October 2025 - ffmpeg-devel - lists.ffmpeg.org

Re: [FFmpeg-devel] [PATCH] libavformat/whip: Add av_freep() to avoid potential memory leak
by Jiasheng Jiang 01 Dec '25

01 Dec '25

Nicolas George (HE12025-08-07) > Jiasheng Jiang (HE12025-08-07): >> Add av_freep() if avio_alloc_context() fails to avoid potential memory leak. >> >> Fixes: 167e343bbe ("avformat/whip: Add WHIP muxer support for subsecond latency streaming") >> Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> >> --- >> libavformat/whip.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/libavformat/whip.c b/libavformat/whip.c >> index 256ea14d2c..82a5a51029 100644 >> --- a/libavformat/whip.c >> +++ b/libavformat/whip.c >> @@ -1553,6 +1553,7 @@ static int create_rtp_muxer(AVFormatContext *s) >> >> rtp_ctx->pb = avio_alloc_context(buffer, buffer_size, 1, s, NULL, on_rtp_write_packet, NULL); >> if (!rtp_ctx->pb) { > >> + av_freep(&buffer); >> ret = AVERROR(ENOMEM); >> goto end; > > That belong to after end, otherwise you need to make the change > everywhere. > >> } > > Regards, I found that after the success of avio_alloc_context(), buffer is assigned to rtp_ctx->pb->buffer and will be freed in whip_deinit(). Therefore, I think moving av_freep() after end would cause a double free. - Jiasheng

3 2

[REFUND-REQUEST] GSoC 2025 Mentor Summit Reimbursement Request
by Steven Liu 24 Nov '25

24 Nov '25

Hi Folks, I would like to request reimbursement for the following expenses incurred attending the Google Summer of Code mentor summit. Description | Amount --------------------------------------------------------------+-------- From Beijing To Dubai[EK307] To Munich[EK49] | 7456 CNY From Munich To Dubai[EK52] To Beijing[EK308] | --------------------------------------------------------------+-------- Total | 7456 CNY I understand Google will give FFmpeg $1000 to cover these travel expenses, so my trip should be net positive to the coffers overall. Thanks Steven

3 3

[PATCH] avcodec/qsv: Multiple calls to ff_qsv_init_session_frames() cause handle and memory leaks.
by 김현호(HYUN HO KIM) 21 Nov '25

21 Nov '25

Within qsvdec.c, ff_qsv_init_session_frames() is typically called twice during decoder initialization. Although qsv_create_mids() may be called if avctx->hw_frames_ctx exists, this procedure causes memory and handle leaks because the existing created resources are merely set to NULL before ff_refstruct_unref() is called. Signed-off-by: Hyunho Kim <hh3.kim(a)hanwha.com> --- libavcodec/qsv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/qsv.c b/libavcodec/qsv.c index 8a3dc95706..d8ddf85392 100644 --- a/libavcodec/qsv.c +++ b/libavcodec/qsv.c @@ -1133,13 +1133,13 @@ int ff_qsv_init_session_frames(AVCodecContext *avctx, mfxSession *psession, return ret; if (!opaque) { + /* clean up the exist mids */ + ff_refstruct_unref(&qsv_frames_ctx->mids); qsv_frames_ctx->logctx = avctx; - qsv_frames_ctx->mids = NULL; qsv_frames_ctx->nb_mids = 0; /* allocate the memory ids for the external frames */ if (frames_hwctx->nb_surfaces) { - ff_refstruct_unref(&qsv_frames_ctx->mids); qsv_frames_ctx->mids = qsv_create_mids(qsv_frames_ctx->hw_frames_ctx); if (!qsv_frames_ctx->mids) return AVERROR(ENOMEM); -- 2.48.1.windows.1

2 1

[RFC] mailing list From mangling and bounces and DMARC
by Michael Niedermayer 21 Nov '25

