Version in base suite: 4.1.8-0+deb10u1 Base version: ffmpeg_4.1.8-0+deb10u1 Target version: ffmpeg_4.1.9-0+deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/ffmpeg/ffmpeg_4.1.8-0+deb10u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/ffmpeg/ffmpeg_4.1.9-0+deb10u1.dsc Changelog | 59 ++++++++++++++ RELEASE | 2 VERSION | 2 configure | 4 debian/changelog | 7 + debian/patches/0001-fix-mxfenc-index.patch | 17 ---- debian/patches/series | 1 doc/Doxyfile | 2 libavcodec/alacdsp.c | 2 libavcodec/apedec.c | 22 ++--- libavcodec/diracdec.c | 4 libavcodec/flac_parser.c | 3 libavcodec/g729dec.c | 13 +-- libavcodec/jpeglsdec.c | 10 +- libavcodec/motion_est.c | 9 -- libavcodec/pixlet.c | 4 libavcodec/sonic.c | 2 libavcodec/takdsp.c | 2 libavcodec/ttadsp.c | 6 - libavcodec/vqavideo.c | 7 - libavfilter/vf_gblur.c | 2 libavfilter/vf_lenscorrection.c | 10 -- libavfilter/vf_subtitles.c | 9 +- libavformat/4xm.c | 6 + libavformat/aiffdec.c | 11 +- libavformat/aqtitledec.c | 3 libavformat/avidec.c | 9 +- libavformat/cafdec.c | 2 libavformat/flvdec.c | 2 libavformat/hls.c | 8 + libavformat/latmenc.c | 3 libavformat/matroskadec.c | 24 ++++- libavformat/mov.c | 21 ++++ libavformat/movenc.c | 4 libavformat/mpegenc.c | 19 ++-- libavformat/mxfdec.c | 3 libavformat/mxfenc.c | 3 libavformat/rmdec.c | 9 +- libavformat/tty.c | 21 ++++ libavformat/utils.c | 2 libavformat/webmdashenc.c | 2 libavutil/mathematics.h | 1 tests/ref/fate/webm-dash-manifest | 2 tests/ref/fate/webm-dash-manifest-representations | 2 tests/ref/fate/webm-dash-manifest-unaligned-audio-streams | 2 tests/ref/fate/webm-dash-manifest-unaligned-video-streams | 2 46 files changed, 250 insertions(+), 110 deletions(-) diff -Nru ffmpeg-4.1.8/Changelog ffmpeg-4.1.9/Changelog --- ffmpeg-4.1.8/Changelog 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/Changelog 2022-04-17 14:18:59.000000000 +0000 @@ -1,6 +1,65 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 4.1.9: + avfilter/vf_lenscorrection: make width/height int + avcodec/diracdec: avoid signed integer overflow in global mv + avcodec/takdsp: Fix integer overflow in decorrelate_sf() + avcodec/apedec: fix a integer overflow in long_filter_high_3800() + avfilter/vf_subtitles: pass storage size to libass + avformat/aqtitledec: Skip unrepresentable durations + avformat/cafdec: Do not store empty keys in read_info_chunk() + avformat/hls: Check target_duration + avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn() + avformat/matroskadec: Check pre_ns + avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior + avformat/matroskadec: Use rounded down duration in get_cue_desc() check + avformat/avidec: Check height + avformat/rmdec: Better duplicate tags check + avformat/mov: Disallow empty sidx + avformat/matroskadec: Check duration + avformat/mov: Corner case encryption error cleanup in mov_read_senc() + avcodec/jpeglsdec: Fix if( code style + avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error + avcodec/motion_est: fix indention of ff_get_best_fcode() + avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode() + avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned + avformat/matroskadec: Check desc_bytes + avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value() + avformat/matroskadec: