwdif-mode0 b/tests/ref/fate/filter-bwdif-mode0 index 23dcaee900..91b47dbe70 100644 --- a/tests/ref/fate/filter-bwdif-mode0 +++ b/tests/ref/fate/filter-bwdif-mode0 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 9, 9, 1, 622080, 0xd435648a +0, 9, 9, 1, 622080, 0x3f25bfc2 0, 10, 10, 1, 622080, 0x62085455 0, 11, 11, 1, 622080, 0x60f943a0 0, 12, 12, 1, 622080, 0x5396f14a diff --git a/tests/ref/fate/filter-bwdif-mode1 b/tests/ref/fate/filter-bwdif-mode1 index e8db88c932..1e604646e7 100644 --- a/tests/ref/fate/filter-bwdif-mode1 +++ b/tests/ref/fate/filter-bwdif-mode1 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 18, 18, 1, 622080, 0xd435648a +0, 18, 18, 1, 622080, 0x3f25bfc2 0, 19, 19, 1, 622080, 0xef4617cc 0, 20, 20, 1, 622080, 0x62085455 0, 21, 21, 1, 622080, 0x5b5ae735 diff --git a/tests/ref/fate/filter-bwdif10 b/tests/ref/fate/filter-bwdif10 index 85ce543880..d97acea991 100644 --- a/tests/ref/fate/filter-bwdif10 +++ b/tests/ref/fate/filter-bwdif10 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 9, 9, 1, 1244160, 0x57c21e2b +0, 9, 9, 1, 1244160, 0x4f0e6e1c 0, 10, 10, 1, 1244160, 0x57152296 0, 11, 11, 1, 1244160, 0x0074598b 0, 12, 12, 1, 1244160, 0x44537bb8 -- 2.52.0 From a5696b44a6f692118f5ebf6e420f0158971e9345 Mon Sep 17 00:00:00 2001 From: Nicholas Carlini <[email protected]> Date: Sat, 14 Mar 2026 04:47:53 +0000 Subject: [PATCH 25/45] avcodec/h264_slice: reject slice_num >= 0xFFFF An H.264 picture with 65536 slices makes slice_num collide with the slice_table sentinel. slice_table is uint16_t, initialized via memset(..., -1, ...) so spare entries (one per row, mb_stride = mb_width + 1) stay 0xFFFF. slice_num is an uncapped ++h->current_slice. At slice 65535 the collision makes slice_table[spare] == slice_num pass, defeating the deblock_topleft check in xchg_mb_border and the top_type zeroing in fill_decode_caches. With both guards bypassed at mb_x = 0, top_borders[top_idx][-1] underflows 96 bytes and XCHG writes at -88 below the allocation (plus -72 and -56 for chroma in the non-444 path). Fixes: heap-buffer-overflow Found-by: Nicholas Carlini <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 39e1969303a0b9ec5fb5f5eb643bf7a5b69c0a89) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/h264_slice.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 69f70c90bb..0ce8e46c72 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -1979,6 +1979,12 @@ static int h264_slice_init(H264Context *h, H264SliceContext *sl, h->ps.pps->chroma_qp_index_offset[1]) + 6 * (h->ps.sps->bit_depth_luma - 8); + // slice_table is uint16_t initialized to 0xFFFF as a sentinel. + if (h->current_slice >= 0xFFFE) { + av_log(h->avctx, AV_LOG_ERROR, "Too many slices (%d)\n", h->current_slice + 1); + return AVERROR_PATCHWELCOME; + } + sl->slice_num = ++h->current_slice; if (sl->slice_num) -- 2.52.0 From b6a617c8bfc1b3b1a661013c93727a708b7e1b13 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 14 Mar 2026 00:50:17 +0100 Subject: [PATCH 26/45] avcodec/cbs_h266_syntax_template: Check tile_y Fixes: invalid state leading to out of array access Fixes: 490615782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4711353817563136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 12303cd922d9cfb21b6160dcdd18083815f839b8) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_h266_syntax_template.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index b411382aa7..98a8954943 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1971,6 +1971,8 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, current->slice_top_left_tile_idx[i] = tile_idx; tile_x = tile_idx % current->num_tile_columns; tile_y = tile_idx / current->num_tile_columns; + if (tile_y >= current->num_tile_rows) + return AVERROR_INVALIDDATA; if (tile_x != current->num_tile_columns - 1) { ues(pps_slice_width_in_tiles_minus1[i], 0, current->num_tile_columns - 1 - tile_x, 1, i); -- 2.52.0 From 259ee609acd124456f1c6c442843168b111ab262 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 11 Mar 2026 17:29:31 +0100 Subject: [PATCH 27/45] avcodec/aac/aacdec_usac_mps212: Introduce a temporary array for ff_aac_ec_data_dec() This also reverts: c2364e92229ac33b07ae5158f51f4a08fdb0288c Fixes: out of array access (testcase exists but did not replicate for me) Founbd-by: Gil Portnoy <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 770bc1c23a18fe72874e888e1be123a21620acb5) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac_mps212.