December 2025 - ffmpeg-cvslog

[ffmpeg] .forgejo/CODEOWNERS: maintain tools/target_dec_fuzzer.c (branch master)
by Michael Niedermayer 28 Dec '25

28 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 9ab2a437a1 .forgejo/CODEOWNERS: maintain tools/target_dec_fuzzer.c 9ab2a437a1 is described below commit 9ab2a437a108469e90bbbfb9dd8dc29ece1c806b Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Tue Dec 23 04:00:50 2025 +0100 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sun Dec 28 21:58:02 2025 +0000 .forgejo/CODEOWNERS: maintain tools/target_dec_fuzzer.c Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- .forgejo/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/.forgejo/CODEOWNERS b/.forgejo/CODEOWNERS index 45f501a4c3..1c079d49cc 100644 --- a/.forgejo/CODEOWNERS +++ b/.forgejo/CODEOWNERS @@ -206,6 +206,7 @@ libswscale/.* @haasn # tools # ===== fftools/ffplay_renderer.* @haasn +tools/target_dec_fuzzer.c @michaelni # doc # ===

1 0

[ffmpeg] branch master updated (afeff1c729 -> fc5f45bd42)
by ffmpeg-git 28 Dec '25

28 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from afeff1c729 avcodec/interplayacm: add a flush callback function new a8f1c2366e avcodec/libaomdec: don't overwrite color information from the container if unset in the bitstream new fc5f45bd42 avcodec/libdav1d: only consider colorspace when choosing between YUV and GBR The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/libaomdec.c | 9 ++++++--- libavcodec/libdav1d.c | 7 ++----- 2 files changed, 8 insertions(+), 8 deletions(-)

2 2

[ffmpeg] avcodec/interplayacm: add a flush callback function (branch master)
by James Almer 28 Dec '25

28 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new afeff1c729 avcodec/interplayacm: add a flush callback function afeff1c729 is described below commit afeff1c72952f6f733d2839f3ebd4761c568c6d6 Author: James Almer <jamrial(a)gmail.com> AuthorDate: Sun Dec 28 12:55:59 2025 -0300 Commit: James Almer <jamrial(a)gmail.com> CommitDate: Sun Dec 28 12:55:59 2025 -0300 avcodec/interplayacm: add a flush callback function Should prevent potential buffer overflows if passing new packets after seeking. Signed-off-by: James Almer <jamrial(a)gmail.com> --- libavcodec/interplayacm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavcodec/interplayacm.c b/libavcodec/interplayacm.c index 2ae992a71d..2d940b903b 100644 --- a/libavcodec/interplayacm.c +++ b/libavcodec/interplayacm.c @@ -622,6 +622,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, return n; } +static void decode_flush(AVCodecContext *avctx) +{ + InterplayACMContext *s = avctx->priv_data; + + s->bitstream_size = 0; + s->bitstream_index = 0; +} + static av_cold int decode_close(AVCodecContext *avctx) { InterplayACMContext *s = avctx->priv_data; @@ -641,6 +649,7 @@ const FFCodec ff_interplay_acm_decoder = { .p.type = AVMEDIA_TYPE_AUDIO, .p.id = AV_CODEC_ID_INTERPLAY_ACM, .init = decode_init, + .flush = decode_flush, .close = decode_close, FF_CODEC_DECODE_CB(decode_frame), .p.capabilities = AV_CODEC_CAP_DELAY | AV_CODEC_CAP_DR1,

1 0

[ffmpeg] avcodec/jpeg2000htdec: Check pLSB (branch master)
by Michael Niedermayer 27 Dec '25

27 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 224b3ff82a avcodec/jpeg2000htdec: Check pLSB 224b3ff82a is described below commit 224b3ff82af032bc82c4b6125f30a0834bee6b8e Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Mon Dec 22 22:56:10 2025 +0100 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sat Dec 27 21:42:20 2025 +0000 avcodec/jpeg2000htdec: Check pLSB Fixes: negative shift and other undefined shifts Fixes: 462335934/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-4538493775970304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/jpeg2000htdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c index 08140e06a9..54b37009c2 100644 --- a/libavcodec/jpeg2000htdec.c +++ b/libavcodec/jpeg2000htdec.c @@ -1263,6 +1263,11 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c cblk->zbp = S_blk - 1; pLSB = 30 - S_blk; + if (pLSB <= 1 || pLSB >= 31) { + avpriv_request_sample(s->avctx, "pLSB %d", pLSB); + return AVERROR_PATCHWELCOME; + } + Scup = (Dcup[Lcup - 1] << 4) + (Dcup[Lcup - 2] & 0x0F); if (Scup < 2 || Scup > Lcup || Scup > 4079) {

