ffmpeg.git
2 days agoavformat/mov: fix cases where we discard iamf packets from enabled streams release/7.0
James Almer [Fri, 27 Feb 2026 13:41:31 +0000 (10:41 -0300)]
avformat/mov: fix cases where we discard iamf packets from enabled streams

Given the entire iamf struct is inside a single Track, if the first iamf stream
(which is the one sharing the index and id from the Track) was to be disabled,
then packets from every iamf stream would be discarded.
Fix this by actually going through the entire iamf Sample and discarding those
from the disabled streams only.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 16ee3d8d99a2f2e83a2559e958e19ede813b29f8)

2 days agoavformat/mov: fix setting iamf stream id offsets
James Almer [Fri, 27 Feb 2026 13:38:14 +0000 (10:38 -0300)]
avformat/mov: fix setting iamf stream id offsets

If we were to add the highest id of a non iamf stream as offset to iamf stream
ids, and one of the latter was 0, then an id overlap would ocurr.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 51aef95ba156b7848eca5445f0f59b091c3b1004)

2 days agoavformat/mov: add an offset to IAMF streams
James Almer [Fri, 20 Dec 2024 15:57:48 +0000 (12:57 -0300)]
avformat/mov: add an offset to IAMF streams

Using audio_substream_id for AVStream ids is not ideal give that in containers
like mp4, the IAMF structure is opaque to the outside and other streams may
share such id values.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit a8f23745074acd8a1934e3653caebd5a0ba05c6f)

2 days agofate/mov: add an IAMF+video muxing test
James Almer [Thu, 1 Aug 2024 01:57:58 +0000 (22:57 -0300)]
fate/mov: add an IAMF+video muxing test

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit eb3cc508d85e8113cbc66fbec09d29e94ec3fd44)

3 weeks agoavcodec/libsvtav1: rename aq_mode for v4.0.0
Christopher Degawa [Wed, 21 Jan 2026 06:12:59 +0000 (00:12 -0600)]
avcodec/libsvtav1: rename aq_mode for v4.0.0

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agoforgejo: backport CI job names
Timo Rothenpieler [Fri, 2 Jan 2026 19:00:45 +0000 (20:00 +0100)]
forgejo: backport CI job names

8 weeks agoavformat/img2dec: reject input images too big to fit into a single packet
Timo Rothenpieler [Wed, 31 Dec 2025 02:41:21 +0000 (03:41 +0100)]
avformat/img2dec: reject input images too big to fit into a single packet

Not entirely sure if it should instead use some entirely different
approach here, given that images exceeding 2GB don't seem that crazy
to me, but so far processing such images results in a heap overflow,
since the size addition overflows and a much too small packet is
allocated and its size never checked again when writing into it.

Fixes #YWH-PGM40646-32

(cherry picked from commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8)

2 months agofate/ffmpeg: remove comparison against ref from fix_sub_duration_heartbeat
Jan Ekström [Thu, 11 Dec 2025 20:11:07 +0000 (22:11 +0200)]
fate/ffmpeg: remove comparison against ref from fix_sub_duration_heartbeat

After the full ffmpeg CLI multithreading changes went in, this
test started depending on how far the input side read and decoded
the input compared to how quickly the output encoded things, causing
spurious failures on the CI.

To my knowledge all of the failures have so far been valid correct
results, but unfortunately FATE's built in checks mostly consist of
whether there is a difference against an exact result.

This way we still get the CI and valgrind running of the code,
but stop its comparison. Reference file is left around so that
the previous reference is still available.

(cherry picked from commit e54bd7065d024bd3925f80533eae10ef88a5cced)

2 months agoavfilter/stack_internal: fix checkheaders test
Kacper Michajłow [Sat, 9 Aug 2025 03:38:20 +0000 (05:38 +0200)]
avfilter/stack_internal: fix checkheaders test

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 1a1377c53decf1264ca255910124caae82fd63a0)

2 months agotools/check_arm_indent: skip empty glob
Timo Rothenpieler [Sun, 30 Nov 2025 20:39:04 +0000 (21:39 +0100)]
tools/check_arm_indent: skip empty glob

2 months agoall: apply linter fixes
Timo Rothenpieler [Sun, 30 Nov 2025 20:35:24 +0000 (21:35 +0100)]
all: apply linter fixes

3 months agoforgejo: apply needed CI changes for 7.0
Timo Rothenpieler [Sun, 30 Nov 2025 15:58:33 +0000 (16:58 +0100)]
forgejo: apply needed CI changes for 7.0

3 months agoforgejo: backport CI to release/7.0
Timo Rothenpieler [Sun, 30 Nov 2025 15:25:19 +0000 (16:25 +0100)]
forgejo: backport CI to release/7.0

3 months agofftools/ffmpeg_sched: use correct source scheduler node when unchoking
Niklas Haas [Thu, 13 Nov 2025 12:32:35 +0000 (13:32 +0100)]
fftools/ffmpeg_sched: use correct source scheduler node when unchoking

Fixes an issue in the previous commit where I forgot that 7.x still had the
distinction between the src and src_sched nodes; which was later removed.