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index 6c1f3acb80..3e4119d3fc 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -591,9 +591,6 @@ static int get_freq_strides(int16_t *freq_strides, int band_stride, } } - for (int i = 0; i <= data_bands; i++) - freq_strides[i] = av_clip_uintp2(freq_strides[i], 2); - return data_bands; } @@ -643,7 +640,8 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, fine_to_coarse(ld->last_data, data_type, start_band, end_band); } - int data_bands = get_freq_strides(ld->freq_res, + int16_t freq_stride_map[MPS_MAX_PARAM_BANDS + 1]; + int data_bands = get_freq_strides(freq_stride_map, stride_table[ld->freq_res[set_idx]], start_band, end_band); @@ -651,7 +649,7 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, return AVERROR(EINVAL); for (int j = 0; j < data_bands; j++) - ld->last_data[start_band + j] = ld->last_data[ld->freq_res[j]]; + ld->last_data[start_band + j] = ld->last_data[freq_stride_map[j]]; int err = ec_pair_dec(gb, ld->data[set_idx + 0], ld->data[set_idx + 1], @@ -664,11 +662,11 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, if (data_type == MPS_IPD) { const int mask = ld->coarse_quant[set_idx] ? 0x7 : 0xF; for (int j = 0; j < data_bands; j++) - for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++) + for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++) ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j] & mask; } else { for (int j = 0; j < data_bands; j++) - for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++) + for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++) ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j]; } -- 2.52.0 From 42692d0f571f335174049e06c855b20340d73e6d Mon Sep 17 00:00:00 2001 From: Nicholas Carlini <[email protected]> Date: Sat, 14 Mar 2026 15:39:51 +0000 Subject: [PATCH 28/45] avformat/mpegts: remove JPEG-XS early return on invalid header_size new_pes_packet() moves a buffer with pkt->buf = pes->buffer before JPEG-XS validation. If header_size > pkt->size, an early return leaves pes->buffer as a stale alias of pkt->buf with refcount 1. Later, mpegts_read_packet() calls av_packet_unref(), freeing the buffer through pkt->buf. The flush loop then re-enters new_pes_packet() and dereferences the dangling pes->buffer; a second path hits it via av_buffer_unref() in handle_packets() after a seek. Drop the early return. The packet is delivered with AV_PKT_FLAG_CORRUPT set, matching the PES-size-mismatch case above, and the function falls through to the normal cleanup path. The else guards the header trim so pkt->data/pkt->size stay valid for the memset. Fixes: use after free Fixes regression since 16f89d342e. Found-by: Nicholas Carlini <[email protected]> (cherry picked from commit 55bf0e6cd5a46b26b0ebd2374ad2625a7133e4ee) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegts.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 0ee10f9a77..bfbdbf5b19 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1041,10 +1041,10 @@ static int new_pes_packet(PESContext *pes, AVPacket *pkt) "Invalid JPEG-XS header size %"PRIu32" > packet size %d\n", header_size, pkt->size); pes->flags |= AV_PKT_FLAG_CORRUPT; - return AVERROR_INVALIDDATA; + } else { + pkt->data += header_size; + pkt->size -= header_size; } - pkt->data += header_size; - pkt->size -= header_size; } memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); -- 2.52.0 From 6f890cb10423aa5835f55f0e52e46b5cdbf5b2cc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 13 Mar 2026 00:51:14 +0100 Subject: [PATCH 29/45] avcodec/exr: Check input space before reverse_lut() Fixes: use of uninitialized memory Fixes: 490707906/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6310933506097152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 70286d59f1bd413009c28dea22ab69649fa87490) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/exr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index a0f00a7cf1..c7fcd302cd 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -637,6 +637,9 @@ static int piz_uncompress(const EXRContext *s, const uint8_t *src, int ssize, max_non_zero - min_non_zero + 1); memset(td->bitmap + max_non_zero + 1, 0, BITMAP_SIZE - max_non_zero - 1); + if (bytestream2_get_bytes_left(&gb) < 4) + return AVERROR_INVALIDDATA; + maxval = reverse_lut(td->bitmap, td->lut); bytestream2_skip(&gb, 4); -- 2.52.0 From 7df9a56f0d2bdbf45e7868f7b4e1f06a6fc01be1 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 11 Mar 2026 21:48:33 +0800 Subject: [PATCH 30/45] avformat/rtmpproto: fix listen_timeout conversion for special