June 2026 - ffmpeg-devel - lists.ffmpeg.org

[PR] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure (PR #23626)
by michaelni 28 Jun '26

28 Jun '26

PR #23626 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626.patch Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 4e5c0df681ef9284f55d91dc488d5a3a35d02405 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 19:04:07 +0200 Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/lcldec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index 29b1d85be3..5023243017 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -120,6 +120,9 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign } } + if (destptr < destptr_end) + memset(destptr, 0, destptr_end - destptr); + return destptr - destptr_bak; } @@ -153,8 +156,11 @@ static int zlib_decomp(AVCodecContext *avctx, const uint8_t *src, int src_len, i if (expected != (unsigned int)zstream->total_out) { av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n", expected, zstream->total_out); - if (expected > (unsigned int)zstream->total_out) + if (expected > (unsigned int)zstream->total_out) { + memset(c->decomp_buf + offset + zstream->total_out, 0, + c->decomp_size - offset - zstream->total_out); return (unsigned int)zstream->total_out; + } return AVERROR_UNKNOWN; } return zstream->total_out; -- 2.52.0

1 0

[PR] avfilter/vf_quirc: resize the quirc buffers when the input size changes (PR #23625)
by michaelni 28 Jun '26

28 Jun '26

PR #23625 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625.patch Fixes: out of array access Fixes: JbvzNObhorBp Fixes: 030e140145 (lavfi: add quirc filter) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 4dc1be7e18b45c764cfa82e1601d718a006feb5a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 15:33:38 +0200 Subject: [PATCH] avfilter/vf_quirc: resize the quirc buffers when the input size changes Fixes: out of array access Fixes: JbvzNObhorBp Fixes: 030e140145 (lavfi: add quirc filter) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavfilter/vf_quirc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavfilter/vf_quirc.c b/libavfilter/vf_quirc.c index 59dc84caa8..d2ba48e7bc 100644 --- a/libavfilter/vf_quirc.c +++ b/libavfilter/vf_quirc.c @@ -36,6 +36,7 @@ typedef struct QuircContext { const AVClass *class; struct quirc *quirc; + int width, height; } QuircContext; static av_cold int init(AVFilterContext *ctx) @@ -67,6 +68,8 @@ static int config_input(AVFilterLink *inlink) if (err == -1) { return AVERROR(ENOMEM); } + quirc->width = inlink->w; + quirc->height = inlink->h; return 0; } @@ -80,6 +83,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame) int codes_count; uint8_t *image; + if (quirc->width != inlink->w || quirc->height != inlink->h) { + if (quirc_resize(quirc->quirc, inlink->w, inlink->h) < 0) { + av_frame_free(&frame); + return AVERROR(ENOMEM); + } + quirc->width = inlink->w; + quirc->height = inlink->h; + } + /* copy input image to quirc buffer */ image = quirc_begin(quirc->quirc, NULL, NULL); av_image_copy_plane(image, inlink->w, -- 2.52.0

1 0

[PR] fftools/ffmpeg_demux: fix -readrate on badly interleaved files (PR #23624)
by Niklas Haas 28 Jun '26