1 0

[ffmpeg] avfilter/vf_libplacebo: replace preproc directive in function-like macros (branch master)
by nikitalita 27 Dec '25

27 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 0629780cf6 avfilter/vf_libplacebo: replace preproc directive in function-like macros 0629780cf6 is described below commit 0629780cf63b4fde5f2df643dc3cd278b9778bfd Author: nikitalita <69168929+nikitalita(a)users.noreply.github.com> AuthorDate: Sat Dec 27 07:44:23 2025 -0800 Commit: Niklas Haas <ffmpeg(a)haasn.dev> CommitDate: Sat Dec 27 18:13:13 2025 +0000 avfilter/vf_libplacebo: replace preproc directive in function-like macros MSVC build was failing due to preprocessor directives being used within function-like macro argument lists, which is undefined behavior according to the C11 spec. Fixed by replacing the directive blocks with macro definitions outside of the macro invocations. --- libavfilter/vf_libplacebo.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/libavfilter/vf_libplacebo.c b/libavfilter/vf_libplacebo.c index c8015a9641..74c1fd7214 100644 --- a/libavfilter/vf_libplacebo.c +++ b/libavfilter/vf_libplacebo.c @@ -451,16 +451,18 @@ static int update_settings(AVFilterContext *ctx) .temperature = (s->temperature - 6500.0) / 3500.0, }; - opts->peak_detect_params = *pl_peak_detect_params( + opts->peak_detect_params = (struct pl_peak_detect_params) { + PL_PEAK_DETECT_DEFAULTS .smoothing_period = s->smoothing, .scene_threshold_low = s->scene_low, .scene_threshold_high = s->scene_high, #if PL_API_VER >= 263 .percentile = s->percentile, #endif - ); + }; - opts->color_map_params = *pl_color_map_params( + opts->color_map_params = (struct pl_color_map_params) { + PL_COLOR_MAP_DEFAULTS .tone_mapping_function = get_tonemapping_func(s->tonemapping), .tone_mapping_param = s->tonemapping_param, .inverse_tone_mapping = s->inverse_tonemapping, @@ -469,7 +471,7 @@ static int update_settings(AVFilterContext *ctx) .contrast_recovery = s->contrast_recovery, .contrast_smoothness = s->contrast_smoothness, #endif - ); + }; set_gamut_mode(&opts->color_map_params, gamut_mode); @@ -484,7 +486,8 @@ static int update_settings(AVFilterContext *ctx) .strength = s->cone_str, ); - opts->params = *pl_render_params( + opts->params = (struct pl_render_params) { + PL_RENDER_DEFAULTS .antiringing_strength = s->antiringing, .background_transparency = 1.0f - (float) s->fillcolor[3] / UINT8_MAX, .background_color = { @@ -513,7 +516,7 @@ static int update_settings(AVFilterContext *ctx) .disable_builtin_scalers = s->disable_builtin, .force_dither = s->force_dither, .disable_fbos = s->disable_fbos, - ); + }; RET(find_scaler(ctx, &opts->params.upscaler, s->upscaler, 0)); RET(find_scaler(ctx, &opts->params.downscaler, s->downscaler, 0));

1 0

[ffmpeg] avformat/iamf_parse: check layer channel count and stream count for consistency (branch master)
by James Almer 27 Dec '25

