February 2026 - ffmpeg-cvslog

[ffmpeg] avformat/wtvdec: Check that language is fully read (branch master)
by Michael Niedermayer 24 Feb '26

24 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 989d6ddea0 avformat/wtvdec: Check that language is fully read 989d6ddea0 is described below commit 989d6ddea0da4c779e6b81998779344ada773824 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Sun Feb 22 13:47:23 2026 +0100 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Tue Feb 24 10:22:37 2026 +0000 avformat/wtvdec: Check that language is fully read Fixes: use-of-uninitialized-value Fixes: 483856523/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5221422609006592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/wtvdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index 1f299510c9..50d019a03f 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -881,7 +881,8 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p AVStream *st = s->streams[stream_index]; uint8_t language[4]; avio_skip(pb, 12); - avio_read(pb, language, 3); + if (avio_read(pb, language, 3) != 3) + return AVERROR_INVALIDDATA; if (language[0]) { language[3] = 0; av_dict_set(&st->metadata, "language", language, 0);

1 0

[ffmpeg] avformat/whip: use ffurl_closep instead of ffurl_close for dtls_uc (branch master)
by Nariman-Sayed 24 Feb '26

24 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 186e388716 avformat/whip: use ffurl_closep instead of ffurl_close for dtls_uc 186e388716 is described below commit 186e388716dcfa29a5d7e4b53e732e7e74b4bb31 Author: Nariman-Sayed <narimansayed28(a)gmail.com> AuthorDate: Mon Feb 23 23:38:41 2026 +0200 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Tue Feb 24 02:58:34 2026 +0000 avformat/whip: use ffurl_closep instead of ffurl_close for dtls_uc --- libavformat/whip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/whip.c b/libavformat/whip.c index fda5fed40c..08bd19d9c7 100644 --- a/libavformat/whip.c +++ b/libavformat/whip.c @@ -1999,7 +1999,7 @@ static av_cold void whip_deinit(AVFormatContext *s) ff_srtp_free(&whip->srtp_video_rtx_send); ff_srtp_free(&whip->srtp_rtcp_send); ff_srtp_free(&whip->srtp_recv); - ffurl_close(whip->dtls_uc); + ffurl_closep(&whip->dtls_uc); ffurl_closep(&whip->udp); av_freep(&whip->dtls_fingerprint); }

1 0

[ffmpeg] avcodec/imm5: Dont pass EAGAIN on as is (branch master)
by Michael Niedermayer 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 7761b8fbac avcodec/imm5: Dont pass EAGAIN on as is 7761b8fbac is described below commit 7761b8fbacd3bfffdc56459b49458c32c85d7140 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Thu Feb 12 23:54:42 2026 +0100 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Mon Feb 23 23:58:11 2026 +0100 avcodec/imm5: Dont pass EAGAIN on as is Fixes: Assertion consumed != (-(11)) failed at libavcodec/decode.c:465 Fixes: 471587358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IMM5_fuzzer-4737412376100864 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/imm5.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/imm5.c b/libavcodec/imm5.c index 7bb77b5e7a..b1cda453c9 100644 --- a/libavcodec/imm5.c +++ b/libavcodec/imm5.c @@ -136,6 +136,8 @@ static int imm5_decode_frame(AVCodecContext *avctx, AVFrame *frame, } ret = avcodec_receive_frame(codec_avctx, frame); + if (ret == AVERROR(EAGAIN)) + return avpkt->size; if (ret < 0) return ret;

1 0

[ffmpeg] branch master updated (3827b3f1f0 -> 302f198ba5)
by ffmpeg-git 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 3827b3f1f0 tools/target_dec_fuzzer: Adjust threshold for G2M new 2ab23ec729 avcodec/interplayacm: Check input for fill_block() new 302f198ba5 avcodec/mjpegdec: Check for multiple exif The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/interplayacm.c | 3 +++ libavcodec/mjpegdec.c | 5 +++++ 2 files changed, 8 insertions(+)