negative values rtmpproto converts listen_timeout to milliseconds by multiplying it by 1000 before passing it to TCP. However, negative values are special sentinels (e.g., -1 for infinite wait) and should not be multiplied. This worked prior to commit 49c6e6cc44f because there was no range validation. Since that commit, ff_parse_opts_from_query_string validates option values against their declared ranges, causing these multiplied negative values to fail. Fixes ticket #22469. Signed-off-by: Zhao Zhili <[email protected]> (cherry picked from commit f189657ec67cfae78dc7fdf44754aa1633e24be0) Signed-off-by: Marvin Scholz <[email protected]> -- 2.52.0 From fcbbd8b394829c06c558518f5fc1b8fa23c1026b Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Thu, 12 Mar 2026 20:32:34 -0300 Subject: [PATCH 31/45] avcodec/h2645_sei: refactor decode_registered_user_data() Switch statements are cleaner and will be useful for an upcoming change. Signed-off-by: James Almer <[email protected]> (cherry picked from commit 64edbb37f129f43f51cd8125d9d0b467c05f653d) --- libavcodec/h2645_sei.c | 120 +++++++++++++++++++++++++---------------- 1 file changed, 74 insertions(+), 46 deletions(-) diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c index f3ce3da9eb..798c17aa9f 100644 --- a/libavcodec/h2645_sei.c +++ b/libavcodec/h2645_sei.c @@ -161,7 +161,10 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, /* itu_t_t35_payload_byte follows */ provider_code = bytestream2_get_be16u(gb); - if (country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_ATSC) { + switch (country_code) { + case ITU_T_T35_COUNTRY_CODE_US: + switch (provider_code) { + case ITU_T_T35_PROVIDER_CODE_ATSC: { uint32_t user_identifier; if (bytestream2_get_bytes_left(gb) < 4) @@ -179,53 +182,15 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, user_identifier); break; } - } else if (country_code == ITU_T_T35_COUNTRY_CODE_UK && provider_code == ITU_T_T35_PROVIDER_CODE_VNOVA) { - if (bytestream2_get_bytes_left(gb) < 2) - return AVERROR_INVALIDDATA; - - bytestream2_skipu(gb, 1); // user_data_type_code - return decode_registered_user_data_lcevc(&h->lcevc, gb); - } + break; + } #if CONFIG_HEVC_SEI - else if (country_code == ITU_T_T35_COUNTRY_CODE_CN && provider_code == ITU_T_T35_PROVIDER_CODE_HDR_VIVID) { - const uint16_t cuva_provider_oriented_code = 0x0005; - uint16_t provider_oriented_code; - - if (!IS_HEVC(codec_id)) - goto unsupported_provider_code; - - if (bytestream2_get_bytes_left(gb) < 2) - return AVERROR_INVALIDDATA; - - provider_oriented_code = bytestream2_get_be16u(gb); - if (provider_oriented_code == cuva_provider_oriented_code) { - return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb); - } - } else if(country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_SAMSUNG) { - // A/341 Amendment - 2094-40 - const uint16_t smpte2094_40_provider_oriented_code = 0x0001; - const uint8_t smpte2094_40_application_identifier = 0x04; - uint16_t provider_oriented_code; - uint8_t application_identifier; - - if (!IS_HEVC(codec_id)) - goto unsupported_provider_code; - - if (bytestream2_get_bytes_left(gb) < 3) - return AVERROR_INVALIDDATA; - - provider_oriented_code = bytestream2_get_be16u(gb); - application_identifier = bytestream2_get_byteu(gb); - if (provider_oriented_code == smpte2094_40_provider_oriented_code && - application_identifier == smpte2094_40_application_identifier) { - return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb); - } - } else if (country_code == ITU_T_T35_COUNTRY_CODE_US && provider_code == ITU_T_T35_PROVIDER_CODE_AOM) { + case ITU_T_T35_PROVIDER_CODE_AOM: { const uint16_t aom_grain_provider_oriented_code = 0x0001; uint16_t provider_oriented_code; if (!IS_HEVC(codec_id)) - goto unsupported_provider_code; + break; if (bytestream2_get_bytes_left(gb) < 2) return AVERROR_INVALIDDATA; @@ -236,14 +201,77 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, gb->buffer, bytestream2_get_bytes_left(gb)); } + break; + } + case ITU_T_T35_PROVIDER_CODE_SAMSUNG: { + // A/341 Amendment - 2094-40 + const uint16_t smpte2094_40_provider_oriented_code = 0x0001; + const uint8_t smpte2094_40_application_identifier = 0x04; + uint16_t provider_oriented_code; + uint8_t application_identifier; + + if (!IS_HEVC(codec_id)) + break; + + if (bytestream2_get_bytes_left(gb) < 3) + return AVERROR_INVALIDDATA; + + provider_oriented_code = bytestream2_get_be16u(gb); + application_identifier = bytestream2_get_byteu(gb); + if (provider_oriented_code == smpte2094_40_provider_oriented_code && + application_identifier == smpte2094_40_application_identifier) { + return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb); + } + break; + } +#endif + default: + break; + } + break; + case ITU_T_T35_COUNTRY_CODE_UK: + switch (provider_code) { + case ITU_T_T35_PROVIDER_CODE_VNOVA: + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; + + bytestream2_skipu(gb, 1); // user_data_type_code + return decode_registered_user_data_lcevc(&h->lcevc, gb); + default: + break; + } + break; +#if CONFIG_HEVC_SEI + case ITU_T_T35_COUNTRY_CODE_CN: { + const uint16_t cuva_provider_oriented_code = 0x0005; + uint16_t provider_oriented_code; + + switch (provider_code) { + case ITU_T_T35_PROVIDER_CODE_HDR_VIVID: + if (!IS_HEVC(codec_id)) + break; + + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; + + provider_oriented_code = bytestream2_get_be16u(gb); + if (provider_oriented_code == cuva_provider_oriented_code) { + return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb); + } + break; + default: + break; + } + break; } #endif - else { - unsupported_provider_code: + default: + break; + } + av_log(logctx, AV_LOG_VERBOSE, "Unsupported User Data Registered ITU-T T35 SEI message (country_code = %d, provider_code = %d)\n", country_code, provider_code); - } return 0; } -- 2.52.0 From 93c915a572d9fded8561675debd6f274af3688c8 Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Thu, 12 Mar 2026 20:39:57 -0300 Subject: [PATCH 32/45] avcodec/h2645_sei: reindent after the previous change Signed-off-by: James Almer <[email protected]> (cherry picked from commit 3af824a54081949dd1a078fab23b475eeff7bc63) --- libavcodec/h2645_sei.c | 114 ++++++++++++++++++++--------------------- 1 file changed, 57 insertions(+), 57 deletions(-) diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c index 798c17aa9f..a6bdb8b817 100644 --- a/libavcodec/h2645_sei.c +++ b/libavcodec/h2645_sei.c @@ -165,63 +165,63 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, case ITU_T_T35_COUNTRY_CODE_US: switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_ATSC: { - uint32_t user_identifier; + uint32_t user_identifier; - if (bytestream2_get_bytes_left(gb) < 4) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(gb) < 4) + return AVERROR_INVALIDDATA; - user_identifier = bytestream2_get_be32u(gb); - switch (user_identifier) { - case MKBETAG('D', 'T', 'G', '1'): // afd_data - return decode_registered_user_data_afd(&h->afd, gb); - case MKBETAG('G', 'A', '9', '4'): // closed captions - return decode_registered_user_data_closed_caption(&h->a53_caption, gb); - default: - av_log(logctx, AV_LOG_VERBOSE, - "Unsupported User Data Registered ITU-T T35 SEI message (atsc user_identifier = 0x%04x)\n", - user_identifier); - break; - } + user_identifier = bytestream2_get_be32u(gb); + switch (user_identifier) { + case MKBETAG('D', 'T', 'G', '1'): // afd_data + return decode_registered_user_data_afd(&h->afd, gb); + case MKBETAG('G', 'A', '9', '4'): // closed captions + return decode_registered_user_data_closed_caption(&h->a53_caption, gb); + default: + av_log(logctx, AV_LOG_VERBOSE, + "Unsupported User Data Registered ITU-T T35 SEI message (atsc user_identifier = 0x%04x)\n", + user_identifier); + break; + } break; } #if CONFIG_HEVC_SEI case ITU_T_T35_PROVIDER_CODE_AOM: { - const uint16_t aom_grain_provider_oriented_code = 0x0001; - uint16_t provider_oriented_code; + const uint16_t aom_grain_provider_oriented_code = 0x0001; + uint16_t provider_oriented_code; - if (!IS_HEVC(codec_id)) - break; + if (!IS_HEVC(codec_id)) + break; - if (bytestream2_get_bytes_left(gb) < 2) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; - provider_oriented_code = bytestream2_get_byteu(gb); - if (provider_oriented_code == aom_grain_provider_oriented_code) { - return ff_aom_parse_film_grain_sets(&h->aom_film_grain, - gb->buffer, - bytestream2_get_bytes_left(gb)); - } + provider_oriented_code = bytestream2_get_byteu(gb); + if (provider_oriented_code == aom_grain_provider_oriented_code) { + return ff_aom_parse_film_grain_sets(&h->aom_film_grain, + gb->buffer, + bytestream2_get_bytes_left(gb)); + } break; } case ITU_T_T35_PROVIDER_CODE_SAMSUNG: { - // A/341 Amendment - 2094-40 - const uint16_t smpte2094_40_provider_oriented_code = 0x0001; - const uint8_t smpte2094_40_application_identifier = 0x04; - uint16_t provider_oriented_code; - uint8_t application_identifier; + // A/341 Amendment - 2094-40 + const uint16_t smpte2094_40_provider_oriented_code = 0x0001; + const uint8_t smpte2094_40_application_identifier = 