August 2025 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/osq: Add note about update_stats() count
by Michael Niedermayer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jun 17 02:28:08 2025 +0200| [6739f24c0ba772fbb46c5730a8b1ed970d64d29a] | committer: Michael Niedermayer avcodec/osq: Add note about update_stats() count It seems this is basically unused and unfinished code Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b587afcb65192c4c4bf88422f6565e5355eaf31e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6739f24c0ba772fbb… --- libavcodec/osq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 256b1d6421..7cbb36d5d6 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -149,6 +149,8 @@ static void update_stats(OSQChannel *cb, int val) cb->history[cb->pos] = FFABS((int64_t)val); cb->pos++; cb->count++; + //NOTE for this to make sense count would need to be limited to FF_ARRAY_ELEMS(cb->history) + //Otherwise the average computation later makes no sense if (cb->pos >= FF_ARRAY_ELEMS(cb->history)) cb->pos = 0; }

1 0

avcodec/osq: Fix signed integer overflow in update_stats()
by Michael Niedermayer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jun 17 01:05:54 2025 +0200| [fbef482fce54f935bd4baa52b6482c8fbe68b1ed] | committer: Michael Niedermayer avcodec/osq: Fix signed integer overflow in update_stats() Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736 Note, none of the available osq files uses update_stats(), this change may fix or break files using coding_mode == 2. The code prior looks wrong though Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c909ef31be96b6983698c3b01c675de8e5f2637a) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fbef482fce54f935b… --- libavcodec/osq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 99a035c5c5..256b1d6421 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -145,8 +145,8 @@ static void reset_stats(OSQChannel *cb) static void update_stats(OSQChannel *cb, int val) { - cb->sum += FFABS(val) - cb->history[cb->pos]; - cb->history[cb->pos] = FFABS(val); + cb->sum += FFABS((int64_t)val) - cb->history[cb->pos]; + cb->history[cb->pos] = FFABS((int64_t)val); cb->pos++; cb->count++; if (cb->pos >= FF_ARRAY_ELEMS(cb->history))

1 0

avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer
by James Almer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | James Almer <jamrial(a)gmail.com> | Sun Jun 22 10:51:06 2025 -0300| [1e7dbc8962ea35cf05fb291b569c4ccec1a55e5b] | committer: Michael Niedermayer avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer Fixes: libavcodec/mss2dsp.c:59:14: runtime error: applying zero offset to null pointer Tested-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit b1172b8cc615a884d4051517d7356d5842939bb6) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1e7dbc8962ea35cf0… --- libavcodec/mss2dsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/mss2dsp.c b/libavcodec/mss2dsp.c index cc39dd637f..ace92ef9c7 100644 --- a/libavcodec/mss2dsp.c +++ b/libavcodec/mss2dsp.c @@ -56,7 +56,7 @@ static av_always_inline void mss2_blit_wmv9_template(uint8_t *dst, } } } - mask += mask_stride; + mask = FF_PTR_ADD(mask, mask_stride); dst += dst_stride; srcy += srcy_stride; srcu += srcuv_stride * (r & 1);

1 0

avformat/movenc: fix writing reserved bits in EC3SpecificBox
by James Almer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | James Almer <jamrial(a)gmail.com> | Thu Jun 5 18:24:07 2025 -0300| [ac7d514d9e070083182b8840f99ca55483af82ff] | committer: Michael Niedermayer avformat/movenc: fix writing reserved bits in EC3SpecificBox As described in section F.6.1 from ETSI TS 102 366. Found-by: nyanmisaka Reviewed-by: Baptiste Coudurier <baptiste.coudurier(a)gmail.com> Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit 17729aa80c618dddb83276effa0e0bd0c1db3b70) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ac7d514d9e0700831… --- libavformat/movenc.c | 4 ++-- tests/ref/fate/copy-trac3074 | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 6604b019b4..1b50e8df87 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -581,7 +581,7 @@ static int mov_write_eac3_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra } info = track->eac3_priv; - size = 2 + ((34 * (info->num_ind_sub + 1) + 7) >> 3); + size = 2 + ((32 * (info->num_ind_sub + 1) + 7) >> 3); buf = av_malloc(size); if (!buf) { return AVERROR(ENOMEM); @@ -598,7 +598,7 @@ static int mov_write_eac3_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra put_bits(&pbc, 3, info->substream[i].bsmod); put_bits(&pbc, 3, info->substream[i].acmod); put_bits(&pbc, 1, info->substream[i].lfeon); - put_bits(&pbc, 5, 0); /* reserved */ + put_bits(&pbc, 3, 0); /* reserved */ put_bits(&pbc, 4, info->substream[i].num_dep_sub); if (!info->substream[i].num_dep_sub) { put_bits(&pbc, 1, 0); /* reserved */ diff --git a/tests/ref/fate/copy-trac3074 b/tests/ref/fate/copy-trac3074 index 53ba27e920..9ed42c8d8d 100644 --- a/tests/ref/fate/copy-trac3074 +++ b/tests/ref/fate/copy-trac3074 @@ -1,5 +1,5 @@ -36fcc0a62695bcf93068fcfe68283ee9 *tests/data/fate/copy-trac3074.mp4 -334016 tests/data/fate/copy-trac3074.mp4 +5b4a3ed9de3b2a92e5dcb127bca12e68 *tests/data/fate/copy-trac3074.mp4 +334015 tests/data/fate/copy-trac3074.mp4 #tb 0: 1/48000 #media_type 0: audio #codec_id 0: eac3

1 0

avcodec/hevc/hevcdec: Check num_entry_point_offsets
by Michael Niedermayer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu May 8 23:57:33 2025 +0200| [3e05424fb4e1aea09703cf3162c930ebcb5ad929] | committer: Michael Niedermayer avcodec/hevc/hevcdec: Check num_entry_point_offsets The code uses int, unsigned int and uint16_t to store num_entry_point_offsets This limits it to the smallest of the 3. Alternatively uint16_t can be changed and then a larger limit used. A Check will still be needed. Fixes: 391974932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5966648879677440 Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 791a333a0ea5aeee1bea12065b407ba442ac59b4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e05424fb4e1aea09… --- libavcodec/hevcdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index c8776e9e9d..855c900487 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -949,7 +949,7 @@ static int hls_slice_header(HEVCContext *s) if (s->ps.pps->tiles_enabled_flag || s->ps.pps->entropy_coding_sync_enabled_flag) { unsigned num_entry_point_offsets = get_ue_golomb_long(gb); // It would be possible to bound this tighter but this here is simpler - if (num_entry_point_offsets > get_bits_left(gb)) { + if (num_entry_point_offsets > get_bits_left(gb) || num_entry_point_offsets > UINT16_MAX) { av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets); return AVERROR_INVALIDDATA; }

1 0

avcodec/speexdec: Pass and check remaining packets to decode functions
by Michael Niedermayer 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu May 8 16:55:13 2025 +0200| [b53ec80e3e5fbdb35432b14d3a9090ef88e99351] | committer: Michael Niedermayer avcodec/speexdec: Pass and check remaining packets to decode functions Fixes: out of array access Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f6986e75be87f512f65d64ac91ba19d505a8d210) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b53ec80e3e5fbdb35… --- libavcodec/speexdec.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 08c7e77e7d..4430a11dc0 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -166,7 +166,7 @@ typedef struct SpeexSubmode { typedef struct SpeexMode { int modeID; /**< ID of the mode */ - int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out); + int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out, int packets_left); int frame_size; /**< Size of frames used for decoding */ int subframe_size; /**< Size of sub-frames used for decoding */ int lpc_size; /**< Order of LPC filter */ @@ -518,8 +518,8 @@ static const SpeexSubmode wb_submode4 = { split_cb_shape_sign_unquant, &split_cb_high, -1.f }; -static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *); -static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *); +static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); +static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); static const SpeexMode speex_modes[SPEEX_NB_MODES] = { { @@ -864,7 +864,7 @@ static void lsp_to_lpc(const float *freq, float *ak, int lpcrdr) } static int nb_decode(AVCodecContext *avctx, void *ptr_st, - GetBitContext *gb, float *out) + GetBitContext *gb, float *out, int packets_left) { DecoderState *st = ptr_st; float ol_gain = 0, ol_pitch_coef = 0, best_pitch_gain = 0, pitch_average = 0; @@ -1215,7 +1215,7 @@ static void qmf_synth(const float *x1, const float *x2, const float *a, float *y } static int sb_decode(AVCodecContext *avctx, void *ptr_st, - GetBitContext *gb, float *out) + GetBitContext *gb, float *out, int packets_left) { SpeexContext *s = avctx->priv_data; DecoderState *st = ptr_st; @@ -1231,9 +1231,11 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st, mode = st->mode; if (st->modeID > 0) { + if (packets_left <= 1) + return AVERROR_INVALIDDATA; low_innov_alias = out + st->frame_size; s->st[st->modeID - 1].innov_save = low_innov_alias; - ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out); + ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out, packets_left); if (ret < 0) return ret; } @@ -1554,7 +1556,7 @@ static int speex_decode_frame(AVCodecContext *avctx, AVFrame *frame, dst = (float *)frame->extended_data[0]; for (int i = 0; i < frames_per_packet; i++) { - ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size); + ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size, frames_per_packet - i); if (ret < 0) return ret; if (avctx->ch_layout.nb_channels == 2)

