August 2025 - ffmpeg-cvslog - lists.ffmpeg.org

[ffmpeg] branch master updated. 0226b6fb2c avcodec/sanm: bl16: fix artifacts in larger videos
by ffmpeg-git＠ffmpeg.org 18 Aug '25

18 Aug '25

The branch, master has been updated via 0226b6fb2c0855eca417feb0a4e3bdf1f1193332 (commit) from 8426622bb9584ec4fc32215f006a91e7ddc480cc (commit) - Log ----------------------------------------------------------------- commit 0226b6fb2c0855eca417feb0a4e3bdf1f1193332 Author: Manuel Lauss <manuel.lauss(a)gmail.com> AuthorDate: Thu Aug 14 00:21:09 2025 +0200 Commit: Manuel Lauss <manuel.lauss(a)gmail.com> CommitDate: Mon Aug 18 09:11:09 2025 +0000 avcodec/sanm: bl16: fix artifacts in larger videos The DOS/Windows decoder precomputes a table of linear offsets of all motion vectors given the current image width. For larger widths (>=762), the pairs starting at indices 1 and 254 of motion_vectors[] will overflow the int16_t, changing the sign. Playing back the 800x600 "jonesopn_8.snm" video of "Indiana Jones and the Infernal Machine" reveals a lot of artifacts and a lot of "Ignoring invalid motion vector (149, -41)->(136, 0), block size = 8" messages, hinting at the wrong direction of the motion vectors. Fix this by doing the calculation that the DOS/Windows players do, let the value overflow and reextract the "new" mvec x/y components. diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 9e99aa9dd9..e4308af647 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -2074,6 +2074,20 @@ static int codec2subblock(SANMVideoContext *ctx, int cx, int cy, int blk_size) mx = motion_vectors[opcode][0]; my = motion_vectors[opcode][1]; + /* The original implementation of this codec precomputes a table + * of int16_t all motion vectors for given image width. + * For larger widths, starting with 762 pixels, the calculation of + * mv table indices 1+ and 255- overflow the int16_t, inverting the + * sign of the offset. This is actively exploited in e.g. the + * "jonesopn_8.snm" video of "Indiana Jones and the Infernal Machine". + * Therefore let the overflow happen and extract x/y components from + * the new value. + */ + if (ctx->width > 761) { + index = (int16_t)(my * ctx->width + mx); + mx = index % ctx->width; + my = index / ctx->width; + } if (good_mvec(ctx, cx, cy, mx, my, blk_size)) { copy_block(ctx->frm0 + cx + ctx->pitch * cy, ctx->frm2 + cx + mx + ctx->pitch * (cy + my), ----------------------------------------------------------------------- Summary of changes: libavcodec/sanm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 8426622bb9 avformat/avio: clarify that AVSEEK_FORCE has no effect
by ffmpeg-git＠ffmpeg.org 17 Aug '25

17 Aug '25

The branch, master has been updated via 8426622bb9584ec4fc32215f006a91e7ddc480cc (commit) from 134fbfd1dcb59441e38d870ddd231772f4e8e127 (commit) - Log ----------------------------------------------------------------- commit 8426622bb9584ec4fc32215f006a91e7ddc480cc Author: Valerii Zapodovnikov <val.zapod.vz(a)gmail.com> AuthorDate: Mon Aug 4 23:53:49 2025 +0300 Commit: Marton Balint <cus(a)passwd.hu> CommitDate: Sun Aug 17 20:47:11 2025 +0000 avformat/avio: clarify that AVSEEK_FORCE has no effect avio_seek() never supported SEEK_END and returned AVERROR(EINVAL) when specified, so the later check "(whence != SEEK_END || force)" was always true. This also means that AVSEEK_FORCE had no effect since 7a6fe01f99, that is 15 years ago. Rather than changing behaviour, let's document instead that the flag has no effect. Also fixed other commit 41ed7ab45f which confused ORing / passing AVSEEK_FORCE and AVSEEK_SIZE in the docs. Signed-off-by: Valerii Zapodovnikov <val.zapod.vz(a)gmail.com> diff --git a/libavformat/avio.h b/libavformat/avio.h index ebf611187d..fbcb7dbfc3 100644 --- a/libavformat/avio.h +++ b/libavformat/avio.h @@ -461,17 +461,17 @@ int avio_put_str16be(AVIOContext *s, const char *str); void avio_write_marker(AVIOContext *s, int64_t time, enum AVIODataMarkerType type); /** - * ORing this as the "whence" parameter to a seek function causes it to + * Passing this as the "whence" parameter to a seek function causes it to * return the filesize without seeking anywhere. Supporting this is optional. * If it is not supported then the seek function will return <0. */ #define AVSEEK_SIZE 0x10000 /** - * Passing this flag as the "whence" parameter to a seek function causes it to + * OR'ing this flag into the "whence" parameter to a seek function causes it to * seek by any means (like reopening and linear reading) or other normally unreasonable * means that can be extremely slow. - * This may be ignored by the seek code. + * This is the default and therefore ignored by the seek code since 2010. */ #define AVSEEK_FORCE 0x20000 diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 34743556ae..2e65f50006 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -238,10 +238,9 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence) FFIOContext *const ctx = ffiocontext(s); int64_t offset1; int64_t pos; - int force = whence & AVSEEK_FORCE; int buffer_size; int short_seek; - whence &= ~AVSEEK_FORCE; + whence &= ~AVSEEK_FORCE; // force flag does nothing if(!s) return AVERROR(EINVAL); @@ -282,8 +281,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence) } else if ((!(s->seekable & AVIO_SEEKABLE_NORMAL) || offset1 <= buffer_size + short_seek) && !s->write_flag && offset1 >= 0 && - (!s->direct || !s->seek) && - (whence != SEEK_END || force)) { + (!s->direct || !s->seek)) { while(s->pos < offset && !s->eof_reached) fill_buffer(s); if (s->eof_reached) @@ -300,7 +298,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence) s->pos = pos; s->eof_reached = 0; fill_buffer(s); - return avio_seek(s, offset, SEEK_SET | force); + return avio_seek(s, offset, SEEK_SET); } else { int64_t res; if (s->write_flag) { ----------------------------------------------------------------------- Summary of changes: libavformat/avio.h | 6 +++--- libavformat/aviobuf.c | 8 +++----- 2 files changed, 6 insertions(+), 8 deletions(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 134fbfd1dc avcodec/sanm: Check w, h, left, top
by ffmpeg-git＠ffmpeg.org 17 Aug '25

