July 2025 - FFmpeg-trac - lists.ffmpeg.org

#10988(undetermined:new): Acrossover crash
by FFmpeg 02 Aug '25

02 Aug '25

#10988: Acrossover crash -------------------------------------+------------------------------------- Reporter: JamesBond | Type: defect Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Setup: Windows 7 x64, FFMPEG g08781ebe1-2024-04-29 x64 Source: song.dsf https://fastupload.io/en/8hp1Dg1K3KNY3Zc/file Command: ffmpeg -i song.dsf -af "volume=6dB,aresample=96000:resampler=soxr:precision=28:osf=s32:dither_method=triangular_hp,acrossover=24000:order=8th[low][high];[low]anull;[high]anullsink" out.flac When the encoding is almost done, the red line appears. It says “Assertion best_input >= 0 failed at fftools/ffmpeg_filter.c:2075”. Then I see a GUI window that says “ffmpeg.exe has stopped working” with a button “Close the program”. An incomplete FLAC file remains on the disk, i.e. flac -t song.flac says “FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC” and “ FLAC__STREAM_DECODER_END_OF_STREAM”. If I remove that acrossover filter, then the encoding goes fine. -- Ticket URL: <https://trac.ffmpeg.org/ticket/10988> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 5

#11047(undetermined:new): Compressing to yuv422p10le with x264 errors
by FFmpeg 01 Aug '25

01 Aug '25

#11047: Compressing to yuv422p10le with x264 errors -------------------------------------+------------------------------------- Reporter: Mads | Type: defect Johansen | Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: libx264, | Blocked By: yuv422p10le | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: Compressing to x264 with yuv422p10le triggers unplayable file, but with different results depending on resolution. As I see it, there is a bug with 1080 and 2160 in vertical resolutions, because 1440x1080,1920x1080,2048x1080 and 3840x2160 all has errors. The complete logs are below, identified by (n), where n is an integer. Result 1: Works perfectly: ffmpeg -f lavfi -i mandelbrot -t 5 -pix_fmt yuv422p10le mandelbrot.mov (1) ffmpeg -f lavfi -i mandelbrot=s=640x480 -t 5 -pix_fmt yuv422p10le mandelbrot640x480.mov (ruling out the size parameter) Result 2: Errors in playback: ffmpeg -f lavfi -i mandelbrot=s=1920x1080 -t 5 -pix_fmt yuv422p10le 1080p.mov (2) ffmpeg -f lavfi -i mandelbrot=s=3840x2160 -t 5 -pix_fmt yuv422p10le 2160p.mov (3) ffmpeg -f lavfi -i mandelbrot=s=2048x1080 -t 5 -pix_fmt yuv422p10le 2048x1080.mov (20) ffmpeg -i 2048x1080.mov (21) There are oddities with resolutions though: ffmpeg -f lavfi -i mandelbrot=s=1922x1082 -t 5 -pix_fmt yuv422p10le 1082p.mov gives a perfectly working file. (4) Just to make sure that it’s not my player, I did ffmpeg -i 1080.mov, with [h264 @ 00000245b2270500] deblocking_filter_idc 6 out of range [h264 @ 00000245b2270500] decode_slice_header error [h264 @ 00000245b2270500] no frame! See more at (5) Same for 2160p.mov: [h264 @ 000002025a890500] non-existing PPS 0 referenced Last message repeated 1 times [h264 @ 000002025a890500] decode_slice_header error [h264 @ 000002025a890500] no frame! See (6) In the interest of being thorough I have tested with old versions of ffmpeg from https://github.com/BtbN/FFmpeg- Builds/releases/tag/autobuild-2022-07-31-12-37 Same results: (7), (8), (9) and (10) That means it’s not a recent problem. I have also tested if it is lavfi -> codec that is a problem. Create the same test file into cineform and ffv1: ffmpeg -f lavfi -i mandelbrot=s=1920x1080 -t 5 -c:v cfhd cfhd1080p.mov ffmpeg -f lavfi -i mandelbrot=s=1920x1080 -t 5 -c:v ffv1 ffv11080p.mov (11), (12) Then converting the intermediate file into x264 yuv422p10le: ffmpeg -i cfhd1080p.mov -pix_fmt yuv422p10le cfhd_x264yuv422p10le.mov ffmpeg -i ffv11080p.mov -pix_fmt yuv422p10le ffv1_x264yuv422p10le.mov (13), (14) Same result (a broken file). Verified with ffmpeg -i cfhd_x264yuv422p10le.mov ffmpeg -i ffv1_x264yuv422p10le.mov Same results as with lavfi above. (15), (16) That means it’s not a lavfi problem. So far I’ve trusted that libx264 supports yuv422p10le. Verified by ffmpeg -h encoder=libx264 Supported pixel formats: yuv420p yuvj420p yuv422p yuvj422p yuv444p yuvj444p nv12 nv16 nv21 yuv420p10le yuv422p10le yuv444p10le nv20le gray gray10le That means it’s not an unsupported format. To confirm it’s an ffmpeg problem I’ve downloaded x264-r3191-4613ac3.exe from https://artifacts.videolan.org/x264/release-win64/ To create a supported file, I created ffmpeg -f lavfi -i mandelbrot=s=1920x1080 -t 5 -strict -1 -pix_fmt yuv422p10 ffmpeg_y4m.y4m (17) Then I converted the output file with x264-r3191-4613ac3.exe to yuv422p10le with x264-r3191-4613ac3 --profile high422 --output-depth 10 --output-csp i422 -o x264.mov ffmpeg_y4m.y4m (18) And the file works and plays back with no problems. Stream #0:0: Video: h264 (High 4:2:2), yuv422p10le(progressive), 1920x1080 [SAR 1:1 DAR 16:9], 25 fps, 50 tbr, 1200k tbn (19) What will the next steps be? Best regards Mads Johansen -- Ticket URL: <https://trac.ffmpeg.org/ticket/11047> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 7

