July 2025 - ffmpeg-devel - lists.ffmpeg.org

[PATCH 0/2] Support the new APMP boxes and spherical metadata
by Vittorio Giovara 29 Jul '25

29 Jul '25

This patchset adds new boxes and projection values from from https://developer.apple.com/av-foundation/Stereo-Video-ISOBMFF-Extensions.p… Vittorio Giovara (2): mov: Export frame packing information from pack box lavu/spherical: Add support for Spherical Immersive type libavformat/mov.c | 89 +++++++++++++++++++++++++++++++++++++++++++ libavutil/spherical.c | 1 + libavutil/spherical.h | 6 +++ 3 files changed, 96 insertions(+)

2 2

[PATCH] libavfilter/vf_scale_npp: fix yuva420p -> yuv420p conversion
by Jorge Estrada 28 Jul '25

28 Jul '25

When converting from yuva420p to yuv420p the resize loop would try to access an output plane that did not exist. Added a check for the output planes existence. Example cmd: ffmpeg -hwaccel cuda -hwaccel_output_format cuda -i example.mp4 -vf scale_npp=format=yuva420p,scale_npp=format=yuv420p -c:v h264_nvenc -f null - Signed-off-by: Jorge Estrada <jestrada.list(a)gmail.com> --- libavfilter/vf_scale_npp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_scale_npp.c b/libavfilter/vf_scale_npp.c index 1b1b7b9fc9..5387bf9c7a 100644 --- a/libavfilter/vf_scale_npp.c +++ b/libavfilter/vf_scale_npp.c @@ -721,7 +721,7 @@ static int nppscale_resize(AVFilterContext *ctx, NPPScaleStageContext *stage, NppStatus err; int i; - for (i = 0; i < FF_ARRAY_ELEMS(stage->planes_in) && i < FF_ARRAY_ELEMS(in->data) && in->data[i]; i++) { + for (i = 0; i < FF_ARRAY_ELEMS(stage->planes_in) && i < FF_ARRAY_ELEMS(in->data) && in->data[i] && out->data[i]; i++) { int iw = stage->planes_in[i].width; int ih = stage->planes_in[i].height; int ow = stage->planes_out[i].width; -- 2.34.1

1 1

[PATCH v3 1/2] lavc/vvc: Don't discard palette_subblock_data return code
by Frank Plowman 28 Jul '25

28 Jul '25

Signed-off-by: Frank Plowman <post(a)frankplowman.com> --- libavcodec/vvc/ctu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/vvc/ctu.c b/libavcodec/vvc/ctu.c index cf7edccb8b..35c18e78f6 100644 --- a/libavcodec/vvc/ctu.c +++ b/libavcodec/vvc/ctu.c @@ -2118,9 +2118,12 @@ static int hls_palette_coding(VVCLocalContext *lc, const VVCTreeType tree_type) palette_qp(lc, tree_type, escape_present); index[0] = 0; - for (int i = 0; i <= (cu->cb_width * cu->cb_height - 1) >> 4; i++) - palette_subblock_data(lc, max_index, i, transpose, + for (int i = 0; i <= (cu->cb_width * cu->cb_height - 1) >> 4; i++) { + ret = palette_subblock_data(lc, max_index, i, transpose, run_type, index, &prev_run_pos, &adjust); + if (ret < 0) + return ret; + } return 0; } -- 2.47.0

2 3

[PATCH 1/4] avformat/iamf_parse: Check extradata size
by Michael Niedermayer 28 Jul '25

28 Jul '25

Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406 Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/iamf_parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 71497876ac3..330e01733dd 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -305,6 +305,8 @@ static int update_extradata(AVCodecParameters *codecpar) skip_bits(&gb, 4); put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config ret = put_bits_left(&pb); + if (ret < 0) + return AVERROR_INVALIDDATA; while (ret >= 32) { put_bits32(&pb, get_bits_long(&gb, 32)); ret -= 32; -- 2.49.0

4 16

[PATCH 1/3] avcodec/shorten: Clear the additionally allocated space on realloc
by Michael Niedermayer 28 Jul '25