0x04; + uint16_t provider_oriented_code; + uint8_t application_identifier; - if (!IS_HEVC(codec_id)) - break; + if (!IS_HEVC(codec_id)) + break; - if (bytestream2_get_bytes_left(gb) < 3) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(gb) < 3) + return AVERROR_INVALIDDATA; - provider_oriented_code = bytestream2_get_be16u(gb); - application_identifier = bytestream2_get_byteu(gb); - if (provider_oriented_code == smpte2094_40_provider_oriented_code && - application_identifier == smpte2094_40_application_identifier) { - return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb); - } + provider_oriented_code = bytestream2_get_be16u(gb); + application_identifier = bytestream2_get_byteu(gb); + if (provider_oriented_code == smpte2094_40_provider_oriented_code && + application_identifier == smpte2094_40_application_identifier) { + return decode_registered_user_data_dynamic_hdr_plus(&h->dynamic_hdr_plus, gb); + } break; } #endif @@ -232,11 +232,11 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, case ITU_T_T35_COUNTRY_CODE_UK: switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_VNOVA: - if (bytestream2_get_bytes_left(gb) < 2) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; - bytestream2_skipu(gb, 1); // user_data_type_code - return decode_registered_user_data_lcevc(&h->lcevc, gb); + bytestream2_skipu(gb, 1); // user_data_type_code + return decode_registered_user_data_lcevc(&h->lcevc, gb); default: break; } @@ -248,16 +248,16 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_HDR_VIVID: - if (!IS_HEVC(codec_id)) - break; + if (!IS_HEVC(codec_id)) + break; - if (bytestream2_get_bytes_left(gb) < 2) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; - provider_oriented_code = bytestream2_get_be16u(gb); - if (provider_oriented_code == cuva_provider_oriented_code) { - return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb); - } + provider_oriented_code = bytestream2_get_be16u(gb); + if (provider_oriented_code == cuva_provider_oriented_code) { + return decode_registered_user_data_dynamic_hdr_vivid(&h->dynamic_hdr_vivid, gb); + } break; default: break; @@ -269,9 +269,9 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, break; } - av_log(logctx, AV_LOG_VERBOSE, - "Unsupported User Data Registered ITU-T T35 SEI message (country_code = %d, provider_code = %d)\n", - country_code, provider_code); + av_log(logctx, AV_LOG_VERBOSE, + "Unsupported User Data Registered ITU-T T35 SEI message (country_code = %d, provider_code = %d)\n", + country_code, provider_code); return 0; } -- 2.52.0 From 29e0d0ef13347b80c5df7e62beb99803bc065c0a Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Thu, 12 Mar 2026 20:43:23 -0300 Subject: [PATCH 33/45] avcodec/h2645_sei: fix parsing payloads for UK country_code The correct syntax after country_code is: t35_uk_country_code_second_octet b(8) t35_uk_manufacturer_code_first_octet b(8) t35_uk_manufacturer_code_second_octet b(8) Signed-off-by: James Almer <[email protected]> (cherry picked from commit 8172be423e05f9abe91432ec8dcb2ecf93a1e86d) --- libavcodec/h2645_sei.c | 12 ++++++++++-- libavcodec/itut35.h | 4 +--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c index a6bdb8b817..332371e5c0 100644 --- a/libavcodec/h2645_sei.c +++ b/libavcodec/h2645_sei.c @@ -159,10 +159,11 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, } /* itu_t_t35_payload_byte follows */ - provider_code = bytestream2_get_be16u(gb); switch (country_code) { case ITU_T_T35_COUNTRY_CODE_US: + provider_code = bytestream2_get_be16u(gb); + switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_ATSC: { uint32_t user_identifier; @@ -230,12 +231,17 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, } break; case ITU_T_T35_COUNTRY_CODE_UK: + bytestream2_skipu(gb, 1); // t35_uk_country_code_second_octet + if (bytestream2_get_bytes_left(gb) < 2) + return AVERROR_INVALIDDATA; + + provider_code = bytestream2_get_be16u(gb); + switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_VNOVA: if (bytestream2_get_bytes_left(gb) < 2) return AVERROR_INVALIDDATA; - bytestream2_skipu(gb, 1); // user_data_type_code return decode_registered_user_data_lcevc(&h->lcevc, gb); default: break; @@ -246,6 +252,8 @@ static int decode_registered_user_data(H2645SEI *h, GetByteContext *gb, const uint16_t cuva_provider_oriented_code = 0x0005; uint16_t provider_oriented_code; + provider_code = bytestream2_get_be16u(gb); + switch (provider_code) { case ITU_T_T35_PROVIDER_CODE_HDR_VIVID: if (!IS_HEVC(codec_id)) diff --git a/libavcodec/itut35.h