January 2026 - ffmpeg-cvslog - lists.ffmpeg.org

[ffmpeg] avformat/img2dec: reject input images too big to fit into a single packet (branch release/8.0)
by Timo Rothenpieler 01 Jan '26

01 Jan '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg. The following commit(s) were added to refs/heads/release/8.0 by this push: new ec78e95627 avformat/img2dec: reject input images too big to fit into a single packet ec78e95627 is described below commit ec78e956273c8329d83e8c08d7f43a60e2bd1940 Author: Timo Rothenpieler <timo(a)rothenpieler.org> AuthorDate: Wed Dec 31 03:41:21 2025 +0100 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Thu Jan 1 19:52:19 2026 +0000 avformat/img2dec: reject input images too big to fit into a single packet Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 (cherry picked from commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8) --- libavformat/img2dec.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index f0ed84f8f6..a0749da2bb 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -416,8 +416,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) char filename_bytes[1024]; char *filename = filename_bytes; int i, res; - int size[3] = { 0 }, ret[3] = { 0 }; - AVIOContext *f[3] = { NULL }; + int ret[3] = { 0 }; + int64_t size[3] = { 0 }; + int64_t total_size; + AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; if (!s->is_pipe) { @@ -497,7 +499,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - res = av_new_packet(pkt, size[0] + size[1] + size[2]); + total_size = size[0]; + if (total_size > INT64_MAX - size[1]) + return AVERROR_INVALIDDATA; + total_size += size[1]; + if (total_size > INT64_MAX - size[2]) + return AVERROR_INVALIDDATA; + total_size += size[2]; + if (total_size > INT_MAX) + return AVERROR_INVALIDDATA; + + res = av_new_packet(pkt, total_size); if (res < 0) { goto fail; }

1 0

[ffmpeg] avformat/img2dec: reject input images too big to fit into a single packet (branch release/7.1)
by Timo Rothenpieler 01 Jan '26

01 Jan '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/7.1 in repository ffmpeg. The following commit(s) were added to refs/heads/release/7.1 by this push: new 7ce7207770 avformat/img2dec: reject input images too big to fit into a single packet 7ce7207770 is described below commit 7ce72077704d5351d2c4a8d06016548e0f8a730c Author: Timo Rothenpieler <timo(a)rothenpieler.org> AuthorDate: Wed Dec 31 03:41:21 2025 +0100 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Wed Dec 31 17:48:24 2025 +0100 avformat/img2dec: reject input images too big to fit into a single packet Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 (cherry picked from commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8) --- libavformat/img2dec.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 3389fa818e..2bcbfafdfc 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -416,8 +416,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) char filename_bytes[1024]; char *filename = filename_bytes; int i, res; - int size[3] = { 0 }, ret[3] = { 0 }; - AVIOContext *f[3] = { NULL }; + int ret[3] = { 0 }; + int64_t size[3] = { 0 }; + int64_t total_size; + AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; if (!s->is_pipe) { @@ -497,7 +499,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - res = av_new_packet(pkt, size[0] + size[1] + size[2]); + total_size = size[0]; + if (total_size > INT64_MAX - size[1]) + return AVERROR_INVALIDDATA; + total_size += size[1]; + if (total_size > INT64_MAX - size[2]) + return AVERROR_INVALIDDATA; + total_size += size[2]; + if (total_size > INT_MAX) + return AVERROR_INVALIDDATA; + + res = av_new_packet(pkt, total_size); if (res < 0) { goto fail; }

1 0

[ffmpeg] avformat/img2dec: reject input images too big to fit into a single packet (branch release/7.0)
by Timo Rothenpieler 01 Jan '26