28 Jun '26

PR #23624 opened by Niklas Haas (haasn) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23624 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23624.patch Reproduce: ``` $ make && ./ffmpeg_g -re -i fallbeatcaptiontest.mp4 -c copy -f null -t 10 - [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.512 with rate 1.050 after a lag of 0.488s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 1.000 with rate 1.050 after a lag of 0.306s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.981 with rate 1.050 after a lag of 0.802s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 0.981 with rate 1.050 after a lag of 1.120s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 2.000 with rate 1.050 after a lag of 0.610s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 2.000 with rate 1.050 after a lag of 0.915s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 1.963 with rate 1.050 after a lag of 1.430s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 1.963 with rate 1.050 after a lag of 1.747s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 3.000 with rate 1.050 after a lag of 1.219s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 3.000 with rate 1.050 after a lag of 1.523s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 2.965 with rate 1.050 after a lag of 2.067s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 2.965 with rate 1.050 after a lag of 2.384s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 4.000 with rate 1.050 after a lag of 1.839s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 4.000 with rate 1.050 after a lag of 2.143s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 3.968 with rate 1.050 after a lag of 2.685s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 3.968 with rate 1.050 after a lag of 3.002s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 5.000 with rate 1.050 after a lag of 2.459s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 5.000 with rate 1.050 after a lag of 2.763s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 4.971 with rate 1.050 after a lag of 3.302s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 4.971 with rate 1.050 after a lag of 3.619s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 6.000 with rate 1.050 after a lag of 3.078s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 6.000 with rate 1.050 after a lag of 3.383s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 5.973 with rate 1.050 after a lag of 3.919s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 5.973 with rate 1.050 after a lag of 4.236s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 7.000 with rate 1.050 after a lag of 3.699s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 7.000 with rate 1.050 after a lag of 4.003s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 6.976 with rate 1.050 after a lag of 4.537s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 6.976 with rate 1.050 after a lag of 4.854s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 8.000 with rate 1.050 after a lag of 4.318s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 8.000 with rate 1.050 after a lag of 4.623s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 7.979 with rate 1.050 after a lag of 5.154s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 7.979 with rate 1.050 after a lag of 5.471s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 9.000 with rate 1.050 after a lag of 4.939s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 9.000 with rate 1.050 after a lag of 5.243s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 8.981 with rate 1.050 after a lag of 5.771s [aist#0:1/aac @ 0x2b944f80] Resumed reading at pts 8.981 with rate 1.050 after a lag of 6.088s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 10.000 with rate 1.050 after a lag of 5.559s [vist#0:0/h264 @ 0x2b945480] Resumed reading at pts 10.000 with rate 1.050 after a lag of 5.863s frame= 300 fps= 19 q=-1.0 Lsize=N/A time=00:00:10.03 bitrate=N/A speed=0.645x elapsed=0:00:15.56 ``` I'm not sure if I am allowed to share the sample file here. From 5c648050c7198c6b829a9709820ccf5f066dc7dc Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:27:28 +0200 Subject: [PATCH 1/3] fftools/ffmpeg_demux: skip finished/unstarted streams in readrate_sleep() This shouldn't affect the actual behavior, as the initialization of ds->dts (implicitly zero'd) and the previous calculation of stream_ts_offset guarantees that the `if (pts <= stream_ts_offset) continue;` branch fires. Mainly a minor clarification of the code for the upcoming refactor. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 2d2dd5a82d..9287a31774 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -521,10 +521,10 @@ static void readrate_sleep(Demuxer *d) InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); int64_t stream_ts_offset, pts, now, wc_elapsed, elapsed, lag, max_pts, limit_pts; + if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) + continue; - if (ds->discard) continue; - - stream_ts_offset = FFMAX(ds->first_dts != AV_NOPTS_VALUE ? ds->first_dts : 0, file_start); + stream_ts_offset = FFMAX(ds->first_dts, file_start); pts = av_rescale(ds->dts, 1000000, AV_TIME_BASE); now = av_gettime_relative(); wc_elapsed = now - d->wallclock_start; -- 2.52.0 From 6c42209ae8b95d5cbc3bd4a7993db8c30122c1c5 Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:43:14 +0200 Subject: [PATCH 2/3] fftools/ffmpeg_demux: remove unused variable This is a dead assignment except on a single branch, so just define it locally. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 9287a31774..5dbd14dc0a 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -520,7 +520,7 @@ static void readrate_sleep(Demuxer *d) for (int i = 0; i < f->nb_streams; i++) { InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); - int64_t stream_ts_offset, pts, now, wc_elapsed, elapsed, lag, max_pts, limit_pts; + int64_t stream_ts_offset, pts, now, wc_elapsed, lag, max_pts, limit_pts; if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) continue; @@ -544,10 +544,9 @@ static void readrate_sleep(Demuxer *d) if (ds->lag && !lag) ds->lag = ds->resume_wc = ds->resume_pts = 0; if (ds->resume_wc) { - elapsed = now - ds->resume_wc; + int64_t elapsed = now - ds->resume_wc; limit_pts = ds->resume_pts + (int64_t)(elapsed * d->readrate_catchup); } else { - elapsed = wc_elapsed; limit_pts = max_pts; } -- 2.52.0 From 9652c9cbb781eda2e1272ee8e4aac0869def53fd Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Sun, 28 Jun 2026 14:48:19 +0200 Subject: [PATCH 3/3] fftools/ffmpeg_demux: only throttle readrate on the slowest stream If streams are badly interleaved, then the readrate logic can end up accumulating an ever-growing lag. Rather than looping over each stream and sleeping for each stream individually based on the local DTS and lag logic, pull the sleep out of the loop and only sleep once based on the furthest-behind stream (i.e. the stream contributing the lowest sleep duration). To reproduce: $ ./ffmpeg -re -i fallbeatcaptiontest.mp4 -c copy -f null -t 10 - Before this commit, this would run at ~0.7x and accumulate an infinitely growing lag in one stream. After this commit, both streams run at ~1x as expected, after an initial burst period due to the bad (1s granularity) interleaving. Signed-off-by: Niklas Haas <git(a)haasn.dev> --- fftools/ffmpeg_demux.c | 78 +++++++++++++++++++++++++----------------- 1 file changed, 46 insertions(+), 32 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 5dbd14dc0a..38bd580bfc 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -99,12 +99,6 @@ typedef struct DemuxStream { uint64_t nb_packets; // combined size of all the packets read uint64_t data_size; - // latest wallclock time at which packet reading resumed after a stall - used for readrate - int64_t resume_wc; - // timestamp of first packet sent after the latest stall - used for readrate - int64_t resume_pts; - // measure of how far behind packet reading is against spceified readrate - int64_t lag; } DemuxStream; typedef struct DemuxStreamGroup { @@ -147,6 +141,13 @@ typedef struct Demuxer { double readrate_initial_burst; float readrate_catchup; + // latest wallclock time at which packet reading resumed after a stall - used for readrate + int64_t resume_wc; + // relative timestamp of first packet sent after the latest stall - used for readrate + int64_t resume_progress; + // measure of how far behind packet reading is against spceified readrate + int64_t lag; + Scheduler *sch; AVPacket *pkt_heartbeat; @@ -517,42 +518,55 @@ static void readrate_sleep(Demuxer *d) int64_t initial_burst = AV_TIME_BASE * d->readrate_initial_burst; int resume_warn = 0; + DemuxStream *slowest = NULL; + int64_t progress = INT64_MAX; + for (int i = 0; i < f->nb_streams; i++) { InputStream *ist = f->streams[i]; DemuxStream *ds = ds_from_ist(ist); - int64_t stream_ts_offset, pts, now, wc_elapsed, lag, max_pts, limit_pts; + int64_t stream_ts_offset, pts, pts_diff; if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE) continue; stream_ts_offset = FFMAX(ds->first_dts, file_start); pts = av_rescale(ds->dts, 1000000, AV_TIME_BASE); - now = av_gettime_relative(); - wc_elapsed = now - d->wallclock_start; - - if (pts <= stream_ts_offset + initial_burst) continue; - - max_pts = stream_ts_offset + initial_burst + (int64_t)(wc_elapsed * d->readrate); - lag = FFMAX(max_pts - pts, 0); - if ( (!ds->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > ds->lag + 0.3 * AV_TIME_BASE) ) { - ds->lag = lag; - ds->resume_wc = now; - ds->resume_pts = pts; - av_log_once(ds, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn, - "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n", - (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE); + pts_diff = pts - stream_ts_offset; + if (pts_diff < progress) { + progress = pts_diff; + slowest = ds; } - if (ds->lag && !lag) - ds->lag = ds->resume_wc = ds->resume_pts = 0; - if (ds->resume_wc) { - int64_t elapsed = now - ds->resume_wc; - limit_pts = ds->resume_pts + (int64_t)(elapsed * d->readrate_catchup); - } else { - limit_pts = max_pts; - } - - if (pts > limit_pts) - av_usleep(pts - limit_pts); } + + if (!slowest || progress <= initial_burst) + return; + + int64_t now = av_gettime_relative(); + int64_t wc_elapsed = now - d->wallclock_start; + int64_t max_prog = initial_burst + (int64_t)(wc_elapsed * d->readrate); + int64_t lag = FFMAX(max_prog - progress, 0); + int64_t limit; + + if ( (!d->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > d->lag + 0.3 * AV_TIME_BASE) ) { + d->lag = lag; + d->resume_wc = now; + d->resume_progress = progress; + + int64_t pts = FFMAX(slowest->first_dts, file_start) + progress; + av_log_once(slowest, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn, + "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n", + (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE); + } + if (d->lag && !lag) + d->lag = d->resume_wc = d->resume_progress = 0; + if (d->resume_wc) { + int64_t elapsed = now - d->resume_wc; + limit = d->resume_progress + (int64_t)(elapsed * d->readrate_catchup); + } else { + limit = max_prog; + } + + if (progress > limit) + av_usleep(progress - limit); } static int do_send(Demuxer *d, DemuxStream *ds, AVPacket *pkt, unsigned flags, -- 2.52.0