27 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new f8e6f8f0a2 avformat/iamf_parse: check layer channel count and stream count for consistency f8e6f8f0a2 is described below commit f8e6f8f0a2dca947a91cd5fabcd2c51e27d29616 Author: James Almer <jamrial(a)gmail.com> AuthorDate: Fri Dec 26 20:37:19 2025 -0300 Commit: James Almer <jamrial(a)gmail.com> CommitDate: Sat Dec 27 15:16:49 2025 +0000 avformat/iamf_parse: check layer channel count and stream count for consistency A layer could define a loudspeaker_layout that corresponds to a certain channel layout, but then report an amount of substream_count and coupled_substream_count that might not match the expected channel count. Fixes: Invalid write of size 4 Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848 Signed-off-by: James Almer <jamrial(a)gmail.com> --- libavformat/iamf_parse.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 57ed89e74d..b9f24c0d6a 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -406,6 +406,7 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, int substream_count, coupled_substream_count; int expanded_loudspeaker_layout = -1; int ret, byte = avio_r8(pb); + int channels; layer = av_iamf_audio_element_add_layer(audio_element->element); if (!layer) @@ -455,7 +456,13 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, .nb_channels = substream_count + coupled_substream_count }; - if (i && ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels) + channels = ch_layout.nb_channels; + if (i) { + if (ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels) + return AVERROR_INVALIDDATA; + channels -= audio_element->element->layers[i-1]->ch_layout.nb_channels; + } + if (channels != substream_count + coupled_substream_count) return AVERROR_INVALIDDATA; for (int j = 0; j < substream_count; j++) {

1 0

[ffmpeg] lavc/vvc: Error on inter slice with no reference pics (branch master)
by Frank Plowman 27 Dec '25

27 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 90f1f797aa lavc/vvc: Error on inter slice with no reference pics 90f1f797aa is described below commit 90f1f797aa9231375e4858df523fbfeda89bfd79 Author: Frank Plowman <post(a)frankplowman.com> AuthorDate: Wed Dec 24 15:35:06 2025 +0000 Commit: James Almer <jamrial(a)gmail.com> CommitDate: Sat Dec 27 15:14:16 2025 +0000 lavc/vvc: Error on inter slice with no reference pics The semantics of sh_num_ref_idx_active_minus1[ i ] state that When the current slice is a P slice, the value of NumRefIdxActive[ 0 ] shall be greater than 0. When the current slice is a B slice, both NumRefIdxActive[ 0 ] and NumRefIdxActive[ 1 ] shall be greater than 0. Fixes: use of uninitialized memory Fixes: 449549597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5600497089445888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reported-by: Michael Niedermayer michael(a)niedermayer.cc --- libavcodec/cbs_h266_syntax_template.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index 8b337c75d0..d9a65a9c19 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -3248,6 +3248,12 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw, FFMIN(ref_pic_lists->rpl_ref_list[i].num_ref_entries, pps->pps_num_ref_idx_default_active_minus1[i] + 1); } + + if (current->num_ref_idx_active[i] <= 0) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "Inter slice but no reference pictures available for RPL%d.\n", i); + return AVERROR_INVALIDDATA; + } } else { current->num_ref_idx_active[i] = 0; }

1 0

[ffmpeg] swscale/tests/sws_ops: add optional -src and -dst parameters (branch master)
by Ramiro Polla 26 Dec '25

