June 2026 - ffmpeg-cvslog - lists.ffmpeg.org

[ffmpeg] branch release/8.1 updated (38b88335f9 -> dba917bab5)
by ffmpeg-git 29 Jun '26

29 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch release/8.1 in repository ffmpeg. from 38b88335f9 Bump for 8.1.2 new eb98bef9d2 fftools/ffmpeg_demux: skip finished/unstarted streams in readrate_sleep() new 9193beee0d fftools/ffmpeg_demux: remove unused variable new dba917bab5 fftools/ffmpeg_demux: only throttle readrate on the slowest stream The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: fftools/ffmpeg_demux.c | 83 +++++++++++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 35 deletions(-)

2 3

[ffmpeg] branch release/9.0 updated (16e59dfabf -> d9402f5d71)
by ffmpeg-git 29 Jun '26

29 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch release/9.0 in repository ffmpeg. from 16e59dfabf forgejo/workflows: change to targeting 9.0 release branch new 5a4b9c5976 fftools/ffmpeg_demux: skip finished/unstarted streams in readrate_sleep() new b9a83fda41 fftools/ffmpeg_demux: remove unused variable new d9402f5d71 fftools/ffmpeg_demux: only throttle readrate on the slowest stream The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: fftools/ffmpeg_demux.c | 83 +++++++++++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 35 deletions(-)

2 3

[ffmpeg] branch master updated (86708357d1 -> de6bcf5c05)
by ffmpeg-git 29 Jun '26

29 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 86708357d1 avformat/iamf_parse: check count_label against the available bytes new 5c877416a5 fftools/ffmpeg_demux: skip finished/unstarted streams in readrate_sleep() new e7be06c8bd fftools/ffmpeg_demux: remove unused variable new de6bcf5c05 fftools/ffmpeg_demux: only throttle readrate on the slowest stream The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: fftools/ffmpeg_demux.c | 83 +++++++++++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 35 deletions(-)

2 3

[ffmpeg] avformat/iamf_parse: check count_label against the available bytes (branch master)
by Michael Niedermayer 29 Jun '26

29 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 86708357d1 avformat/iamf_parse: check count_label against the available bytes 86708357d1 is described below commit 86708357d126af84c16f80d9c57335d1e8c845c5 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Sun Jun 28 22:05:28 2026 +0200 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sun Jun 28 23:57:40 2026 +0000 avformat/iamf_parse: check count_label against the available bytes Fixes: unbounded allocation / denial of service Fixes: tP59h4cpaFyg Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/iamf_parse.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index d74a8677d6..4c2df2c9e6 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -1009,6 +1009,11 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le mix_presentation->cmix = mix; mix_presentation->count_label = ffio_read_leb(pbc); + if (mix_presentation->count_label > len - avio_tell(pbc)) { + mix_presentation->count_label = 0; + ret = AVERROR_INVALIDDATA; + goto fail; + } mix_presentation->language_label = av_calloc(mix_presentation->count_label, sizeof(*mix_presentation->language_label)); if (!mix_presentation->language_label) {