1 0

[PR] web/security: CVE# administrativa should go to ffmpeg-cve (PR #6)
by michaelni 28 Jun '26

28 Jun '26

PR #6 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/web/pulls/6 Patch URL: https://code.ffmpeg.org/FFmpeg/web/pulls/6.patch Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> From 09b0c2d12fd17d1829eb9ef366bd66524bd2c3c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sun, 28 Jun 2026 14:11:02 +0200 Subject: [PATCH] web/security: CVE# administrativa should go to ffmpeg-cve Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- src/security | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security b/src/security index a5e489c..11e1fe1 100644 --- a/src/security +++ b/src/security @@ -24,7 +24,7 @@ And that you provide a easy to use testcase. Automated submissions are not accep <p>The list of CVEs on this page is maintained by the FFmpeg community. If you register a CVE or find one missing from the lists below, please help keep it up to date:</p> <h4>Before the fix has been backported to release branches</h4> -<p>Please email <a href="mailto:ffmpeg-security@ffmpeg.org">ffmpeg-security(a)ffmpeg.org</a> with the CVE identifier and the git commit that fixes it.</p> +<p>Please email <a href="mailto:ffmpeg-cve@ffmpeg.org">ffmpeg-cve(a)ffmpeg.org</a> with the CVE identifier and the git commit that fixes it.</p> <h4>After the fix has been backported</h4> <p>Please <a href="https://code.ffmpeg.org/FFmpeg/web/pulls">open a pull request</a> against the web repository to add the entry to the relevant section(s) of this page.</p> -- 2.52.0

1 0

CVE# vs Security report mail alias split
by Michael Niedermayer 28 Jun '26

28 Jun '26

Hi everyone I will split ffmpeg-security into ffmpeg-security and ffmpeg-cve so the 2 tasks of 1. Report and fix a security issue 2. cve# administrativa like add/adjust a CVE# on our security page This should improve the signal-to-noise ratio for both tasks. thx -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB When you are offended at any man's fault, turn to yourself and study your own failings. Then you will forget your anger. -- Epictetus

1 0

[PATCH] libavformat: Removed log of unspecified protocol when custom AVIOContext is specified
by Voitenko Vladimir 28 Jun '26