b/libavcodec/itut35.h index b8987d0b01..84ea86f3dd 100644 --- a/libavcodec/itut35.h +++ b/libavcodec/itut35.h @@ -30,10 +30,8 @@ // - CN providers #define ITU_T_T35_PROVIDER_CODE_HDR_VIVID 0x0004 // - UK providers -// V-Nova should be 0x5000 according to UK Register of Manufacturer Codes // https://www.cix.co.uk/~bpechey/H221/h221code.htm -// but FFmpeg has been using 0x0050 -#define ITU_T_T35_PROVIDER_CODE_VNOVA 0x0050 +#define ITU_T_T35_PROVIDER_CODE_VNOVA 0x5000 // - US providers #define ITU_T_T35_PROVIDER_CODE_ATSC 0x0031 #define ITU_T_T35_PROVIDER_CODE_DOLBY 0x003B -- 2.52.0 From 0a8bf5fcaae2bd9568901e86a656e10733b843a3 Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Fri, 13 Mar 2026 20:15:24 -0300 Subject: [PATCH 34/45] avcodec/bsf/extract_extradata: don't use a NULL pointer to initialize an empty PutByteContext Fixes UB in the form or adding a 0 offset to a NULL pointer, and substracting a NULL pointer from another. Signed-off-by: James Almer <[email protected]> --- libavcodec/bsf/extract_extradata.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/bsf/extract_extradata.c b/libavcodec/bsf/extract_extradata.c index 1532eb6a7d..6a9a43b0db 100644 --- a/libavcodec/bsf/extract_extradata.c +++ b/libavcodec/bsf/extract_extradata.c @@ -369,8 +369,9 @@ static int extract_extradata_lcevc(AVBSFContext *ctx, AVPacket *pkt, for (i = 0; i < s->h2645_pkt.nb_nals; i++) { H2645NAL *nal = &s->h2645_pkt.nals[i]; if (val_in_array(extradata_nal_types, nb_extradata_nal_types, nal->type)) { - bytestream2_init_writer(&pb_extradata, NULL, 0); - // dummy pass to find sc, gc or ai + // dummy pass to find sc, gc or ai. A dummy pointer is used to prevent + // UB in PutByteContext. Nothing will be written. + bytestream2_init_writer(&pb_extradata, nal->data, 0); if (!write_lcevc_nalu(ctx, &pb_extradata, nal, 0)) extradata_size += nal->raw_size + 3; } -- 2.52.0 From a5a1653a9ebdfd6ca11225f72098353baf4e391b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Fri, 2 Nov 2018 01:36:21 +0100 Subject: [PATCH 35/45] RELEASE_NOTES: Based on the version from 8.0 Name suggested by 2 people on ML, all other suggestions had only 1 supporter Signed-off-by: Michael Niedermayer <[email protected]> --- RELEASE_NOTES | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 RELEASE_NOTES diff --git a/RELEASE_NOTES b/RELEASE_NOTES new file mode 100644 index 0000000000..80646e8bd4 --- /dev/null +++ b/RELEASE_NOTES @@ -0,0 +1,15 @@ + + ┌──────────────────────────────────────┐ + │ RELEASE NOTES for FFmpeg 8.1 "Hoare" │ + └──────────────────────────────────────┘ + + The FFmpeg Project proudly presents FFmpeg 8.1 "Hoare", about 7 + months after the release of FFmpeg 8.0. + + A complete Changelog is available at the root of the project, and the + complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git + + We hope you will like this release as much as we enjoyed working on it, and + as usual, if you have any questions about it, or any FFmpeg related topic, + feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask + on the mailing-lists. -- 2.52.0 From 7dad4d2cb559b09b915e16c6f089da6782d645bd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 16 Mar 2026 02:51:22 +0100 Subject: [PATCH 36/45] Changelog, remove "version <next>" --- Changelog | 2 -- 1 file changed, 2 deletions(-) diff --git a/Changelog b/Changelog index 47744f82cc..5ddf9a6ab5 100644 --- a/Changelog +++ b/Changelog @@ -1,8 +1,6 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. -version <next>: - version 8.1: - ffprobe -codec option -- 2.52.0 From 8a8881d226da869965d9c56a9988a17fd01bcf04 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 16 Mar 2026 02:51:37 +0100 Subject: [PATCH 37/45] RELEASE: prepare for 8.1 Signed-off-by: Michael Niedermayer <[email protected]> --- RELEASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASE b/RELEASE index f5facffc32..b8eb026350 100644 --- a/RELEASE +++ b/RELEASE @@ -1 +1 @@ -8.0.git +8.1 -- 2.52.0 From 43a4771cd06600fa95dbea7ddc8774537d537771 Mon Sep 17 00:00:00 2001 From: Anton Khirnov <[email protected]> Date: Sat, 14 Mar 2026 20:29:36 +0100 Subject: [PATCH 38/45] opus/dec_celt: avoid emph_coeff becoming a subnormal This happens for silence frames, which on many CPUs massively slows down processing the decoded output. Cf. https://github.com/Genymobile/scrcpy/issues/6715 (cherry picked from commit 5b112b17c009b57a0063ca965dd49dc7e018d771) --- libavcodec/opus/dec_celt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/opus/dec_celt.c b/libavcodec/opus/dec_celt.c