01 Jan '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/7.0 in repository ffmpeg. The following commit(s) were added to refs/heads/release/7.0 by this push: new 1a7ab8affa avformat/img2dec: reject input images too big to fit into a single packet 1a7ab8affa is described below commit 1a7ab8affab8f4b921b7a4b8fc40e9cbc25acd74 Author: Timo Rothenpieler <timo(a)rothenpieler.org> AuthorDate: Wed Dec 31 03:41:21 2025 +0100 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Wed Dec 31 17:52:36 2025 +0100 avformat/img2dec: reject input images too big to fit into a single packet Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 (cherry picked from commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8) --- libavformat/img2dec.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index ddefbe85e2..d65c1c76c9 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -416,8 +416,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) char filename_bytes[1024]; char *filename = filename_bytes; int i, res; - int size[3] = { 0 }, ret[3] = { 0 }; - AVIOContext *f[3] = { NULL }; + int ret[3] = { 0 }; + int64_t size[3] = { 0 }; + int64_t total_size; + AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; if (!s->is_pipe) { @@ -497,7 +499,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - res = av_new_packet(pkt, size[0] + size[1] + size[2]); + total_size = size[0]; + if (total_size > INT64_MAX - size[1]) + return AVERROR_INVALIDDATA; + total_size += size[1]; + if (total_size > INT64_MAX - size[2]) + return AVERROR_INVALIDDATA; + total_size += size[2]; + if (total_size > INT_MAX) + return AVERROR_INVALIDDATA; + + res = av_new_packet(pkt, total_size); if (res < 0) { goto fail; }

1 0

[ffmpeg] avformat/file: respect pkt_size even in streaming mode (branch master)
by Marton Balint 01 Jan '26

01 Jan '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 8579037b6c avformat/file: respect pkt_size even in streaming mode 8579037b6c is described below commit 8579037b6c7c757e0b1fe9440bb195de0d3dc476 Author: Marton Balint <cus(a)passwd.hu> AuthorDate: Tue Dec 30 02:36:04 2025 +0100 Commit: Marton Balint <cus(a)passwd.hu> CommitDate: Thu Jan 1 18:20:58 2026 +0000 avformat/file: respect pkt_size even in streaming mode Also clarify the documentation a bit. Signed-off-by: Marton Balint <cus(a)passwd.hu> --- doc/protocols.texi | 12 +++++++----- libavformat/file.c | 18 +++++++++++------- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/doc/protocols.texi b/doc/protocols.texi index b5330a1160..350c52a465 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -354,13 +354,15 @@ overriding this might speed up opening certain files at the cost of losing some features (e.g. accurate seeking). @item pkt_size -Set the maximum packet size used for file I/O. +Set the maximum packet size used for file I/O. A smaller value may reduce +memory usage. A higher value may increase throughput especially with networked +filesystems. -For writing, this sets the size of each write operation. The default is -262144 bytes. For reading, if explicitly set, it overrides the default internal buffer size -(32768 bytes) and limits the maximum amount of data read per operation. -Setting a smaller value may reduce memory usage when reading files sequentially. +(32 KB) and limits the maximum amount of data read per operation. + +For writing, this sets the size of each write operation. The default is 256 KB +for regular files, 32 KB otherwise. @end table @section ftp diff --git a/libavformat/file.c b/libavformat/file.c index 23dc7081d3..3ceddc8c25 100644 --- a/libavformat/file.c +++ b/libavformat/file.c @@ -312,14 +312,18 @@ static int file_open(URLContext *h, const char *filename, int flags) h->is_streamed = !fstat(fd, &st) && S_ISFIFO(st.st_mode); - /* Buffer writes more than the default 32k to improve throughput especially - * with networked file systems */ - if (!h->is_streamed) { - if (flags & AVIO_FLAG_WRITE) - h->min_packet_size = h->max_packet_size = c->pkt_size ? c->pkt_size : 262144; - else if (flags & AVIO_FLAG_READ && c->pkt_size) - h->max_packet_size = c->pkt_size; + if (c->pkt_size) { + h->max_packet_size = c->pkt_size; + } else { + /* Buffer writes more than the default 32k to improve throughput especially + * with networked file systems */ + if (!h->is_streamed && flags & AVIO_FLAG_WRITE) + h->max_packet_size = 262144; } + /* Disable per-packet flushing by default to improve throughput especially + * with networked file systems */ + if (!h->is_streamed && flags & AVIO_FLAG_WRITE) + h->min_packet_size = h->max_packet_size; if (c->seekable >= 0) h->is_streamed = !c->seekable;

1 0

[ffmpeg] cbs_vp9: Always update loop filter and segmentation from current frame (branch release/8.0)
by David Rosca 01 Jan '26