17 Aug '25

The branch, master has been updated via 134fbfd1dcb59441e38d870ddd231772f4e8e127 (commit) from a2cfaf1b916cd4519249031adc37e339baca7a7b (commit) - Log ----------------------------------------------------------------- commit 134fbfd1dcb59441e38d870ddd231772f4e8e127 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Sun Aug 17 15:31:48 2025 +0200 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Sun Aug 17 15:39:33 2025 +0200 avcodec/sanm: Check w,h,left,top The setup code fow w,h,left,top is complex, the code using it also falls in at least 2 different classes, one using left/top the other not. To ensure no out of array access happens we add this clear check. Fixes: out of array access Fixes: 439261995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5383455572819968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index a066a864eb..9e99aa9dd9 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -1757,6 +1757,11 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb) memset(ctx->fbuf, 0, ctx->frm0_size); } + if (w + FFMAX(left, 0) > ctx->avctx->width || h + FFMAX(top, 0) > ctx->avctx->height) { + avpriv_request_sample(ctx->avctx, "overly large frame\n"); + return AVERROR_PATCHWELCOME; + } + switch (codec) { case 1: case 3: ----------------------------------------------------------------------- Summary of changes: libavcodec/sanm.c | 5 +++++ 1 file changed, 5 insertions(+) hooks/post-receive --

1 0

[ffmpeg] branch master updated. a2cfaf1b91 avformat/mov: pass stream index to sanity_checks on HEIF images
by ffmpeg-git＠ffmpeg.org 17 Aug '25

17 Aug '25

The branch, master has been updated via a2cfaf1b916cd4519249031adc37e339baca7a7b (commit) via a28e01a6c16430da689340d0af6eec094020b719 (commit) from 7df92712723dee0ace3596684a90282c0e12a8ef (commit) - Log ----------------------------------------------------------------- commit a2cfaf1b916cd4519249031adc37e339baca7a7b Author: James Almer <jamrial(a)gmail.com> AuthorDate: Sat Aug 16 21:38:32 2025 -0300 Commit: James Almer <jamrial(a)gmail.com> CommitDate: Sat Aug 16 21:59:18 2025 -0300 avformat/mov: pass stream index to sanity_checks on HEIF images Instead of item_id. Same behavior as with standard video tracks. Signed-off-by: James Almer <jamrial(a)gmail.com> diff --git a/libavformat/mov.c b/libavformat/mov.c index b29c41a6b6..e9a582e5aa 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10470,7 +10470,7 @@ static int mov_parse_heif_items(AVFormatContext *s) sc->sample_size = sc->stsz_sample_size = item->extent_length; sc->sample_count = 1; - err = sanity_checks(s, sc, item->item_id); + err = sanity_checks(s, sc, st->index); if (err) return AVERROR_INVALIDDATA; commit a28e01a6c16430da689340d0af6eec094020b719 Author: James Almer <jamrial(a)gmail.com> AuthorDate: Sat Aug 16 14:16:38 2025 -0300 Commit: James Almer <jamrial(a)gmail.com> CommitDate: Sat Aug 16 21:59:18 2025 -0300 avformat/mov: don't use an allocated array for sample_size with HEIF images The array is only ever needed for streams where each sample entry may have a different value. Given that for non animated HEIF there's a single value that applies to the image, use the field defined for that. Fixes: NULL pointer dereference Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer <jamrial(a)gmail.com> diff --git a/libavformat/mov.c b/libavformat/mov.c index 86037c6712..b29c41a6b6 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) if (!sc->chunk_offsets) goto fail; sc->chunk_count = 1; - sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); - if (!sc->sample_sizes) - goto fail; - sc->sample_count = 1; sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); if (!sc->stts_data) goto fail; @@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s) st->codecpar->width = item->width; st->codecpar->height = item->height; + sc->sample_size = sc->stsz_sample_size = item->extent_length; + sc->sample_count = 1; + err = sanity_checks(s, sc, item->item_id); - if (err || !sc->sample_count) + if (err) return AVERROR_INVALIDDATA; - sc->sample_sizes[0] = item->extent_length; sc->chunk_offsets[0] = item->extent_offset + offset; if (item->item_id == mov->primary_item_id) ----------------------------------------------------------------------- Summary of changes: libavformat/mov.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 7df9271272 avfilter/whisper: correct option formatting
by ffmpeg-git＠ffmpeg.org 17 Aug '25