index 3feb4a4e47..a43d63d9db 100644 --- a/libavcodec/opus/dec_celt.c +++ b/libavcodec/opus/dec_celt.c @@ -463,6 +463,8 @@ int ff_celt_decode_frame(CeltFrame *f, OpusRangeCoder *rc, block->emph_coeff, ff_opus_deemph_weights, frame_size); + if (!isnormal(block->emph_coeff)) + block->emph_coeff = 0.0; } if (channels == 1) -- 2.52.0 From 5f3122760fe1a910f4f75b8fc8ba2f05913ed3c1 Mon Sep 17 00:00:00 2001 From: Weidong Wang <[email protected]> Date: Sat, 14 Mar 2026 13:45:39 -0500 Subject: [PATCH 39/45] avcodec/xxan: zero-initialize y_buffer Fixes ticket #22420. When the first decoded frame is type 1, xan_decode_frame_type1() reads y_buffer as prior-frame state before any data has been written to it. Since y_buffer is allocated with av_malloc(), this may propagate uninitialized heap data into the decoded luma output. Allocate y_buffer with av_mallocz() instead. (cherry picked from commit 236dbc9f82b2d6b9946f63940eed67ca1489a803) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/xxan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c index cb6a97c668..60d2c40075 100644 --- a/libavcodec/xxan.c +++ b/libavcodec/xxan.c @@ -68,7 +68,7 @@ static av_cold int xan_decode_init(AVCodecContext *avctx) } s->buffer_size = avctx->width * avctx->height; - s->y_buffer = av_malloc(s->buffer_size); + s->y_buffer = av_mallocz(s->buffer_size); if (!s->y_buffer) return AVERROR(ENOMEM); s->scratch_buffer = av_malloc(s->buffer_size + 130); -- 2.52.0 From c471fce2bfa3d2f0e01f051b40c9a361e468226b Mon Sep 17 00:00:00 2001 From: Nicholas Carlini <[email protected]> Date: Sun, 15 Mar 2026 23:10:51 +0000 Subject: [PATCH 40/45] avformat/mpegts: fix descriptor accounting across multiple IOD descriptors pmt_cb() passes mp4_descr + mp4_descr_count as the output base but MAX_MP4_DESCR_COUNT (16) as the capacity, not the remaining capacity. init_MP4DescrParseContext() resets d->descr_count to 0 on every call, so the bounds check at parse_MP4ESDescrTag compares a fresh 0 against 16 regardless of the shifted base. A PMT with two IOD descriptors of 16 ESDescrs each will crash. The first fills the buffer mp4_descr[0..15], and then the second writes mp4_descr[16..31] -- 1152 bytes past the end of the stack. This change passes the remaining capacity instead of always passing 16. The writeback in mp4_read_iods is incremented so the caller's running count is preserved. Fixes: stack-buffer-overflow Found-by: Nicholas Carlini <[email protected]> (cherry picked from commit 3e8bec7871bae6722f8f615020374c1b53de7b56) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpegts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index bfbdbf5b19..4b326d309b 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1703,7 +1703,7 @@ static int mp4_read_iods(AVFormatContext *s, const uint8_t *buf, unsigned size, ret = parse_mp4_descr(&d, avio_tell(&d.pb.pub), size, MP4IODescrTag); - *descr_count = d.descr_count; + *descr_count += d.descr_count; return ret; } @@ -2614,7 +2614,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len get8(&p, p_end); // label len -= 2; mp4_read_iods(ts->stream, p, len, mp4_descr + mp4_descr_count, - &mp4_descr_count, MAX_MP4_DESCR_COUNT); + &mp4_descr_count, MAX_MP4_DESCR_COUNT - mp4_descr_count); } else if (tag == REGISTRATION_DESCRIPTOR && len >= 4) { prog_reg_desc = bytestream_get_le32(&p); len -= 4; -- 2.52.0 From 5c923e26ab1bdc55d4f13a8ee3eb02fb4f264a65 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 16 Mar 2026 13:08:53 +0100 Subject: [PATCH 41/45] avformat/wsddec: Use ffio_read_size() in get_metadata() Fixes: use of uninitialized memory Fixes: 492587173/clusterfuzz-testcase-minimized-ffmpeg_dem_WSD_fuzzer-6596163492184064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 4b83833087245910ed00b0f277e7b08b90b6611e) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/wsddec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/wsddec.c b/libavformat/wsddec.c index f36c254621..8bf9e98b91 100644 --- a/libavformat/wsddec.c +++ b/libavformat/wsddec.c @@ -82,7 +82,7 @@ static int get_metadata(AVFormatContext *s, const char *const tag, const unsigne if (!buf) return AVERROR(ENOMEM); - if ((ret = avio_read(s->pb, buf, size)) < 0) { + if ((ret = ffio_read_size(s->pb, buf, size)) < 0) { av_free(buf); return ret; } -- 2.52.0 From e1a84cd0030ebde527962d7b10c6463b43939553 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 16 Mar 2026 17:24:34 +0100 Subject: [PATCH 42/45] doc/Doxyfile: set version to 8.1 Signed-off-by: Michael Niedermayer <[email