28 Jun '26

I compile static version of ffmpeg without any protocols and use custom AVIOContext that reads from buffer in memory, because no protocols are bundled in, I always receive annoying messages in terminal that could not be disabled unless I bundle some protocol that I obviously won`t use Signed-off-by: Vladimir Voitenko <vladimirdev635(a)gmail.com> --- libavformat/seek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/seek.c b/libavformat/seek.c index c0d94371e6..ec0d7898dd 100644 --- a/libavformat/seek.c +++ b/libavformat/seek.c @@ -182,7 +182,7 @@ void ff_configure_buffers_for_index(AVFormatContext *s, int64_t time_tolerance) av_assert0(time_tolerance >= 0); - if (!proto) { + if (!proto && s->pb == NULL) { av_log(s, AV_LOG_INFO, "Protocol name not provided, cannot determine if input is local or " "a network protocol, buffers and access patterns cannot be configured " -- 2.47.1

1 0

[PR] swscale/rational64: implement av_gcd_q64 (PR #23623)
by Zhao Zhili 28 Jun '26

28 Jun '26

PR #23623 opened by Zhao Zhili (quink) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23623 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23623.patch av_gcd_q64 was declared in rational64.h but never defined. Mirror the 32-bit av_gcd_q semantics. # Summary of changes Briefly describe what this PR does and why.  From 06169124bba761f9bbd1668b9745ecadf2b08481 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <zhilizhao(a)tencent.com> Date: Sun, 28 Jun 2026 14:22:01 +0800 Subject: [PATCH] swscale/rational64: implement av_gcd_q64 av_gcd_q64 was declared in rational64.h but never defined. Mirror the 32-bit av_gcd_q semantics. --- libswscale/rational64.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libswscale/rational64.c b/libswscale/rational64.c index 998e46c572..9c1bcdbc6d 100644 --- a/libswscale/rational64.c +++ b/libswscale/rational64.c @@ -29,6 +29,7 @@ #include <limits.h> #include "libavutil/int128.h" +#include "libavutil/mathematics.h" #include "rational64.h" static av_int128 gcd128(av_int128 a, av_int128 b) @@ -144,3 +145,14 @@ AVRational64 av_sub_q64(AVRational64 b, AVRational64 c) av_mul128(av_to128i(c.num), av_to128i(b.den))), av_mul128(av_to128i(b.den), av_to128i(c.den))); } + +AVRational64 av_gcd_q64(AVRational64 a, AVRational64 b, int max_den, AVRational64 def) +{ + int64_t gcd = av_gcd(a.den, b.den); + /* lcm can exceed INT64_MAX, so keep it in 128-bit until the comparison */ + av_int128 lcm = av_mul128(av_to128i(a.den / gcd), av_to128i(b.den)); + + if (av_cmp128(lcm, av_to128i(max_den)) < 0) + return av_make_q64(av_gcd(a.num, b.num), av_from128i(lcm)); + return def; +} -- 2.52.0

1 0

[PR] avfilter/vf_v360: reject dimensions too small for the projection (PR #23622)
by michaelni 28 Jun '26