17 Aug '25

The branch, master has been updated via 7df92712723dee0ace3596684a90282c0e12a8ef (commit) from 1d06e8ddcd8c14232d0a3c2b1c21e50b232549b4 (commit) - Log ----------------------------------------------------------------- commit 7df92712723dee0ace3596684a90282c0e12a8ef Author: Gyan Doshi <ffmpeg(a)gyani.pro> AuthorDate: Sat Aug 16 16:12:10 2025 +0530 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Sun Aug 17 00:58:03 2025 +0000 avfilter/whisper: correct option formatting diff --git a/libavfilter/af_whisper.c b/libavfilter/af_whisper.c index bd145d6d1d..385180b4ed 100644 --- a/libavfilter/af_whisper.c +++ b/libavfilter/af_whisper.c @@ -430,7 +430,8 @@ static int query_formats(const AVFilterContext *ctx, #define HOURS 3600000000 static const AVOption whisper_options[] = { - { "model", "Path to the whisper.cpp model file", OFFSET(model_path), AV_OPT_TYPE_STRING,.flags = FLAGS }, { "language", "Language for transcription ('auto' for auto-detect)", OFFSET(language), AV_OPT_TYPE_STRING, {.str = "auto"}, .flags = FLAGS }, + { "model", "Path to the whisper.cpp model file", OFFSET(model_path), AV_OPT_TYPE_STRING,.flags = FLAGS }, + { "language", "Language for transcription ('auto' for auto-detect)", OFFSET(language), AV_OPT_TYPE_STRING, {.str = "auto"}, .flags = FLAGS }, { "queue", "Audio queue size", OFFSET(queue), AV_OPT_TYPE_DURATION, {.i64 = 3000000}, 20000, HOURS, .flags = FLAGS }, { "use_gpu", "Use GPU for processing", OFFSET(use_gpu), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, .flags = FLAGS }, { "gpu_device", "GPU device to use", OFFSET(gpu_device), AV_OPT_TYPE_INT, {.i64 = 0}, 0, INT_MAX, .flags = FLAGS }, ----------------------------------------------------------------------- Summary of changes: libavfilter/af_whisper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 1d06e8ddcd avfilter/af_whisper: fix broken output for multibyte character
by ffmpeg-git＠ffmpeg.org 16 Aug '25

16 Aug '25

The branch, master has been updated via 1d06e8ddcd8c14232d0a3c2b1c21e50b232549b4 (commit) from 30e695692041888d727159c6279f433540453c3f (commit) - Log ----------------------------------------------------------------- commit 1d06e8ddcd8c14232d0a3c2b1c21e50b232549b4 Author: Zhao Zhili <quinkblack(a)foxmail.com> AuthorDate: Fri Aug 15 20:39:49 2025 +0800 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sat Aug 16 13:58:14 2025 +0000 avfilter/af_whisper: fix broken output for multibyte character text + 1 can break a multibyte character, e.g., Chinese in UTF-8. There is no space at the beginning in this case. diff --git a/libavfilter/af_whisper.c b/libavfilter/af_whisper.c index 186b624504..bd145d6d1d 100644 --- a/libavfilter/af_whisper.c +++ b/libavfilter/af_whisper.c @@ -215,7 +215,9 @@ static void run_transcription(AVFilterContext *ctx, AVFrame *frame, int samples) for (int i = 0; i < n_segments; ++i) { const char *text = whisper_full_get_segment_text(wctx->ctx_wsp, i); - char *text_cleaned = av_strireplace(text + 1, "[BLANK_AUDIO]", ""); + if (av_isspace(text[0])) + text++; + char *text_cleaned = av_strireplace(text, "[BLANK_AUDIO]", ""); if (av_strnlen(text_cleaned, 1) == 0) { av_freep(&text_cleaned); ----------------------------------------------------------------------- Summary of changes: libavfilter/af_whisper.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 30e6956920 .forgejo/CODEOWNERS: add myself to JPEG XL and PNG
by ffmpeg-git＠ffmpeg.org 16 Aug '25