1 0

avcodec/rkmppdec: Fix double-free on error
by Andreas Rheinhardt 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Sun Sep 24 13:15:48 2023 +0200| [b43a12363c1fef0efa7eac15b6b830417656db15] | committer: Michael Niedermayer avcodec/rkmppdec: Fix double-free on error After having created the AVBuffer that is put into frame->buf[0], ownership of several objects (namely an AVDRMFrameDescriptor, an MppFrame and some AVBufferRefs framecontextref and decoder_ref) has passed to the AVBuffer and therefore to the frame. Yet it has nevertheless been freed manually on error afterwards, which would lead to a double-free as soon as the AVFrame is unreferenced. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> (cherry picked from commit 4513300989502090c4fd6560544dce399a8cd53c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b43a12363c1fef0ef… --- libavcodec/rkmppdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/rkmppdec.c b/libavcodec/rkmppdec.c index 5768568b00..2ca368e0a9 100644 --- a/libavcodec/rkmppdec.c +++ b/libavcodec/rkmppdec.c @@ -462,8 +462,8 @@ static int rkmpp_retrieve_frame(AVCodecContext *avctx, AVFrame *frame) frame->hw_frames_ctx = av_buffer_ref(decoder->frames_ref); if (!frame->hw_frames_ctx) { - ret = AVERROR(ENOMEM); - goto fail; + av_frame_unref(frame); + return AVERROR(ENOMEM); } return 0;

1 0

avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access
by Andreas Rheinhardt 04 Aug '25

04 Aug '25

ffmpeg | branch: release/6.1 | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Wed Mar 13 02:10:26 2024 +0100| [bed04417b4d38af7a1b477b24ea6e26547e32373] | committer: Michael Niedermayer avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6, so the latter needs to support 0..3. But it has only three elements. Add another one. The value for the last element has been guesstimated from subpel_filters in libavcodec/vp8dsp.c. This is also intended to fix FATE-failures with UBSan here: https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-1… Tested-by: Sean McGovern <gseanmcg(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> (cherry picked from commit 09e6840cf7a3ee07a73c3ae88a020bf27ca1a667) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bed04417b4d38af7a… --- libavcodec/ppc/vp8dsp_altivec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/ppc/vp8dsp_altivec.c b/libavcodec/ppc/vp8dsp_altivec.c index 12dac8b0a8..061914fc38 100644 --- a/libavcodec/ppc/vp8dsp_altivec.c +++ b/libavcodec/ppc/vp8dsp_altivec.c @@ -50,11 +50,12 @@ static const vec_s8 h_subpel_filters_inner[7] = // for 6tap filters, these are the outer two taps // The zeros mask off pixels 4-7 when filtering 0-3 // and vice-versa -static const vec_s8 h_subpel_filters_outer[3] = +static const vec_s8 h_subpel_filters_outer[4] = { REPT4(0, 0, 2, 1), REPT4(0, 0, 3, 3), REPT4(0, 0, 1, 2), + REPT4(0, 0, 0, 0), }; #define LOAD_H_SUBPEL_FILTER(i) \

