June 2026 - ffmpeg-devel - lists.ffmpeg.org

[PR] avcodec/mace: reject sample counts that overflow int (PR #23631)
by michaelni 28 Jun '26

28 Jun '26

PR #23631 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631.patch Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 0e1e457a7e675e06d82a36a61f7b6adfeef469a2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Mon, 29 Jun 2026 01:16:44 +0200 Subject: [PATCH] avcodec/mace: reject sample counts that overflow int Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/mace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/mace.c b/libavcodec/mace.c index 299e5f5cfe..87e802684a 100644 --- a/libavcodec/mace.c +++ b/libavcodec/mace.c @@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame, } /* get output buffer */ - frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels; + int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels; + if (nb_samples > INT_MAX) + return AVERROR_INVALIDDATA; + frame->nb_samples = nb_samples; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; samples = (int16_t **)frame->extended_data; -- 2.52.0

1 0

[PR] avcodec/riscv/flacdsp: guard the LPC loops against len <= pred_order (PR #23630)
by michaelni 28 Jun '26

28 Jun '26

PR #23630 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23630 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23630.patch Fixes: out of array write Fixes: nxPpr3NozEXk Fixes: ca664f2254 (lavc/flacdsp: R-V V LPC16 function) Found-by: Clouditera Security, Z.ai Security, NSFOCUS Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 9e3f64d474f8bc6fb18a6bbb457b39c04b09101a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 23:05:56 +0200 Subject: [PATCH] avcodec/riscv/flacdsp: guard the LPC loops against len <= pred_order Fixes: out of array write Fixes: nxPpr3NozEXk Fixes: ca664f2254 (lavc/flacdsp: R-V V LPC16 function) Found-by: Clouditera Security, Z.ai Security, NSFOCUS Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/riscv/flacdsp_rvv.S | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/riscv/flacdsp_rvv.S b/libavcodec/riscv/flacdsp_rvv.S index a927f188d3..e24ecbeddd 100644 --- a/libavcodec/riscv/flacdsp_rvv.S +++ b/libavcodec/riscv/flacdsp_rvv.S @@ -26,6 +26,7 @@ func ff_flac_lpc16_rvv, zve32x, b vsetvl zero, a2, t0 vle32.v v8, (a1) sub a4, a4, a2 + blez a4, 2f vle32.v v16, (a0) sh2add a0, a2, a0 vmv.s.x v0, zero @@ -42,6 +43,7 @@ func ff_flac_lpc16_rvv, zve32x, b addi a0, a0, 4 bnez a4, 1b +2: ret endfunc @@ -55,6 +57,7 @@ func ff_flac_lpc32_rvv, zve64x, zba vsetvli zero, a2, e32, m8, ta, ma vle32.v v8, (a1) sub a4, a4, a2 + blez a4, 2f vle32.v v16, (a0) sh2add a0, a2, a0 1: @@ -75,6 +78,7 @@ func ff_flac_lpc32_rvv, zve64x, zba addi a0, a0, 4 bnez a4, 1b +2: ret endfunc @@ -87,6 +91,7 @@ func ff_flac_lpc32_rvv_simple, zve64x, b vsetvl zero, zero, t2 // e32 vle32.v v8, (a1) sub a4, a4, a2 + blez a4, 2f vle32.v v16, (a0) sh2add a0, a2, a0 1: @@ -104,6 +109,7 @@ func ff_flac_lpc32_rvv_simple, zve64x, b addi a0, a0, 4 bnez a4, 1b +2: ret endfunc @@ -115,6 +121,7 @@ func ff_flac_lpc33_rvv, zve64x, b sh2add a1, a3, a1 vle32.v v24, (a2) sub a5, a5, a3 + blez a5, 2f vle64.v v16, (a0) sh3add a0, a3, a0 vsext.vf2 v8, v24 @@ -132,6 +139,7 @@ func ff_flac_lpc33_rvv, zve64x, b addi a0, a0, 8 bnez a5, 1b +2: ret endfunc #endif -- 2.52.0