16 Aug '25

The branch, master has been updated via 30e695692041888d727159c6279f433540453c3f (commit) from 37507c6a78ab63bbf8dda1c0525545d30877bca2 (commit) - Log ----------------------------------------------------------------- commit 30e695692041888d727159c6279f433540453c3f Author: Leo Izen <leo.izen(a)gmail.com> AuthorDate: Wed Aug 13 22:54:04 2025 -0400 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Sat Aug 16 05:07:19 2025 -0400 .forgejo/CODEOWNERS: add myself to JPEG XL and PNG Add myself to JPEG XL and PNG decoders/encoders/parsers/etc. as a suggested reviewer. I'm the maintainer of the JXL files and I know the PNG code very well. Signed-off-by: Leo Izen <leo.izen(a)gmail.com> diff --git a/.forgejo/CODEOWNERS b/.forgejo/CODEOWNERS index a4ea6dd50f..0d310fb71f 100644 --- a/.forgejo/CODEOWNERS +++ b/.forgejo/CODEOWNERS @@ -20,9 +20,10 @@ libavcodec/.*ffv1.* @lynne @michaelni libavcodec/golomb.* @michaelni libavcodec/.*h266.* @frankplow @NuoMi @jianhuaw libavcodec/h26x/.* @frankplow @NuoMi @jianhuaw -libavcodec/.*jpegxl.* @lynne -libavcodec/.*jxl.* @lynne +libavcodec/.*jpegxl.* @lynne @Traneptora +libavcodec/.*jxl.* @lynne @Traneptora libavcodec/.*opus.* @lynne +libavcodec/.*png.* @Traneptora libavcodec/.*prores.* @lynne libavcodec/rangecoder.* @michaelni libavcodec/ratecontrol.* @michaelni @@ -45,6 +46,8 @@ libavfilter/vsrc_mandelbrot.* @michaelni # avformat # ======= libavformat/iamf.* @jamrial +libavformat/.*jpegxl.* @Traneptora +libavformat/.*jxl.* @Traneptora # avutil # ====== ----------------------------------------------------------------------- Summary of changes: .forgejo/CODEOWNERS | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 37507c6a78 avformat/whip: remove DTLSState enum
by ffmpeg-git＠ffmpeg.org 16 Aug '25