#11691(swscale:new): [Security] heap-buffer-overflow on yuv2rgb.c:558
by FFmpeg 31 Jul '25

31 Jul '25

#11691: [Security] heap-buffer-overflow on yuv2rgb.c:558 ------------------------------------+-------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: git-master Keywords: fuzz | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ------------------------------------+-------------------------------------- Summary of the bug: {{{ fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1143 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000495,sig:06,src:015818_time:53332181_execs:35594827_op:havoc_rep:2 Reading 132 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000495,sig:06,src:015818_time:53332181_execs:35594827_op:havoc_rep:2 2 x 2 yuv422p -> 2 x 2 rgb4 [swscaler @ 0x62f000000400] No accelerated colorspace conversion found from yuv422p to rgb4. libswscale/swscale.c:1127:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1127:17 in libswscale/swscale.c:1129:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1129:17 in libswscale/swscale.c:1130:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1130:17 in libswscale/swscale.c:1131:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1131:17 in ================================================================= ==2095131==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e0000000e0 at pc 0x555555b15e9a bp 0x7fffffffc790 sp 0x7fffffffc788 READ of size 1 at 0x60e0000000e0 thread T0 #0 0x555555b15e99 in yuv422p_bgr4 /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/yuv2rgb.c:558:1 #1 0x55555599ce4c in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1160:15 #2 0x5555559a94ca in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12 #3 0x555555968c32 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:197:9 #4 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #5 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #6 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #7 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #8 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1143+0x315fdd) 0x60e0000000e0 is located 32 bytes to the left of 96-byte region [0x60e000000100,0x60e000000160) allocated by thread T0 here: #0 0x55555591951c in posix_memalign /home/fuzz/Desktop/fuzz- introspector/build/llvm-project/compiler- rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x555556375474 in av_malloc /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:107:9 #2 0x55555637691b in av_mallocz /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:258:17 #3 0x55555596a96e in alloc_plane /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:65:23 #4 0x5555559672e6 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:156:11 #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/yuv2rgb.c:558:1 in yuv422p_bgr4 Shadow bytes around the buggy address: 0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 =>0x0c1c7fff8010: 00 00 00 00 fa fa fa fa fa fa fa fa[fa]fa fa fa 0x0c1c7fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1c7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c1c7fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1c7fff8060: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2095131==ABORTING }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11691> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 3

#11690(swscale:new): [Security] Null pointer deference on libswscale/swscale.c:1125
by FFmpeg 31 Jul '25