1 0

New commits on branch release/5.1
by Git System 04 Aug '25

04 Aug '25

URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d5a24d530c960be5e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 4 17:04:49 2025 +0200 Update for 5.1.7 URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d08d2b447b0d807b7… Author: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Date: Sun Aug 3 20:32:23 2025 +0000 libavcodec/tests/motion: Add check for avcodec_alloc_context3() Add check for the return value of avcodec_alloc_context3() to avoid potential NULL pointer dereference. Fixes: 5d48e4eafa ("Merge commit 'a6a750c7ef240b72ce01e9653343a0ddf247d196'") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 55d234b4330d1588eb127cf2283a442ee341f2c2) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e88605c63005e945… Author: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Date: Sun Aug 3 19:14:38 2025 +0000 avcodec/tests/avpacket: Add av_free() to avoid memory leak Add av_free() to free extra_data if av_packet_add_side_data() fails. Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 008679ec162d1769afd706af5b1ce7a593f13f2b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc152b5b9e108c568… Author: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Date: Sat Aug 2 23:28:48 2025 +0000 examples: Add av_freep to avoid potential memory leak Add av_freep() to free avio_ctx_buffer if avio_alloc_context fails to avoid potential memory leak. Fixes: 5fc4dea39c ("examples: add avio_reading.c example") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9ca58424ded24e931fed329174c28244b67d5670) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ecae469cfcada91c1… Author: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Date: Sun Aug 3 20:09:38 2025 +0000 avcodec/tests/avpacket: Add av_packet_free() to avoid memory leak Add av_packet_free() to free avpkt_clone and avpkt in the error paths to avoid potential memory leak. Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ab040e25657436e88a62624b3751a583dfe4e123) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e405372444cb5831… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 01:47:54 2025 +0200 avcodec/fits: Clear naxis Fixes: Use of uninitialized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_DEC_fuzzer-5602250833854464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1687daa93c131f929495c7ab0509d2e5c98b40f5) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f81d93ec4181f6306… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 14:52:36 2025 +0200 avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer Fixes: use of uninintilaized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 44864dbbb9b87d13d8f4ec92fb8536be0f9dbbc4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bc781b19d96427a2a… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 08:33:40 2025 +0200 avcodec/lzf: Check for input space Fixes: use of uninitialized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5597015691296768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 610d368d9bc3f1b7073a0b33e352f8bd7db24c7e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=45b41e4173db86231… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 14:39:53 2025 +0200 avcodec/imc: Clear padding of buf16 Fixes: use of uninitialized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IAC_fuzzer-6685890556788736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 715df4b1ff398758ca1b8a82c3d16940bc63fc56) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=15f292803fcd96a21… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 14:34:59 2025 +0200 avcodec/cri: Check bytestream2_get_buffer() for end Fixes: use of uninintialized memory Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5910856640823296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ea3851bebf91a96b11d16be2b36bf88111e30e36) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cc65c50342879a16e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 3 14:34:25 2025 +0200 avcodec/cri: Factor read_len out Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit d9bf3c141bb96dd285477278400b8349e9f964b0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6e9758a4e7f983d67… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Jul 28 23:41:56 2025 +0200 avformat/dashdec: Allocate space for appended "/" Fixes: writing 1 byte over the end of the array Fixes: BIGSLEEP-433502298/test.xml Found-by: Google Big Sleep A prettier solution is welcome! A testcase exists only for the baseurl case Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ce0a655f85c1144d19a4acad59afbb92e4997e30) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=85bc00a3c8003bf2b… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jul 24 01:05:40 2025 +0200 avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE Fixes: use of uninitialized memory Fixes: 427532813/clusterfuzz-testcase-minimized-ffmpeg_dem_MXG_fuzzer-5661938917113856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1b12e919cfe3bf69038225794330d14575fb78d0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=816bd485dea65546d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jul 23 13:36:42 2025 +0200 avformat/vqf: Ensure that comm_chunk is fully read Fixes: use of uninitialized memory Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1b7a327b3a43df6ab82885cea5ae02bf9dd899a9) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ce94db58611637168… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jul 23 13:16:33 2025 +0200 avformat/mov: make sure file_checksum is fully initialized Fixes: use of uninitialized memory Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8b16e1ddd9c0bc4ca90447d481186216cfdce0fe) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3064fdc97ea5e2272… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jul 23 01:57:54 2025 +0200 avformat/asfdec_f: Check amount of value read Fixes: use of uninitialized memory Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit fa197924a66d83106c5d4dadb8610a1c526afd67) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4ec12a24c319962a1… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Jul 13 03:10:27 2025 +0200 avformat/concatdec: Clip duration in one more case in get_best_effort_duration() Fixes: signed integer overflow: 40000 - -9223372036854770000 cannot be represented in type 'long' Fixes: 427262541/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4831506940100608 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george(a)nsup.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8cdb47e47a7a53a3c635a71bf712d79119eb86b4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3b33d0a7b53a7002e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jul 16 00:01:07 2025 +0200 avcodec/ffv1dec: Check k in get_vlc_symbol() The true problem happens in several previous get_vlc_symbol() but checking that is more expensive (involving FFABS()) here its just a simple check between 2 variables we have. Fixes: Assertion log >= k failed at libavcodec/golomb.h:406 Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 051e0d7744dbb45f680bbfa72bfead947b11ef2f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3b922a53d2b96cee4… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Jul 15 22:19:24 2025 +0200 avcodec/cfhd: Check idwt_buf size before allocation Fixes: OOM Fixes: 428760799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_DEC_fuzzer-5685176435015680 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 2d72bf6fe0793c3f069ba181a0e733dcc9f28180) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2626ee447636f7c32… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Jul 15 23:28:09 2025 +0200 avcodec/ivi: Check luma/chroma mb_size Fixes: shift exponent -1 is negative Fixes: 429011224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5031059358285824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c0f1c3e18579c249cc729bc6033c034f6a6f7426) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=86a08ee29d11b7bac… Author: James Almer <jamrial(a)gmail.com> Date: Sun Jul 13 20:01:26 2025 -0300 avcodec/motion_est: don't add offsets to NULL pointers Fixes: libavcodec/motion_est.c:94:31: runtime error: applying zero offset to null pointer Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit 585a8d53576f19a14394d7728ed2831e1bee8dbf) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb0acca2dbe58e937… Author: James Almer <jamrial(a)gmail.com> Date: Sun Jul 13 19:50:57 2025 -0300 swscale/swscale_unscaled: don't add offsets to NULL pointers Fixes: libswscale/swscale_unscaled.c:916:20: runtime error: applying zero offset to null pointer Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit af9b43455a972841154b194057a79ee8b606e727) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aad4b59cfee1f0a3c… Author: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Date: Thu Jul 10 16:26:39 2025 +0000 libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc() Add check for the return value of av_malloc_array() and av_calloc() to avoid potential NULL pointer dereference. Fixes: dcfd24b10c ("avcodec/alsdec: Implement floating point sample data decoding") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ee6b6318d62ea0310… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jun 19 23:02:25 2025 +0200 avcodec/psd: Move frame allocation after RLE processing Fixes: Timeout Fixes: 410609448/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PSD_fuzzer-6267226128973824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 67559760c6636b9c1643e4870bfe8c98244803d1) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ec651ce7f1c04d511… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jul 3 03:01:11 2025 +0200 avcodec/smacker: Move buffer allocation to later Reduces allocations on random input Fixes: 421650030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-6144441767493632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9899c8c00bb7674fe3cf5c8483b522c6c78e1248) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=59ce20dc3f9247873… Author: Kacper Michajłow <kasper93(a)gmail.com> Date: Thu Jul 3 23:08:23 2025 +0200 avcodec/opus: don't materialize buf pointer from null Fixes: avcodec/opus/dec.c: runtime error: applying non-zero offset 10 to null pointer Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 3b6ec5abb5fb3cffdfcd25f834c43e53cab2cabe) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=474af7f9eedb828ac… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Jun 27 18:09:24 2025 +0200 avcodec/speexdec: consider differing frame sizes in remaining space check Fixes: talk109-q5.spx Regression since: f6986e75be87f512f65d64ac91ba19d505a8d210 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit cfd1f81e7d06e64cc03d670bafe739cc8925f5be) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d9613a3142b253d3… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Jun 21 02:01:22 2025 +0200 avformat/iff: Check nb_channels == 0 in CHNL Fixes: division by 0 Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000 Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 5b1301004bdade13e3fee22081459e339ddd2637) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3c8e3297f6c6976f5… Author: James Almer <jamrial(a)gmail.com> Date: Sun Jun 22 10:51:06 2025 -0300 avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer Fixes: libavcodec/mss2dsp.c:59:14: runtime error: applying zero offset to null pointer Tested-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit b1172b8cc615a884d4051517d7356d5842939bb6) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=444025cbfade27827… Author: James Almer <jamrial(a)gmail.com> Date: Thu Jun 5 18:24:07 2025 -0300 avformat/movenc: fix writing reserved bits in EC3SpecificBox As described in section F.6.1 from ETSI TS 102 366. Found-by: nyanmisaka Reviewed-by: Baptiste Coudurier <baptiste.coudurier(a)gmail.com> Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit 17729aa80c618dddb83276effa0e0bd0c1db3b70) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dd350164dc76e12d2… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu May 8 16:55:13 2025 +0200 avcodec/speexdec: Pass and check remaining packets to decode functions Fixes: out of array access Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f6986e75be87f512f65d64ac91ba19d505a8d210) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d45964ac04a83f02c… Author: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Date: Sun Sep 24 13:15:48 2023 +0200 avcodec/rkmppdec: Fix double-free on error After having created the AVBuffer that is put into frame->buf[0], ownership of several objects (namely an AVDRMFrameDescriptor, an MppFrame and some AVBufferRefs framecontextref and decoder_ref) has passed to the AVBuffer and therefore to the frame. Yet it has nevertheless been freed manually on error afterwards, which would lead to a double-free as soon as the AVFrame is unreferenced. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> (cherry picked from commit 4513300989502090c4fd6560544dce399a8cd53c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1a874e645d4a0adef… Author: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Date: Wed Mar 13 02:10:26 2024 +0100 avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access h_subpel_filters_inner[i] and h_subpel_filters_outer[i / 2] belong together and the former allows the range 0..6, so the latter needs to support 0..3. But it has only three elements. Add another one. The value for the last element has been guesstimated from subpel_filters in libavcodec/vp8dsp.c. This is also intended to fix FATE-failures with UBSan here: https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-1… Tested-by: Sean McGovern <gseanmcg(a)gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> (cherry picked from commit 09e6840cf7a3ee07a73c3ae88a020bf27ca1a667) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=be2fff27a044d0b80… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 11 23:09:07 2025 +0200 avcodec/takdec: Check remaining space for first predictors Fixes: Timeout Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8e6db875afcd147d48718130fde4a05c3ac406db) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bcf1a19e06c906efa… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 11 01:35:29 2025 +0200 avcodec/svq3: Check there are bits left before decompression Fixes: out of array read Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c06f5b3ab97b1b1d0420309201568e38b3920860) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=49284e871f1668db6… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 11 01:08:06 2025 +0200 avcodec/sonic: Check num_taps The encoder uses max 128 taps, which is quiet a lot already If work is done to improve sonic, it will be more radical than changing the taps Fixes: Timeout Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit fd0a792766c8ae513dd849fc47fa9e899cc5664b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6bbd95776df1a0fc7… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat May 10 23:52:57 2025 +0200 avformat/imf_cpl: do not continue looping forever Fixes: infinite loop Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824 Regression since: 61fa1e14e4178d3f2550c76f7a36484220f6dc0c Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 39800d78b07e65a6b29a69366d651f80105b95a1) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8ed465d5ebae61480… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat May 10 23:39:53 2025 +0200 avformat/mov: reject negative ELST durations Fixes: multiple integer overflows Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9fc2702f6f502064d0d2d75c97ece33f4b56eb84) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d38b3353ccf1660e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat May 10 01:55:27 2025 +0200 avformat/avidec: Ignore duplicate GAB2 Fixes: memleak Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6a47046981d05c59f6ac766d5fbf6586261a216f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a6d756b2f443d8120… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Apr 16 02:25:00 2025 +0200 avcodec/h264_mb: Fix tmp_cr for arm When decoding a bitstream with weighted-bipred enabled, the results on ARM and x86 platforms may differ. The reason for the inconsistency is that the value of STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN is set to the buffer stride of temporary buffers for U and V components in mc_part_weighted. If the buffer stride is 32 or 64 (as on x86 platforms), the U and V pixels can be interleaved row by row without overlapping, resulting in correct output. However, on ARM platforms where the stride is 16, the V component did overwrite part of the U component's pixels, leading to incorrect predicted pixels. The bug can be reproduced by the following bitstream. https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264 Fixes: ticket 11357 Commit-msg-mostly-by: Bin Peng <pengbin(a)visionular.com> Reviewed-by: Bin Peng <pengbin(a)visionular.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 74fd2c3ddbaf1fef5c4777784aa72b5747ad389c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf92796f7c299e6c4… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Apr 6 16:49:31 2025 +0200 avcodec/vorbisdec: Dont treat overread as error This differs from libvorbis by stddev: 2.44 PSNR: 88.58 MAXDIFF: 41 bytes: 834304/ 834304 for the file from the ticket Fixes: Ticket11427 Regression since: dc89cf804a811c0d25f4649a99f7fab4b5b416fa This is a similar solution to what james proposed earlier in [FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit fd5a3c5fed2c190446b2beb9bc532887db360cf7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e55d3fb8faddadb0… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu May 8 23:10:52 2025 +0200 avformat/iff: Check nb_channels == 0 in MHDR Fixes: division by 0 Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670 Reviewed-by: Peter Ross <pross(a)xvid.org> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ce1fd73d637a34551161fd8054ce3d410631982c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3288cac76eb874036… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon May 5 19:53:57 2025 +0200 tests/fate/filter-video: Fix dependancy for codecview Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1b643e3f65d75a4e6a25986466254bdd4fc1a01a) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4e1122aea615edfc1… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu May 1 21:20:31 2025 +0200 libpostproc: check minimum size Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 917c15435ae2e11a90de5d1a1153405bd3686fbe) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ca80672a2a030e520… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Apr 30 01:05:18 2025 +0200 avformat/hls: Fix flash1.bogulus.cfd support Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 75be669ca1c986cc3510a5ad847e82785e2682e0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ffbb402090e6d4e0c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Apr 30 01:37:27 2025 +0200 avformat/hls: Split allowed_segment_extensions off allowed_extensions This allows the user to set only the one that is needed to ALL or a specific "wrong" extension like html Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f99f223eb1ac9a6e36dab0e31756369214b5564f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bed3ae9e5912724c5… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Apr 6 18:52:05 2025 +0200 avformat/hls: Fix Youtube AAC Fixes: Ticket11435 Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 48c0dba23b3ce8c2bcb180bd2c8029c3c2875424) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7248719023acc6f7f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Apr 6 12:47:34 2025 +0200 avformat/hls: add fmp4 to allowed_extensions Fixes: yt-dlp/issues/12700 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit d82016c7302e0ede8626fc3d92f1418c567fbab4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ca76bf994f71d7dff… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Apr 6 12:43:12 2025 +0200 avformat/hls: Add ec3 to allowed_extensions Fixes part of Ticket11435 Fixes: Elisa Viihde (Finnish online recording service) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 68644994fd7cf55613e8b17bcc95b29226285ec5) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1da45df21b055a69e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Apr 6 12:30:04 2025 +0200 avformat/hls: Add cmfv and cmfa to allowed_extensions Fixes: www.nicovideo.jp Fixes: Ticket11526 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 2352145e416c7cbdcf9679ea690c9c1dee4a7936) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4de9b462f3ce6ecce… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Mar 24 02:57:46 2025 +0100 configure: Clearer documentation for "disable-safe-bitstream-reader" Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 979608dde7a833b7af50a9f6bad81fc483c1ff04) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=289848bd1663f9e36… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Feb 4 03:58:44 2025 +0100 swscale/output: Fix integer overflow in yuv2gbrp_full_X_c() Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int' Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ce538ef97a7b1fdab6f2a3c8afc538c1cc3760d9) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2259a6cbf49aa1cc… Author: James Almer <jamrial(a)gmail.com> Date: Fri Feb 7 00:04:25 2025 -0300 avcodec/libtheora: fix setting keyframe_mask t_info.keyframe_granule_shift is set to the library default of 6, which is ok for gop sizes up to 63. Since there's apparently no way to query the updated value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE, calculate it manually instead. Fixes ticket #11454. Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit 22aa71d4da37a4ad2b0d28deeace64b57aa2ef50) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a01eaecf6325cefab… Author: James Almer <jamrial(a)gmail.com> Date: Mon Dec 30 00:25:41 2024 -0300 avfilter/buffersrc: check for valid sample rate A sample rate <= 0 is invalid. Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set. Fixes ticket #11385. Signed-off-by: James Almer <jamrial(a)gmail.com> (cherry picked from commit 1446e37d3d032e1452844778b3e6ba2c20f0c322) URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0c7f5e0ad4087dd2b… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Apr 1 02:00:41 2025 +0200 doc: replace http/git by https urls These are more secure Reviewed-by: Gyan Doshi <ffmpeg(a)gyani.pro> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b4d165c68fe74f4b9c7fa4cbc2e1467a0bafea37) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e45b8b29efc9095a… Author: Lynne <dev(a)lynne.ee> Date: Wed Jan 1 18:03:33 2025 +0900 configure: update copyright year On 01/01/2025 19:05, Peter Ross wrote: > FFmpeg turns 25 this year. (cherry picked from commit d3aa99a4f436e89773246339d9d363587a1d21df) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=93d792505ecbca6de… Author: softworkz <softworkz(a)hotmail.com> Date: Thu Feb 27 16:36:56 2025 +0000 avformat/hls: Partially revert "reduce default max reload to 3" (setting to 100 as a reasonable compromise) The change has caused regressions for many users and consumers. Playlist reloads only happen when a playlist doesn't indicate that it has ended (via #EXT-X-ENDLIST), which means that the addition of future segments is still expected. It is well possible that an HLS server is temporarily unable to serve further segments but resumes after some time, either indicating a discontinuity or even by fully catching up. With a segment length of 3s, a max_reload value of 1000 corresponds to a duration of 50 minutes which appears to be a reasonable default. Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ace9f03a6c0a58b84a02701df1b6e5d5ac1d1b8e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9913cb6a0b03e823d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Feb 6 13:09:08 2025 +0100 avformat/hls: Fix twitter Allow mp4 with all mpegts extensions Fixes: Ticket11435 Reviewed-by: Steven Liu <lingjiujianke(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit cef3422b4819e3b6f07086625fa7890eaa8d45e7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d740f3692f2e4e1a… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Jan 28 23:07:54 2025 +0100 libavformat/hls: Be more restrictive on mpegts extensions Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 0113e30806b205111344e266bc69ff9657a3ca02) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=97fa3b4c2b6e15605… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Jan 28 13:26:34 2025 +0100 avformat/hls: .ts is always ok even if its a mov/mp4 Maybe fixes: 11435 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9e12572933dc1c49e9b35d772ddcae896c2ba8a8) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e3639a28ca518841… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Jan 28 12:51:58 2025 +0100 avformat/hls: Print input format in error message Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit d8455331302c72cde2f0b72f255004a91189dd93) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9803800e0e8cd8e1e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jan 16 01:28:46 2025 +0100 avformat/hls: Be more picky on extensions This blocks disallowed extensions from probing It also requires all available segments to have matching extensions to the format mpegts is treated independent of the extension It is recommended to set the whitelists correctly instead of depending on extensions, but this should help a bit, and this is easier to backport Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification The other parts of CVE-2023-6602 have been fixed by prior commits Found-by: Harvey Phillips of Amazon Element55 (element55) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3ef588940eef62742… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon May 15 00:54:50 2023 +0200 avformat: add ff_match_url_ext() Match url against a list of extensions similar to av_match_ext() Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit a7b06bfc5d20b12ff0122702c09517cf359fbb66) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8e6c82cefb45372de… Author: Cosmin Stejerean <cosmin(a)cosmin.at> Date: Wed Dec 6 18:39:32 2023 +0800 avfilter/bwdif: account for chroma sub-sampling in min size calculation The current logic for detecting frames that are too small for the algorithm does not account for chroma sub-sampling, and so a sample where the luma plane is large enough, but the chroma planes are not will not be rejected. In that event, a heap overflow will occur. This change adjusts the logic to consider the chroma planes and makes the change to all three bwdif implementations. Fixes #10688 Signed-off-by: Cosmin Stejerean <cosmin(a)cosmin.at> Reviewed-by: Thomas Mundt <tmundt75(a)gmail.com> Signed-off-by: Philip Langdale <philipl(a)overt.org> (cherry picked from commit 737ede405b11a37fdd61d19cf25df296a0cb0b75) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3a8f94cf7b29ed4b8… Author: Paul B Mahol <onemda(a)gmail.com> Date: Mon Nov 27 11:45:34 2023 +0100 avfilter/af_afwtdn: fix crash with EOF handling (cherry picked from commit b1942734c7cbcdc9034034373abcc9ecb9644c47) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=28a7db723971c73f0… Author: Paul B Mahol <onemda(a)gmail.com> Date: Mon Nov 27 12:08:20 2023 +0100 avfilter/vf_colorcorrect: fix memory leaks (cherry picked from commit 5f87a68cf70dafeab2fb89b42e41a4c29053b89b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=785a6df0e477f408c… Author: Zhao Zhili <zhilizhao(a)tencent.com> Date: Fri Dec 29 05:56:43 2023 +0800 avfilter/vf_codecview: fix heap buffer overflow And improve the performance by a little bit. Signed-off-by: Zhao Zhili <zhilizhao(a)tencent.com> (cherry picked from commit 99debe5f823f45a482e1dc08de35879aa9c74bd2) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ba6712e4843a99564… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Feb 9 01:28:17 2025 +0100 avformat/iff: Check that we have a stream in read_dst_frame() Fixes: null pointer dereference Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8668957ef604bd2b99175310638bc5031ae0d991) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5e9af0efd540d352c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Feb 7 02:33:21 2025 +0100 avformat/mlvdec: fix size checks Fixes: heap-buffer-overflow Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 251d43aef0df9262f2688c1c848af993bbb67d08) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ef236e509e240975c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Feb 5 03:47:52 2025 +0100 avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit() Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long' Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <git(a)haerdin.se> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8a6ad9eab2f1c37a18c2f30e6660260edd7c0c16) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07bd4b68f7ddb0fa5… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jan 30 02:28:32 2025 +0100 avcodec/h263dec: Check against previous dimensions instead of coded Fixes: out of array access Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c Found-by: Kacper Michajlow <kasper93(a)gmail.com> Reviewed-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 0fe33c99a26a06a6875c4abfb96362a65145264b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1b1acf964fa163267… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Sep 23 20:05:37 2024 +0200 avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet() Fixes: Use of uninitialized memory Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6ecc96f4d08d74b0590ab03f39f93f386910c4c0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=25d58649919fb3847… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Nov 30 01:48:22 2024 +0100 avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream() Fixes: use of uninitialized memory Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ef71552cf970876085d99834abdb8e429aea9730) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5ccb7d1680df08d83… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Dec 26 03:07:51 2024 +0100 avformat/ipmovie: Check signature_buffer read Fixes: use of uninitilaized data Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 788abe0d253b2034af15876d7889265d4746df2b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dcc9cdee5eba6cfa5… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Dec 26 02:53:45 2024 +0100 avformat/wtvdec: Initialize buf ff_parse_mpeg2_descriptor() reads over what is initialized Fixes: use of uninitialized memory Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 17b019c517af26c6d2f0c6266938c60d36db1fa3) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3064e3a51cce9cd0c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jan 1 05:03:08 2025 +0100 avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex Fixes: use-of-uninitialized-value Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e81d410242ea604c4f667da4a415836c1575d72f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7c4a8f13eb21ab48d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Dec 31 04:13:25 2024 +0100 avformat/vqf: Propagate errors from add_metadata() Suggested-by: Marton Balint <cus(a)passwd.hu> Reviewed-by: Alexander Strasser <eclipse7(a)gmx.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 49fa3f6c5ba6d43cc4b3ade4f8d9dc2fdbc71f0a) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dbfc0ebcfc07407c9… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Dec 26 01:46:49 2024 +0100 avformat/vqf: Check avio_read() in add_metadata() Fixes: use of uninitialized data Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c43dbecbdad152a91eadc7538b545852eee562ae) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=097131a6474bd6294… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jan 16 00:22:05 2025 +0100 avformat/dashdec: Check whitelist Fixes: CVE-2023-6602, V. DASH Playlist SSRF Found-by: Harvey Phillips of Amazon Element55 (element55) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=11f57761ba7b61743… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jan 15 03:30:21 2025 +0100 avutil/avstring: dont mess with NULL pointers in av_match_list() Fixes: applying zero offset to null pointer Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c6c54943d161812b3c4034116cb14f3f5c05dc43) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=04e985a5c9d8830e3… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jan 8 03:11:02 2025 +0100 avfilter/vf_v360: Fix NULL pointer use Fixes: applying zero offset to null pointer partly Fixes: verysmall.flv Found-by: Elias Myllymäki <elias.myllymaki04p(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 66e9888bf418984a274beddbc3e87e9f1b8f5077) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e38b5570e7e7314b… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jan 8 02:59:28 2025 +0100 avcodec/mpegvideo_enc: Check FLV1 resolution limits Found-by: Elias Myllymäki <elias.myllymaki04p(a)gmail.com> Reviewed-by: Alexander Strasser <eclipse7(a)gmx.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 827c073154f4cc17d1bd3777dff3b58370210bcb) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a3964b3cec1ec62d6… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jan 9 21:35:06 2025 +0100 avcodec/ffv1enc: Fix handling of 32bit unsigned symbols This may be needed for floats Sponsored-by: Sovereign Tech Fund Reviewed-by: Alexander Strasser <eclipse7(a)gmx.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 402824e9e99461f1c9e74a6730ced40894669560) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=09acecae6be39fa75… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Dec 1 23:30:55 2024 +0100 avcodec/vc1dec: Clear block_index in vc1_decode_reset() Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472 Fixes: out of array access Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 251de1791e645f16e80b09d82999d4a5e24b1ad1) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7ed68b4edcf826197… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Dec 1 22:27:18 2024 +0100 avcodec/aacsbr_template: Clear n_q on error Fixes: index 5 out of bounds for type 'uint8_t [5]' Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 3f029bfb7f9ca1c73fecb8d0eacf3c4e0550f771) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a8485dca2b4830f56… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Dec 1 03:25:09 2024 +0100 swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template() Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int' Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 56faee21c136942c491f30a2e82cfbbfce180beb) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=edfcade702b41de44… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Jan 6 22:01:39 2025 +0100 avfilter/af_pan: Fix sscanf() use Fixes: Memory Data Leak Found-by: Simcha Kosman <simcha.kosman(a)cyberark.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b5b6391d64807578ab872dc58fb8aa621dcfc38a) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea423f628d307a7a7… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Jan 6 05:06:10 2025 +0100 avfilter/vf_grayworld: Use the correct pointer for av_log() Fixes: crash Found-by: Elias Myllymäki <elias.myllymaki04p(a)gmail.com> Reviewed-by: Alexander Strasser <eclipse7(a)gmx.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9ffa127aa6853790acb40004fbab97f13ff4c72e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=25a53dd099013169f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Jan 5 02:36:25 2025 +0100 avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]() Fixes: out of array read Found-by: Elias Myllymäki <elias.myllymaki04p(a)gmail.com> Reviewed-by: Alexander Strasser <eclipse7(a)gmx.net> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b72de492959fb19eab37368232e65a4371c367f7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9685934184b10611d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Aug 16 17:30:45 2024 +0200 avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video Fixes: Use of uninintialized value Fixes: 70993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6378949754552320 Fixes: 71104/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5001538727116800 For the AAC/USAC/SBR code which reads uninitialized memory, it would be good, if it did not a fix for that is welcome! Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b9b4c9ebf07748993ad91ba9b9b9f06914d67865) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=45ec94d3742d3eac4… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Aug 16 14:47:42 2024 +0200 avformat/rmdec: check that buf if completely filled Fixes: use of uninitialized value Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 9578c135d00dd9cc01491b8559d7fad5a387e90d) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ad37b8c87ad8e30e7… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 11 23:15:32 2024 +0200 avcodec/hapdec: Clear tex buffer The code following makes no attempt to initialize all of the buffer Fixes: use of uninitialized value Fixes: 70980/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5329909059223552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7eeeda703b599847aa89c7c08bb433d0b3da9590) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=910affb8a1c13a416… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 11 22:53:47 2024 +0200 avformat/mxfdec: Check that key was read sucessfull Fixes: use of uninitialized value Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 4c62cbcae2612acbc7ab5e8a7e7815674a6e8df4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0cce0e51b5672a84a… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Nov 18 04:09:11 2024 +0100 avformat/rpl: Fix check for negative values Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long') Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376 Found-by: ossfuzz Reported-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit eab65379bf89c55d8ec4bc6f00e04f15b37d3d85) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=92183532dc833b277… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Dec 25 05:13:02 2024 +0100 avformat/mlvdec: Check avio_read() Fixes: use-of-uninitialized-value Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit bb85423142103d694d97bad1967bd3dc55440e71) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d475d4542959b5602… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Dec 11 22:37:07 2024 +0100 avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int' Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 93270930798da368d5b1954a73ef7ff9dfa48f73) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0f0903f3937fa2451… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Dec 11 21:36:11 2024 +0100 avformat/matroskadec: Check pre_ns for overflow Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long' Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 361d24e6d920e4f7e4e5fa1fd6fbb6922bff35f2) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=94fcb2570f332f7b1… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Dec 22 00:28:21 2024 +0100 avutil/timecode: Avoid fps overflow in av_timecode_get_smpte_from_framenum() Fix from c94875471e3ba3dc396c6919ff3ec9b14539cd71 Found-by: Youngjae Choi <youngjaechoi(a)korea.ac.kr> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6ba33b50f51b17eef0449f20b3524f174dc9c3cc) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=36ef7f5a3a676efab… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Aug 16 16:00:01 2024 +0200 avcodec/webp: Check ref_x/y Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072 Fixes: use of uninintailized value Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7c1e732ad2e240af5afe9ffea443c91bb233aa65) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6c5570c5b386ae2c7… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Sep 23 19:57:28 2024 +0200 avcodec/ilbcdec: Initialize tempbuff2 Fixes: Use of uninitialized value Fixes: 71350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 4482218440534804d067de00ee1a4bc493c8b41d) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=df4f6a01b512d14c1… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Sep 23 20:55:17 2024 +0200 avformat/qcp: Check for read failure in header Fixes: Use of uninitialized value Fixes: 71551/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-4647386712965120 