16 Aug '25

The branch, master has been updated via 37507c6a78ab63bbf8dda1c0525545d30877bca2 (commit) from 50affd2b09ca7ebf6beb287a087947be887b2417 (commit) - Log ----------------------------------------------------------------- commit 37507c6a78ab63bbf8dda1c0525545d30877bca2 Author: Jack Lau <jacklau1222(a)qq.com> AuthorDate: Mon Jul 21 15:47:37 2025 +0800 Commit: stevenliu <lingjiujianke(a)gmail.com> CommitDate: Sat Aug 16 06:25:04 2025 +0000 avformat/whip: remove DTLSState enum This patch aims to simplify the dtls handshake process since dtls handshake use force block mode We can just use the return code instead of DTLSState enum Signed-off-by: Jack Lau <jacklau1222(a)qq.com> diff --git a/libavformat/tls.h b/libavformat/tls.h index 4d4999aa7c..2afa248f4c 100644 --- a/libavformat/tls.h +++ b/libavformat/tls.h @@ -34,17 +34,6 @@ */ #define MAX_CERTIFICATE_SIZE 8192 -enum DTLSState { - DTLS_STATE_NONE, - - /* Whether DTLS handshake is finished. */ - DTLS_STATE_FINISHED, - /* Whether DTLS session is closed. */ - DTLS_STATE_CLOSED, - /* Whether DTLS handshake is failed. */ - DTLS_STATE_FAILED, -}; - typedef struct TLSShared { char *ca_file; int verify; @@ -65,8 +54,6 @@ typedef struct TLSShared { int is_dtls; int use_srtp; - enum DTLSState state; - /* The certificate and private key content used for DTLS handshake */ char* cert_buf; char* key_buf; @@ -112,8 +99,6 @@ int ff_tls_set_external_socket(URLContext *h, URLContext *sock); int ff_dtls_export_materials(URLContext *h, char *dtls_srtp_materials, size_t materials_sz); -int ff_dtls_state(URLContext *h); - int ff_ssl_read_key_cert(char *key_url, char *cert_url, char *key_buf, size_t key_sz, char *cert_buf, size_t cert_sz, char **fingerprint); int ff_ssl_gen_key_cert(char *key_buf, size_t key_sz, char *cert_buf, size_t cert_sz, char **fingerprint); diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index 0f2dbc8da6..db7147e491 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -476,12 +476,6 @@ int ff_dtls_export_materials(URLContext *h, char *dtls_srtp_materials, size_t ma return 0; } -int ff_dtls_state(URLContext *h) -{ - TLSContext *c = h->priv_data; - return c->tls_shared.state; -} - static int print_ssl_error(URLContext *h, int ret) { TLSContext *c = h->priv_data; @@ -656,7 +650,6 @@ static int dtls_handshake(URLContext *h) goto end; ret = 0; - c->tls_shared.state = DTLS_STATE_FINISHED; end: return ret; } diff --git a/libavformat/tls_schannel.c b/libavformat/tls_schannel.c index b60e3100be..b854f484fa 100644 --- a/libavformat/tls_schannel.c +++ b/libavformat/tls_schannel.c @@ -681,12 +681,6 @@ int ff_dtls_export_materials(URLContext *h, char *dtls_srtp_materials, size_t ma #endif } -int ff_dtls_state(URLContext *h) -{ - TLSContext *c = h->priv_data; - return c->tls_shared.state; -} - static void init_sec_buffer(SecBuffer *buffer, unsigned long type, void *data, unsigned long size) { @@ -1111,7 +1105,6 @@ static int tls_handshake(URLContext *h) #endif c->connected = 1; - s->state = DTLS_STATE_FINISHED; fail: return ret; diff --git a/libavformat/whip.c b/libavformat/whip.c index 65fd3b39b2..e2fa774c6f 100644 --- a/libavformat/whip.c +++ b/libavformat/whip.c @@ -198,9 +198,6 @@ typedef struct WHIPContext { /* The state of the RTC connection. */ enum WHIPState state; - /* The callback return value for DTLS. */ - int dtls_ret; - int dtls_closed; /* Parameters for the input audio and video codecs. */ AVCodecParameters *audio_par; @@ -348,41 +345,6 @@ static av_cold int certificate_key_init(AVFormatContext *s) return ret; } -/** - * When DTLS state change. - */ -static int dtls_context_on_state(AVFormatContext *s, const char* type, const char* desc) -{ - int ret = 0; - WHIPContext *whip = s->priv_data; - int state = ff_dtls_state(whip->dtls_uc); - - if (state == DTLS_STATE_CLOSED) { - whip->dtls_closed = 1; - av_log(whip, AV_LOG_VERBOSE, "DTLS session closed, type=%s, desc=%s, elapsed=%dms\n", - type ? type : "", desc ? desc : "", ELAPSED(whip->whip_starttime, av_gettime())); - goto error; - } - - if (state == DTLS_STATE_FAILED) { - whip->state = WHIP_STATE_FAILED; - av_log(whip, AV_LOG_ERROR, "DTLS session failed, type=%s, desc=%s\n", - type ? type : "", desc ? desc : ""); - whip->dtls_ret = AVERROR(EIO); - goto error; - } - - if (state == DTLS_STATE_FINISHED && whip->state < WHIP_STATE_DTLS_FINISHED) { - whip->state = WHIP_STATE_DTLS_FINISHED; - whip->whip_dtls_time = av_gettime(); - av_log(whip, AV_LOG_VERBOSE, "DTLS handshake is done, elapsed=%dms\n", - ELAPSED(whip->whip_starttime, av_gettime())); - return ret; - } -error: - return -1; -} - static av_cold int dtls_initialize(AVFormatContext *s) { WHIPContext *whip = s->priv_data; @@ -1326,9 +1288,18 @@ next_packet: /* If got any DTLS messages, handle it. */ if (is_dtls_packet(whip->buf, ret) && whip->state >= WHIP_STATE_ICE_CONNECTED || whip->state == WHIP_STATE_DTLS_CONNECTING) { whip->state = WHIP_STATE_DTLS_CONNECTING; - if ((ret = ffurl_handshake(whip->dtls_uc)) < 0) + ret = ffurl_handshake(whip->dtls_uc); + if (ret < 0) { + whip->state = WHIP_STATE_FAILED; + av_log(whip, AV_LOG_VERBOSE, "DTLS session failed\n"); goto end; - dtls_context_on_state(s, NULL, NULL); + } + if (!ret) { + whip->state = WHIP_STATE_DTLS_FINISHED; + whip->whip_dtls_time = av_gettime(); + av_log(whip, AV_LOG_VERBOSE, "DTLS handshake is done, elapsed=%dms\n", + ELAPSED(whip->whip_starttime, whip->whip_dtls_time)); + } goto next_packet; } } @@ -1771,10 +1742,8 @@ static av_cold int whip_init(AVFormatContext *s) goto end; end: - if (ret < 0 && whip->state < WHIP_STATE_FAILED) + if (ret < 0) whip->state = WHIP_STATE_FAILED; - if (ret >= 0 && whip->state >= WHIP_STATE_FAILED && whip->dtls_ret < 0) - ret = whip->dtls_ret; return ret; } @@ -1822,12 +1791,8 @@ static int whip_write_packet(AVFormatContext *s, AVPacket *pkt) } end: - if (ret < 0 && whip->state < WHIP_STATE_FAILED) + if (ret < 0) whip->state = WHIP_STATE_FAILED; - if (ret >= 0 && whip->state >= WHIP_STATE_FAILED && whip->dtls_ret < 0) - ret = whip->dtls_ret; - if (ret >= 0 && whip->dtls_closed) - ret = AVERROR(EIO); return ret; } ----------------------------------------------------------------------- Summary of changes: libavformat/tls.h | 15 ------------ libavformat/tls_openssl.c | 7 ------ libavformat/tls_schannel.c | 7 ------ libavformat/whip.c | 61 ++++++++++------------------------------------ 4 files changed, 13 insertions(+), 77 deletions(-) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 50affd2b09 avcodec/rv60dec: clear pu_info
by ffmpeg-git＠ffmpeg.org 16 Aug '25

16 Aug '25

The branch, master has been updated via 50affd2b09ca7ebf6beb287a087947be887b2417 (commit) from 61d00509244d7503b3ad467c719da2662d11b6c7 (commit) - Log ----------------------------------------------------------------- commit 50affd2b09ca7ebf6beb287a087947be887b2417 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Fri Aug 15 19:49:19 2025 +0200 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sat Aug 16 00:24:52 2025 +0000 avcodec/rv60dec: clear pu_info pu_info is read uninitialized on damaged input and at that point the following codepath is dependant on the uninitialized data. In one of these pathes out of array accesses happen. None of this is replicatable Less uninitialized data also should result in more reproducable reports Fixes: Use of uninitialized memory Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5103986067963904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c index 4a3d9067db..208fbc68f7 100644 --- a/libavcodec/rv60dec.c +++ b/libavcodec/rv60dec.c @@ -308,6 +308,8 @@ static int update_dimensions_clear_info(RV60Context *s, int width, int height) if ((ret = av_reallocp_array(&s->blk_info, s->blk_stride * (s->cu_height << 4), sizeof(s->blk_info[0]))) < 0) return ret; + memset(s->pu_info, 0, s->pu_stride * (s->cu_height << 3) * sizeof(s->pu_info[0])); + for (int j = 0; j < s->cu_height << 4; j++) for (int i = 0; i < s->cu_width << 4; i++) s->blk_info[j*s->blk_stride + i].mv.mvref = MVREF_NONE; ----------------------------------------------------------------------- Summary of changes: libavcodec/rv60dec.c | 2 ++ 1 file changed, 2 insertions(+) hooks/post-receive --