31 Jul '25

#11690: [Security] Null pointer deference on libswscale/swscale.c:1125 ------------------------------------+-------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: git-master Keywords: fuzz | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ------------------------------------+-------------------------------------- Summary of the bug: {{{ fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1143 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000444,sig:11,src:014509+008528_time:21110904_execs:14763970_op:splice_rep:16 Reading 134 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000444,sig:11,src:014509+008528_time:21110904_execs:14763970_op:splice_rep:16 6171 x 2 bgr444be -> 142 x 2 yuv420p libswscale/swscale.c:1125:21: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1125:21 in libswscale/swscale.c:1126:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1126:17 in libswscale/swscale.c:1127:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1127:17 in libswscale/swscale.c:1131:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1131:17 in libswscale/swscale.c:302:28: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:302:28 in libswscale/swscale.c:303:29: runtime error: applying non-zero offset 18446744073709551312 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:303:29 in libswscale/swscale.c:304:29: runtime error: applying non-zero offset 18446744073709551464 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:304:29 in libswscale/vscale.c:273:22: runtime error: applying non-zero offset 18446744073709551576 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/vscale.c:273:22 in libswscale/vscale.c:273:22: runtime error: member access within address 0xffffffffffffffd8 with insufficient space for an object of type 'struct SwsFilterDescriptor' 0xffffffffffffffd8: note: pointer points here <memory cannot be printed> SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/vscale.c:273:22 in AddressSanitizer:DEADLYSIGNAL ================================================================= ==115787==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x5555559f7a9f bp 0x7fffffffc410 sp 0x7fffffffc380 T0) ==115787==The signal is caused by a READ memory access. ==115787==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x5555559f7a9f in ff_init_vscale_pfn /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/vscale.c:273:35 #1 0x55555596ec87 in ff_swscale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:387:5 #2 0x55555599bf54 in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1165:15 #3 0x5555559a94ca in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12 #4 0x555555968c32 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:197:9 #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #6 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #7 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #8 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1143+0x315fdd) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/vscale.c:273:35 in ff_init_vscale_pfn ==115787==ABORTING ------------------------------------------------------------------- fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1143 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000454,sig:11,src:010843_time:25643361_execs:18002259_op:havoc_rep:4 Reading 151 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000454,sig:11,src:010843_time:25643361_execs:18002259_op:havoc_rep:4 5011 x 2 rgb444be -> 1 x 3 xv36le libswscale/swscale.c:1125:21: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1125:21 in libswscale/swscale.c:1126:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1126:17 in libswscale/swscale.c:1127:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1127:17 in libswscale/swscale.c:1129:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1129:17 in libswscale/swscale.c:1130:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1130:17 in libswscale/swscale.c:1131:17: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1131:17 in libswscale/swscale.c:302:28: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:302:28 in libswscale/swscale.c:303:29: runtime error: applying non-zero offset 18446744073709551312 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:303:29 in libswscale/swscale.c:304:29: runtime error: applying non-zero offset 18446744073709551464 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:304:29 in libswscale/vscale.c:298:18: runtime error: applying non-zero offset 18446744073709551576 to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/vscale.c:298:18 in libswscale/vscale.c:298:18: runtime error: member access within address 0xffffffffffffffd8 with insufficient space for an object of type 'struct SwsFilterDescriptor' 0xffffffffffffffd8: note: pointer points here <memory cannot be printed> SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/vscale.c:298:18 in AddressSanitizer:DEADLYSIGNAL ================================================================= ==199274==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x5555559f6b92 bp 0x7fffffffc410 sp 0x7fffffffc380 T0) ==199274==The signal is caused by a READ memory access. ==199274==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x5555559f6b92 in ff_init_vscale_pfn /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/vscale.c:298:31 #1 0x55555596ec87 in ff_swscale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:387:5 #2 0x55555599bf54 in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1165:15 #3 0x5555559a94ca in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12 #4 0x555555968c32 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:197:9 #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #6 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #7 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #8 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1143+0x315fdd) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/vscale.c:298:31 in ff_init_vscale_pfn ==199274==ABORTING }}} How to reproduce: {{{ % ffmpeg -i input ... output ffmpeg version built on ... }}} Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker. -- Ticket URL: <https://trac.ffmpeg.org/ticket/11690> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 5