Fixes: d65d34d65612580f2ba266dd9984c6fbf98f8fac

3 months agofftools/ffmpeg_sched: prevent demuxers from getting stuck
Niklas Haas [Sat, 27 Sep 2025 18:02:07 +0000 (20:02 +0200)]
fftools/ffmpeg_sched: prevent demuxers from getting stuck

When the furthest-behind stream is being fed by a demuxer that is also
feeding packets to a choked filter graph, we need to unchoke that filter
graph to prevent the demuxer from getting stuck trying to write packets to
the choked filter graph.

This situation can also apply recursively - if the demuxer is also writing
to a filtergraph that is also reading from a choked demuxer, there is a
similar deadlock.

Solve all such deadlocks by just brute-force recursively unchoking all
nodes that can somehow prevent this demuxer from writing packets. This
should normally not result in any change in behavior, unless audio/video
streams are badly desynchronized, in which case it may result in extra
memory usage from the too-far-ahead stream buffering packets inside the
muxer. (But this is, of course, preferable to a deadlock)

---------

Backporting changes:
1. Replaced `SchDec.outputs` by `SchDec.dst`
2. Replace `av_unreachable()` by `av_assert0`

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20611
Backported-From: 133a0bcb1385f3214e501970f0ced52dcde906cb

3 months agolavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10
Bin Peng [Fri, 24 Oct 2025 07:58:08 +0000 (15:58 +0800)]
lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10

The mismatch between neon and C functions can be reproduced
using the following bitstream and command line on aarch64 devices.

wget https://streams.videolan.org/ffmpeg/incoming/replay_intra_pred_16x16.h264
 ./ffmpeg -cpuflags 0  -threads 1 -i replay_intra_pred_16x16.h264  -f framemd5 -y md5_ref
 ./ffmpeg              -threads 1 -i replay_intra_pred_16x16.h264 -f framemd5 -y md5_neon

Signed-off-by: Bin Peng <pengbin@visionular.com>
(cherry picked from commit 3115c0c0e6c27c689a02a7267dcf8e61fa2ac425)

5 months agoavcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction
James Almer [Tue, 16 Sep 2025 01:18:52 +0000 (22:18 -0300)]
avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction

Fixes unpredictable behavior with floats.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 57a29f2e7dd2374a1df27316c6cf7c0225e86758)

6 months agoChangelog: update n7.0.3
Michael Niedermayer [Mon, 4 Aug 2025 23:19:14 +0000 (01:19 +0200)]
Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/libopenmpt: fix seeking weirdness
Kimapr [Mon, 28 Jul 2025 01:32:27 +0000 (06:32 +0500)]
avformat/libopenmpt: fix seeking weirdness

- proper pts for packets. leaving it blank leaves it up for guessing,
  but the guess doesn't take seeking into account, causing weirdness.

- clamp to 0 when seeking to negative ts. libopenmpt docs are unclear on
  this but not doing this causes an immediate EOF when seeking backwards
  to the beginning in mpv.

- only set song duration and packet pts when they are non-negative and
  in int64 range. NaNs count as out of range. this isn't a fix for any
  specific issue but might be helpful still, and shouldn't break
  anything.

(cherry picked from commit ecef5f9e1fb70b38f3e325c8e613349344c97de4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: add cmfv/cmfa exceptions
Michael Niedermayer [Sat, 2 Aug 2025 16:55:26 +0000 (18:55 +0200)]
avformat/hls: add cmfv/cmfa exceptions

Fixes: Ticket11526

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3c3a6ecfb230c56a8ff9d219d79d5981b2aa4f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/lrcdec: support arbitrary precision timestamp
Kacper Michajłow [Wed, 23 Jul 2025 18:04:53 +0000 (20:04 +0200)]
avformat/lrcdec: support arbitrary precision timestamp

Apparently files with milliseconds exist in the wild. And since it cost
nothing to support arbitrary number of digits, extend format to support
that.

Depending on number of digits, the time base of fractional part is
changing. Most LRCs use 2 digits and centiseconds base, but subs with 3
digits and miliseconds exist too.

Set internal time base to AV_TIME_BASE, which in parcitice allows to
hold microseconds with 6 digits. Totally artificial, but who knows maybe
someone wants that.

Fixes: #11677

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit bc3cc0a6af44adc63caf4e5097fcfebd7a7475b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoChangelog: update
Michael Niedermayer [Mon, 4 Aug 2025 19:21:33 +0000 (21:21 +0200)]
Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/ffv1dec: Disable frame threading due to race condition
Michael Niedermayer [Mon, 4 Aug 2025 19:08:47 +0000 (21:08 +0200)]
avcodec/ffv1dec: Disable frame threading due to race condition

Slice threading remains available!

The race condition fix is in 8d5efc218245c3f0559f48837b3e63e2932525e0
and bcf08c11710cab5db8eb3d0774e1a93e322fb821
Backport of these is welcome

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agolibavcodec/tests/motion: Add check for avcodec_alloc_context3()
Jiasheng Jiang [Sun, 3 Aug 2025 20:32:23 +0000 (20:32 +0000)]
libavcodec/tests/motion: Add check for avcodec_alloc_context3()

Add check for the return value of avcodec_alloc_context3() to avoid potential NULL pointer dereference.