1 0

[ffmpeg] branch master updated. 61d0050924 avformat/tls_openssl: simplify fingerprint generation
by ffmpeg-git＠ffmpeg.org 16 Aug '25

16 Aug '25

The branch, master has been updated via 61d00509244d7503b3ad467c719da2662d11b6c7 (commit) via 4676f97928c1c38753d4f5da4ec13a75d5f22944 (commit) via 113c9c6cf36a703afc5ef10bbb40f248df521425 (commit) via 3a8b3dfeca2ddbee9999262f3240bfe05b55c66a (commit) from 1f4fed5cc3be0737305e342f753c42716d6bf432 (commit) - Log ----------------------------------------------------------------- commit 61d00509244d7503b3ad467c719da2662d11b6c7 Author: Kacper Michajłow <kasper93(a)gmail.com> AuthorDate: Wed Jul 30 00:23:20 2025 +0200 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Sat Aug 16 00:15:30 2025 +0000 avformat/tls_openssl: simplify fingerprint generation Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index ba5895316a..0f2dbc8da6 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -91,48 +91,26 @@ done: /** * Generate a SHA-256 fingerprint of an X.509 certificate. - * - * @param ctx AVFormatContext for logging (can be NULL) - * @param cert X509 certificate to fingerprint - * @return Newly allocated fingerprint string in "AA:BB:CC:…" format, - * or NULL on error (logs via av_log if ctx is not NULL). - * Caller must free() the returned string. */ -static char *generate_fingerprint(X509 *cert) +static int x509_fingerprint(X509 *cert, char **fingerprint) { unsigned char md[EVP_MAX_MD_SIZE]; int n = 0; - AVBPrint fingerprint; - char *result = NULL; - int i; - - /* To prevent a crash during cleanup, always initialize it. */ - av_bprint_init(&fingerprint, 0, AV_BPRINT_SIZE_UNLIMITED); + AVBPrint buf; if (X509_digest(cert, EVP_sha256(), md, &n) != 1) { - av_log(NULL, AV_LOG_ERROR, "TLS: Failed to generate fingerprint, %s\n", ERR_error_string(ERR_get_error(), NULL)); - goto end; - } - - for (i = 0; i < n; i++) { - av_bprintf(&fingerprint, "%02X", md[i]); - if (i + 1 < n) - av_bprintf(&fingerprint, ":"); + av_log(NULL, AV_LOG_ERROR, "TLS: Failed to generate fingerprint, %s\n", + ERR_error_string(ERR_get_error(), NULL)); + return AVERROR(ENOMEM); } - if (!fingerprint.str || !strlen(fingerprint.str)) { - av_log(NULL, AV_LOG_ERROR, "TLS: Fingerprint is empty\n"); - goto end; - } + av_bprint_init(&buf, n*3, n*3); - result = av_strdup(fingerprint.str); - if (!result) { - av_log(NULL, AV_LOG_ERROR, "TLS: Out of memory generating fingerprint\n"); - } + for (int i = 0; i < n - 1; i++) + av_bprintf(&buf, "%02X:", md[i]); + av_bprintf(&buf, "%02X", md[n - 1]); -end: - av_bprint_finalize(&fingerprint, NULL); - return result; + return av_bprint_finalize(&buf, fingerprint); } int ff_ssl_read_key_cert(char *key_url, char *cert_url, char *key_buf, size_t key_sz, char *cert_buf, size_t cert_sz, char **fingerprint) @@ -190,15 +168,9 @@ int ff_ssl_read_key_cert(char *key_url, char *cert_url, char *key_buf, size_t ke pkey_to_pem_string(pkey, key_buf, key_sz); cert_to_pem_string(cert, cert_buf, cert_sz); - /* Generate fingerprint. */ - if (fingerprint) { - *fingerprint = generate_fingerprint(cert); - if (!*fingerprint) { - av_log(NULL, AV_LOG_ERROR, "TLS: Failed to generate fingerprint from %s\n", cert_url); - ret = AVERROR(EIO); - goto end; - } - } + ret = x509_fingerprint(cert, fingerprint); + if (ret < 0) + av_log(NULL, AV_LOG_ERROR, "TLS: Failed to generate fingerprint from %s\n", cert_url); end: BIO_free(key_b); @@ -347,12 +319,9 @@ static int openssl_gen_certificate(EVP_PKEY *pkey, X509 **cert, char **fingerpri goto einval_end; } - if (fingerprint) { - *fingerprint = generate_fingerprint(*cert); - if (!*fingerprint) { - goto enomem_end; - } - } + ret = x509_fingerprint(*cert, fingerprint); + if (ret < 0) + goto end; goto end; enomem_end: commit 4676f97928c1c38753d4f5da4ec13a75d5f22944 Author: Kacper Michajłow <kasper93(a)gmail.com> AuthorDate: Tue Jul 29 23:55:33 2025 +0200 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Sat Aug 16 00:15:30 2025 +0000 avformat/tls_openssl: clean keys serialization It was unnecessary convoluted, remove not needed memory allocations, snprintf. Also fixes posibility to call snprinft with NULL as %s input. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index a1073da216..ba5895316a 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -35,80 +35,57 @@ #include <openssl/x509v3.h> /** - * Returns a heap-allocated null-terminated string containing - * the PEM-encoded public key. Caller must free. + * Convert an EVP_PKEY to a PEM string. */ -static char *pkey_to_pem_string(EVP_PKEY *pkey) { - BIO *mem = NULL; - BUF_MEM *bptr = NULL; - char *pem_str = NULL; +static int pkey_to_pem_string(EVP_PKEY *pkey, char *out, size_t out_sz) +{ + BIO *mem = NULL; + size_t read_bytes = 0; + + if (!pkey || !out || !out_sz) + goto done; - // Create a memory BIO if (!(mem = BIO_new(BIO_s_mem()))) - goto err; + goto done; - // Write public key in PEM form if (!PEM_write_bio_PrivateKey(mem, pkey, NULL, NULL, 0, NULL, NULL)) - goto err; - - // Extract pointer/length - BIO_get_mem_ptr(mem, &bptr); - if (!bptr || !bptr->length) - goto err; + goto done; - // Allocate string (+1 for NUL) - pem_str = av_malloc(bptr->length + 1); - if (!pem_str) - goto err; + if (!BIO_read_ex(mem, out, out_sz - 1, &read_bytes)) + goto done; - // Copy data & NUL-terminate - memcpy(pem_str, bptr->data, bptr->length); - pem_str[bptr->length] = '\0'; - -cleanup: +done: BIO_free(mem); - return pem_str; - -err: - // error path: free and return NULL - free(pem_str); - pem_str = NULL; - goto cleanup; + if (out && out_sz) + out[read_bytes] = '\0'; + return read_bytes; } /** - * Serialize an X509 certificate to a av_malloc’d PEM string. - * Caller must free the returned pointer. + * Convert an X509 certificate to a PEM string. */ -static char *cert_to_pem_string(X509 *cert) +static int cert_to_pem_string(X509 *cert, char *out, size_t out_sz) { - BIO *mem = BIO_new(BIO_s_mem()); - BUF_MEM *bptr = NULL; - char *out = NULL; - - if (!mem) goto err; + BIO *mem = NULL; + size_t read_bytes = 0; - /* Write the PEM certificate */ - if (!PEM_write_bio_X509(mem, cert)) - goto err; + if (!cert || !out || !out_sz) + goto done; - BIO_get_mem_ptr(mem, &bptr); - if (!bptr || !bptr->length) goto err; + if (!(mem = BIO_new(BIO_s_mem()))) + goto done; - out = av_malloc(bptr->length + 1); - if (!out) goto err; + if (!PEM_write_bio_X509(mem, cert)) + goto done; - memcpy(out, bptr->data, bptr->length); - out[bptr->length] = '\0'; + if (!BIO_read_ex(mem, out, out_sz - 1, &read_bytes)) + goto done; -cleanup: +done: BIO_free(mem); - return out; - -err: - free(out); - out = NULL; - goto cleanup; + if (out && out_sz) + out[read_bytes] = '\0'; + return read_bytes; } @@ -165,7 +142,6 @@ int ff_ssl_read_key_cert(char *key_url, char *cert_url, char *key_buf, size_t ke AVBPrint key_bp, cert_bp; EVP_PKEY *pkey = NULL; X509 *cert = NULL; - char *key_tem = NULL, *cert_tem = NULL; /* To prevent a crash during cleanup, always initialize it. */ av_bprint_init(&key_bp, 1, MAX_CERTIFICATE_SIZE); @@ -211,11 +187,8 @@ int ff_ssl_read_key_cert(char *key_url, char *cert_url, char *key_buf, size_t ke goto end; } - key_tem = pkey_to_pem_string(pkey); - cert_tem = cert_to_pem_string(cert); - - snprintf(key_buf, key_sz, "%s", key_tem); - snprintf(cert_buf, cert_sz, "%s", cert_tem); + pkey_to_pem_string(pkey, key_buf, key_sz); + cert_to_pem_string(cert, cert_buf, cert_sz); /* Generate fingerprint. */ if (fingerprint) { @@ -232,8 +205,6 @@ end: av_bprint_finalize(&key_bp, NULL); BIO_free(cert_b); av_bprint_finalize(&cert_bp, NULL); - av_free(key_tem); - av_free(cert_tem); EVP_PKEY_free(pkey); X509_free(cert); return ret; @@ -403,7 +374,6 @@ int ff_ssl_gen_key_cert(char *key_buf, size_t key_sz, char *cert_buf, size_t cer int ret = 0; EVP_PKEY *pkey = NULL; X509 *cert = NULL; - char *key_tem = NULL, *cert_tem = NULL; ret = openssl_gen_private_key(&pkey); if (ret < 0) goto error; @@ -411,14 +381,9 @@ int ff_ssl_gen_key_cert(char *key_buf, size_t key_sz, char *cert_buf, size_t cer ret = openssl_gen_certificate(pkey, &cert, fingerprint); if (ret < 0) goto error; - key_tem = pkey_to_pem_string(pkey); - cert_tem = cert_to_pem_string(cert); - - snprintf(key_buf, key_sz, "%s", key_tem); - snprintf(cert_buf, cert_sz, "%s", cert_tem); + pkey_to_pem_string(pkey, key_buf, key_sz); + cert_to_pem_string(cert, cert_buf, cert_sz); - av_free(key_tem); - av_free(cert_tem); error: X509_free(cert); EVP_PKEY_free(pkey); commit 113c9c6cf36a703afc5ef10bbb40f248df521425 Author: Kacper Michajłow <kasper93(a)gmail.com> AuthorDate: Wed Jul 30 20:08:38 2025 +0200 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Sat Aug 16 00:15:30 2025 +0000 configure: require at least OpenSSL 1.1.1 (LTS) Commit f256487cd8f29f24036efa5d91a84a26b048861a bumped requirement to 1.1.0 for OPENSSL_init_ssl. Bump this again to 1.1.1, because it was an LTS version. Although it has no mainline support anymore, it still has paid/premium support. 