2 2

[ffmpeg] branch master updated (ce05529180 -> 3827b3f1f0)
by ffmpeg-git 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from ce05529180 tools/target_dec_fuzzer: Adjust threshold for CPIA new bebea1e8e3 tools/target_dec_fuzzer: Adjust threshold for XAN_WC3 new 3827b3f1f0 tools/target_dec_fuzzer: Adjust threshold for G2M The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: tools/target_dec_fuzzer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

2 2

[ffmpeg] branch master updated (538824fd84 -> ce05529180)
by ffmpeg-git 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 538824fd84 avcodec/hdrdec: Check input size before buffer allocation new 9c5e6a319c tools/target_dec_fuzzer: Adjust threshold for QOI new ce05529180 tools/target_dec_fuzzer: Adjust threshold for CPIA The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: tools/target_dec_fuzzer.c | 2 ++ 1 file changed, 2 insertions(+)

2 2

[ffmpeg] branch master updated (f81d6479ec -> 538824fd84)
by ffmpeg-git 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from f81d6479ec tools/target_dec_fuzzer: Adjust threshold for MPC8 new 55bb6e2646 avcodec/tmv: Move space check before buffer allocation new 538824fd84 avcodec/hdrdec: Check input size before buffer allocation The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/hdrdec.c | 3 +++ libavcodec/tmv.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-)

2 2

[ffmpeg] branch master updated (4446dfb0e3 -> f81d6479ec)
by ffmpeg-git 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 4446dfb0e3 avcodec/flashsv: Check for input space before (re)allocating frame new c8b57f0a1e tools/target_dec_fuzzer: Adjust threshold for BFI new f81d6479ec tools/target_dec_fuzzer: Adjust threshold for MPC8 The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: tools/target_dec_fuzzer.c | 2 ++ 1 file changed, 2 insertions(+)

2 2

[ffmpeg] avcodec/flashsv: Check for input space before (re)allocating frame (branch master)
by Michael Niedermayer 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 4446dfb0e3 avcodec/flashsv: Check for input space before (re)allocating frame 4446dfb0e3 is described below commit 4446dfb0e326fcc6228476d1efeb9cdaea088702 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Tue Feb 10 02:37:58 2026 +0100 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Mon Feb 23 22:59:44 2026 +0100 avcodec/flashsv: Check for input space before (re)allocating frame Fixes: Timeout Fixes: 471605680/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLASHSV2_DEC_fuzzer-6210773459468288 Fixes: 471605920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLASHSV_DEC_fuzzer-6230719287590912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/flashsv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c index d27918c923..ba5c995006 100644 --- a/libavcodec/flashsv.c +++ b/libavcodec/flashsv.c @@ -314,6 +314,9 @@ static int flashsv_decode_frame(AVCodecContext *avctx, AVFrame *rframe, v_blocks = s->image_height / s->block_height; v_part = s->image_height % s->block_height; + if (h_blocks * v_blocks * 16 > get_bits_left(&gb)) + return AVERROR_INVALIDDATA; + /* the block size could change between frames, make sure the buffer * is large enough, if not, get a larger one */ if (s->block_size < s->block_width * s->block_height) {

1 0

[ffmpeg] avcodec/mdec: Check input space vs minimal block size (branch master)
by Michael Niedermayer 23 Feb '26

23 Feb '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 40cafc25cf avcodec/mdec: Check input space vs minimal block size 40cafc25cf is described below commit 40cafc25cfc435e91ff3862cd9489573f6a38dc1 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Fri Feb 6 22:37:53 2026 +0100 Commit: Michael Niedermayer <michael(a)niedermayer.cc> CommitDate: Mon Feb 23 22:54:38 2026 +0100 avcodec/mdec: Check input space vs minimal block size Fixes: Timeout Fixes: 481006706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MDEC_fuzzer-6122832651419648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/mdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/mdec.c b/libavcodec/mdec.c index c8865d7c63..6ea64a8a3b 100644 --- a/libavcodec/mdec.c +++ b/libavcodec/mdec.c @@ -174,6 +174,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, int buf_size = avpkt->size; int ret; + if (a->mb_width * a->mb_height * 3 > buf_size) + return AVERROR_INVALIDDATA; + if ((ret = ff_thread_get_buffer(avctx, frame, 0)) < 0) return ret;

1 0