1 0

[ffmpeg] avcodec/rasc: Check that 32-bit DLTA accesses stay within the row (branch master)
by Umar Pathan 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 11ff18a6c8 avcodec/rasc: Check that 32-bit DLTA accesses stay within the row 11ff18a6c8 is described below commit 11ff18a6c80187405fc492f9bb07ba9f2f663f76 Author: Umar Pathan <hello(a)umar.ac> AuthorDate: Sun Jun 28 23:02:52 2026 +0200 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sun Jun 28 21:52:21 2026 +0000 avcodec/rasc: Check that 32-bit DLTA accesses stay within the row Found-by: bikini (github.com/bikini/exploitarium) Fixes: out of array access Fixes: rowspill_128x1.avi / gen_rowspill_avi.py Fixes: xGV79bIb7uAJ --- libavcodec/rasc.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c index 5f956a9b2c..d784a44063 100644 --- a/libavcodec/rasc.c +++ b/libavcodec/rasc.c @@ -320,6 +320,11 @@ static int decode_move(AVCodecContext *avctx, return 0; } +static inline int dlta_room(unsigned cx, unsigned w, unsigned bpp, unsigned need) +{ + return cx + need <= w * bpp; +} + #define NEXT_LINE \ if (cx >= w * s->bpp) { \ cx = 0; \ @@ -418,6 +423,8 @@ static int decode_dlta(AVCodecContext *avctx, case 4: fill = bytestream2_get_byte(&dc); while (len > 0 && cy > 0) { + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx++; @@ -427,6 +434,8 @@ static int decode_dlta(AVCodecContext *avctx, case 7: fill = bytestream2_get_le32(&dc); while (len > 0 && cy > 0) { + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx += 4; @@ -443,6 +452,8 @@ static int decode_dlta(AVCodecContext *avctx, while (len > 0 && cy > 0) { unsigned v0, v1; + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; v0 = AV_RL32(b2 + cx); v1 = AV_RL32(b1 + cx); AV_WL32(b2 + cx, v1); @@ -454,6 +465,8 @@ static int decode_dlta(AVCodecContext *avctx, case 13: while (len > 0 && cy > 0) { fill = bytestream2_get_le32(&dc); + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx += 4;

1 0

[ffmpeg] ffbuild/common.mak: ensure target directories are created before running shell redirects into them (branch master)
by Alexander Kanavin 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 9579983197 ffbuild/common.mak: ensure target directories are created before running shell redirects into them 9579983197 is described below commit 95799831978b3cda47ce51722f8d8a980423e546 Author: Alexander Kanavin <alex(a)linutronix.de> AuthorDate: Thu Dec 11 20:14:25 2025 +0100 Commit: Kacper Michajłow <kasper93(a)gmail.com> CommitDate: Sun Jun 28 20:29:15 2026 +0000 ffbuild/common.mak: ensure target directories are created before running shell redirects into them Otherwise, occasional build races have been observed: https://autobuilder.yoctoproject.org/valkyrie/#/builders/37/builds/3001/ste… /bin/sh: 4: cannot create fftools/resources/graph.css.min: Directory nonexistent mkdir -p fftools/graph /bin/sh: 1: cannot create fftools/resources/graph.html.gz: Directory nonexistent make: *** [/srv/pokybuild/.../ffmpeg-8.0.1/ffbuild/common.mak:165: fftools/resources/graph.html.gz] Error 2 make: *** Waiting for unfinished jobs.... make: *** [/srv/pokybuild/.../ffmpeg-8.0.1/ffbuild/common.mak:145: fftools/resources/graph.css.min] Error 2 There's a separate rule for making those directories, but unfortunately it's racing with the rules that expect the directories to exist. Rather than add a Makefile dependency, I've injected the dir creation directly into the commands that can otherwise fail - a proper fix would probably add the rule rather. Signed-off-by: Alexander Kanavin <alex(a)linutronix.de> --- ffbuild/common.mak | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ffbuild/common.mak b/ffbuild/common.mak index 059de5abf3..328d6df8d6 100644 --- a/ffbuild/common.mak +++ b/ffbuild/common.mak @@ -114,8 +114,8 @@ $(BIN2CEXE): ffbuild/bin2c_host.o $(HOSTLD) $(HOSTLDFLAGS) $(HOSTLD_O) $^ $(HOSTEXTRALIBS) RUN_BIN2C = $(BIN2C) $(patsubst $(SRC_PATH)/%,$(SRC_LINK)/%,$<) $@ $(subst .,_,$(basename $(notdir $@))) -RUN_GZIP = $(M)gzip -nc9 $(patsubst $(SRC_PATH)/%,$(SRC_LINK)/%,$<) >$@ -RUN_MINIFY = $(M)sed 's!/\\*.*\\*/!!g' $< | tr '\n' ' ' | tr -s ' ' | sed 's/^ //; s/ $$//' > $@ +RUN_GZIP = $(M)mkdir -p $(dir $@) && gzip -nc9 $(patsubst $(SRC_PATH)/%,$(SRC_LINK)/%,$<) >$@ +RUN_MINIFY = $(M)mkdir -p $(dir $@) && sed 's!/\\*.*\\*/!!g' $< | tr '\n' ' ' | tr -s ' ' | sed 's/^ //; s/ $$//' > $@ %.gz: TAG = GZIP %.min: TAG = MINIFY