21 Nov '25

Hi everyone As we all certainly know, this ML since a few months rewrites all "From:" headers to "X Y via ffmpeg-devel <ffmpeg-devel(a)ffmpeg.org>" We changed this because neither me nor timo nor rather unhelpfull AI could fix the bounce & dmarc issue 33 @outlook and 19 @hotmail subscribers got deleted on october 8th because their accounts where disabled from earlier bounces and they did not re-enable their accounts. Other mailing lists from other projects seem to survive without universal rewriting. Should we try to switch this list back to only rewrite the addresses that need it ? mailman3 has a list where we can manually add domains which need it hotmail.com and outlook.com both have a DMARC policy of none so they would not automatically fall under DMARC mitigations and it seems noone added them to the mailman3 list nor was outlook in the postfix list we had from mailman2 days Both me and timo want to try reducing the from rewriting again. We seem to disagree a bit on if we try with the mailman3 manual DMARC list empty first or starting with outlook and all entries from the sender_canonical rewrite list. Are there any people reading this, who have some information / experiencees they can share about mailman3 DMARC settings ? (so we can benefit of your experience and can skip some trial and error :) What do people think ? any other thing we are missing ? PS: we now have a DMARC setup, ARC signing and mailman3 thx -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Modern terrorism, a quick summary: Need oil, start war with country that has oil, kill hundread thousand in war. Let country fall into chaos, be surprised about raise of fundamantalists. Drop more bombs, kill more people, be surprised about them taking revenge and drop even more bombs and strip your own citizens of their rights and freedoms. to be continued

3 6

[RFC] Funded Task Ideas
by Michael Niedermayer 19 Nov '25

19 Nov '25

Hi Everyone As we are now looking for sponsors, we also should look for tasks to fund. I suggest, we first do some brainstorming and make a list, and then figure out which tasks we want to sponsor (or maybe someone wants to do one as a volunteer) Heres some random ideas from me /mostly things for which i am not able to find the time ATM (that is, iam happy if someone else does these) please add your ideas. * cherry pick the remaining codecs and demuxers from almpeg * cleanup new tickets on trac (aka close (invalid/needs more info/fixed) or open * do something about the difference between mitre and our CVE list (that is go over the output from tools/compare-cvelists.sh) * do we have any bugs or feature requests that have alot of votes on them ? thx PS: once we have enough yearly income we can look at hiring / funding people fulltime. -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Elect your leaders based on what they did after the last election, not based on what they say before an election.

8 25

[PATCH] avformat/whip: Fix rtp_ctx->streams access (PR #20805)
by michaelni 16 Nov '25

16 Nov '25

PR #20805 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20805 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20805.patch Fixes: out of array access No testcase Found-by: Joshua Rogers <joshua(a)joshua.hu> with ZeroPath Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From e01eb935a6b919d0bc4361e30a0ab00ff01783af Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Fri, 31 Oct 2025 18:00:11 +0100 Subject: [PATCH] avformat/whip: Fix rtp_ctx->streams access Fixes: out of array access No testcase Found-by: Joshua Rogers <joshua(a)joshua.hu> with ZeroPath Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/whip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/whip.c b/libavformat/whip.c index a11fffb9c6..6a9b208f69 100644 --- a/libavformat/whip.c +++ b/libavformat/whip.c @@ -1592,8 +1592,8 @@ static int create_rtp_muxer(AVFormatContext *s) * therefore, we deactivate the extradata detection for the RTP muxer. */ if (s->streams[i]->codecpar->codec_id == AV_CODEC_ID_H264) { - av_freep(&rtp_ctx->streams[i]->codecpar->extradata); - rtp_ctx->streams[i]->codecpar->extradata_size = 0; + av_freep(&rtp_ctx->streams[0]->codecpar->extradata); + rtp_ctx->streams[0]->codecpar->extradata_size = 0; } buffer = av_malloc(buffer_size); -- 2.49.1

4 3

[PATCH] avformat/webvttdec: improve WebVTT parsing
by Marcos Del Sol Vives 11 Nov '25