28 Jul '25

Fixes: use of uninitialized memory Fixes: 421954767/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-515682786246656 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/shorten.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index ad2e7588d69..bed92936801 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -584,7 +584,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame, if (avpkt->size) { int max_framesize = s->blocksize * s->channels * 8; void *tmp_ptr; - + unsigned old_allocated_bitstream_size = s->allocated_bitstream_size; tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, max_framesize + AV_INPUT_BUFFER_PADDING_SIZE); if (!tmp_ptr) { @@ -592,9 +592,8 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame, return AVERROR(ENOMEM); } s->bitstream = tmp_ptr; - if (max_framesize > s->max_framesize) - memset(s->bitstream + s->max_framesize, 0, (max_framesize - s->max_framesize) + - AV_INPUT_BUFFER_PADDING_SIZE); + if (s->allocated_bitstream_size > old_allocated_bitstream_size) + memset(s->bitstream + old_allocated_bitstream_size, 0, s->allocated_bitstream_size - old_allocated_bitstream_size); s->max_framesize = FFMAX(s->max_framesize, max_framesize); *got_frame_ptr = 0; goto finish_frame; -- 2.50.1

1 3

[PATCH 1/4] avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation
by Michael Niedermayer 28 Jul '25

28 Jul '25

Fixes: use of uninitialized memory Fixes: 378102648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5896308499480576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/hevc/hevcdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 21ecf063c5a..53aa8d60ff4 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -152,10 +152,10 @@ static int pic_arrays_init(HEVCLayerContext *l, const HEVCSPS *sps) int w = sps->width >> sps->hshift[c_idx]; int h = sps->height >> sps->vshift[c_idx]; l->sao_pixel_buffer_h[c_idx] = - av_malloc((w * 2 * sps->ctb_height) << + av_mallocz((w * 2 * sps->ctb_height) << sps->pixel_shift); l->sao_pixel_buffer_v[c_idx] = - av_malloc((h * 2 * sps->ctb_width) << + av_mallocz((h * 2 * sps->ctb_width) << sps->pixel_shift); if (!l->sao_pixel_buffer_h[c_idx] || !l->sao_pixel_buffer_v[c_idx]) -- 2.50.1

3 7

[PATCH] avformat/asfdec_f: Check amount of value read
by Michael Niedermayer 28 Jul '25

28 Jul '25

Fixes: use of uninitialized memory Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/asfdec_f.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index ea6e8ef4f3a..10f5dea57c3 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -241,7 +241,9 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int avio_get_str16le(s->pb, len, value, 2 * len + 1); break; case -1: // ASCI - avio_read(s->pb, value, len); + ;int ret = ffio_read_size(s->pb, value, len); + if (ret < 0) + goto finish; value[len]=0; break; case ASF_BYTE_ARRAY: -- 2.49.0

2 4

[PATCH 1/2] avcodec/alsdec: Allow the user to set a maximum prediction order
by Michael Niedermayer 28 Jul '25

28 Jul '25

The only offical profile i could find (ALS simple profile) has a max of 15 while the bitstream allows 1023 which is very slow. We do have a fate sample with 1023 Fixes: Timeout Fixes: 429645375/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5377900448907264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/alsdec.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 97b04a95f96..231d4ce52d6 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -38,6 +38,7 @@ #include "internal.h" #include "mlz.h" #include "libavutil/mem.h" +#include "libavutil/opt.h" #include "libavutil/samplefmt.h" #include "libavutil/crc.h" #include "libavutil/softfloat_ieee754.h" @@ -194,6 +195,7 @@ typedef struct ALSChannelData { typedef struct ALSDecContext { + AVClass *av_class; AVCodecContext *avctx; ALSSpecificConfig sconf; GetBitContext gb; @@ -239,6 +241,7 @@ typedef struct ALSDecContext { unsigned char *larray; ///< buffer to store the output of masked lz decompression int *nbits; ///< contains the number of bits to read for masked lz decompression for all samples int highest_decoded_channel; + int user_max_order; ///< user specified maximum prediction order } ALSDecContext; @@ -352,6 +355,11 @@ static av_cold int read_specific_config(ALSDecContext *ctx) skip_bits(&gb, 5); // skip 5 reserved bits skip_bits1(&gb); // skip aux_data_enabled + if (sconf->max_order > ctx->user_max_order) { + av_log(avctx, AV_LOG_ERROR, "order %d exceeds specified max %d\n", sconf->max_order, ctx->user_max_order); + return AVERROR_INVALIDDATA; + } + // check for ALSSpecificConfig struct if (als_id != MKBETAG('A','L','S','\0')) @@ -2183,6 +2191,17 @@ static av_cold void flush(AVCodecContext *avctx) ctx->frame_id = 0; } +static const AVOption options[] = { + { "max_order", "Sets the maximum order (ALS simple profile allows max 15)", offsetof(ALSDecContext, user_max_order), AV_OPT_TYPE_INT, { .i64 = 1023 }, 0, 1023, AV_OPT_FLAG_AUDIO_PARAM | AV_OPT_FLAG_DECODING_PARAM }, + { NULL } +}; + +static const AVClass als_class = { + .class_name = "als", + .item_name = av_default_item_name, + .option = options, + .version = LIBAVUTIL_VERSION_INT, +}; const FFCodec ff_als_decoder = { .p.name = "als", @@ -2193,6 +2212,7 @@ const FFCodec ff_als_decoder = { .init = decode_init, .close = decode_end, FF_CODEC_DECODE_CB(decode_frame), + .p.priv_class = &als_class, .flush = flush, .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_CHANNEL_CONF, .caps_internal = FF_CODEC_CAP_INIT_CLEANUP, -- 2.49.0