1 0

[ffmpeg] branch master updated (97ba3c4a9a -> 983d457c2b)
by ffmpeg-git 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 97ba3c4a9a avcodec/ffv1enc_vulkan: fix format specifier for VkDeviceSize new 587db45caf avfilter/vf_bwdif_cuda: fix typos in algorithm new 983d457c2b avfilter/vf_yadif_cuda: fix typos in algorithm The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavfilter/vf_bwdif_cuda.cu | 18 +++++++++--------- libavfilter/vf_yadif_cuda.cu | 23 +++++++++++------------ 2 files changed, 20 insertions(+), 21 deletions(-)

2 2

[ffmpeg] avcodec/ffv1enc_vulkan: fix format specifier for VkDeviceSize (branch master)
by Zhao Zhili 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 97ba3c4a9a avcodec/ffv1enc_vulkan: fix format specifier for VkDeviceSize 97ba3c4a9a is described below commit 97ba3c4a9a02083e26f8b0f639987292bc61bffc Author: Zhao Zhili <quinkblack(a)foxmail.com> AuthorDate: Mon Jun 15 22:31:03 2026 +0800 Commit: Zhao Zhili <quink(a)noreply.code.ffmpeg.org> CommitDate: Sun Jun 28 18:27:44 2026 +0000 avcodec/ffv1enc_vulkan: fix format specifier for VkDeviceSize Fix build warning on macOS: > format specifies type 'size_t' (aka 'unsigned long') but the > argument has type 'VkDeviceSize' (aka 'unsigned long long') VkDeviceSize is typedef as uint64_t. --- libavcodec/ffv1enc_vulkan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1enc_vulkan.c b/libavcodec/ffv1enc_vulkan.c index 83950cc504..2c83e6869e 100644 --- a/libavcodec/ffv1enc_vulkan.c +++ b/libavcodec/ffv1enc_vulkan.c @@ -1387,7 +1387,7 @@ static av_cold int vulkan_encode_ffv1_init(AVCodecContext *avctx) maxsize = ff_ffv1_encode_buffer_size(avctx); if (maxsize > fv->s.props_11.maxMemoryAllocationSize) { av_log(avctx, AV_LOG_WARNING, "Encoding buffer size (%zu) larger " - "than maximum device allocation (%zu), clipping\n", + "than maximum device allocation (%"PRIu64"), clipping\n", maxsize, fv->s.props_11.maxMemoryAllocationSize); maxsize = fv->s.props_11.maxMemoryAllocationSize; }