protected]> --- doc/Doxyfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/Doxyfile b/doc/Doxyfile index d0191c56a0..be1bb71bc1 100644 --- a/doc/Doxyfile +++ b/doc/Doxyfile @@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = +PROJECT_NUMBER = 8.1 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a -- 2.52.0 From 9047fa1b084f76b1b4d065af2d743df1b40dfb56 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Thu, 19 Feb 2026 19:39:52 +0100 Subject: [PATCH 43/45] avutil: attributes: fix AV_HAS_STD_ATTRIBUTE checks Attributes with the language-supported [[attr]] style are only supported since C++11 and C23 respectively, so this needs to be accounted for in these checks. This solves a huge amount of warning spam of: warning: [[]] attributes are a C23 extension [-Wc23-extensions] when using --enable-extra-warnings. (cherry picked from commit cce545a74b84ca64eb0c3e8e9aa8ea10dda2a066) Signed-off-by: Marvin Scholz <[email protected]> --- libavutil/attributes.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavutil/attributes.h b/libavutil/attributes.h index 9e0222a691..0e49b22b9d 100644 --- a/libavutil/attributes.h +++ b/libavutil/attributes.h @@ -46,9 +46,14 @@ # define AV_HAS_ATTRIBUTE(x) 0 #endif -#if defined(__cplusplus) && defined(__has_cpp_attribute) +#if defined(__cplusplus) && \ + defined(__has_cpp_attribute) && \ + __cplusplus >= 201103L # define AV_HAS_STD_ATTRIBUTE(x) __has_cpp_attribute(x) -#elif !defined(__cplusplus) && defined(__has_c_attribute) +#elif !defined(__cplusplus) && \ + defined(__has_c_attribute) && \ + defined(__STDC_VERSION__) && \ + __STDC_VERSION__ >= 202311L # define AV_HAS_STD_ATTRIBUTE(x) __has_c_attribute(x) #else # define AV_HAS_STD_ATTRIBUTE(x) 0 -- 2.52.0 From 9f799f12df13b03e2419a2c4d47383e54da783b6 Mon Sep 17 00:00:00 2001 From: bird <[email protected]> Date: Sun, 5 Apr 2026 01:35:37 -0400 Subject: [PATCH 44/45] avformat/rtpenc: raise minimum packet_size to prevent integer underflow Individual RTP codec packetizers subtract per-codec header sizes from max_payload_size without checking for underflow. When packet_size is between 13 and ~32, max_payload_size is positive but smaller than the codec header, causing the subtraction to wrap negative. This value propagates through FFMIN() to memcpy(), where the implicit cast to size_t produces a near-SIZE_MAX length, causing a heap buffer overflow and immediate SIGSEGV. The existing check (packet_size <= 12) only ensures the 12-byte RTP base header fits but does not account for per-codec payload headers (2-20+ bytes depending on codec). Affected codecs confirmed via SIGSEGV: VP8 (header 4), H.264 (2-3), HEVC (2-3), H.261 (4), AAC (4+), Vorbis/Xiph (6), Theora/Xiph (6) Reproducer: ffmpeg -f lavfi -i testsrc=d=0.1:s=16x16:r=1 -c:v libvpx \ -f rtp -packetsize 13 rtp://127.0.0.1:9999 Signed-off-by: bird <[email protected]> --- libavformat/rtpenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c index 1d4b00a0f4..fdff4820d2 100644 --- a/libavformat/rtpenc.c +++ b/libavformat/rtpenc.c @@ -152,7 +152,7 @@ static int rtp_write_header(AVFormatContext *s1) s1->pb->max_packet_size); } else s1->packet_size = s1->pb->max_packet_size; - if (s1->packet_size <= 12) { + if (s1->packet_size <= 44) { av_log(s1, AV_LOG_ERROR, "Max packet size %u too low\n", s1->packet_size); return AVERROR(EIO); } -- 2.52.0 From 5a47855ce5964c6ce74559fe89c2825b98ca9118 Mon Sep 17 00:00:00 2001 From: bird <[email protected]> Date: Sun, 5 Apr 2026 01:35:37 -0400 Subject: [PATCH 45/45] avformat/sctp: add size check in sctp_read() matching sctp_write() Commit 5b98cea4 added a size < 2 guard to sctp_write() to prevent out-of-bounds access when max_streams is enabled, but the identical pattern in sctp_read() was not addressed. When max_streams is non-zero, sctp_read() passes (buf + 2, size - 2) to ff_sctp_recvmsg(). If size < 2, size - 2 wraps to a large value on the implicit cast to size_t in the callee. Add the same guard. Signed-off-by: bird <[email protected]> --- libavformat/sctp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/sctp.c b/libavformat/sctp.c index 9a6b991803..0efac12d96 100644 --- a/libavformat/sctp.c +++ b/libavformat/sctp.c @@ -309,6 +309,9 @@ static int sctp_read(URLContext *h, uint8_t *buf, int size) } if (s->max_streams) { + if (size < 2) + return AVERROR(EINVAL); + /*StreamId is introduced as a 2byte code into the stream*/ struct sctp_sndrcvinfo info = { 0 }; ret = ff_sctp_recvmsg(s->fd, buf + 2, size - 2, NULL, 0, &info, 0); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