1 0

[PR] avcodec/apac: Check bitstream_size to avoid integer overflow (PR #23629)
by michaelni 28 Jun '26

28 Jun '26

PR #23629 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23629 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23629.patch Found-by: k00shi_ Fixes: OOM Fixes: poc.c Fixes: XMkAe1I9uFro From 2a150688cce392e65fea87371effb879ebd2a98a Mon Sep 17 00:00:00 2001 From: Anxious Koisi <ddoaoing(a)gmail.com> Date: Sun, 28 Jun 2026 23:03:25 +0200 Subject: [PATCH] avcodec/apac: Check bitstream_size to avoid integer overflow Found-by: k00shi_ Fixes: OOM Fixes: poc.c Fixes: XMkAe1I9uFro --- libavcodec/apac.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/apac.c b/libavcodec/apac.c index 00e48e7635..ea3b93359d 100644 --- a/libavcodec/apac.c +++ b/libavcodec/apac.c @@ -140,6 +140,9 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame, buf_size = pkt->size; input_buf_size = buf_size; + if ((int64_t)s->bitstream_size + buf_size > INT_MAX / (16 * 8)) + return AVERROR_INVALIDDATA; + if (s->bitstream_index > 0 && s->bitstream_size > 0) { memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size); s->bitstream_index = 0; -- 2.52.0

1 0

[PR] avcodec/rasc: Check that 32-bit DLTA accesses stay within the row (PR #23628)
by michaelni 28 Jun '26

28 Jun '26

PR #23628 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23628 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23628.patch Found-by: bikini (github.com/bikini/exploitarium) Fixes: out of array access Fixes: rowspill_128x1.avi / gen_rowspill_avi.py Fixes: xGV79bIb7uAJ From 7ae64dba3c5ee27e63efe5958d20d96f6f03da9b Mon Sep 17 00:00:00 2001 From: Umar Pathan <hello(a)umar.ac> Date: Sun, 28 Jun 2026 23:02:52 +0200 Subject: [PATCH] avcodec/rasc: Check that 32-bit DLTA accesses stay within the row Found-by: bikini (github.com/bikini/exploitarium) Fixes: out of array access Fixes: rowspill_128x1.avi / gen_rowspill_avi.py Fixes: xGV79bIb7uAJ --- libavcodec/rasc.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c index 5f956a9b2c..d784a44063 100644 --- a/libavcodec/rasc.c +++ b/libavcodec/rasc.c @@ -320,6 +320,11 @@ static int decode_move(AVCodecContext *avctx, return 0; } +static inline int dlta_room(unsigned cx, unsigned w, unsigned bpp, unsigned need) +{ + return cx + need <= w * bpp; +} + #define NEXT_LINE \ if (cx >= w * s->bpp) { \ cx = 0; \ @@ -418,6 +423,8 @@ static int decode_dlta(AVCodecContext *avctx, case 4: fill = bytestream2_get_byte(&dc); while (len > 0 && cy > 0) { + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx++; @@ -427,6 +434,8 @@ static int decode_dlta(AVCodecContext *avctx, case 7: fill = bytestream2_get_le32(&dc); while (len > 0 && cy > 0) { + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx += 4; @@ -443,6 +452,8 @@ static int decode_dlta(AVCodecContext *avctx, while (len > 0 && cy > 0) { unsigned v0, v1; + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; v0 = AV_RL32(b2 + cx); v1 = AV_RL32(b1 + cx); AV_WL32(b2 + cx, v1); @@ -454,6 +465,8 @@ static int decode_dlta(AVCodecContext *avctx, case 13: while (len > 0 && cy > 0) { fill = bytestream2_get_le32(&dc); + if (!dlta_room(cx, w, s->bpp, 4)) + return AVERROR_INVALIDDATA; AV_WL32(b1 + cx, AV_RL32(b2 + cx)); AV_WL32(b2 + cx, fill); cx += 4; -- 2.52.0