1 0

[ffmpeg] fftools/ffmpeg: disable stdin interaction when fd 0 is closed (branch master)
by Zhao Zhili 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 0b4798f7ab fftools/ffmpeg: disable stdin interaction when fd 0 is closed 0b4798f7ab is described below commit 0b4798f7ab964e288241536175228179acb1410f Author: Zhao Zhili <quinkblack(a)foxmail.com> AuthorDate: Mon Jun 22 20:36:10 2026 +0800 Commit: Zhao Zhili <quink(a)noreply.code.ffmpeg.org> CommitDate: Sun Jun 28 18:26:49 2026 +0000 fftools/ffmpeg: disable stdin interaction when fd 0 is closed When the parent process closes stdin before launching ffmpeg, fd 0 is left invalid. The first opened input file then reuses fd 0, and the read_key() poll in the transcode loop reads from that input instead of the terminal, stealing bytes and corrupting the stream. Fixes #23539 --- fftools/ffmpeg.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fftools/ffmpeg.c b/fftools/ffmpeg.c index b394243f59..d38acffbdf 100644 --- a/fftools/ffmpeg.c +++ b/fftools/ffmpeg.c @@ -216,6 +216,16 @@ void term_init(void) #endif #if HAVE_TERMIOS_H + /* A closed fd 0 is later reused by the first opened input file. read_key() + * would then read from that input instead of the terminal and corrupt the + * stream, so disable interaction when fd 0 is not an open descriptor. + */ + if (stdin_interaction && fcntl(0, F_GETFD) == -1) { + av_log(NULL, AV_LOG_WARNING, + "fd 0 is not an open file descriptor, stdin interaction disabled\n"); + stdin_interaction = 0; + } + if (stdin_interaction) { struct termios tty; if (tcgetattr (0, &tty) == 0) {

1 0

[ffmpeg] avformat/mov: check current_dts for overflow (branch master)
by Michael Niedermayer 28 Jun '26

28 Jun '26

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 7e4366cf51 avformat/mov: check current_dts for overflow 7e4366cf51 is described below commit 7e4366cf51e4cf9f428a2517e4ae03650e11d607 Author: Michael Niedermayer <michael(a)niedermayer.cc> AuthorDate: Fri Jun 5 04:16:30 2026 +0200 Commit: michaelni <michael(a)niedermayer.cc> CommitDate: Sun Jun 28 17:38:11 2026 +0000 avformat/mov: check current_dts for overflow This includes a bunch of semi related checks that Fairy wanted added Fixes: 498236160/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4526018559016960 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/mov.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 0915b35a7f..90b01f9499 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4876,7 +4876,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) sc->time_offset = start_time - (uint64_t)empty_duration; sc->min_corrected_pts = start_time; if (!mov->advanced_editlist) - current_dts = -sc->time_offset; + current_dts = -av_clip64(sc->time_offset, -INT64_MAX, INT64_MAX); } if (!multiple_edits && !mov->advanced_editlist && @@ -4897,8 +4897,10 @@ static void mov_build_index(MOVContext *mov, AVStream *st) int rap_group_present = sc->rap_group_count && sc->rap_group; int key_off = (sc->keyframe_count && sc->keyframes[0] > 0) || (sc->stps_count && sc->stps_data[0] > 0); + av_assert0(sc->dts_shift >= 0); + if (current_dts < INT64_MIN + sc->dts_shift) + return; current_dts -= sc->dts_shift; - if (!sc->sample_count || sti->nb_index_entries || sc->tts_count) return; if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) @@ -4994,6 +4996,8 @@ static void mov_build_index(MOVContext *mov, AVStream *st) current_offset += sample_size; stream_size += sample_size; + if (current_dts > INT64_MAX - sc->tts_data[stts_index].duration) + return; current_dts += sc->tts_data[stts_index].duration; distance++; @@ -5103,6 +5107,8 @@ static void mov_build_index(MOVContext *mov, AVStream *st) size, samples); current_offset += size; + if (current_dts > INT64_MAX - samples) + return; current_dts += samples; chunk_samples -= samples; } @@ -5120,9 +5126,9 @@ static void mov_build_index(MOVContext *mov, AVStream *st) // Update start time of the stream. if (st->start_time == AV_NOPTS_VALUE && st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && sti->nb_index_entries > 0) { - st->start_time = sti->index_entries[0].timestamp + sc->dts_shift; + st->start_time = av_sat_add64(sti->index_entries[0].timestamp, sc->dts_shift); if (sc->tts_data) { - st->start_time += sc->tts_data[0].offset; + st->start_time = av_sat_add64(st->start_time, sc->tts_data[0].offset); } }

1 0