1 2

[PATCH] avformat/hlsenc: limit segments count to search duplicated segments filenames
by Artem Smorodin 28 Jul '25

28 Jul '25

This linear search has a complexity of O(n). When ffmpeg attempts to parse a playlist containing approximately 100,000 segments, it effectively causes a hang for several minutes. This patch limits the allowed size for duplicate searches to a reasonable value. Now it takes between 0.5 and a few seconds (tested on different devices) instead of several minutes. Signed-off-by: Artem Smorodin <artem.smorodin(a)dacast.com> --- libavformat/hlsenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index a93d35ab75..d3db83093c 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -1172,7 +1172,7 @@ static int hls_append_segment(struct AVFormatContext *s, HLSContext *hls, if (hls->use_localtime_mkdir) { filename = vs->avf->url; } - if ((find_segment_by_filename(vs->segments, filename) || find_segment_by_filename(vs->old_segments, filename)) + if (vs->nb_entries <= 5000 && (find_segment_by_filename(vs->segments, filename) || find_segment_by_filename(vs->old_segments, filename)) && !byterange_mode) { av_log(hls, AV_LOG_WARNING, "Duplicated segment filename detected: %s\n", filename); } -- 2.43.0

2 1

[PATCH 0/1] avformat/movenc: fix HEVC fmp4 HLS init segment for Apple playback
by David McElroy 28 Jul '25

28 Jul '25

Hi FFmpeg developers, This patch fixes a bug that makes HEVC fmp4 HLS streams generated by FFmpeg unplayable on all Apple platforms (macOS/iOS Safari, QuickTime, etc.). The issue is a malformed init segment, as detailed in the commit message. A similar patch was proposed in November 2023 by Jay Zhang, but it was never merged. https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2023-November/317173.html **To Reproduce the Bug:** You can generate a problematic HLS init segment using a command like this on the current master branch: $ ffmpeg -i ../BigBuckBunny_short.mp4 -c:v libx265 -f hls -hls_segment_type fmp4 playlist.m3u8 **Sample Files:** To make review easier, I've uploaded two sample streams produced with that command from that file from latest master (commit 9c9b41b) with and without the patch applied: - Source file: https://david.mcelroy.online/ffmpegbug/examples/BigBuckBunny_short.mp4 - Broken stream (from master): https://david.mcelroy.online/ffmpegbug/examples/9c9b41b/playlist.m3u8 - Fixed stream (with this patch): https://david.mcelroy.online/ffmpegbug/examples/patched/playlist.m3u8 These links can be loaded directly in Safari to see the playback issue. - Broken init segment (from master): https://david.mcelroy.online/ffmpegbug/examples/9c9b41b/init.mp4 - Fixed init segment (with this patch): https://david.mcelroy.online/ffmpegbug/examples/patched/init.mp4 You may also note that when selected in Finder, the broken init segment fails to be recognized as HEVC video, while the fixed one is recognized correctly. I also ran `make fate` to ensure no regressions were introduced and all tests passed. The commit contains the full technical details of the fix. Thanks, David McElroy David McElroy (1): avformat/movenc: fix HEVC fmp4 HLS init segment for Apple playback libavformat/movenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2