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f52b9d05837c23b0c55013551bc28dce4922de0b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=48d99a2934c3b0886… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Oct 19 01:15:53 2024 +0200 avformat/dxa: check bpc Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7e020f21413269418180eea7933a94ecb6bf2ef8) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5805ba349efd61b02… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Oct 19 00:08:03 2024 +0200 swscale/slice: clear allocated memory in alloc_lines() Fixes: use of uninitialized memory in hScale16To15_c() Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit aeec39f3c1be82863efe64ce95242de58e075e8f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d1137191d1745a01f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Nov 18 23:55:05 2024 +0100 avcodec/mjpegdec: Disallow progressive bayer images Fixes: Null pointer dereference Fixes: sample1.dng Found-by: South East <8billion.people(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6d8285633d8965658dfa6cd0b201cca36184c467) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2f31e3733e0fffed… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 11:07:27 2024 +0100 avformat/icodec: fix integer overflow with nb_pal Fixes: runtime error: signed integer overflow Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472 Found-by: ossfuzz Reported-by: Kacper Michajlow Tested-by: Kacper Michajlow Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 84569b6c22cb4eda9c682aabeb5f658112126780) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc0b2e96053fd8b01… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Nov 16 21:32:53 2024 +0100 doc/developer: Document relationship between git accounts and MAINTAINERS This should have been documented long ago and i thought it was Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7051825b0171bd5d566c5a5cc78852c5f3aa3072) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=af649d6d02f4a54e1… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 20:54:29 2024 +0100 avformat/vividas: Check avio_read() for failure Fixes: use of uninitialized value (untested) Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5505802505355264 Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 96d45c3b212689f82bff2530c3637405df9e9369) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=caf049735f0f94a15… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 20:47:07 2024 +0100 avformat/ilbc: Check avio_read() for failure Fixes: use of uninitialized value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e30d957a9bacf7f7307c640aa0bd1e70cb3bbe7e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f789b5640ddb46450… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 20:43:21 2024 +0100 avformat/nistspheredec: Clear buffer Fixes: use-of-uninitialized-value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 898f6582eb51bf77b1f88e8f55eab67ee6ee13b8) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2adc5831eeb6f9f24… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 20:18:36 2024 +0100 avformat/mccdec: Initialize and check rate.den Fixes: Assertion c > 0 failed at libavutil/mathematics.c:61 Fixes: use-of-uninitialized-value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-5939605805793280 Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit bf8e43083f68c383b9d905d2c8c791ac33ecc7bc) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=519adedd4d80f2369… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Nov 3 20:08:07 2024 +0100 avformat/rpl: check channels Fixes: 42537199/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5447162658357248 Fixes: runtime error: signed integer overflow: -3330498059201358222 * 4 cannot be represented in type 'int64_t' (aka 'long') Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit beca13a42e9fb5341e8bd6356fd7d9c2d18aac9b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=df119b663cdb63b3e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Nov 2 18:23:50 2024 +0100 INSTALL: explain the circular dependency issue and solution Sponsored-by: Sovereign Tech Fund Reviewed-by: James Almer <jamrial(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit df00705e0010cc2c53d17d51944f847c2c852189) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=98d4d5d975a2d2a3f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Oct 9 23:44:00 2024 +0200 avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen Fixes: use of uninitialized variable Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit db7b4fc89fb18d5ff0a1426bd433c234555a3fff) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cbf8d621e1737b38c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Oct 9 20:47:34 2024 +0200 avformat/mxfdec: Fix overflow in midpoint computation Fixes: signed integer overflow: 4611686016549392399 + 9223372033098784800 cannot be represented in type 'long long' Fixes: 368503277/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5928227458056192 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 23088a5ff2b549fa4fc037bb9ed833fffbc89ca0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6f6faa2ad5e061d31… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Oct 9 20:39:07 2024 +0200 swscale/output: used unsigned for bit accumulation Fixes: Integer overflow Fixes: 368725672/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5009093023563776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 3fe3014405494503a03c2e6eff4743db91a21c00) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=54f32ca767581aa7e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Oct 16 14:39:20 2024 +0200 avcodec/rangecoder: only perform renorm check/loop for callers that need it Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit d147b3d7ecba2bd40cb45284f920238da97a95ee) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d716d67cf392056bc… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Oct 10 20:39:23 2024 +0200 avcodec/ffv1dec: Fix end computation with ec=2 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 10e5af15bf220d9da128ca12d2d474ff6ab0076e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=633ace5ede8538976… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Oct 1 22:06:40 2024 +0200 avcodec/ffv1enc: Prevent generation of files with broken slices Fixes: Ticket5548 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b7ff66a35804275b25c1176cad560540785e8750) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=37c130b010e1f492d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Jul 28 22:08:23 2024 +0200 avformat/matroskadec: Check desc_bytes so bits fit in 64bit Likely a tighter check can be done Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long' Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c4122406f6d2726aea833480a2a8e345833dd881) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e2783c23596781fe… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Jul 28 20:53:49 2024 +0200 avformat/mov: Avoid overflow in dts This basically ignores the overflow without undefined behavior, alternatively we could detect and error out Fixes: signed integer overflow: 6310596683470275584 + 7660622966157213696 cannot be represented in type 'long' Fixes: 70433/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5483347233538048 Fixes: 369662284/clusterfuzz-testcase-minimized-media_metadata_parser_fuzzer-5327368763670528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 057b8c2066da3554072565744f4f00435cc3342b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d44190af872d38974… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Oct 1 22:04:58 2024 +0200 avcodec/ffv1enc: Correct error message about unsupported version Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 556c767786e9e3c072f7666d60a68a31a3400438) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb9702a253e156c82… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Oct 6 22:23:33 2023 +0200 avcodec/ffv1enc: Slice combination is unsupported We always write minimal slices, the size calculation is wrong in some corner cases but as its always 1x1 (minus1) we can for now just hard-code it This helps with ticket 5548 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7d514655bfa47c6e5cc1b81fbba8e750e368036e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=268140aa43c55041d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Sep 30 23:42:50 2024 +0200 avcodec/ffv1enc: 2Pass mode is not possible with golomb coding "Fixes" Ticket7063 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 417b163c00555ccda201a963e797bfa663a26ff5) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c46678ed90e00590b… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Sep 24 23:43:09 2024 +0200 avcodec/ffv1enc: Fix >8bit context size Fixes: Ticket5405 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit a9c83e43f2fc9128e20851291b0270add1a6b95f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=413ddbfef73935a13… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Sep 22 23:15:35 2024 +0200 avcodec/xan: Add basic input size check Fixes: Timeout Fixes: 71739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_WC3_fuzzer-6170301405134848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 56bef2fd58d0ed30dbe940083c30ada2b0404491) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6c6ee6d0babdcb0cb… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Sep 22 20:31:58 2024 +0200 avcodec/svq3: Check for minimum size input Fixes: Timeout Fixes: 71295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-4999941125111808 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 050b5e85cbe61414ba9b78f76a04b2488e816f42) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=18312a1f017a11e56… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 19 23:57:31 2024 +0200 avcodec/eacmv: Check input size for intra frames Fixes: Timeout Fixes: 71135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EACMV_fuzzer-6251879028293632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c3a1cbbf5d99337b5e99260eb95c84e65c7587f6) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=40ccf60268509e294… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 19 21:57:09 2024 +0200 avcodec/jfdctint_template: use unsigned z* in row_fdct() Fixes: signed integer overflow: 856827136 + 2123580416 cannot be represented in type 'int' Fixes: 70772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-5180569961431040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f27c8b04d3059fa538db8f2db6503cbb586eb3ad) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=625df906c54a07b26… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 19 19:56:48 2024 +0200 avformat/asf: Check picsize Fixes: signed integer overflow: 1073750247 * 2 cannot be represented in type 'int' Fixes: 70722/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5447231587549184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit fde8637fda8e5ac4ccfa4b137a7467e16cd631b6) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4afe8f448464e299f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 12 22:05:24 2024 +0200 avformat/mxfdec: Check timecode for overflow Fixes: signed integer overflow: 9223372036840103968 + 538976288 cannot be represented in type 'long' Fixes: 70604/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4844090340999168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6be3786c828edfd60d810c98a42a43eeac4f050c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b409adb80cb61816d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 12 22:29:04 2024 +0200 avformat/mxfdec: More offset_temp checks Fixes: signed integer overflow: 9223372036854775807 - -1927491430256034080 cannot be represented in type 'long' Fixes: 70607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5282235077951488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <git(a)haerdin.se> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 5a96aa435af0d66bdec52ee115cf4dd971855fcd) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e7a948214e365c1d… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 12 22:51:53 2024 +0200 swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template() Fixes: signed integer overflow: -1082982400 + -1083218484 cannot be represented in type 'int' Fixes: 70657/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6707819712675840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit bd80c97391969f9dbb312d6c498211ad85bb67cb) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d05bbbd2965e0aacd… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 12 20:08:42 2024 +0200 swscale/swscale: Use unsigned operation to avoid undefined behavior I have not checked that the constant is correct, this just fixes the undefined behavior Fixes: signed integer overflow: -646656 * 3517 cannot be represented in type 'int Fixes: 70559/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5209368631508992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 44c5641ae82387fcfce94820f5b53ce8e9dcd27f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=36e303a394e3fdc9f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Sep 12 20:03:55 2024 +0200 avcodec/vc2enc: basic sanity check on slice_max_bytes Fixes: left shift of 896021632 by 3 places cannot be represented in type 'int' Fixes: 70544/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6685593652756480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 6df9a0292ca6c29ef3b220fbf9b257924cabf035) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=01131b822153d7a46… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Aug 