1 0

[PR] avformat/iamf_parse: check count_label against the available bytes (PR #23627)
by michaelni 28 Jun '26

28 Jun '26

PR #23627 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627.patch Fixes: unbounded allocation / denial of service Fixes: tP59h4cpaFyg Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 27be9b85ef97be80f2c5924ce59a206e08a5745b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 22:05:28 +0200 Subject: [PATCH] avformat/iamf_parse: check count_label against the available bytes Fixes: unbounded allocation / denial of service Fixes: tP59h4cpaFyg Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/iamf_parse.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index d74a8677d6..4c2df2c9e6 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -1009,6 +1009,11 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le mix_presentation->cmix = mix; mix_presentation->count_label = ffio_read_leb(pbc); + if (mix_presentation->count_label > len - avio_tell(pbc)) { + mix_presentation->count_label = 0; + ret = AVERROR_INVALIDDATA; + goto fail; + } mix_presentation->language_label = av_calloc(mix_presentation->count_label, sizeof(*mix_presentation->language_label)); if (!mix_presentation->language_label) { -- 2.52.0

1 0

[PR] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure (PR #23626)
by michaelni 28 Jun '26

28 Jun '26

PR #23626 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626.patch Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 4e5c0df681ef9284f55d91dc488d5a3a35d02405 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 19:04:07 +0200 Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/lcldec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index 29b1d85be3..5023243017 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -120,6 +120,9 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign } } + if (destptr < destptr_end) + memset(destptr, 0, destptr_end - destptr); + return destptr - destptr_bak; } @@ -153,8 +156,11 @@ static int zlib_decomp(AVCodecContext *avctx, const uint8_t *src, int src_len, i if (expected != (unsigned int)zstream->total_out) { av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n", expected, zstream->total_out); - if (expected > (unsigned int)zstream->total_out) + if (expected > (unsigned int)zstream->total_out) { + memset(c->decomp_buf + offset + zstream->total_out, 0, + c->decomp_size - offset - zstream->total_out); return (unsigned int)zstream->total_out; + } return AVERROR_UNKNOWN; } return zstream->total_out; -- 2.52.0

1 0

[PR] avfilter/vf_quirc: resize the quirc buffers when the input size changes (PR #23625)
by michaelni 28 Jun '26

28 Jun '26

PR #23625 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625.patch Fixes: out of array access Fixes: JbvzNObhorBp Fixes: 030e140145 (lavfi: add quirc filter) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 4dc1be7e18b45c764cfa82e1601d718a006feb5a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 15:33:38 +0200 Subject: [PATCH] avfilter/vf_quirc: resize the quirc buffers when the input size changes Fixes: out of array access Fixes: JbvzNObhorBp Fixes: 030e140145 (lavfi: add quirc filter) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavfilter/vf_quirc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavfilter/vf_quirc.c b/libavfilter/vf_quirc.c index 59dc84caa8..d2ba48e7bc 100644 --- a/libavfilter/vf_quirc.c +++ b/libavfilter/vf_quirc.c @@ -36,6 +36,7 @@ typedef struct QuircContext { const AVClass *class; struct quirc *quirc; + int width, height; } QuircContext; static av_cold int init(AVFilterContext *ctx) @@ -67,6 +68,8 @@ static int config_input(AVFilterLink *inlink) if (err == -1) { return AVERROR(ENOMEM); } + quirc->width = inlink->w; + quirc->height = inlink->h; return 0; } @@ -80,6 +83,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame) int codes_count; uint8_t *image; + if (quirc->width != inlink->w || quirc->height != inlink->h) { + if (quirc_resize(quirc->quirc, inlink->w, inlink->h) < 0) { + av_frame_free(&frame); + return AVERROR(ENOMEM); + } + quirc->width = inlink->w; + quirc->height = inlink->h; + } + /* copy input image to quirc buffer */ image = quirc_begin(quirc->quirc, NULL, NULL); av_image_copy_plane(image, inlink->w, -- 2.52.0