#11689(swscale:new): [Security] Division by zero on libswscale/utils.c:1408:60
by FFmpeg 31 Jul '25

31 Jul '25

#11689: [Security] Division by zero on libswscale/utils.c:1408:60 ------------------------------------+-------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: git-master Keywords: fuzzer | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ------------------------------------+-------------------------------------- Summary of the bug: {{{ fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1051 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000457,sig:08,src:014662_time:386353182_execs:207939645_op:havoc_rep:16 Reading 224 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000457,sig:08,src:014662_time:386353182_execs:207939645_op:havoc_rep:16 8 x 474 gray12be -> 8 x 1 yuv410p libswscale/utils.c:1408:60: runtime error: division by zero SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/utils.c:1408:60 in AddressSanitizer:DEADLYSIGNAL ================================================================= ==1625492==ERROR: AddressSanitizer: FPE on unknown address 0x5555557b8a46 (pc 0x5555557b8a46 bp 0x7fffffffcd70 sp 0x7fffffffcaa0 T0) #0 0x5555557b8a46 in ff_sws_init_single_context /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/utils.c:1408:60 #1 0x5555559689db in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1051.c:178:11 #2 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #3 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #4 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #5 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #6 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1051+0x315fdd) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/utils.c:1408:60 in ff_sws_init_single_context ==1625492==ABORTING }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11689> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 3

#11688(swscale:new): [Assertion Failed] libswscale/x86/swscale.c:573
by FFmpeg 31 Jul '25

31 Jul '25

#11688: [Assertion Failed] libswscale/x86/swscale.c:573 ------------------------------------+-------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: git-master Keywords: assertion | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ------------------------------------+-------------------------------------- Summary of the bug: {{{ fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1051 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000323,sig:06,src:000787+000421_time:1987217_execs:955874_op:splice_rep:2 Reading 129 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000323,sig:06,src:000787+000421_time:1987217_execs:955874_op:splice_rep:2 1 x 1 yaf32le -> 1 x 1 yuv420p Assertion c->srcBpc == 16 failed at libswscale/x86/swscale.c:573 Aborted }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11688> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#11687(swscale:new): [Security] Null pointer deference on libswscale/slice.c
by FFmpeg 31 Jul '25

31 Jul '25

#11687: [Security] Null pointer deference on libswscale/slice.c -------------------------------------+------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: | unspecified Keywords: scale | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1051 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000128,sig:11,src:000545+000155_time:144463_execs:66025_op:splice_rep:8 Reading 181 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000128,sig:11,src:000545+000155_time:144463_execs:66025_op:splice_rep:8 1 x 10216 yuva420p10le -> 127 x 1 nv16 libswscale/slice.c:233:25: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/slice.c:233:25 in libswscale/slice.c:233:25: runtime error: load of null pointer of type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/slice.c:233:25 in AddressSanitizer:DEADLYSIGNAL ================================================================= ==2824107==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x555556091215 bp 0x7fffffffc890 sp 0x7fffffffc7a0 T0) ==2824107==The signal is caused by a READ memory access. ==2824107==Hint: address points to the zero page. #0 0x555556091215 in get_min_buffer_size /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/slice.c:233:25 #1 0x5555560878ca in ff_init_filters /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/slice.c:265:5 #2 0x5555557b93f9 in ff_sws_init_single_context /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/utils.c:1452:20 #3 0x5555559689db in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1051.c:178:11 #4 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #5 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #6 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #7 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #8 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1051+0x315fdd) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/slice.c:233:25 in get_min_buffer_size ==2824107==ABORTING How to reproduce: {{{ % ffmpeg -i input ... output ffmpeg version built on ... }}} Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker. -- Ticket URL: <https://trac.ffmpeg.org/ticket/11687> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 5

#9195(avfilter:new): vibrance (video filter) incorrect defaults for luma
by FFmpeg 31 Jul '25