26 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 0dfaed77a6 swscale/tests/sws_ops: add optional -src and -dst parameters 0dfaed77a6 is described below commit 0dfaed77a691909d6cf4e233c0c5e43a644fc8ff Author: Ramiro Polla <ramiro.polla(a)gmail.com> AuthorDate: Tue Dec 23 17:18:19 2025 +0100 Commit: Ramiro Polla <ramiro.polla(a)gmail.com> CommitDate: Fri Dec 26 13:14:28 2025 +0000 swscale/tests/sws_ops: add optional -src and -dst parameters --- libswscale/tests/sws_ops.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/libswscale/tests/sws_ops.c b/libswscale/tests/sws_ops.c index 1c17cf24a0..69852fc1e0 100644 --- a/libswscale/tests/sws_ops.c +++ b/libswscale/tests/sws_ops.c @@ -76,12 +76,50 @@ static void log_stdout(void *avcl, int level, const char *fmt, va_list vl) int main(int argc, char **argv) { + enum AVPixelFormat src_fmt_min = 0; + enum AVPixelFormat dst_fmt_min = 0; + enum AVPixelFormat src_fmt_max = AV_PIX_FMT_NB - 1; + enum AVPixelFormat dst_fmt_max = AV_PIX_FMT_NB - 1; int ret = 1; #ifdef _WIN32 _setmode(_fileno(stdout), _O_BINARY); #endif + for (int i = 1; i < argc; i += 2) { + if (!strcmp(argv[i], "-help") || !strcmp(argv[i], "--help")) { + fprintf(stderr, + "sws_ops [options...]\n" + " -help\n" + " This text\n" + " -dst <pixfmt>\n" + " Only test the specified destination pixel format\n" + " -src <pixfmt>\n" + " Only test the specified source pixel format\n" + ); + return 0; + } + if (argv[i][0] != '-' || i + 1 == argc) + goto bad_option; + if (!strcmp(argv[i], "-src")) { + src_fmt_min = src_fmt_max = av_get_pix_fmt(argv[i + 1]); + if (src_fmt_min == AV_PIX_FMT_NONE) { + fprintf(stderr, "invalid pixel format %s\n", argv[i + 1]); + goto error; + } + } else if (!strcmp(argv[i], "-dst")) { + dst_fmt_min = dst_fmt_max = av_get_pix_fmt(argv[i + 1]); + if (dst_fmt_min == AV_PIX_FMT_NONE) { + fprintf(stderr, "invalid pixel format %s\n", argv[i + 1]); + goto error; + } + } else { +bad_option: + fprintf(stderr, "bad option or argument missing (%s) see -help\n", argv[i]); + goto error; + } + } + SwsContext *ctx = sws_alloc_context(); AVFrame *frame = av_frame_alloc(); if (!ctx || !frame) @@ -90,7 +128,13 @@ int main(int argc, char **argv) av_log_set_callback(log_stdout); for (const AVPixFmtDescriptor *src = NULL; (src = av_pix_fmt_desc_next(src));) { + enum AVPixelFormat src_fmt = av_pix_fmt_desc_get_id(src); + if (src_fmt < src_fmt_min || src_fmt > src_fmt_max) + continue; for (const AVPixFmtDescriptor *dst = NULL; (dst = av_pix_fmt_desc_next(dst));) { + enum AVPixelFormat dst_fmt = av_pix_fmt_desc_get_id(dst); + if (dst_fmt < dst_fmt_min || dst_fmt > dst_fmt_max) + continue; int err = run_test(ctx, frame, src, dst); if (err < 0) goto fail; @@ -102,4 +146,7 @@ fail: av_frame_free(&frame); sws_free_context(&ctx); return ret; + +error: + return AVERROR(EINVAL); }

1 0

[ffmpeg] branch master updated (fe1dae1e18 -> abb1524138)
by ffmpeg-git 24 Dec '25

24 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from fe1dae1e18 avcodec/lcevcdec: free pictures on error new 61eca588dc swscale/ops: move ff_sws_op_list_update_comps() to ops.c new 9586b81373 swscale/ops: don't strip SwsComps from SWS_OP_READ new 5a6602e959 swscale/format: add pixel range metadata to SWS_OP_READ new 5f1be98f62 swscale/ops: add SWS_COMP_SWAPPED new a0032fb40f swscale/ops: use switch/case for updating SwsComps ranges new ede8318e9f swscale/ops: explicitly reset value range after SWS_OP_UNPACK new c0f49db53d swscale/ops: remove broken value range assumption hack new abb1524138 Revert "swscale/ops: clarify SwsOpList.src/dst semantics" The 8 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libswscale/format.c | 36 ++++++- libswscale/ops.c | 241 +++++++++++++++++++++++++++++++++++++++++++- libswscale/ops.h | 20 +++- libswscale/ops_optimizer.c | 239 ------------------------------------------- tests/ref/fate/sws-ops-list | 2 +- 5 files changed, 289 insertions(+), 249 deletions(-)

2 8

[ffmpeg] branch master updated (3e91d82292 -> fe1dae1e18)
by ffmpeg-git 24 Dec '25

24 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 3e91d82292 avcodec/cbs_apv: use av_unreachable instead of av_assert0(0) at the end of a non-void function new b392d75cf7 avcodec/lcevcdec: avoid copying the input frame new 4f86ebfe94 avcodec/lcevcdec: fix input dimensions for the base picture new fe1dae1e18 avcodec/lcevcdec: free pictures on error The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/lcevcdec.c | 53 ++++++++++++++++++--------------------------------- 1 file changed, 19 insertions(+), 34 deletions(-)

2 3