1
0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Commit Graph

26002 Commits

Author SHA1 Message Date
James Almer
6f9e7431fd avformat/mov: check ff_mov_read_chnl return value
Fixes use of uninitialized value.
Fixes issue #24960.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-10-11 11:22:13 -03:00
Timo Rothenpieler
b4d26aacce avformat/imfdec: don't busy-loop if non-Asset in Asset-list
(cherry picked from commit ef305e32e8)
2026-10-09 23:24:50 +00:00
Timo Rothenpieler
3f740d6aa3 avformat/mux: don't let positive write_trailer ret shadow pb failure
(cherry picked from commit 1de217ad4b)
2026-09-29 19:25:38 +00:00
Timo Rothenpieler
7fa1f8e4ca avformat/mov: don't leak on realloc failure
Fixes: #YWH-PGM40646-48
(cherry picked from commit d975849594)
2026-09-26 16:04:37 +00:00
James Almer
9b6ffd74b5 avformat/mov: don't abort on unsupported or invalid chnl boxes
They are optional and just define a channel layout, which may also be defined
by the underlying codec.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 95fe0658d7)
2026-06-01 12:03:25 -03:00
James Almer
a995680756 avformat/mov_chan: keep the layout untouched on chan/chnl box failure
Needed to keep the process going if some issue was found while parsing these boxes.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fd1c8fa0e6)
2026-06-01 12:03:09 -03:00
Romain Beauxis
fc265ebb9e avformat/oggparsevorbis.c: Prevent integer overflow when summing header lengths; add bounds check.
Cherry-picked from 6e0e13b0bf

Signed-off-by: Romain Beauxis <romain.beauxis@gmail.com>
2026-05-27 20:49:20 -05:00
Franciszek Kalinowski
d0f9f7a27b avformat/oggparsecelt: bound extra_headers to avoid an effectively infinite loop
celt_header() reads a uint32 `extra_headers` field from the CELT identification
header and stores `1 + extra_headers` into the signed int extra_headers_left.
With extra_headers = 0x7FFFFFFE this becomes INT_MAX and the OGG parser
consumes every subsequent page as a CELT "extra header" without ever reaching
audio data, hanging on any streaming input. A value of 0xFFFFFFFE wraps the
signed addition negative, with the same family of consequences.

Reject any extra_headers count above a small fixed cap (16, well above any
real CELT-over-Ogg stream).

Verified with the audit PoC (a crafted file plus an infinite-page FIFO):
without the patch, ffmpeg consumes pages forever; with the patch it logs
"Too many CELT extra headers (...)" and exits in ~70 ms with
AVERROR_INVALIDDATA.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.

(cherry picked from commit 87439ed619)
2026-05-21 09:36:39 -05:00
Kacper Michajłow
b865754e49 avformat/demux: use correct close function for custom io
You may look and think `AVFMT_FLAG_CUSTOM_IO` check is enough, but this
is not what it seems. This flag means that user provided custom
AVIOContext, before creating AVFormatContext and it should not be
closed. However nested sub-demuxers may still open an temporary io, and
those have to be closed and use correct io_close2 function.

You can see 0dcac9c3f0 and
ef01061225 where this flag is cleared for
nested opens to avoid leaking those.

lavf micro version bumped so API users can know if it is safe to use
custom io.

(cherry picked from commit dc74fe70b2)

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-05-16 18:14:17 +02:00
Kacper Michajłow
62f85cb5a9 avformat/hlsenc: use correct close function for custom io
This is open by s->io_open().

(cherry picked from commit 200cbaeb5a)

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-05-16 18:13:54 +02:00
Kacper Michajłow
e76025fb1b avformat/hlsenc: respect io_open set in AVFormatContext
io_open_default() will call internal impl if needed, don't call it
directly.

(cherry picked from commit 06ef9a74ea)

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-05-16 18:13:54 +02:00
Kacper Michajłow
87bf919d2d avformat/dashenc: respect io_open set in AVFormatContext
io_open_default() will call internal impl if needed, don't call it
directly.

(cherry picked from commit 4cf687b3b1)

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-05-16 18:13:54 +02:00
Kacper Michajłow
9bccbd7823 avformat/dashdec: respect io_open set in AVFormatContext
io_open_default() will call internal impl if needed, don't call it
directly.