1 0

[PR] fftools/ffmpeg_demux: fix -readrate on badly interleaved files (PR #23624)
by Niklas Haas 28 Jun '26

28 Jun '26

PR #23624 opened by Niklas Haas (haasn) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23624 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23624.patch Reproduce: ``` $ make && ./ffmpeg_g -re -i fallbeatcaptiontest.mp4 -c copy -f null -t 10 - [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.512 with rate 1.050 after a lag of 0.488s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 1.000 with rate 1.050 after a lag of 0.306s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.981 with rate 1.050 after a lag of 0.802s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.981 with rate 1.050 after a lag of 1.120s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 2.000 with rate 1.050 after a lag of 0.610s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 2.000 with rate 1.050 after a lag of 0.915s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 1.963 with rate 1.050 after a lag of 1.430s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 1.963 with rate 1.050 after a lag of 1.747s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 3.000 with rate 1.050 after a lag of 1.219s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 3.000 with rate 1.050 after a lag of 1.523s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 2.965 with rate 1.050 after a lag of 2.067s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 2.965 with rate 1.050 after a lag of 2.384s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 4.000 with rate 1.050 after a lag of 1.839s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 4.000 with rate 1.050 after a lag of 2.143s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 3.968 with rate 1.050 after a lag of 2.685s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 3.968 with rate 1.050 after a lag of 3.002s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 5.000 with rate 1.050 after a lag of 2.459s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 5.000 with rate 1.050 after a lag of 2.763s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 4.971 with rate 1.050 after a lag of 3.302s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 4.971 with rate 1.050 after a lag of 3.619s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 6.000 with rate 1.050 after a lag of 3.078s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 6.000 with rate 1.050 after a lag of 3.383s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 5.973 with rate 1.050 after a lag of 3.919s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 5.973 with rate 1.050 after a lag of 4.236s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 7.000 with rate 1.050 after a lag of 3.699s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 7.000 with rate 1.050 after a lag of 4.003s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 6.976 with rate 1.050 after a lag of 4.537s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 6.976 with rate 1.050 after a lag of 4.854s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 8.000 with rate 1.050 after a lag of 4.318s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 8.000 with rate 1.050 after a lag of 4.623s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 7.979 with rate 1.050 after a lag of 5.154s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 7.979 with rate 1.050 after a lag of 5.471s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 9.000 with rate 1.050 after a lag of 4.939s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 9.000 with rate 1.050 after a lag of 5.243s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 8.981 with rate 1.050 after a lag of 5.771s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 8.981 with rate 1.050 after a lag of 6.088s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 10.000 with rate 1.050 after a lag of 5.559s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 10.000 with rate 1.050 after a lag of 5.863s frame= 300 fps= 19 q=-1.0 Lsize=N/A time=00:00:10.03 bitrate=N/A speed=0.645x elapsed=0:00:15.56 ``` I'm not sure if I am allowed to share the sample file here. From 5c648050c7198c6b829a9709820ccf5f066dc7dc Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:27:28 +0200 Subject: [PATCH 1/3] fftools/ffmpeg_demux: skip finished/unstarted streams in readrate_sleep() This shouldn't affect the actual behavior, as the initialization of ds->dts (implicitly zero'd) and the previous calculation of stream_ts_offset guarantees that the `if (pts <= stream_ts_offset) continue;` branch fires. Mainly a minor clarification of the code for the upcoming refactor. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 2d2dd5a82d..9287a31774 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -521,10 +521,10 @@ static void readrate_sleep(Demuxer *d) InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); int64_t stream_ts_offset, pts, now, wc_elapsed, elapsed, lag, max_pts, limit_pts; + if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) + continue; - if (ds->discard) continue; - - stream_ts_offset = FFMAX(ds->first_dts != AV_NOPTS_VALUE ? ds->first_dts : 0, file_start); + stream_ts_offset = FFMAX(ds->first_dts, file_start); pts = av_rescale(ds->dts, 1000000, AV_TIME_BASE); now = av_gettime_relative(); wc_elapsed = now - d->wallclock_start; -- 2.52.0 From 6c42209ae8b95d5cbc3bd4a7993db8c30122c1c5 Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:43:14 +0200 Subject: [PATCH 2/3] fftools/ffmpeg_demux: remove unused variable This is a dead assignment except on a single branch, so just define it locally. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 9287a31774..5dbd14dc0a 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -520,7 +520,7 @@ static void readrate_sleep(Demuxer *d) for (int i = 0; i < f->nb_streams; i++) { InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); - int64_t stream_ts_offset, pts, now, wc_elapsed, elapsed, lag, max_pts, limit_pts; + int64_t stream_ts_offset, pts, now, wc_elapsed, lag, max_pts, limit_pts; if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) continue; @@ -544,10 +544,9 @@ static void readrate_sleep(Demuxer *d) if (ds->lag && !lag) ds->lag = ds->resume_wc = ds->resume_pts = 0; if (ds->resume_wc) { - elapsed = now - ds->resume_wc; + int64_t elapsed = now - ds->resume_wc; limit_pts = ds->resume_pts + (int64_t)(elapsed * d->readrate_catchup); } else { - elapsed = wc_elapsed; limit_pts = max_pts; } -- 2.52.0 From 9652c9cbb781eda2e1272ee8e4aac0869def53fd Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:48:19 +0200 Subject: [PATCH 3/3] fftools/ffmpeg_demux: only throttle readrate on the slowest stream If streams are badly interleaved, then the readrate logic can end up accumulating an ever-growing lag. Rather than looping over each stream and sleeping for each stream individually based on the local DTS and lag logic, pull the sleep out of the loop and only sleep once based on the furthest-behind stream (i.e. the stream contributing the lowest sleep duration). To reproduce: $ ./ffmpeg -re -i fallbeatcaptiontest.mp4 -c copy -f null -t 10 - Before this commit, this would run at ~0.7x and accumulate an infinitely growing lag in one stream. After this commit, both streams run at ~1x as expected, after an initial burst period due to the bad (1s granularity) interleaving. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 78 +++++++++++++++++++++++++----------------- 1 file changed, 46 insertions(+), 32 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 5dbd14dc0a..38bd580bfc 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -99,12 +99,6 @@ typedef struct DemuxStream { uint64_t nb_packets; // combined size of all the packets read uint64_t data_size; - // latest wallclock time at which packet reading resumed after a stall - used for readrate - int64_t resume_wc; - // timestamp of first packet sent after the latest stall - used for readrate - int64_t resume_pts; - // measure of how far behind packet reading is against spceified readrate - int64_t lag; } DemuxStream; typedef struct DemuxStreamGroup { @@ -147,6 +141,13 @@ typedef struct Demuxer { double readrate_initial_burst; float readrate_catchup; + // latest wallclock time at which packet reading resumed after a stall - used for readrate + int64_t resume_wc; + // relative timestamp of first packet sent after the latest stall - used for readrate + int64_t resume_progress; + // measure of how far behind packet reading is against spceified readrate + int64_t lag; + Scheduler *sch; AVPacket *pkt_heartbeat; @@ -517,42 +518,55 @@ static void readrate_sleep(Demuxer *d) int64_t initial_burst = AV_TIME_BASE * d->readrate_initial_burst; int resume_warn = 0; + DemuxStream *slowest = NULL; + int64_t progress = INT64_MAX; + for (int i = 0; i < f->nb_streams; i++) { InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); - int64_t stream_ts_offset, pts, now, wc_elapsed, lag, max_pts, limit_pts; + int64_t stream_ts_offset, pts, pts_diff; if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) continue; stream_ts_offset = FFMAX(ds->first_dts, file_start); pts = av_rescale(ds->dts, 1000000, AV_TIME_BASE); - now = av_gettime_relative(); - wc_elapsed = now - d->wallclock_start; - - if (pts <= stream_ts_offset + initial_burst) continue; - - max_pts = stream_ts_offset + initial_burst + (int64_t)(wc_elapsed * d->readrate); - lag = FFMAX(max_pts - pts, 0); - if ( (!ds->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > ds->lag + 0.3 * AV_TIME_BASE) ) { - ds->lag = lag; - ds->resume_wc = now; - ds->resume_pts = pts; - av_log_once(ds, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn, - "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n", - (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE); + pts_diff = pts - stream_ts_offset; + if (pts_diff < progress) { + progress = pts_diff; + slowest = ds; } - if (ds->lag && !lag) - ds->lag = ds->resume_wc = ds->resume_pts = 0; - if (ds->resume_wc) { - int64_t elapsed = now - ds->resume_wc; - limit_pts = ds->resume_pts + (int64_t)(elapsed * d->readrate_catchup); - } else { - limit_pts = max_pts; - } - - if (pts > limit_pts) - av_usleep(pts - limit_pts); } + + if (!slowest || progress <= initial_burst) + return; + + int64_t now = av_gettime_relative(); + int64_t wc_elapsed = now - d->wallclock_start; + int64_t max_prog = initial_burst + (int64_t)(wc_elapsed * d->readrate); + int64_t lag = FFMAX(max_prog - progress, 0); + int64_t limit; + + if ( (!d->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > d->lag + 0.3 * AV_TIME_BASE) ) { + d->lag = lag; + d->resume_wc = now; + d->resume_progress = progress; + + int64_t pts = FFMAX(slowest->first_dts, file_start) + progress; + av_log_once(slowest, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn, + "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n", + (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE); + } + if (d->lag && !lag) + d->lag = d->resume_wc = d->resume_progress = 0; + if (d->resume_wc) { + int64_t elapsed = now - d->resume_wc; + limit = d->resume_progress + (int64_t)(elapsed * d->readrate_catchup); + } else { + limit = max_prog; + } + + if (progress > limit) + av_usleep(progress - limit); } static int do_send(Demuxer *d, DemuxStream *ds, AVPacket *pkt, unsigned flags, -- 2.52.0