11 Nov '25

The parser will now strictly check if WebVTT files start with the correct "WEBVTT" marker. Before, files were not checked if they truly started with it. It will also now ignore all non-cue blocks, instead of only a hardcoded list. This is closer to the specification that calls for no action if unknown blocks are encountered. Signed-off-by: Marcos Del Sol Vives <marcos(a)orca.pet> --- libavformat/webvttdec.c | 178 ++++++++++++++++++++++------------------ 1 file changed, 98 insertions(+), 80 deletions(-) diff --git a/libavformat/webvttdec.c b/libavformat/webvttdec.c index 6feda1585e..b454b2c1cf 100644 --- a/libavformat/webvttdec.c +++ b/libavformat/webvttdec.c @@ -58,6 +58,79 @@ static int64_t read_ts(const char *s) return AV_NOPTS_VALUE; } +static int webvtt_parse_cue(WebVTTContext *webvtt, AVBPrint *cue, int64_t pos) +{ + int i; + AVPacket *sub; + const char *p, *identifier, *settings; + size_t identifier_len, settings_len; + int64_t ts_start, ts_end; + + p = identifier = cue->str; + + /* optional cue identifier (can be a number like in SRT or some kind of + * chaptering id) */ + for (i = 0; p[i] && p[i] != '\n' && p[i] != '\r'; i++) { + if (!strncmp(p + i, "-->", 3)) { + identifier = NULL; + break; + } + } + if (!identifier) + identifier_len = 0; + else { + identifier_len = strcspn(p, "\r\n"); + p += identifier_len; + if (*p == '\r') + p++; + if (*p == '\n') + p++; + } + + /* cue timestamps */ + if ((ts_start = read_ts(p)) == AV_NOPTS_VALUE) + return AVERROR_INVALIDDATA; + if (!(p = strstr(p, "-->"))) + return AVERROR_INVALIDDATA; + p += 2; + do p++; while (*p == ' ' || *p == '\t'); + if ((ts_end = read_ts(p)) == AV_NOPTS_VALUE) + return AVERROR_INVALIDDATA; + + /* optional cue settings */ + p += strcspn(p, "\n\r\t "); + while (*p == '\t' || *p == ' ') + p++; + settings = p; + settings_len = strcspn(p, "\r\n"); + p += settings_len; + if (*p == '\r') + p++; + if (*p == '\n') + p++; + + /* create packet */ + sub = ff_subtitles_queue_insert(&webvtt->q, p, strlen(p), 0); + if (!sub) + return AVERROR(ENOMEM); + sub->pos = pos; + sub->pts = ts_start; + sub->duration = ts_end - ts_start; + +#define SET_SIDE_DATA(name, type) do { \ + if (name##_len) { \ + uint8_t *buf = av_packet_new_side_data(sub, type, name##_len); \ + if (!buf) \ + return AVERROR(ENOMEM); \ + memcpy(buf, name, name##_len); \ + } \ +} while (0) + + SET_SIDE_DATA(identifier, AV_PKT_DATA_WEBVTT_IDENTIFIER); + SET_SIDE_DATA(settings, AV_PKT_DATA_WEBVTT_SETTINGS); + return 0; +} + static int webvtt_read_header(AVFormatContext *s) { WebVTTContext *webvtt = s->priv_data; @@ -74,13 +147,27 @@ static int webvtt_read_header(AVFormatContext *s) av_bprint_init(&cue, 0, AV_BPRINT_SIZE_UNLIMITED); + res = ff_subtitles_read_chunk(s->pb, &cue); + if (res < 0) { + av_log(s, AV_LOG_ERROR, "Unable to read file header\n"); + goto end; + } + + if (!cue.len) { + av_log(s, AV_LOG_ERROR, "Unable to read file header\n"); + res = AVERROR_EOF; + goto end; + } + + if (!strncmp(cue.str, "\xEF\xBB\xBFWEBVTT", 9) && + !strncmp(cue.str, "WEBVTT", 6)) { + av_log(s, AV_LOG_ERROR, "Invalid file header\n"); + res = AVERROR_INVALIDDATA; + goto end; + } + for (;;) { - int i; - int64_t pos; - AVPacket *sub; - const char *p, *identifier, *settings; - size_t identifier_len, settings_len; - int64_t ts_start, ts_end; + int64_t pos = avio_tell(s->pb); res = ff_subtitles_read_chunk(s->pb, &cue); if (res < 0) @@ -89,81 +176,12 @@ static int webvtt_read_header(AVFormatContext *s) if (!cue.len) break; - p = identifier = cue.str; - pos = avio_tell(s->pb); - - /* ignore header chunk */ - if (!strncmp(p, "\xEF\xBB\xBFWEBVTT", 9) || - !strncmp(p, "WEBVTT", 6) || - !strncmp(p, "STYLE", 5) || - !strncmp(p, "REGION", 6) || - !strncmp(p, "NOTE", 4)) - continue; - - /* optional cue identifier (can be a number like in SRT or some kind of - * chaptering id) */ - for (i = 0; p[i] && p[i] != '\n' && p[i] != '\r'; i++) { - if (!strncmp(p + i, "-->", 3)) { - identifier = NULL; - break; - } - } - if (!identifier) - identifier_len = 0; - else { - identifier_len = strcspn(p, "\r\n"); - p += identifier_len; - if (*p == '\r') - p++; - if (*p == '\n') - p++; + res = webvtt_parse_cue(webvtt, &cue, pos); + if (res < 0) { + if (res != AVERROR_INVALIDDATA) + goto end; + av_log(s, AV_LOG_DEBUG, "Ignoring non-cue block at 0x%"PRIx64"\n", pos); } - - /* cue timestamps */ - if ((ts_start = read_ts(p)) == AV_NOPTS_VALUE) - break; - if (!(p = strstr(p, "-->"))) - break; - p += 2; - do p++; while (*p == ' ' || *p == '\t'); - if ((ts_end = read_ts(p)) == AV_NOPTS_VALUE) - break; - - /* optional cue settings */ - p += strcspn(p, "\n\r\t "); - while (*p == '\t' || *p == ' ') - p++; - settings = p; - settings_len = strcspn(p, "\r\n"); - p += settings_len; - if (*p == '\r') - p++; - if (*p == '\n') - p++; - - /* create packet */ - sub = ff_subtitles_queue_insert(&webvtt->q, p, strlen(p), 0); - if (!sub) { - res = AVERROR(ENOMEM); - goto end; - } - sub->pos = pos; - sub->pts = ts_start; - sub->duration = ts_end - ts_start; - -#define SET_SIDE_DATA(name, type) do { \ - if (name##_len) { \ - uint8_t *buf = av_packet_new_side_data(sub, type, name##_len); \ - if (!buf) { \ - res = AVERROR(ENOMEM); \ - goto end; \ - } \ - memcpy(buf, name, name##_len); \ - } \ -} while (0) - - SET_SIDE_DATA(identifier, AV_PKT_DATA_WEBVTT_IDENTIFIER); - SET_SIDE_DATA(settings, AV_PKT_DATA_WEBVTT_SETTINGS); } ff_subtitles_queue_finalize(s, &webvtt->q); -- 2.34.1