15 00:37:05 2024 +0200 avformat/mvdec: Check if name was fully read Fixes: use of uninitialized value Fixes: 70901/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-6341913949569024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 4e39795c75e664ef06f17473adec8c75fcf9de6f) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7016a790a425d930b… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Aug 15 00:37:04 2024 +0200 avcodec/wmavoice: Do not use uninitialized pitch[0] Fixes: use of uninitialized value Fixes: 70850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-4806127362048000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 53387079301690f1bd38b97fdf31d63194201d17) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9714f17f128aa5859… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 19 22:17:48 2024 +0200 avformat/argo_brp: Check that ASF chunk header is completely read Fixes: Use of uninitialized value Fixes: 71280/clusterfuzz-testcase-minimized-ffmpeg_dem_ARGO_BRP_fuzzer-4692991866896384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 815d00868101956e2f1f9f8dd509c11af5a63684) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=255fae73224f8df38… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 19 20:37:56 2024 +0200 avcodec/notchlc: Check bytes left before reading Fixes: Use of uninitialized value Fixes: 71230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-4624502095413248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b9c7f50c7de9b7d8c533eae173c9b77a6719346c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=684ea8d46bf7bb5b7… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 19 20:02:41 2024 +0200 avcodec/vc1_block: propagate error codes Fixes: use of uninitialized value Fixes: 71228/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6188476880453632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 01910ca6037379804572c5ec9bbd0b94e7e4b83e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=13e553448d5469afb… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 19 17:02:12 2024 +0200 avformat/apetag: Check APETAGEX Fixes: Use of uninitialized value Fixes: 71074/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5697034877730816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 796ff2d599449ed798b69ab798ebcbcc0a5853f5) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=942697042021e0b49… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Aug 17 01:11:50 2024 +0200 avcodec/avcodec: Warn about data returned from get_buffer*() Text based on suggestion by: epirat07(a)gmail.com Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 93444c46fce195e378c4ebb1a20ea662e7f0123b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=730ce561a18821cc6… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Aug 3 18:35:48 2024 +0200 avformat/av1dec: Better fix for 70872/clusterfuzz-testcase-minimized-ffmpeg_dem_OBU_fuzzer-6005782487826432 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 7ad937f0c8cb9f120c50f3e792a699076923768e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b1d78733db15020af… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 22:32:31 2024 +0200 avcodec/alsdec: clear last_acf_mantissa Fixes: use-of-uninitialized-value Fixes: 70869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5476567461986304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit db843c8910781eb72a4658780283ef4e2da4591d) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=29f90ca7079e80c36… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 22:30:03 2024 +0200 avcodec/aic: Clear slice_data Fixes: use-of-uninitialized-value Fixes: 70865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-4874102695854080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit de3f6c8888bcf3df4ca6cb265a83507b95c884cd) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a4a6a7c670a29b93a… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 22:15:08 2024 +0200 avcodec/vc1dec: Clear mb_type_base and ttblk_base Fixes: two use-of-uninitialized-value Fixes: 70856/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5539349918187520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 50471f96c4a68874575ab21f799c5999ed920838) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=009d2a811339d485c… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 22:10:48 2024 +0200 avcodec/shorten: clear padding Fixes: use-of-uninitialized-value Fixes: 70854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5533480570650624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e44349ee88418ac16051bbc9231c1bfdc25d3504) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c46fd97384314fa6… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 21:27:44 2024 +0200 avformat/mpeg: Check an avio_read() for failure Fixes: use-of-uninitialized-value Fixes: 70849/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-4684401009557504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 66ee75d76ce56a3553a99d67e74b8a9970c18f5b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=13555ae146bd04b11… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Aug 3 19:11:33 2024 +0200 avcodec/mvha: Clear remaining space after inflate() Fixes: use-of-uninitialized-value Fixes: 70838/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVHA_fuzzer-4878509466517504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit cba4e2e40dec1ff2ce534fec87c7e3e8bef7ff9b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=027f8d7dcda1dca71… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Tue Aug 6 18:02:58 2024 +0200 avformat/segafilm: Set keyframe Fixes: use of uninitialized value Fixes: 70871/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5883617752973312 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 4dc7dfe65aaa21801a907c66592b92b05da921dc) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9fb8aec40c59ec6ce… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 12 18:20:33 2024 +0200 avcodec/sga: av_assert1 check init_get_bits8() Related: CID1473562 Unchecked return value Related: CID1473592 Unchecked return value Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 0f4524f07a93bf9061f9034ffa510d4bf9b582e8) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ca38b468d56aafb7f… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon Aug 12 15:23:56 2024 +0200 tools/target_dec_fuzzer: Check that FFv1 doesnt leave uninitialized memory in its buffers Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e40b23c52abe3356effa552549b2e989708a6e70) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c9d4fb32cf83e5986… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon May 27 01:24:09 2024 +0200 avdevice/dshow: Initialize 2 pointers Coverity claims these are used uninitilaized in CID1598561 Uninitialized pointer write and CID1598565 Uninitialized pointer write Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 43cde54fc14bc4644374b4736b2b7fff05359171) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2346076980400c4f9… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 26 22:33:11 2024 +0200 avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame() Related: CID1591924 Uninitialized scalar variable Related: CID1591938 Uninitialized scalar variable Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1d6a2aebae202652feb5964a2d62bdba4e5cc6e4) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d51c98f02ed152a8… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 26 22:28:04 2024 +0200 avcodec/dxva2: initialize validate Related: CID1591915 Uninitialized scalar variable Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 2232c4cc8c3d64dec4e4399b58e057f5dbb9ff98) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4b4b8d45cb5534bd9… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 26 22:23:16 2024 +0200 avcodec/dxva2: Initialize ConfigBitstreamRaw Related: CID1591894 Uninitialized scalar variable Related: CID1591906 Uninitialized scalar variable Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 489c05b9c3ea7d856b7a81abce247721b3b3d6e8) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=428590539ece23f38… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun May 26 22:13:28 2024 +0200 avcodec/dxva2: Initialize dxva_size and check it Related: CID1591878 Uninitialized scalar variable Related: CID1591928 Uninitialized pointer read Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c8c59e99295f9ef572b5d6f0fd9075bb2b79acbd) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b04d1365d36734c71… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jul 11 00:17:39 2024 +0200 avfilter/vf_xfade: Compute w2, h2 with float Fixes: CID1458148 Result is not floating-point Fixes: CID1458149 Result is not floating-point Fixes: CID1458150 Result is not floating-point Fixes: CID1458151 Result is not floating-point Fixes: CID1458152 Result is not floating-point Fixes: CID1458154 Result is not floating-point Fixes: CID1458155 Result is not floating-point Fixes: CID1458156 Result is not floating-point Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit b98125e5a52c2f96dc02380f8f7e3bb16752765b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4df3cd852fa0e54f8… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Thu Jul 11 00:10:45 2024 +0200 avfilter/vf_v360: Assert that vf was initialized Maybe helps: CID1504571 Uninitialized scalar variable Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f802d65de0fe419563705a6846a73b77b020ef14) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cbe80399b8129a383… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Jul 10 23:47:46 2024 +0200 avfilter/vf_tonemap_opencl: Dereference after NULL check Fixes: CID1437472 Dereference before null check Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e5c0f56ca09b4cb4ea87a61547218f9c818b52d7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=810159a0da93f3dfe… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Jul 12 22:16:13 2024 +0200 avfilter/af_surround: Check output format Fixes: CID1516994 Out-of-bounds access Fixes: CID1516996 Out-of-bounds access Fixes: CID1516999 Out-of-bounds access Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 22ee55a1da8218fb00c536723d488b7ca9344bd3) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41cbd7934102d9204… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri Jul 12 00:28:14 2024 +0200 avfilter/vf_xfade_opencl: Check ff_inlink_consume_frame() for failure Fixes: CID1458127 Unchecked return value Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 43b62b7e0c85c0a1038ac2bc90ae06597e3ef706) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a79d390d216681fa3… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Jul 13 09:16:48 2024 +0200 avformat/lmlm4: Eliminate some AVERROR(EIO) Found by code review related to CID732224 Overflowed constant Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 191a685010319cb0d248771574c7c61d76e4eb95) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=18fcdb860d79920fc… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Aug 7 00:18:52 2024 +0200 tools/target_dec_fuzzer: Use av_buffer_allocz() to avoid missing slices to have unpredictable content This matches production code which also zeros these buffers Fixes: use of uninitialized values Fixes: 70885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6F_fuzzer-4610946029387776 (and likely others) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1b8d95da3a4a5c9441238928a36b653da693c286) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c07fe9a3eb78027aa… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Aug 7 00:18:53 2024 +0200 avformat/wtvdec: Check length of read mpeg2_descriptor Fixes: Use of uninitialized value Fixes: 70900/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6286909377150976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c390234da2e3c7a8884f5592f0b9b4928c482b3e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=722e982fe54e1025e… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Wed Aug 7 00:18:51 2024 +0200 avformat/wtvdec: clear sectors The code can leave uninitialized holes in the array. Fixes: use of uninitialized values Fixes: 70883/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6698694567591936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross(a)xvid.org> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit c95ea0310468e0a0906fa7d590ff7406c39d6991) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=66ba00b9dadb5d1e0… Author: Kacper Michajłow <kasper93(a)gmail.com> Date: Thu Jun 27 02:40:35 2024 +0200 avcodec/parser: ensure input padding is zeroed Fixes use of uninitialized value, reported by MSAN. Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 5dfc0cc84129758b4eab2acdc3e186c3116deacd) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=67fcbe528c06cf820… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun Aug 4 22:00:35 2024 +0200 avformat/img2dec: Clear padding data after EOF Fixes: use-of-uninitialized-value Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 3978e81809a3daf278199849f7bbeacbffb9fa09) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=011c8e6612e8af614… Author: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat Aug 3 19:45:15 2024 +0200 avformat/wavdec: Check if there are 16 bytes before testing them Fixes: use-of-uninitialized-value Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 79a1cf30d1289f90da682263ba160f6e4a5a7bf1) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc>