1 0

[PR] web/security: CVE# administrativa should go to ffmpeg-cve (PR #6)
by michaelni 28 Jun '26

28 Jun '26

PR #6 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/web/pulls/6 Patch URL: https://code.ffmpeg.org/FFmpeg/web/pulls/6.patch Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 09b0c2d12fd17d1829eb9ef366bd66524bd2c3c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 14:11:02 +0200 Subject: [PATCH] web/security: CVE# administrativa should go to ffmpeg-cve Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- src/security | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security b/src/security index a5e489c..11e1fe1 100644 --- a/src/security +++ b/src/security @@ -24,7 +24,7 @@ And that you provide a easy to use testcase. Automated submissions are not accep <p>The list of CVEs on this page is maintained by the FFmpeg community. If you register a CVE or find one missing from the lists below, please help keep it up to date:</p> <h4>Before the fix has been backported to release branches</h4> -<p>Please email <a href="mailto:ffmpeg-security@ffmpeg.org">ffmpeg-security(a)ffmpeg.org</a> with the CVE identifier and the git commit that fixes it.</p> +<p>Please email <a href="mailto:ffmpeg-cve@ffmpeg.org">ffmpeg-cve(a)ffmpeg.org</a> with the CVE identifier and the git commit that fixes it.</p> <h4>After the fix has been backported</h4> <p>Please <a href="https://code.ffmpeg.org/FFmpeg/web/pulls">open a pull request</a> against the web repository to add the entry to the relevant section(s) of this page.</p> -- 2.52.0

1 0

CVE# vs Security report mail alias split
by Michael Niedermayer 28 Jun '26

28 Jun '26

Hi everyone I will split ffmpeg-security into ffmpeg-security and ffmpeg-cve so the 2 tasks of 1. Report and fix a security issue 2. cve# administrativa like add/adjust a CVE# on our security page This should improve the signal-to-noise ratio for both tasks. thx -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB When you are offended at any man's fault, turn to yourself and study your own failings. Then you will forget your anger. -- Epictetus

1 0