4 12

[PATCH 1/5] avformat/flvdec: Check for EOF in AudioPacketTypeMultichannelConfig
by Michael Niedermayer 08 Nov '25

08 Nov '25

Fixes: Infinite loop Fixes: 427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-6582567304495104 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/flvdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index ac681954cb7..a4fa0157512 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -1715,6 +1715,9 @@ retry_duration: av_log(s, AV_LOG_DEBUG, "Set channel data from MultiChannel info.\n"); + if (avio_feof(s->pb)) + return AVERROR_EOF; + goto next_track; } } else if (stream_type == FLV_STREAM_TYPE_VIDEO) { -- 2.49.0

6 21

[POLL][VOTE] Revoke social media delegation
by Michael Niedermayer 02 Nov '25

02 Nov '25

Hi Everyone As requested, reposting this, as a new thread For context please see: https://www.youtube.com/watch?v=3VkcAvqV24c https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/thread/PZL3N… Subject: Twitter/X spat on Youtube Should the delegation, from where this came from, be revoked to FFmpeg social media? (vote ends in 7 days) Please reply on ffmpeg-devel with your choice: [R] revoke access [K] keep access thx -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Avoid a single point of failure, be that a person or equipment.

16 33

mailman3 ffmpeg-devel-owner bounce mitigation
by Michael Niedermayer 01 Nov '25

01 Nov '25

Hi all I think ive finally found a way to fix the ffmpeg-devel-owners from being unsubscribed/disabled due to spam bounces Let me first explain what the problem is, then how we solved it. The problem: 1. spam hits ffmpeg-devel-owners 2. our spam filters remove alot but not all spam 3. spam to ffmpeg-devel-owners is processed my mailman3 4. mailman3 forwards the spam to all the people on ffmpeg-devel-owners 5. some of this spam bounces because it is spam 6. the bounce is now indistingishable from a ffmpeg-devel subscriber 7. the bounce hits our server and is routed to mailman 8. mailman3 increases the bouce score for the address that bounced the spam (if theres a matching subscriber) 9. once the bouce score reaches the threshold the person has his subscription disabled 10. If you followed along, you will realize that mailman now disabled an account but that account was never involved in the bounce mailman2 did not have this issue What we tried: 1. Improve spam filtering, we did not run *-owner through all our spam filters, now we do, but its not enough. future plan here is to install rspamd 2. verp_probes = yes & probe_add_dsn: no This should prevent primary bounces from disabling accounts by having a final test message send (which should ideally not bounce as spam) sadly these seem to be able to bounce too 3. postfix we simply handle the ffmpeg-devel-owner in postfix now and now as mailman doesnt forward it, the return address is distinct from mailing list subscriber mail and thus any bounces from owners dont get counted as subscriber bounces. ATM this is used only for ffmpeg-devel-owner, i intend to enable the same thing for other mailing lists what this also means, you can now again subscribe with the same mail address to the list as used in ffmpeg-devel-owner without being unsubscribed/disabled due to ffmpeg-devel-owner bounces. Of course bounces from normal mailing list mail still can get your account disabled. thx -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB If you fake or manipulate statistics in a paper in physics you will never get a job again. If you fake or manipulate statistics in a paper in medicin you will get a job for life at the pharma industry.

2 3