(cherry picked from commit fbc4003642)

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-05-16 18:13:54 +02:00
AdityaTeltia
be9bd5a7cf avformat/hls_sample_encryption: add missing padding for audio setup buffer
Fixes ticket #22890.

The ff_hls_senc_parse_audio_setup_info function passes setup_data to
parsers like avpriv_ac3_parse_header and init_get_bits8 which require
the buffer to be padded with AV_INPUT_BUFFER_PADDING_SIZE bytes at the end.

(cherry picked from commit 71d5fa8d4d)
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
2026-04-28 11:45:38 +02:00
James Almer
67641670cc avformat/mov: fix cases where we discard iamf packets from enabled streams
Given the entire iamf struct is inside a single Track, if the first iamf stream
(which is the one sharing the index and id from the Track) was to be disabled,
then packets from every iamf stream would be discarded.
Fix this by actually going through the entire iamf Sample and discarding those
from the disabled streams only.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 16ee3d8d99)
2026-02-27 12:27:55 -03:00
James Almer
9434a8349d avformat/mov: fix setting iamf stream id offsets
If we were to add the highest id of a non iamf stream as offset to iamf stream
ids, and one of the latter was 0, then an id overlap would ocurr.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 51aef95ba1)
2026-02-27 12:21:09 -03:00
James Almer
3157e62866 avformat/mov: add an offset to IAMF streams
Using audio_substream_id for AVStream ids is not ideal give that in containers
like mp4, the IAMF structure is opaque to the outside and other streams may
share such id values.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit a8f2374507)
2026-02-27 12:17:16 -03:00
Timo Rothenpieler
1a7ab8affa avformat/img2dec: reject input images too big to fit into a single packet
Not entirely sure if it should instead use some entirely different
approach here, given that images exceeding 2GB don't seem that crazy
to me, but so far processing such images results in a heap overflow,
since the size addition overflows and a much too small packet is
allocated and its size never checked again when writing into it.

Fixes #YWH-PGM40646-32

(cherry picked from commit f6a95c7eb7)
2025-12-31 17:52:36 +01:00
Timo Rothenpieler
4225417da2 all: apply linter fixes 2025-12-03 20:27:43 +01:00
Kimapr
38de29fd85 avformat/libopenmpt: fix seeking weirdness
- proper pts for packets. leaving it blank leaves it up for guessing,
  but the guess doesn't take seeking into account, causing weirdness.

- clamp to 0 when seeking to negative ts. libopenmpt docs are unclear on
  this but not doing this causes an immediate EOF when seeking backwards
  to the beginning in mpv.

- only set song duration and packet pts when they are non-negative and
  in int64 range. NaNs count as out of range. this isn't a fix for any
  specific issue but might be helpful still, and shouldn't break
  anything.

(cherry picked from commit ecef5f9e1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 23:15:23 +02:00
Michael Niedermayer
3d630b7479 avformat/hls: add cmfv/cmfa exceptions
Fixes: Ticket11526

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3c3a6ecfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 23:11:43 +02:00
Kacper Michajłow
acf92ba7ab avformat/lrcdec: support arbitrary precision timestamp
Apparently files with milliseconds exist in the wild. And since it cost
nothing to support arbitrary number of digits, extend format to support
that.

Depending on number of digits, the time base of fractional part is
changing. Most LRCs use 2 digits and centiseconds base, but subs with 3
digits and miliseconds exist too.

Set internal time base to AV_TIME_BASE, which in parcitice allows to
hold microseconds with 6 digits. Totally artificial, but who knows maybe
someone wants that.

Fixes: #11677

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit bc3cc0a6af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 23:10:31 +02:00
Michael Niedermayer
cc6371d48d avformat/dashdec: Allocate space for appended "/"
Fixes: writing 1 byte over the end of the array
Fixes: BIGSLEEP-433502298/test.xml