Fixes: 5d48e4eafa ("Merge commit 'a6a750c7ef240b72ce01e9653343a0ddf247d196'")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55d234b4330d1588eb127cf2283a442ee341f2c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/tests/avpacket: Add av_free() to avoid memory leak
Jiasheng Jiang [Sun, 3 Aug 2025 19:14:38 +0000 (19:14 +0000)]
avcodec/tests/avpacket: Add av_free() to avoid memory leak

Add av_free() to free extra_data if av_packet_add_side_data() fails.

Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 008679ec162d1769afd706af5b1ce7a593f13f2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoexamples: Add av_freep to avoid potential memory leak
Jiasheng Jiang [Sat, 2 Aug 2025 23:28:48 +0000 (23:28 +0000)]
examples: Add av_freep to avoid potential memory leak

Add av_freep() to free avio_ctx_buffer if avio_alloc_context fails
to avoid potential memory leak.

Fixes: 5fc4dea39c ("examples: add avio_reading.c example")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ca58424ded24e931fed329174c28244b67d5670)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/tests/avpacket: Add av_packet_free() to avoid memory leak
Jiasheng Jiang [Sun, 3 Aug 2025 20:09:38 +0000 (20:09 +0000)]
avcodec/tests/avpacket: Add av_packet_free() to avoid memory leak

Add av_packet_free() to free avpkt_clone and avpkt in the error paths to avoid potential memory leak.

Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab040e25657436e88a62624b3751a583dfe4e123)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/fits: Clear naxis
Michael Niedermayer [Sat, 2 Aug 2025 23:47:54 +0000 (01:47 +0200)]
avcodec/fits: Clear naxis

Fixes: Use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_DEC_fuzzer-5602250833854464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1687daa93c131f929495c7ab0509d2e5c98b40f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer
Michael Niedermayer [Sun, 3 Aug 2025 12:52:36 +0000 (14:52 +0200)]
avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer

Fixes: use of uninintilaized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44864dbbb9b87d13d8f4ec92fb8536be0f9dbbc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/lzf: Check for input space
Michael Niedermayer [Sun, 3 Aug 2025 06:33:40 +0000 (08:33 +0200)]
avcodec/lzf: Check for input space

Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5597015691296768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 610d368d9bc3f1b7073a0b33e352f8bd7db24c7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/imc: Clear padding of buf16
Michael Niedermayer [Sun, 3 Aug 2025 12:39:53 +0000 (14:39 +0200)]
avcodec/imc: Clear padding of buf16

Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IAC_fuzzer-6685890556788736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 715df4b1ff398758ca1b8a82c3d16940bc63fc56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/iff: Clear ham_buf
Michael Niedermayer [Sun, 3 Aug 2025 12:44:04 +0000 (14:44 +0200)]
avcodec/iff: Clear ham_buf

Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6651797156724736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e9e7cb3b65167f37dcbfcf6a2ee308548af4e73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/cri: Check bytestream2_get_buffer() for end
Michael Niedermayer [Sun, 3 Aug 2025 12:34:59 +0000 (14:34 +0200)]
avcodec/cri: Check bytestream2_get_buffer() for end

Fixes: use of uninintialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5910856640823296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea3851bebf91a96b11d16be2b36bf88111e30e36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/cri: Factor read_len out
Michael Niedermayer [Sun, 3 Aug 2025 12:34:25 +0000 (14:34 +0200)]
avcodec/cri: Factor read_len out

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9bf3c141bb96dd285477278400b8349e9f964b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/dashdec: Allocate space for appended "/"
Michael Niedermayer [Mon, 28 Jul 2025 21:41:56 +0000 (23:41 +0200)]
avformat/dashdec: Allocate space for appended "/"

Fixes: writing 1 byte over the end of the array
Fixes: BIGSLEEP-433502298/test.xml

Found-by: Google Big Sleep
A prettier solution is welcome!
A testcase exists only for the baseurl case

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce0a655f85c1144d19a4acad59afbb92e4997e30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/mpegvideo_dec: Fix lowres=3 field select interlaced mpeg4 frame
Michael Niedermayer [Sat, 12 Jul 2025 23:17:02 +0000 (01:17 +0200)]
avcodec/mpegvideo_dec: Fix lowres=3 field select interlaced mpeg4 frame

Fixes: out of array read in the chroma plane
Fixes: 428034092/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_DEC_fuzzer-5582608941776896.test

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b849ac006b667dbd494a28de2f8b059fec308ac2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
Michael Niedermayer [Wed, 23 Jul 2025 23:05:40 +0000 (01:05 +0200)]
avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE

Fixes: use of uninitialized memory
Fixes: 427532813/clusterfuzz-testcase-minimized-ffmpeg_dem_MXG_fuzzer-5661938917113856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b12e919cfe3bf69038225794330d14575fb78d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/vqf: Ensure that comm_chunk is fully read
Michael Niedermayer [Wed, 23 Jul 2025 11:36:42 +0000 (13:36 +0200)]
avformat/vqf: Ensure that comm_chunk is fully read

Fixes: use of uninitialized memory
Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7a327b3a43df6ab82885cea5ae02bf9dd899a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/mov: make sure file_checksum is fully initialized
Michael Niedermayer [Wed, 23 Jul 2025 11:16:33 +0000 (13:16 +0200)]
avformat/mov: make sure file_checksum is fully initialized

Fixes: use of uninitialized memory
Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b16e1ddd9c0bc4ca90447d481186216cfdce0fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/asfdec_f: Check amount of value read
Michael Niedermayer [Tue, 22 Jul 2025 23:57:54 +0000 (01:57 +0200)]
avformat/asfdec_f: Check amount of value read

Fixes: use of uninitialized memory
Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa197924a66d83106c5d4dadb8610a1c526afd67)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/jpegxl_parser: add sanity check for frame size
Leo Izen [Tue, 15 Jul 2025 17:54:05 +0000 (13:54 -0400)]
avcodec/jpegxl_parser: add sanity check for frame size

If a frame size is absolutely massive, this can spin the parser as it
attempts to decode a permuted TOC. We add a sanity check here for eight
times the size of the image for an internal frame to prevent malicious
bitstreams from slowing the parser down to a crawl.

Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 829680f96a7a7ff02d1543895ec0fb713309d5c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/concatdec: Clip duration in one more case in get_best_effort_duration()
Michael Niedermayer [Sun, 13 Jul 2025 01:10:27 +0000 (03:10 +0200)]
avformat/concatdec: Clip duration in one more case in get_best_effort_duration()

Fixes: signed integer overflow: 40000 - -9223372036854770000 cannot be represented in type 'long'
Fixes: 427262541/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4831506940100608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8cdb47e47a7a53a3c635a71bf712d79119eb86b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/ffv1dec: Check k in get_vlc_symbol()
Michael Niedermayer [Tue, 15 Jul 2025 22:01:07 +0000 (00:01 +0200)]
avcodec/ffv1dec: Check k in get_vlc_symbol()

The true problem happens in several previous get_vlc_symbol()
but checking that is more expensive (involving FFABS())
here its just a simple check between 2 variables we have.

Fixes: Assertion log >= k failed at libavcodec/golomb.h:406
Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 051e0d7744dbb45f680bbfa72bfead947b11ef2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/cfhd: Check idwt_buf size before allocation
Michael Niedermayer [Tue, 15 Jul 2025 20:19:24 +0000 (22:19 +0200)]
avcodec/cfhd: Check idwt_buf size before allocation

Fixes: OOM
Fixes: 428760799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_DEC_fuzzer-5685176435015680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d72bf6fe0793c3f069ba181a0e733dcc9f28180)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/ivi: Check luma/chroma mb_size
Michael Niedermayer [Tue, 15 Jul 2025 21:28:09 +0000 (23:28 +0200)]
avcodec/ivi: Check luma/chroma mb_size

Fixes: shift exponent -1 is negative
Fixes: 429011224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5031059358285824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f1c3e18579c249cc729bc6033c034f6a6f7426)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/motion_est: don't add offsets to NULL pointers
James Almer [Sun, 13 Jul 2025 23:01:26 +0000 (20:01 -0300)]
avcodec/motion_est: don't add offsets to NULL pointers

Fixes: libavcodec/motion_est.c:94:31: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 585a8d53576f19a14394d7728ed2831e1bee8dbf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoswscale/swscale_unscaled: don't add offsets to NULL pointers
James Almer [Sun, 13 Jul 2025 22:50:57 +0000 (19:50 -0300)]
swscale/swscale_unscaled: don't add offsets to NULL pointers

Fixes: libswscale/swscale_unscaled.c:916:20: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit af9b43455a972841154b194057a79ee8b606e727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agolibavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc()
Jiasheng Jiang [Thu, 10 Jul 2025 16:26:39 +0000 (16:26 +0000)]
libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc()

Add check for the return value of av_malloc_array() and av_calloc()
to avoid potential NULL pointer dereference.

Fixes: dcfd24b10c ("avcodec/alsdec: Implement floating point sample data decoding")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/psd: Move frame allocation after RLE processing
Michael Niedermayer [Thu, 19 Jun 2025 21:02:25 +0000 (23:02 +0200)]
avcodec/psd: Move frame allocation after RLE processing

Fixes: Timeout
Fixes: 410609448/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PSD_fuzzer-6267226128973824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67559760c6636b9c1643e4870bfe8c98244803d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/smacker: Move buffer allocation to later
Michael Niedermayer [Thu, 3 Jul 2025 01:01:11 +0000 (03:01 +0200)]
avcodec/smacker: Move buffer allocation to later

Reduces allocations on random input
Fixes: 421650030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-6144441767493632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9899c8c00bb7674fe3cf5c8483b522c6c78e1248)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agofftools/cmdutils: don't try to load arguments from file if not needed
Kacper Michajłow [Mon, 30 Jun 2025 18:36:09 +0000 (20:36 +0200)]
fftools/cmdutils: don't try to load arguments from file if not needed

CLI option parser checks if argument exists when needed, but in this
case only OPT_TYPE_BOOL where checked, so OPT_TYPE_FUNC without argument
where trying to load a file from `arg` which is NULL in this case.