1.1.0 has no support at all. Motivated for use of BIO_read_ex() for next commits. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> diff --git a/Changelog b/Changelog index 0b0e6ecbf4..98b259f17f 100644 --- a/Changelog +++ b/Changelog @@ -8,6 +8,7 @@ version 8.0: - Whisper filter - Drop support for OpenSSL < 1.1.0 - Enable TLS peer certificate verification by default (on next major version bump) +- Drop support for OpenSSL < 1.1.1 - yasm support dropped, users need to use nasm - VVC VAAPI decoder - RealVideo 6.0 decoder diff --git a/configure b/configure index 6c1d6868ea..e1809a3e58 100755 --- a/configure +++ b/configure @@ -7260,10 +7260,10 @@ enabled omx && require_headers OMX_Core.h && \ enabled openssl && { { check_pkg_config openssl "openssl >= 3.0.0" openssl/ssl.h OPENSSL_init_ssl && { enabled gplv3 || ! enabled gpl || enabled nonfree || die "ERROR: OpenSSL >=3.0.0 requires --enable-version3"; }; } || { enabled gpl && ! enabled nonfree && die "ERROR: OpenSSL <3.0.0 is incompatible with the gpl"; } || - check_pkg_config openssl "openssl >= 1.1.0" openssl/ssl.h OPENSSL_init_ssl || + check_pkg_config openssl "openssl >= 1.1.1" openssl/ssl.h OPENSSL_init_ssl || check_lib openssl openssl/ssl.h OPENSSL_init_ssl -lssl -lcrypto || check_lib openssl openssl/ssl.h OPENSSL_init_ssl -lssl -lcrypto -lws2_32 -lgdi32 || - die "ERROR: openssl (>= 1.1.0) not found"; } + die "ERROR: openssl (>= 1.1.1) not found"; } enabled pocketsphinx && require_pkg_config pocketsphinx pocketsphinx pocketsphinx/pocketsphinx.h ps_init enabled rkmpp && { require_pkg_config rkmpp rockchip_mpp rockchip/rk_mpi.h mpp_create && require_pkg_config rockchip_mpp "rockchip_mpp >= 1.3.7" rockchip/rk_mpi.h mpp_create && commit 3a8b3dfeca2ddbee9999262f3240bfe05b55c66a Author: Kacper Michajłow <kasper93(a)gmail.com> AuthorDate: Mon Jul 28 19:07:32 2025 +0200 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Sat Aug 16 00:15:30 2025 +0000 avformat/tls_openssl: use ascii - (0x2D) instead of 0x2010 hyphen Too much AI is bad for you... Fixes: 167e343bbe75515a80db8ee72ffa0c607c944a00 Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index bab2e711c6..a1073da216 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -35,8 +35,8 @@ #include <openssl/x509v3.h> /** - * Returns a heap‐allocated null‐terminated string containing - * the PEM‐encoded public key. Caller must free. + * Returns a heap-allocated null-terminated string containing + * the PEM-encoded public key. Caller must free. */ static char *pkey_to_pem_string(EVP_PKEY *pkey) { BIO *mem = NULL; @@ -61,7 +61,7 @@ static char *pkey_to_pem_string(EVP_PKEY *pkey) { if (!pem_str) goto err; - // Copy data & NUL‐terminate + // Copy data & NUL-terminate memcpy(pem_str, bptr->data, bptr->length); pem_str[bptr->length] = '\0'; @@ -427,7 +427,7 @@ error: /** - * Deserialize a PEM‐encoded private or public key from a NUL-terminated C string. + * Deserialize a PEM-encoded private or public key from a NUL-terminated C string. * * @param pem_str The PEM text, e.g. * "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----\n" @@ -458,7 +458,7 @@ static EVP_PKEY *pkey_from_pem_string(const char *pem_str, int is_priv) } /** - * Deserialize a PEM‐encoded certificate from a NUL-terminated C string. + * Deserialize a PEM-encoded certificate from a NUL-terminated C string. * * @param pem_str The PEM text, e.g. * "-----BEGIN CERTIFICATE-----\n…\n-----END CERTIFICATE-----\n" ----------------------------------------------------------------------- Summary of changes: Changelog | 1 + configure | 4 +- libavformat/tls_openssl.c | 174 ++++++++++++++-------------------------------- 3 files changed, 57 insertions(+), 122 deletions(-) hooks/post-receive --

1 0