28 Jun '26

PR #23622 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23622 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23622.patch From 83554da19685a99d19bb302e359eabeef5340484 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat, 27 Jun 2026 21:31:23 +0200 Subject: [PATCH 1/2] avfilter/vf_v360: reject dimensions too small for the projection Fixes: out of array read Fixes: assertion failure Fixes: mQzloVqnivHQ Found-by: Anthony Hurtado Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavfilter/vf_v360.c | 45 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index c502bd5587..d29bcdef62 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4309,6 +4309,19 @@ static int get_output_dimension(AVFilterContext *ctx, const char *name, return 0; } +static void projection_min_size(int projection, int *min_w, int *min_h) +{ + switch (projection) { + case CUBEMAP_3_2: *min_w = 3; *min_h = 2; break; + case CUBEMAP_1_6: *min_w = 1; *min_h = 6; break; + case CUBEMAP_6_1: *min_w = 6; *min_h = 1; break; + case BARREL: *min_w = 5; *min_h = 2; break; + case BARREL_SPLIT: *min_w = 3; *min_h = 4; break; + case DUAL_FISHEYE: *min_w = 2; *min_h = 1; break; + default: *min_w = 1; *min_h = 1; break; + } +} + static int config_output(AVFilterLink *outlink) { AVFilterContext *ctx = outlink->src; @@ -4489,6 +4502,22 @@ static int config_output(AVFilterLink *outlink) return AVERROR(EINVAL); } + { + int min_w, min_h; + const int pw = s->in_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h) + : AV_CEIL_RSHIFT(w, desc->log2_chroma_w); + const int ph = s->in_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w) + : AV_CEIL_RSHIFT(h, desc->log2_chroma_h); + + projection_min_size(s->in, &min_w, &min_h); + if (pw < min_w || ph < min_h) { + av_log(ctx, AV_LOG_ERROR, + "Input %dx%d is too small for the input projection " + "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h); + return AVERROR(EINVAL); + } + } + switch (s->in) { case EQUIRECTANGULAR: s->in_transform = xyz_to_equirect; @@ -4876,6 +4905,22 @@ static int config_output(AVFilterLink *outlink) set_dimensions(s->pr_width, s->pr_height, w, h, desc); + { + int min_w, min_h; + const int pw = s->out_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h) + : AV_CEIL_RSHIFT(w, desc->log2_chroma_w); + const int ph = s->out_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w) + : AV_CEIL_RSHIFT(h, desc->log2_chroma_h); + + projection_min_size(s->out, &min_w, &min_h); + if (pw < min_w || ph < min_h) { + av_log(ctx, AV_LOG_ERROR, + "Output %dx%d is too small for the output projection " + "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h); + return AVERROR(EINVAL); + } + } + switch (s->out_stereo) { case STEREO_2D: out_offset_w = out_offset_h = 0; -- 2.52.0 From cb4ba7187b9843e6af2a30c3192fc200dff3031e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <michael(a)niedermayer.cc> Date: Sat, 27 Jun 2026 21:31:23 +0200 Subject: [PATCH 2/2] avfilter/vf_v360: handle non-finite output projection vectors Fixes: assertion failure Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavfilter/vf_v360.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index d29bcdef62..b581faa0bc 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4266,6 +4266,10 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) out_mask = s->out_transform(s, j, i, height, width, vec); else out_mask = s->out_transform(s, i, j, width, height, vec); + if (!isfinite(vec[0]) || !isfinite(vec[1]) || !isfinite(vec[2])) { + vec[0] = vec[1] = 0.f; + vec[2] = 1.f; + } offset_vector(vec, s->h_offset, s->v_offset); normalize_vector(vec); av_assert1(!isnan(vec[0]) && !isnan(vec[1]) && !isnan(vec[2])); -- 2.52.0

1 0

[PR] ffbuild: show install destinations in the INSTALL build output (PR #23621)
by Kacper Michajłow 28 Jun '26