Fixes crash on `ffmpeg -/version`

Fixes: 6d17991b7e1bf1a5d104c8a6261709f7e6640d97
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f62e2de98eaf1afdea238b53b2b5ac8f0875239)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/opus: don't materialize buf pointer from null
Kacper Michajłow [Thu, 3 Jul 2025 21:08:23 +0000 (23:08 +0200)]
avcodec/opus: don't materialize buf pointer from null

Fixes: avcodec/opus/dec.c: runtime error: applying non-zero offset 10 to null pointer

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b6ec5abb5fb3cffdfcd25f834c43e53cab2cabe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavfilter/avfilter: fix forwarding EOF for simple API filters in filter_activate_default
Marton Balint [Sat, 21 Jun 2025 06:21:40 +0000 (08:21 +0200)]
avfilter/avfilter: fix forwarding EOF for simple API filters in filter_activate_default

EOF only need to be forwarded back if all outputs have reached EOF.

Fixes infinte loop with ffprobe -f lavfi -i "smptebars=d=1,select=n=2:e=1[out0][out1]"
Regression since d9e41ead82263e96ebd14d4d88d6e7f858dd944c.

Fixes ticket #10959.
Fixes ticket #11366.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit a736ac72bb2e457484724f0589fd11a2b2b5f852)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/speexdec: consider differing frame sizes in remaining space check
Michael Niedermayer [Fri, 27 Jun 2025 16:09:24 +0000 (18:09 +0200)]
avcodec/speexdec: consider differing frame sizes in remaining space check

Fixes: talk109-q5.spx
Regression since: f6986e75be87f512f65d64ac91ba19d505a8d210

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfd1f81e7d06e64cc03d670bafe739cc8925f5be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agolavc/vvc: Fix condition for using default scaling factor
Frank Plowman [Sat, 21 Jun 2025 12:05:14 +0000 (13:05 +0100)]
lavc/vvc: Fix condition for using default scaling factor

Add handling here for
sps_scaling_matrix_for_alternative_colour_space_disabled_flag.

Also add parentheses to make behaviour a little more explicit,
where &&'s precedence over || was relied on previously.

Reported-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Frank Plowman <post@frankplowman.com>
(cherry picked from commit 540a2497d2385f94a661a6bbe0f088636d972783)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/iff: Check nb_channels == 0 in CHNL
Michael Niedermayer [Sat, 21 Jun 2025 00:01:22 +0000 (02:01 +0200)]
avformat/iff: Check nb_channels == 0 in CHNL

Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b1301004bdade13e3fee22081459e339ddd2637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/osq: Request a coding mode 2 sample
Michael Niedermayer [Tue, 17 Jun 2025 20:31:17 +0000 (22:31 +0200)]
avcodec/osq: Request a coding mode 2 sample

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8e30d9eebd25d6ed2db744940f1a6d33534ef7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/osq: Switch back to av_ceil_log2()
Michael Niedermayer [Tue, 17 Jun 2025 00:31:28 +0000 (02:31 +0200)]
avcodec/osq: Switch back to av_ceil_log2()

This returns to code closer to prior 56c334d732dbbce43b0c8fc0809ec545b7946832
The prior fixes should limit the sum and avoid the need for double argument log2()

Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:406
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736

No testcases except fuzzers

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5f861d335491ce2350102b74c7a17f875cad0ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/osq: Add note about update_stats() count
Michael Niedermayer [Tue, 17 Jun 2025 00:28:08 +0000 (02:28 +0200)]
avcodec/osq: Add note about update_stats() count

It seems this is basically unused and unfinished code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b587afcb65192c4c4bf88422f6565e5355eaf31e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/osq: Fix signed integer overflow in update_stats()
Michael Niedermayer [Mon, 16 Jun 2025 23:05:54 +0000 (01:05 +0200)]
avcodec/osq: Fix signed integer overflow in update_stats()

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736

Note, none of the available osq files uses update_stats(), this change may fix or break
files using coding_mode == 2. The code prior looks wrong though

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c909ef31be96b6983698c3b01c675de8e5f2637a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer
James Almer [Sun, 22 Jun 2025 13:51:06 +0000 (10:51 -0300)]
avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer

Fixes: libavcodec/mss2dsp.c:59:14: runtime error: applying zero offset to null pointer

Tested-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b1172b8cc615a884d4051517d7356d5842939bb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/movenc: fix writing reserved bits in EC3SpecificBox
James Almer [Thu, 5 Jun 2025 21:24:07 +0000 (18:24 -0300)]
avformat/movenc: fix writing reserved bits in EC3SpecificBox

As described in section F.6.1 from ETSI TS 102 366.

Found-by: nyanmisaka
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 17729aa80c618dddb83276effa0e0bd0c1db3b70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/hevc/hevcdec: Check num_entry_point_offsets
Michael Niedermayer [Thu, 8 May 2025 21:57:33 +0000 (23:57 +0200)]
avcodec/hevc/hevcdec: Check num_entry_point_offsets

The code uses int, unsigned int and uint16_t to store num_entry_point_offsets
This limits it to the smallest of the 3.
Alternatively uint16_t can be changed and then a larger limit used.
A Check will still be needed.