1 0

[ffmpeg-web] branch master updated. 70386f1 web/security: Add more CVEs
by ffmpeg-git＠ffmpeg.org 02 Aug '25

02 Aug '25

The branch, master has been updated via 70386f1d527f76e2e0b21735769f9e059abe6fe9 (commit) via a4265bb25ccc9393d6377779cbccd267270bd512 (commit) from 40e62e8a4178511ae3eb8d703b73667e505d3e4d (commit) - Log ----------------------------------------------------------------- commit 70386f1d527f76e2e0b21735769f9e059abe6fe9 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Sat Aug 2 17:28:17 2025 +0200 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Sat Aug 2 17:28:17 2025 +0200 web/security: Add more CVEs diff --git a/src/security b/src/security index 0f676ae..62fd6bc 100644 --- a/src/security +++ b/src/security @@ -5,6 +5,9 @@ Fixes following vulnerabilities: </p> <pre> +CVE-2023-6602, 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6604, 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6605, 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf CVE-2025-1373, 43be8d07281caca2e88bfd8ee2333633e1fb1a13, ticket/11460 never affected a release CVE-2025-22920 4bf784c0e5615c3f934e677d5de093a8be7da7ae, ticket/11389 never affected a release CVE-2025-25471 fd1772b7475d0d5673a5dd314ee78443d0be4cf1, ticket/11417 never affected a release @@ -18,6 +21,9 @@ CVE-2025-25471 fd1772b7475d0d5673a5dd314ee78443d0be4cf1, ticket/11417 never affe Fixes following vulnerabilities: </p> <pre> +CVE-2023-6602, b753bac08f6881b2d3dea8f1ab84c81550f35897 / 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6604, b753bac08f6881b2d3dea8f1ab84c81550f35897 / 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6605, c3c7ecfe48d464a0b06564f2e92504b1d9c91d69 / 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf CVE-2025-0518, b827ac49b770635fc666f8543cb9585e1bc6308b / b5b6391d64807578ab872dc58fb8aa621dcfc38a CVE-2025-1816, b06845c6727a7c4391a7d5f607ae078aa0073c43 / 0526535cd58444dd264e810b2f3348b4d96cff3b, ticket/11475 CVE-2025-22919, 145a3a84550a1c3a3b848c12a64b53c3c41d2888 / 1446e37d3d032e1452844778b3e6ba2c20f0c322, ticket/11385 @@ -114,6 +120,14 @@ CVE-2024-7055, 5372bfe01e4a04357ab4465c1426cf8c6412dfd5 / 3faadbe2a27e74ff5bb5f7 CVE-2024-7272, a937b3c58babae893fb46b286a4792cd24a01d3d / 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 </pre> +<h3>5.1.5</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2024-36617, f0e780370cc1c437d64f10d326b1d656ef490b5f / d973fcbcc2f944752ff10e6a76b0b2d9329937a7 +</pre> + <h3>5.1.4</h3> <p> Fixes following vulnerabilities: @@ -195,6 +209,7 @@ CVE-2021-33815, 26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777 CVE-2021-38114, 7150f9575671f898382c370acae35f9087a30ba1 CVE-2021-38171, 9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 CVE-2021-38291, e01d306c647b5827102260b885faa223b646d2d1 ticket/9312, +CVE-2023-6603, 28c83584e8f3cd747c1476a74cc2841d3d1fa7f3 CVE-2023-47343, 0f6a3405e8987ad761a2d9139fdc95bbb6a61118 </pre> @@ -205,6 +220,9 @@ CVE-2023-47343, 0f6a3405e8987ad761a2d9139fdc95bbb6a61118 Fixes following vulnerabilities: </p> <pre> +CVE-2023-6602, 345202af04ae449417101b7bf25a7d4595af8a88 / 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6604, 345202af04ae449417101b7bf25a7d4595af8a88 / 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 +CVE-2023-6605, 96a0450a9f20b51327cfabc30553377622e324b0 / 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf CVE-2023-49502, eb1782ea84ebdb357917b249a353552060a8ebe4 / 737ede405b11a37fdd61d19cf25df296a0cb0b75, ticket/10688 CVE-2025-0518, a0e2fd18917a19605bb4efd12c7501c6b8bc26d0 / b5b6391d64807578ab872dc58fb8aa621dcfc38a CVE-2025-22919, 2ec7f8ea4da98449061cb0f7e61c5d1cb4e1cc92 / 1446e37d3d032e1452844778b3e6ba2c20f0c322, ticket/11385 @@ -1983,6 +2001,7 @@ Fixes following vulnerabilities: <pre> CVE-2014-7933, 490a3ebf36821b81f73e34ad3f554cb523dd2682 CVE-2015-3417, e8714f6f93d1a32f4e4655209960afcf4c185214 +CVE-2017-9051, 8d7ce5cdb707d4b22749f72d3f118e62e2b95cd3 </pre> @@ -3036,6 +3055,7 @@ Fixes following vulnerabilities: </p> <pre> CVE-2017-16803, b829da363985cb2f80130bba304cc29a632f6446 +CVE-2019-9719, b9a07e787bd09036b96370bb87fdf841fe380f9f </pre> <h2>FFmpeg 0.11</h2> commit a4265bb25ccc9393d6377779cbccd267270bd512 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Fri Aug 1 15:10:38 2025 +0200 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Fri Aug 1 15:11:09 2025 +0200 web: Add CVE-2024-35368 + CVE-2024-35367 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> diff --git a/src/security b/src/security index a433046..0f676ae 100644 --- a/src/security +++ b/src/security @@ -29,6 +29,7 @@ Fixes following vulnerabilities: </p> <pre> CVE-2024-7055 3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8 +CVE-2024-35368, 4513300989502090c4fd6560544dce399a8cd53c (specific to builds with --enable-rkmpp) </pre> @@ -54,6 +55,7 @@ CVE-2023-50008, 5f87a68cf70dafeab2fb89b42e41a4c29053b89b, ticket/10701 CVE-2024-28661, 66b50445cb36cf6adb49c2397362509aedb42c71 CVE-2024-31578, 3bb00c0a420c3ce83c6fafee30270d69622ccad7 CVE-2024-31582, 99debe5f823f45a482e1dc08de35879aa9c74bd2 +CVE-2024-35367, 09e6840cf7a3ee07a73c3ae88a020bf27ca1a667 (specific to builds for ppc with altivec) CVE-2024-36617, d973fcbcc2f944752ff10e6a76b0b2d9329937a7 </pre> ----------------------------------------------------------------------- Summary of changes: src/security | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) hooks/post-receive --

1 0