28 Jun '26

PR #23621 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23621 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23621.patch From 48e8b38906c9ae76793423df2973430369c0c548 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sun, 28 Jun 2026 00:58:35 +0200 Subject: [PATCH 1/2] ffbuild/common.mak: fix source path prefix stripping in INSTALL output MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use $(SRC_PATH), the source tree root, for consistent repository-relative paths. SRC_DIR used before was undefined and this macro only stripped leading /. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> --- ffbuild/common.mak | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ffbuild/common.mak b/ffbuild/common.mak index 059de5abf3..e59a9eedef 100644 --- a/ffbuild/common.mak +++ b/ffbuild/common.mak @@ -27,7 +27,7 @@ M = @$(call ECHO,$(TAG),$@); $(foreach VAR,$(BRIEF), \ $(eval override $(VAR) = @$$(call ECHO,$(VAR),$$(MSG)); $($(VAR)))) $(foreach VAR,$(SILENT),$(eval override $(VAR) = @$($(VAR)))) -$(eval INSTALL = @$(call ECHO,INSTALL,$$(^:$(SRC_DIR)/%=%)); $(INSTALL)) +$(eval INSTALL = @$(call ECHO,INSTALL,$$(^:$(SRC_PATH)/%=%)); $(INSTALL)) endif # Prepend to a recursively expanded variable without making it simply expanded. -- 2.52.0 From d4212ee17292324206a2c2cb5d257b17c0079d50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sun, 28 Jun 2026 01:03:54 +0200 Subject: [PATCH 2/2] ffbuild: show install destinations in the INSTALL build output MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The INSTALL pretty-printer echoed the rule prerequisites ($^), which had several shortcomings: - For recipes that run install more than once (e.g. installing a shared library installs the dll, the import library and the def file) the same prerequisite was printed for every command, so the dll name appeared three times regardless of what was actually being installed. - Phony prerequisites such as install-progs-yes leaked into the output. - The destination was never shown. Route install through a small helper that receives the real install command line and prints one "source -> destination" line per installed file before execing install. This deduplicates the output, drops the phony names and shows where each file is installed, similar to meson. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> --- ffbuild/common.mak | 2 +- ffbuild/install_print.sh | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100755 ffbuild/install_print.sh diff --git a/ffbuild/common.mak b/ffbuild/common.mak index e59a9eedef..e9041a2bc1 100644 --- a/ffbuild/common.mak +++ b/ffbuild/common.mak @@ -27,7 +27,7 @@ M = @$(call ECHO,$(TAG),$@); $(foreach VAR,$(BRIEF), \ $(eval override $(VAR) = @$$(call ECHO,$(VAR),$$(MSG)); $($(VAR)))) $(foreach VAR,$(SILENT),$(eval override $(VAR) = @$($(VAR)))) -$(eval INSTALL = @$(call ECHO,INSTALL,$$(^:$(SRC_PATH)/%=%)); $(INSTALL)) +$(eval INSTALL = @$(SRC_PATH)/ffbuild/install_print.sh $(SRC_PATH) $(INSTALL)) endif # Prepend to a recursively expanded variable without making it simply expanded. diff --git a/ffbuild/install_print.sh b/ffbuild/install_print.sh new file mode 100755 index 0000000000..e5b610163a --- /dev/null +++ b/ffbuild/install_print.sh @@ -0,0 +1,33 @@ +#!/bin/sh +# +# Pretty-print the files copied by a single install invocation as +# "source -> destination" and then run the actual install command. +# +# Usage: install_print.sh SRC_PATH INSTALL_PROG [INSTALL_OPTIONS...] SRC... DEST + +src_path=$1 +prog=$2 +shift 2 + +for dest do :; done + +skip=0 +for arg do + if [ "$skip" = 1 ]; then + skip=0 + continue + fi + case $arg in + -m|-o|-g|-t) + skip=1 + continue + ;; + -*) + continue + ;; + esac + [ "$arg" = "$dest" ] && continue + printf 'INSTALL\t%s -> %s\n' "${arg#"$src_path"/}" "$dest" +done + +exec "$prog" "$@" -- 2.52.0

1 0

[PR] Makefile: skip STRIP step when stripping is disabled (PR #23620)
by Kacper Michajłow 28 Jun '26