01 Jan '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg. The following commit(s) were added to refs/heads/release/8.0 by this push: new a6a220ed33 cbs_vp9: Always update loop filter and segmentation from current frame a6a220ed33 is described below commit a6a220ed33be8155d45f9de59ffbc189273fd747 Author: David Rosca <nowrep(a)gmail.com> AuthorDate: Fri Aug 29 10:58:00 2025 +0200 Commit: Kacper Michajłow <kasper93(a)gmail.com> CommitDate: Thu Jan 1 13:49:08 2026 +0100 cbs_vp9: Always update loop filter and segmentation from current frame Fixes decoding vp90-2-09-aq2, vp90-2-15-segkey_adpq, vp90-2-15-segkey and vp90-2-22-svc_1280x720_1 with Vulkan hwaccel. Fixes: 26a2a76346 ("cbs_vp9: Fix VP9 passthrough") (cherry picked from commit a0a16f2ea43e000816c1474f8295e3cf1cfd299b) --- libavcodec/cbs_vp9_syntax_template.c | 58 +++++++++++++++++------------------- 1 file changed, 28 insertions(+), 30 deletions(-) diff --git a/libavcodec/cbs_vp9_syntax_template.c b/libavcodec/cbs_vp9_syntax_template.c index 9d01debb6d..0669cbed0c 100644 --- a/libavcodec/cbs_vp9_syntax_template.c +++ b/libavcodec/cbs_vp9_syntax_template.c @@ -392,39 +392,37 @@ static int FUNC(uncompressed_header)(CodedBitstreamContext *ctx, RWContext *rw, memset(vp9->feature_enabled, 0, sizeof(vp9->feature_enabled)); memset(vp9->feature_value, 0, sizeof(vp9->feature_value)); memset(vp9->feature_sign, 0, sizeof(vp9->feature_sign)); + } - } else { - // Modify previous state based on updates in this frame. - - if (current->loop_filter_delta_update) { - for (i = 0; i < 4; i++) { - if (current->update_ref_delta[i]) - vp9->loop_filter_ref_deltas[i] = - current->loop_filter_ref_deltas[i]; - } - for (i = 0; i < 2; i++) { - if (current->update_mode_delta[i]) - vp9->loop_filter_mode_deltas[i] = - current->loop_filter_mode_deltas[i]; - } + // Modify previous state based on updates in this frame. + if (current->loop_filter_delta_update) { + for (i = 0; i < 4; i++) { + if (current->update_ref_delta[i]) + vp9->loop_filter_ref_deltas[i] = + current->loop_filter_ref_deltas[i]; + } + for (i = 0; i < 2; i++) { + if (current->update_mode_delta[i]) + vp9->loop_filter_mode_deltas[i] = + current->loop_filter_mode_deltas[i]; } + } - if (current->segmentation_update_data) { - memcpy(vp9->feature_enabled, current->feature_enabled, - sizeof(vp9->feature_enabled)); - memcpy(vp9->feature_value, current->feature_value, - sizeof(vp9->feature_value)); - memcpy(vp9->feature_sign, current->feature_sign, - sizeof(vp9->feature_sign)); - - if (current->segmentation_update_map) { - memcpy(vp9->segmentation_tree_probs, - current->segmentation_tree_probs, - sizeof(vp9->segmentation_tree_probs)); - memcpy(vp9->segmentation_pred_prob, - current->segmentation_pred_prob, - sizeof(vp9->segmentation_pred_prob)); - } + if (current->segmentation_update_data) { + memcpy(vp9->feature_enabled, current->feature_enabled, + sizeof(vp9->feature_enabled)); + memcpy(vp9->feature_value, current->feature_value, + sizeof(vp9->feature_value)); + memcpy(vp9->feature_sign, current->feature_sign, + sizeof(vp9->feature_sign)); + + if (current->segmentation_update_map) { + memcpy(vp9->segmentation_tree_probs, + current->segmentation_tree_probs, + sizeof(vp9->segmentation_tree_probs)); + memcpy(vp9->segmentation_pred_prob, + current->segmentation_pred_prob, + sizeof(vp9->segmentation_pred_prob)); } }

1 0