Fixes: 391974932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5966648879677440
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 791a333a0ea5aeee1bea12065b407ba442ac59b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/speexdec: Pass and check remaining packets to decode functions
Michael Niedermayer [Thu, 8 May 2025 14:55:13 +0000 (16:55 +0200)]
avcodec/speexdec: Pass and check remaining packets to decode functions

Fixes: out of array access
Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6986e75be87f512f65d64ac91ba19d505a8d210)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/rkmppdec: Fix double-free on error
Andreas Rheinhardt [Sun, 24 Sep 2023 11:15:48 +0000 (13:15 +0200)]
avcodec/rkmppdec: Fix double-free on error

After having created the AVBuffer that is put into frame->buf[0],
ownership of several objects (namely an AVDRMFrameDescriptor,
an MppFrame and some AVBufferRefs framecontextref and decoder_ref)
has passed to the AVBuffer and therefore to the frame.
Yet it has nevertheless been freed manually on error
afterwards, which would lead to a double-free as soon
as the AVFrame is unreferenced.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 4513300989502090c4fd6560544dce399a8cd53c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/matroskadec: check that channels fit in signed 32bit int
Michael Niedermayer [Sun, 11 May 2025 21:18:19 +0000 (23:18 +0200)]
avformat/matroskadec: check that channels fit in signed 32bit int

Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long'
Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05f8c8c4c2b8f3a0b206ecb7e1b5bba68a9820b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/takdec: Check remaining space for first predictors
Michael Niedermayer [Sun, 11 May 2025 21:09:07 +0000 (23:09 +0200)]
avcodec/takdec: Check remaining space for first predictors

Fixes: Timeout
Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e6db875afcd147d48718130fde4a05c3ac406db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/svq3: Check there are bits left before decompression
Michael Niedermayer [Sat, 10 May 2025 23:35:29 +0000 (01:35 +0200)]
avcodec/svq3: Check there are bits left before decompression

Fixes: out of array read
Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c06f5b3ab97b1b1d0420309201568e38b3920860)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/sonic: Check num_taps
Michael Niedermayer [Sat, 10 May 2025 23:08:06 +0000 (01:08 +0200)]
avcodec/sonic: Check num_taps

The encoder uses max 128 taps, which is quiet a lot already
If work is done to improve sonic, it will be more radical than changing the taps

Fixes: Timeout
Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd0a792766c8ae513dd849fc47fa9e899cc5664b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/imf_cpl: fix indention after previous commit
Michael Niedermayer [Sat, 10 May 2025 21:55:24 +0000 (23:55 +0200)]
avformat/imf_cpl: fix indention after previous commit

(cherry picked from commit d28bec8c4d1bcab3760463f501e14e51fd7b28c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/imf_cpl: do not continue looping forever
Michael Niedermayer [Sat, 10 May 2025 21:52:57 +0000 (23:52 +0200)]
avformat/imf_cpl: do not continue looping forever

Fixes: infinite loop
Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824
Regression since: 61fa1e14e4178d3f2550c76f7a36484220f6dc0c

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39800d78b07e65a6b29a69366d651f80105b95a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/mov: reject negative ELST durations
Michael Niedermayer [Sat, 10 May 2025 21:39:53 +0000 (23:39 +0200)]
avformat/mov: reject negative ELST durations

Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f502064d0d2d75c97ece33f4b56eb84)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/avidec: Ignore duplicate GAB2
Michael Niedermayer [Fri, 9 May 2025 23:55:27 +0000 (01:55 +0200)]
avformat/avidec: Ignore duplicate GAB2

Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a47046981d05c59f6ac766d5fbf6586261a216f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/h264_mb: Fix tmp_cr for arm
Michael Niedermayer [Wed, 16 Apr 2025 00:25:00 +0000 (02:25 +0200)]
avcodec/h264_mb: Fix tmp_cr for arm

When decoding a bitstream with weighted-bipred enabled,
the results on ARM and x86 platforms may differ.

The reason for the inconsistency is that the value of
STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN
is set to the buffer stride of temporary buffers for U
and V components in mc_part_weighted.

If the buffer stride is 32 or 64 (as on x86 platforms),
the U and V pixels can be interleaved row by row without
overlapping, resulting in correct output.
However, on ARM platforms where the stride is 16,
the V component did overwrite part of the U component's pixels,
leading to incorrect predicted pixels.

The bug can be reproduced by the following bitstream.

https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264

Fixes: ticket 11357
Commit-msg-mostly-by: Bin Peng <pengbin@visionular.com>
Reviewed-by: Bin Peng <pengbin@visionular.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74fd2c3ddbaf1fef5c4777784aa72b5747ad389c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/vorbisdec: Dont treat overread as error
Michael Niedermayer [Sun, 6 Apr 2025 14:49:31 +0000 (16:49 +0200)]
avcodec/vorbisdec: Dont treat overread as error

This differs from libvorbis by
stddev:    2.44 PSNR: 88.58 MAXDIFF:   41 bytes:   834304/   834304
for the file from the ticket

Fixes: Ticket11427

Regression since: dc89cf804a811c0d25f4649a99f7fab4b5b416fa

This is a similar solution to what james proposed earlier in
[FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd5a3c5fed2c190446b2beb9bc532887db360cf7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/iff: Check nb_channels == 0 in MHDR
Michael Niedermayer [Thu, 8 May 2025 21:10:52 +0000 (23:10 +0200)]
avformat/iff: Check nb_channels == 0 in MHDR

Fixes: division by 0
Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670

Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce1fd73d637a34551161fd8054ce3d410631982c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agotests/fate/filter-video: Fix dependancy for codecview
Michael Niedermayer [Mon, 5 May 2025 17:53:57 +0000 (19:53 +0200)]
tests/fate/filter-video: Fix dependancy for codecview