28 Jun '26

PR #23620 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23620 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23620.patch From f4540b79543909d29ca085b1aa77db1dd6fbd211 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sun, 28 Jun 2026 00:25:07 +0200 Subject: [PATCH 1/2] Makefile: skip STRIP step when stripping is disabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Instead of showing `STRIP` followed by `skipping strip`. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> --- Makefile | 2 ++ configure | 4 ++-- ffbuild/library.mak | 2 ++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index ca55556cee..b2761a6151 100644 --- a/Makefile +++ b/Makefile @@ -143,8 +143,10 @@ ifeq ($(STRIPTYPE),direct) else $(RM) $@ $(CP) $< $@ +ifneq ($(STRIPTYPE),nostrip) $(STRIP) $@ endif +endif %$(PROGSSUF)_g$(EXESUF): $(FF_DEP_LIBS) $(call LINK,$(LDFLAGS) $(LDEXEFLAGS) $(LD_O) $(OBJS-$*) $(FF_EXTRALIBS)) diff --git a/configure b/configure index 785e23fb16..70e31c563d 100755 --- a/configure +++ b/configure @@ -8620,8 +8620,8 @@ esc(){ echo "config:$arch:$subarch:$cpu:$target_os:$(esc $cc_ident):$(esc $FFMPEG_CONFIGURATION)" > ffbuild/config.fate -enabled stripping || strip="echo skipping strip" -enabled stripping || striptype="" +enabled stripping || striptype="nostrip" +enabled stripping || ASMSTRIPFLAGS="" config_files="$TMPH ffbuild/config.mak doc/config.texi" diff --git a/ffbuild/library.mak b/ffbuild/library.mak index 2759a73a5c..4614b98167 100644 --- a/ffbuild/library.mak +++ b/ffbuild/library.mak @@ -113,7 +113,9 @@ clean:: install-lib$(NAME)-shared: $(SUBDIR)$(SLIBNAME) $(Q)mkdir -p "$(SHLIBDIR)" $$(INSTALL) -m 755 $$< "$(SHLIBDIR)/$(SLIB_INSTALL_NAME)" +ifneq ($(STRIPTYPE),nostrip) $$(STRIP) "$(SHLIBDIR)/$(SLIB_INSTALL_NAME)" +endif $(Q)$(foreach F,$(SLIB_INSTALL_LINKS),(cd "$(SHLIBDIR)" && $(LN_S) $(SLIB_INSTALL_NAME) $(F));) $(if $(SLIB_INSTALL_EXTRA_SHLIB),$$(INSTALL) -m 644 $(SLIB_INSTALL_EXTRA_SHLIB:%=$(SUBDIR)%) "$(SHLIBDIR)") $(if $(SLIB_INSTALL_EXTRA_LIB),$(Q)mkdir -p "$(LIBDIR)") -- 2.52.0 From 9301b14a10d27a87636479ee53881ad212143005 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sun, 28 Jun 2026 00:26:54 +0200 Subject: [PATCH 2/2] Makefile: hide verbose command from linking step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit They are part of LD(XX) step, and shouldn't be shown if verbose output is not enabled. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> --- ffbuild/library.mak | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ffbuild/library.mak b/ffbuild/library.mak index 4614b98167..89908d247e 100644 --- a/ffbuild/library.mak +++ b/ffbuild/library.mak @@ -93,13 +93,13 @@ else $(Q)echo $$(filter %.o,$$^) > $$@.objs endif endif - $(SLIB_CREATE_DEF_CMD) + $(Q)$(SLIB_CREATE_DEF_CMD) ifeq ($(RESPONSE_FILES),yes) $$(call LINK,$$(call $(NAME)LINK_SO_ARGS) $$(LD_O) @$$@.objs $$(call $(NAME)LINK_EXTRA)) else $$(call LINK,$$(call $(NAME)LINK_SO_ARGS) $$(LD_O) $$(filter %.o,$$^) $$(call $(NAME)LINK_EXTRA)) endif - $(SLIB_EXTRA_CMD) + $(Q)$(SLIB_EXTRA_CMD) -$(RM) $$@.objs ifdef SUBDIR -- 2.52.0

1 0