31 Jul '25

#9195: vibrance (video filter) incorrect defaults for luma -------------------------------------+------------------------------------- Reporter: Jim | Type: defect DeLaHunt | Status: new | Priority: normal Component: avfilter | Version: git- | master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: The "vibrance" video filter appears to have incorrect default values for the luma coefficient parameters "rlum" and "blum". They appear to be swapped. How to reproduce: {{{ % ffmpeg -h filter=vibrance ffmpeg version 4.4 Copyright (c) 2000-2021 the FFmpeg developers built with Apple LLVM version 10.0.0 (clang-1000.10.44.4) configuration: --prefix=/opt/local --enable-swscale --enable-avfilter --enable-avresample --enable-libmp3lame --enable-libvorbis --enable- libopus --enable-librsvg --enable-libtheora --enable-libopenjpeg --enable- libmodplug --enable-libvpx --enable-libsoxr --enable-libspeex --enable- libass --enable-libbluray --enable-lzma --enable-gnutls --enable- fontconfig --enable-libfreetype --enable-libfribidi --disable-libjack --disable-libopencore-amrnb --disable-libopencore-amrwb --disable- indev=jack --enable-opencl --disable-outdev=xv --enable-audiotoolbox --enable-videotoolbox --enable-sdl2 --disable-securetransport --mandir=/opt/local/share/man --enable-shared --enable-pthreads --cc=/usr/bin/clang --enable-libdav1d --arch=x86_64 --enable-x86asm --enable-libx265 --enable-gpl --enable-postproc --enable-libx264 --enable- libxvid libavutil 56. 70.100 / 56. 70.100 libavcodec 58.134.100 / 58.134.100 libavformat 58. 76.100 / 58. 76.100 libavdevice 58. 13.100 / 58. 13.100 libavfilter 7.110.100 / 7.110.100 libavresample 4. 0. 0 / 4. 0. 0 libswscale 5. 9.100 / 5. 9.100 libswresample 3. 9.100 / 3. 9.100 libpostproc 55. 9.100 / 55. 9.100 Filter vibrance Boost or alter saturation. slice threading supported Inputs: #0: default (video) Outputs: #0: default (video) vibrance AVOptions: intensity <float> ..FV.....T. set the intensity value (from -2 to 2) (default 0) rbal <float> ..FV.....T. set the red balance value (from -10 to 10) (default 1) gbal <float> ..FV.....T. set the green balance value (from -10 to 10) (default 1) bbal <float> ..FV.....T. set the blue balance value (from -10 to 10) (default 1) rlum <float> ..FV.....T. set the red luma coefficient (from 0 to 1) (default 0.072186) glum <float> ..FV.....T. set the green luma coefficient (from 0 to 1) (default 0.715158) blum <float> ..FV.....T. set the blue luma coefficient (from 0 to 1) (default 0.212656) alternate <boolean> ..FV.....T. use alternate colors (default false) This filter has support for timeline through the 'enable' option. }}} The vibrance filter is documented at https://ffmpeg.org/ffmpeg- filters.html#vibrance . It looks like coefficients "rlum", "glum", and "blum" are supposed to match the luma computation as defined in BT.709-6 (https://en.wikipedia.org/wiki/Rec._709) or something similar. Wikipedia gives this formula as: > R’G’B’ coefficients 0.2126, 0.7152, and 0.0722 (together they add to 1) So, `luma = 0.2126 * r + 0.7152 * g + 0.0722 * b`, a value in [0.0, 1.0] for r, g, b in [0.0, 1.0] But the default values I see in the FFmpeg vibrance filter are (per output above): > rlum (default 0.072186), glum (default 0.715158), blum (default 0.212656) Thus it looks like the default values for rlum and blum are swapped. Vibrance would still compute a luma a value in a range of [0.0, 1.0], but it wouldn't be the correct value per BT.709. Since the vibrance adjustments are relative to luma, they might be slightly off. I believe the fix would be the simple, obvious exchange of default values in ffmpeg/libavfilter/vf_vibrance.c:372-374. But I haven't tried this. Present code: {{{ { "rlum", "set the red luma coefficient", OFFSET(lcoeffs[2]), AV_OPT_TYPE_FLOAT, {.dbl=0.072186}, 0, 1, VF }, { "glum", "set the green luma coefficient", OFFSET(lcoeffs[0]), AV_OPT_TYPE_FLOAT, {.dbl=0.715158}, 0, 1, VF }, { "blum", "set the blue luma coefficient", OFFSET(lcoeffs[1]), AV_OPT_TYPE_FLOAT, {.dbl=0.212656}, 0, 1, VF }, }}} Code with possible fix: {{{ { "rlum", "set the red luma coefficient", OFFSET(lcoeffs[2]), AV_OPT_TYPE_FLOAT, {.dbl=0.212656}, 0, 1, VF }, { "glum", "set the green luma coefficient", OFFSET(lcoeffs[0]), AV_OPT_TYPE_FLOAT, {.dbl=0.715158}, 0, 1, VF }, { "blum", "set the blue luma coefficient", OFFSET(lcoeffs[1]), AV_OPT_TYPE_FLOAT, {.dbl=0.072186}, 0, 1, VF }, }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/9195> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 5