Found-by: Google Big Sleep

A prettier solution is welcome!
A testcase exists only for the baseurl case

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce0a655f85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:43 +02:00
Michael Niedermayer
cfcafeba23 avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
Fixes: use of uninitialized memory
Fixes: 427532813/clusterfuzz-testcase-minimized-ffmpeg_dem_MXG_fuzzer-5661938917113856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b12e919cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:42 +02:00
Michael Niedermayer
b128f50eef avformat/vqf: Ensure that comm_chunk is fully read
Fixes: use of uninitialized memory
Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7a327b3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:42 +02:00
Michael Niedermayer
6fb79cf3ed avformat/mov: make sure file_checksum is fully initialized
Fixes: use of uninitialized memory
Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b16e1ddd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:42 +02:00
Michael Niedermayer
cb57b6ee15 avformat/asfdec_f: Check amount of value read
Fixes: use of uninitialized memory
Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa197924a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:41 +02:00
Michael Niedermayer
ca048cedc3 avformat/concatdec: Clip duration in one more case in get_best_effort_duration()
Fixes: signed integer overflow: 40000 - -9223372036854770000 cannot be represented in type 'long'
Fixes: 427262541/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4831506940100608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8cdb47e47a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:40 +02:00
Michael Niedermayer
1303a16712 avformat/iff: Check nb_channels == 0 in CHNL
Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b1301004b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:35 +02:00
James Almer
92ddbd47e9 avformat/movenc: fix writing reserved bits in EC3SpecificBox
As described in section F.6.1 from ETSI TS 102 366.

Found-by: nyanmisaka
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 17729aa80c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:33 +02:00
Michael Niedermayer
f86bf54eaf avformat/matroskadec: check that channels fit in signed 32bit int
Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long'
Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05f8c8c4c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:32 +02:00
Michael Niedermayer
26d4501cb9 avformat/imf_cpl: fix indention after previous commit
(cherry picked from commit d28bec8c4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer
63efe4bd80 avformat/imf_cpl: do not continue looping forever
Fixes: infinite loop
Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824
Regression since: 61fa1e14e4

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39800d78b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer
6df4b662cb avformat/mov: reject negative ELST durations
Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer
e53e2e26c8 avformat/avidec: Ignore duplicate GAB2
Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a47046981)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:29 +02:00
Michael Niedermayer
f9b617c15a avformat/iff: Check nb_channels == 0 in MHDR
Fixes: division by 0
Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670

Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce1fd73d63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:28 +02:00
Michael Niedermayer
d0f89c457d avformat/hls: Fix flash1.bogulus.cfd support
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75be669ca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer
a7adf9cf18 avformat/hls: Split allowed_segment_extensions off allowed_extensions
This allows the user to set only the one that is needed to ALL or a
specific "wrong" extension like html

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f99f223eb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer
8d1812ad8c avformat/hls: Fix Youtube AAC
Fixes: Ticket11435
Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48c0dba23b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer
62c1f5615d avformat/hls: add fmp4 to allowed_extensions
Fixes: yt-dlp/issues/12700

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
Michael Niedermayer
c418fc8bb4 avformat/hls: Add ec3 to allowed_extensions
Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
Michael Niedermayer
d22a7dbfc6 avformat/hls: Add cmfv and cmfa to allowed_extensions
Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
softworkz
a82046f21f avformat/hls: Partially revert "reduce default max reload to 3"
(setting to 100 as a reasonable compromise)

The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:22 +02:00
James Almer
e0e7c95a06 avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements
Should prevent potential memory leaks on invalid files.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5470d024e1)
2025-02-28 16:24:33 -03:00
James Almer
695dcf29c2 avformat/iamf_parse: add missing constrains for num_parameters in audio_element_oub()
Fixes ticket #11475.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0526535cd5)
2025-02-28 16:24:33 -03:00
James Almer
d6270e6b5c avformat/iamf_parse: add missing av_free() call on failure path
Fixes ticket #11416

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d5873be583)
2025-02-28 16:24:33 -03:00
James Almer
c10f15c0e8 avformat/iamf_writer: ensure the stream groups are not empty
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit cedd9151f8)
2025-02-28 16:24:33 -03:00
James Almer
d88741836e avformat/iamf_writer: fix setting num_samples_per_frame for OPUS
As per section 3.11.1 of the IAMF spec, the sample rate used in Codec Config
for Opus shall be 48kHz, regardless of the original sample rate used during
encoding.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 76049d1c45)
2025-02-28 16:24:33 -03:00
James Almer
70ae846c71 avformat/iamf_parse: fix setting duration for the last subblock in a parameter definition
When subblock durations are constant, the last block may be smaller and the
value needs to be calculated.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fb5e8ea971)
2025-02-28 16:24:33 -03:00
James Almer
5a8055a58a avformat/iamf_parse: add checks to parameter definition durations
Section 3.6.1 of the IAMF spec states "When constant_subblock_duration is equal to 0, the summation of all
subblock_duration in this parameter block SHALL be equal to duration.".

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d38fc25519)
2025-02-28 16:24:33 -03:00