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b643e3f65d75a4e6a25986466254bdd4fc1a01a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agolibpostproc: check minimum size
Michael Niedermayer [Thu, 1 May 2025 19:20:31 +0000 (21:20 +0200)]
libpostproc: check minimum size

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 917c15435ae2e11a90de5d1a1153405bd3686fbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Fix flash1.bogulus.cfd support
Michael Niedermayer [Tue, 29 Apr 2025 23:05:18 +0000 (01:05 +0200)]
avformat/hls: Fix flash1.bogulus.cfd support

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75be669ca1c986cc3510a5ad847e82785e2682e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Split allowed_segment_extensions off allowed_extensions
Michael Niedermayer [Tue, 29 Apr 2025 23:37:27 +0000 (01:37 +0200)]
avformat/hls: Split allowed_segment_extensions off allowed_extensions

This allows the user to set only the one that is needed to ALL or a
specific "wrong" extension like html

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f99f223eb1ac9a6e36dab0e31756369214b5564f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Fix Youtube AAC
Michael Niedermayer [Sun, 6 Apr 2025 16:52:05 +0000 (18:52 +0200)]
avformat/hls: Fix Youtube AAC

Fixes: Ticket11435
Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48c0dba23b3ce8c2bcb180bd2c8029c3c2875424)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: add fmp4 to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:47:34 +0000 (12:47 +0200)]
avformat/hls: add fmp4 to allowed_extensions

Fixes: yt-dlp/issues/12700

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c7302e0ede8626fc3d92f1418c567fbab4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Add ec3 to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:43:12 +0000 (12:43 +0200)]
avformat/hls: Add ec3 to allowed_extensions

Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd7cf55613e8b17bcc95b29226285ec5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Add cmfv and cmfa to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:30:04 +0000 (12:30 +0200)]
avformat/hls: Add cmfv and cmfa to allowed_extensions

Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e416c7cbdcf9679ea690c9c1dee4a7936)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agopostproc/postprocess_template: Fix reading uninitialized pixels in dering_C()
Michael Niedermayer [Tue, 22 Apr 2025 01:35:31 +0000 (03:35 +0200)]
postproc/postprocess_template: Fix reading uninitialized pixels in dering_C()

This issue was found through the new blocktest

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0118f392be916784f92508474e8d64243fd6fa97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoconfigure: Clearer documentation for "disable-safe-bitstream-reader"
Michael Niedermayer [Mon, 24 Mar 2025 01:57:46 +0000 (02:57 +0100)]
configure: Clearer documentation for "disable-safe-bitstream-reader"

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 979608dde7a833b7af50a9f6bad81fc483c1ff04)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/osq: avoid undefined negation
Michael Niedermayer [Tue, 4 Feb 2025 02:58:45 +0000 (03:58 +0100)]
avcodec/osq: avoid undefined negation

Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 390646659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5040277374435328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a889f3e09249d2a643a6beb7d44a8e42ea3541)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoswscale/output: Fix integer overflow in yuv2gbrp_full_X_c()
Michael Niedermayer [Tue, 4 Feb 2025 02:58:44 +0000 (03:58 +0100)]
swscale/output: Fix integer overflow in yuv2gbrp_full_X_c()

Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int'
Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce538ef97a7b1fdab6f2a3c8afc538c1cc3760d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavcodec/libtheora: fix setting keyframe_mask
James Almer [Fri, 7 Feb 2025 03:04:25 +0000 (00:04 -0300)]
avcodec/libtheora: fix setting keyframe_mask

t_info.keyframe_granule_shift is set to the library default of 6, which is ok
for gop sizes up to 63. Since there's apparently no way to query the updated
value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE,
calculate it manually instead.

Fixes ticket #11454.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 22aa71d4da37a4ad2b0d28deeace64b57aa2ef50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavfilter/buffersrc: check for valid sample rate
James Almer [Mon, 30 Dec 2024 03:25:41 +0000 (00:25 -0300)]
avfilter/buffersrc: check for valid sample rate

A sample rate <= 0 is invalid.

Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
Fixes ticket #11385.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1446e37d3d032e1452844778b3e6ba2c20f0c322)

6 months agodoc: replace http/git by https urls
Michael Niedermayer [Tue, 1 Apr 2025 00:00:41 +0000 (02:00 +0200)]
doc: replace http/git by https urls

These are more secure

Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4d165c68fe74f4b9c7fa4cbc2e1467a0bafea37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoconfigure: update copyright year
Lynne [Wed, 1 Jan 2025 09:03:33 +0000 (18:03 +0900)]
configure: update copyright year

On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.

(cherry picked from commit d3aa99a4f436e89773246339d9d363587a1d21df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
6 months agoavformat/hls: Partially revert "reduce default max reload to 3"
softworkz [Thu, 27 Feb 2025 16:36:56 +0000 (16:36 +0000)]
avformat/hls: Partially revert "reduce default max reload to 3"

(setting to 100 as a reasonable compromise)

The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c0a58b84a02701df1b6e5d5ac1d1b8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
7 months agoaacenc_tns: clamp filter direction energy measurement
Lynne [Sat, 8 Feb 2025 03:35:31 +0000 (04:35 +0100)]
aacenc_tns: clamp filter direction energy measurement

The issue is that:

float en[2];
...
tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
for (g = 0; g < tns->n_filt[w]; g++) {
    tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];

When using the AAC Main profile, n_filt = 3, and slant is by
default 2 (normal long frames), g can go above 1.

en is the evolution of energy in the frequency domain for every
band at the given window. E.g. whether the energy is concentrated
at the top of each band, or the bottom.