#11695(build system:new): Configure for armv6 doesn't disable neon and armv6t2.
by FFmpeg 30 Jul '25

30 Jul '25

#11695: Configure for armv6 doesn't disable neon and armv6t2. -------------------------------------+------------------------------------- Reporter: danergo | Type: defect Status: new | Priority: normal Component: build | Version: git- system | master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- I'm trying to configure ffmpeg for rpi1 (armv6). First, I have modified this line: https://github.com/FFmpeg/FFmpeg/blob/master/configure#L8021 From `echo "ARCH $arch ($cpu)"` To `echo "ARCH $arch ($cpu) $subarch"` In case I'm doing a configure with these parameters: `./configure --enable-cross-compile --cross-prefix=arm-linux-gnueabihf- --arch=armv6z --cpu=arm1176jzf-s --target-os=linux`: {{{ source path src C compiler arm-linux-gnueabihf-gcc C library glibc host C compiler gcc host C library glibc ARCH arm (arm1176jzf-s) armv6 big-endian no runtime cpu detection yes ARMv5TE enabled yes ARMv6 enabled yes ARMv6T2 enabled yes VFP enabled yes NEON enabled yes }}} As you can see: $subarch is printed and it's correctly set to armv6. However, neither "ARMv6T2" nor NEON are disabled. -- Ticket URL: <https://trac.ffmpeg.org/ticket/11695> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 0

#11692(swscale:new): [Security] heap-buffer-overflow on alphablend.c:77
by FFmpeg 30 Jul '25

30 Jul '25

#11692: [Security] heap-buffer-overflow on alphablend.c:77 ------------------------------------+-------------------------------------- Reporter: flyfish101 | Type: defect Status: new | Priority: important Component: swscale | Version: git-master Keywords: fuzz | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ------------------------------------+-------------------------------------- Summary of the bug: {{{ fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer_1519 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1519/default/crashes/id:000000,sig:06,src:000005+000654_time:74588_execs:28040_op:splice_rep:8 Reading 168 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1519/default/crashes/id:000000,sig:06,src:000005+000654_time:74588_execs:28040_op:splice_rep:8 4514 x 1 yuva420p9be -> 1 x 1 yuv420p (alphablend: checkerboard) ================================================================= ==3958937==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000004c80 at pc 0x555555c49927 bp 0x7fffffffc1d0 sp 0x7fffffffc1c8 READ of size 2 at 0x625000004c80 thread T0 #0 0x555555c49926 in ff_sws_alphablendaway /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/alphablend.c:77:57 #1 0x55555599dfec in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1160:15 #2 0x5555559b35d5 in scale_cascaded /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:987:15 #3 0x555555997eef in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1056:16 #4 0x5555559aa66a in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12 #5 0x555555969dd8 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:215:5 #6 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 #7 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c #8 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10 #9 0x7ffff7c3b082 in __libc_start_main /build/glibc- B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16 #10 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer_1519+0x315fdd) 0x625000004c80 is located 0 bytes to the right of 9088-byte region [0x625000002900,0x625000004c80) allocated by thread T0 here: #0 0x55555591951c in posix_memalign /home/fuzz/Desktop/fuzz- introspector/build/llvm-project/compiler- rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x555556376614 in av_malloc /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:107:9 #2 0x555556377abb in av_mallocz /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:258:17 #3 0x55555596bb0e in alloc_plane /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:66:23 #4 0x5555559685b6 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:176:11 #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/alphablend.c:77:57 in ff_sws_alphablendaway Shadow bytes around the buggy address: 0x0c4a7fff8940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff8950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff8960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff8970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff8980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c4a7fff8990:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff89a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff89b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff89c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3958937==ABORTING }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11692> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 7