For 2-pole filters, its straightforward.
For 3-pole filters, we need more than 2 measurements.

This commit properly implements support for 3-pole filters, by measuring
the band energy across three areas.

Do note that even xHE-AAC caps n_filt to 2, and only AAC Main allows
n_filt == 3.

Fixes https://trac.ffmpeg.org/ticket/11418

(cherry picked from commit ed09aa28ae3b4509f00a24a9ebdeb084ee00736a)

7 months agofftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated
James Almer [Tue, 8 Jul 2025 18:00:29 +0000 (15:00 -0300)]
fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated

Regardless of the source being an AVFMT_NOTIMESTAMPS format, if the timestamps
are generated like when using the use_wallclock_as_timestamps demuxer option,
then they are reliable.

Fixes ticket #11268

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1787fade209b1ecbd4b911c9d77a52bcdec13fa6)

9 months agoconfigure: Use MSYSTEM_CARCH for default arch on msys2
Coia Prant [Fri, 23 May 2025 09:32:00 +0000 (17:32 +0800)]
configure: Use MSYSTEM_CARCH for default arch on msys2

On msys2, `uname -m` returns the architecture of the base msys2
layer. On Windows on arm64, the base msys2 layer itself is still
x86_64 only, even if running with e.g. the clangarm64 where the
windows native applications are built as aarch64.

If MSYSTEM_CARCH is set, use this instead of `uname -m` for
the default architecture. This gives the correct behaviour
for the clangarm64 environments. It also gives the correct
default for the 32 bit x86 environments such as `mingw32`.

(On `mingw32`, the fact that `uname -m` returned `x86_64`
hasn't been an issue, as both that and `i686` gets normalized
into `x86` internally in ffmpeg's configure.)

Signed-off-by: Coia Prant <coiaprant@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit df967d095ae6a42a46cd4c46b96d61cc1c319b23)

9 months agoavfilter/avfiltergraph: fix regression in picking channel layout
Paul B Mahol [Thu, 22 May 2025 21:21:24 +0000 (21:21 +0000)]
avfilter/avfiltergraph: fix regression in picking channel layout

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1b3f4842c18409dba5a345ef9e7b3de7a4fa3657)

9 months agoconfigure: Enable -fno-common for Darwin targets, avoid linker warnings
Martin Storsjö [Tue, 29 Apr 2025 07:42:48 +0000 (10:42 +0300)]
configure: Enable -fno-common for Darwin targets, avoid linker warnings

Since GCC 10 and llvm.org Clang 11, -fno-common is the default.
However Apple's Xcode Clang hasn't followed suit yet, and still
defaults to -fcommon.

Compiling with -fcommon causes uninitialized global variables to
be treated as "common" (which allows multiple object files to have
similar definitions).

Common variables seem to have the issue that their intended alignment
isn't signaled, so the linker assumes that they may need alignment
according to their full size.

With large global tables, this can lead to linker warnings like
this, with Xcode 16.3:

    ld: warning: reducing alignment of section __DATA,__common from 0x8000 to 0x4000 because it exceeds segment maximum alignment

This can be reproduced with a small snippet like this:

    char table[16385];
    int main(int argc, char* argv[]) { return 0; }

Compiling with -fno-common avoids this issue and warning, and
matches the default behaviour of other compilers. (Compiling with
-fno-common also avoids the risk of accidentally accepting
duplicate definitions of global variables, as long as they are
uninitialized.)

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f4e72eb5a3dbd25ed3ab6c9f89c42adcfc0b5e3d)

9 months agoconfigure: Only try to use the -no_warn_duplicate_libraries flag on Darwin
Martin Storsjö [Mon, 14 Oct 2024 20:43:11 +0000 (23:43 +0300)]
configure: Only try to use the -no_warn_duplicate_libraries flag on Darwin

While we only add the flag if the linker seems to support it,
it turns out that ld.bfd had a bug where the flag is accidentally
accepted, and the flag produces an output file named
"_warn_duplicate_libraries".

The ld.bfd bug was fixed in binutils 2.36, in
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3991c7acb29aa8d7d52150695eb3efa03a08dd50.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 38d08f5c451a312d9064b81472fa05ff53b2e780)

9 months agoconfigure: Silence Xcode warnings about duplicate libraries
Martin Storsjö [Wed, 25 Sep 2024 12:13:34 +0000 (15:13 +0300)]
configure: Silence Xcode warnings about duplicate libraries

Since Xcode 15, macOS developer tools use a new linker. The new
linker by default warns for duplicate -l options. As this is a
known and expected thing, not to be considered an issue, ask for
the warning to be silenced.

This silences linker warnings like this:

    ld: warning: ignoring duplicate libraries: '-lc++', '-lcrypto', '-lm', '-logg', '-lpthread', '-lssl', '-lvorbis', '-lvpx', '-lz'

The linker can also warn about duplicate -rpath options, and there's
currently no option to silence those warnings.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit bd22d7e601933ef8a0975fc9252cee2d44632f61)