Fix infinite loop with bz decompression + avformat/mov: Check size before subtraction + avcodec/apedec: Fix integer overflows in predictor_update_3930() + avcodec/apedec: fix integer overflow in 8bit samples + avformat/flvdec: timestamps cannot use the full int64 range + avcodec/vqavideo: reset accounting on error + avcodec/alacdsp: fix integer overflow in decorrelate_stereo() + avformat/4xm: Check for duplicate track ids + avformat/4xm: Consider max_streams on reallocating tracks array + avformat/mov: Check next offset in mov_read_dref() + avformat/mxfdec: Check for duplicate mxf_read_index_entry_array() + avcodec/apedec: Change avg to uint32_t + avformat/mov: Disallow duplicate smdm + avformat/mov: Check for EOF in mov_read_glbl() + avformat/mov: Check channels for mov_parse_stsd_audio() + avformat/avidec: Check read_odml_index() for failure + avformat/aiffdec: Use av_rescale() for bitrate + avformat/aiffdec: sanity check block_align + avformat/aiffdec: Check sample_rate + avfilter/vf_gblur: fix heap-buffer overflow + avfilter/vf_lenscorrection: fix division by zero + avformat/latmenc: abort if no extradata is available + avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum() + avformat/tty: add probe function + avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE + avcodec/ttadsp: Fix integer overflows in tta_filter_process_c() + avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results + fate: update reference files after the recent dash manifest muxer changes + avformat/webmdashenc: fix on-demand profile string + configure: Add missing libshine->mpegaudioheader dependency + avformat/mpegenc: Ensure packet queue stays valid + avformat/movenc: Fix segfault when remuxing rtp hint stream + avformat/mxfenc: fix index byte count in partition header + version 4.1.8: - configure: update copyright year - avformat/wavdec: Check smv_block_size diff -Nru ffmpeg-4.1.8/RELEASE ffmpeg-4.1.9/RELEASE --- ffmpeg-4.1.8/RELEASE 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/RELEASE 2022-04-17 14:18:59.000000000 +0000 @@ -1 +1 @@ -4.1.8 +4.1.9 diff -Nru ffmpeg-4.1.8/VERSION ffmpeg-4.1.9/VERSION --- ffmpeg-4.1.8/VERSION 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/VERSION 2022-04-17 14:18:59.000000000 +0000 @@ -1 +1 @@ -4.1.8 +4.1.9 diff -Nru ffmpeg-4.1.8/configure ffmpeg-4.1.9/configure --- ffmpeg-4.1.8/configure 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/configure 2022-04-17 14:18:59.000000000 +0000 @@ -3121,7 +3121,7 @@ libopus_encoder_select="audio_frame_queue" librsvg_decoder_deps="librsvg" libshine_encoder_deps="libshine" -libshine_encoder_select="audio_frame_queue" +libshine_encoder_select="audio_frame_queue mpegaudioheader" libspeex_decoder_deps="libspeex" libspeex_encoder_deps="libspeex" libspeex_encoder_select="audio_frame_queue" @@ -7243,7 +7243,7 @@ #define FFMPEG_CONFIG_H #define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)" #define FFMPEG_LICENSE "$(c_escape $license)" -#define CONFIG_THIS_YEAR 2021 +#define CONFIG_THIS_YEAR 2022 #define FFMPEG_DATADIR "$(eval c_escape $datadir)" #define AVCONV_DATADIR "$(eval c_escape $datadir)" #define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})" diff -Nru ffmpeg-4.1.8/debian/changelog ffmpeg-4.1.9/debian/changelog --- ffmpeg-4.1.8/debian/changelog 2021-10-05 08:49:21.000000000 +0000 +++ ffmpeg-4.1.9/debian/changelog 2022-04-26 22:11:27.000000000 +0000 @@ -1,3 +1,10 @@ +ffmpeg (7:4.1.9-0+deb10u1) buster-security; urgency=medium + + * New upstream release. + - Drop 0001-fix-mxfenc-index.patch, contained in new release + + -- Moritz Mühlenhoff Wed, 27 Apr 2022 00:11:27 +0200 + ffmpeg (7:4.1.8-0+deb10u1) buster-security; urgency=high [ Sebastian Ramacher ] diff -Nru ffmpeg-4.1.8/debian/patches/0001-fix-mxfenc-index.patch ffmpeg-4.1.9/debian/patches/0001-fix-mxfenc-index.patch --- ffmpeg-4.1.8/debian/patches/0001-fix-mxfenc-index.patch 2021-10-05 08:45:55.000000000 +0000 +++ ffmpeg-4.1.9/debian/patches/0001-fix-mxfenc-index.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,17 +0,0 @@ -Title: avformat/mxfenc: fix index byte count in partition header -Author: Baptiste Coudurier -Date: Thu Jul 18 10:35:00 2019 -0700 -Forwarded: https://trac.ffmpeg.org/ticket/9036 - ---- a/libavformat/mxfenc.c -+++ b/libavformat/mxfenc.c -@@ -1857,8 +1857,7 @@ - index_byte_count = 80; - - if (index_byte_count) { -- // add encoded ber length -- index_byte_count += 16 + klv_ber_length(index_byte_count); -+ index_byte_count += 16 + 4; // add encoded ber4 length - index_byte_count += klv_fill_size(index_byte_count); - } - diff -Nru ffmpeg-4.1.8/debian/patches/series ffmpeg-4.1.9/debian/patches/series --- ffmpeg-4.1.8/debian/patches/series 2021-10-05 08:45:55.000000000 +0000 +++ ffmpeg-4.1.9/debian/patches/series 2022-04-26 22:11:27.000000000 +0000 @@ -1 +0,0 @@ -0001-fix-mxfenc-index.patch diff -Nru ffmpeg-4.1.8/doc/Doxyfile ffmpeg-4.1.9/doc/Doxyfile --- ffmpeg-4.1.8/doc/Doxyfile 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/doc/Doxyfile 2022-04-17 14:18:59.000000000 +0000 @@ -38,7 +38,7 @@ # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 4.1.8 +PROJECT_NUMBER = 4.1.9 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a diff -Nru ffmpeg-4.1.8/libavcodec/alacdsp.c ffmpeg-4.1.9/libavcodec/alacdsp.c --- ffmpeg-4.1.8/libavcodec/alacdsp.c 2020-07-09 09:17:46.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/alacdsp.c 2022-04-17 14:18:59.000000000 +0000 @@ -34,7 +34,7 @@ a = buffer[0][i]; b = buffer[1][i]; - a -= (b * decorr_left_weight) >> decorr_shift; + a -= (int)(b * (unsigned)decorr_left_weight) >> decorr_shift; b += a; buffer[0][i] = b; diff -Nru ffmpeg-4.1.8/libavcodec/apedec.c ffmpeg-4.1.9/libavcodec/apedec.c --- ffmpeg-4.1.8/libavcodec/apedec.c 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/apedec.c 2022-04-17 14:18:59.000000000 +0000 @@ -101,7 +101,7 @@ int16_t *historybuffer; ///< filter memory int16_t *delay; ///< filtered values - int avg; + uint32_t avg; } APEFilter; typedef struct APERice { @@ -905,7 +905,7 @@ dotprod += delay[j] * (unsigned)coeffs[j]; coeffs[j] += ((delay[j] >> 31) | 1) * sign; } - buffer[i] -= dotprod >> shift; + buffer[i] -= (unsigned)(dotprod >> shift); for (j = 0; j < order - 1; j++) delay[j] = delay[j + 1]; delay[order - 1] = buffer[i]; @@ -1038,13 +1038,13 @@ const int delayA) { int32_t predictionA, sign; - int32_t d0, d1, d2, d3; + uint32_t d0, d1, d2, d3; p->buf[delayA] = p->lastA[filter]; d0 = p->buf[delayA ]; - d1 = p->buf[delayA ] - p->buf[delayA - 1]; - d2 = p->buf[delayA - 1] - p->buf[delayA - 2]; - d3 = p->buf[delayA - 2] - p->buf[delayA - 3]; + d1 = p->buf[delayA ] - (unsigned)p->buf[delayA - 1]; + d2 = p->buf[delayA - 1] - (unsigned)p->buf[delayA - 2]; + d3 = p->buf[delayA - 2] - (unsigned)p->buf[delayA - 3]; predictionA = d0 * p->coeffsA[filter][0] + d1 * p->coeffsA[filter][1] + @@ -1055,10 +1055,10 @@ p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5); sign = APESIGN(decoded); - p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign; - p->coeffsA[filter][1] += ((d1 < 0) * 2 - 1) * sign; - p->coeffsA[filter][2] += ((d2 < 0) * 2 - 1) * sign; - p->coeffsA[filter][3] += ((d3 < 0) * 2 - 1) * sign; + p->coeffsA[filter][0] += (((int32_t)d0 < 0) * 2 - 1) * sign; + p->coeffsA[filter][1] += (((int32_t)d1 < 0) * 2 - 1) * sign; + p->coeffsA[filter][2] += (((int32_t)d2 < 0) * 2 - 1) * sign; + p->coeffsA[filter][3] += (((int32_t)d3 < 0) * 2 - 1) * sign; return p->filterA[filter]; } @@ -1529,7 +1529,7 @@ for (ch = 0; ch < s->channels; ch++) { sample8 = (uint8_t *)frame->data[ch]; for (i = 0; i < blockstodecode; i++) - *sample8++ = (s->decoded[ch][i] + 0x80) & 0xff; + *sample8++ = (s->decoded[ch][i] + 0x80U) & 0xff; } break; case 16: diff -Nru ffmpeg-4.1.8/libavcodec/diracdec.c ffmpeg-4.1.9/libavcodec/diracdec.c --- ffmpeg-4.1.8/libavcodec/diracdec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/diracdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -1430,8 +1430,8 @@ int *c = s->globalmc[ref].perspective; int64_t m = (1<u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep); block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep); diff -Nru ffmpeg-4.1.8/libavcodec/flac_parser.c ffmpeg-4.1.9/libavcodec/flac_parser.c --- ffmpeg-4.1.8/libavcodec/flac_parser.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/flac_parser.c 2022-04-17 14:18:59.000000000 +0000 @@ -55,6 +55,7 @@ /** largest possible size of flac header */ #define MAX_FRAME_HEADER_SIZE 16 +#define MAX_FRAME_VERIFY_SIZE (MAX_FRAME_HEADER_SIZE) typedef struct FLACHeaderMarker { int offset; /**< byte offset from start of FLACParseContext->buffer */ @@ -169,7 +170,7 @@ uint8_t *header_buf; int size = 0; header_buf = flac_fifo_read_wrap(fpc, offset, - MAX_FRAME_HEADER_SIZE, + MAX_FRAME_VERIFY_SIZE + AV_INPUT_BUFFER_PADDING_SIZE, &fpc->wrap_buf, &fpc->wrap_buf_allocated_size); if (frame_header_is_valid(fpc->avctx, header_buf, &fi)) { diff -Nru ffmpeg-4.1.8/libavcodec/g729dec.c ffmpeg-4.1.9/libavcodec/g729dec.c --- ffmpeg-4.1.8/libavcodec/g729dec.c 2021-10-16 18:49:17.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/g729dec.c 2022-04-17 14:18:59.000000000 +0000 @@ -536,12 +536,13 @@ fc_v[i] = < \ fc_v[i] + gain_pitch * fc_v[i-pitch_delay], i >= pitch_delay */ - ff_acelp_weighted_vector_sum(fc + pitch_delay_int[i], - fc + pitch_delay_int[i], - fc, 1 << 14, - av_clip(ctx->past_gain_pitch[0], SHARP_MIN, SHARP_MAX), - 0, 14, - SUBFRAME_SIZE - pitch_delay_int[i]); + if (SUBFRAME_SIZE > pitch_delay_int[i]) + ff_acelp_weighted_vector_sum(fc + pitch_delay_int[i], + fc + pitch_delay_int[i], + fc, 1 << 14, + av_clip(ctx->past_gain_pitch[0], SHARP_MIN, SHARP_MAX), + 0, 14, + SUBFRAME_SIZE - pitch_delay_int[i]); memmove(ctx->past_gain_pitch+1, ctx->past_gain_pitch, 5 * sizeof(int16_t)); ctx->past_gain_code[1] = ctx->past_gain_code[0]; diff -Nru ffmpeg-4.1.8/libavcodec/jpeglsdec.c ffmpeg-4.1.9/libavcodec/jpeglsdec.c --- ffmpeg-4.1.8/libavcodec/jpeglsdec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/jpeglsdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -67,7 +67,7 @@ s->t3 = get_bits(&s->gb, 16); s->reset = get_bits(&s->gb, 16); - if(s->avctx->debug & FF_DEBUG_PICT_INFO) { + if (s->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(s->avctx, AV_LOG_DEBUG, "Coding parameters maxval:%d T1:%d T2:%d T3:%d reset:%d\n", s->maxval, s->t1, s->t2, s->t3, s->reset); } @@ -96,7 +96,7 @@ else maxtab = 65530/wt - 1; - if(s->avctx->debug & FF_DEBUG_PICT_INFO) { + if (s->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(s->avctx, AV_LOG_DEBUG, "LSE palette %d tid:%d wt:%d maxtab:%d\n", id, tid, wt, maxtab); } if (maxtab >= 256) { @@ -186,7 +186,7 @@ if (RItype) temp += state->N[Q] >> 1; - for (k = 0; (state->N[Q] << k) < temp; k++) + for (k = 0; ((unsigned)state->N[Q] << k) < temp; k++) ; #ifdef JLS_BROKEN @@ -195,6 +195,8 @@ #endif ret = get_ur_golomb_jpegls(gb, k, state->limit - limit_add - 1, state->qbpp); + if (ret < 0) + return -0x10000; /* decode mapped error */ map = 0; @@ -209,7 +211,7 @@ ret = ret >> 1; } - if(FFABS(ret) > 0xFFFF) + if (FFABS(ret) > 0xFFFF) return -0x10000; /* update state */ state->A[Q] += FFABS(ret) - RItype; diff -Nru ffmpeg-4.1.8/libavcodec/motion_est.c ffmpeg-4.1.9/libavcodec/motion_est.c --- ffmpeg-4.1.8/libavcodec/motion_est.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/motion_est.c 2022-04-17 14:18:59.000000000 +0000 @@ -1614,7 +1614,7 @@ for(y=0; ymb_height; y++){ int x; int xy= y*s->mb_stride; - for(x=0; xmb_width; x++){ + for(x=0; xmb_width; x++, xy++){ if(s->mb_type[xy] & type){ int mx= mv_table[xy][0]; int my= mv_table[xy][1]; @@ -1622,16 +1622,15 @@ fcode_tab[my + MAX_MV]); int j; - if(mx >= range || mx < -range || - my >= range || my < -range) - continue; + if (mx >= range || mx < -range || + my >= range || my < -range) + continue; for(j=0; jpict_type==AV_PICTURE_TYPE_B || s->current_picture.mc_mb_var[xy] < s->current_picture.mb_var[xy]) score[j]-= 170; } } - xy++; } } diff -Nru ffmpeg-4.1.8/libavcodec/pixlet.c ffmpeg-4.1.9/libavcodec/pixlet.c --- ffmpeg-4.1.8/libavcodec/pixlet.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/pixlet.c 2022-04-17 14:18:59.000000000 +0000 @@ -404,7 +404,7 @@ (int64_t) low [i - 1] * -INT64_C(325392907) + (int64_t) high[i + 0] * INT64_C(1518500249) + (int64_t) high[i - 1] * INT64_C(1518500249); - dest[i * 2] = av_clip_int16(((value >> 32) * scale) >> 32); + dest[i * 2] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 32); } for (i = 0; i < hsize; i++) { @@ -415,7 +415,7 @@ (int64_t) high[i + 1] * INT64_C(303700064) + (int64_t) high[i + 0] * -INT64_C(3644400640) + (int64_t) high[i - 1] * INT64_C(303700064); - dest[i * 2 + 1] = av_clip_int16(((value >> 32) * scale) >> 32); + dest[i * 2 + 1] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 32); } } diff -Nru ffmpeg-4.1.8/libavcodec/sonic.c ffmpeg-4.1.9/libavcodec/sonic.c --- ffmpeg-4.1.8/libavcodec/sonic.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/sonic.c 2022-04-17 14:18:59.000000000 +0000 @@ -1018,7 +1018,7 @@ // dequantize for (i = 0; i < s->num_taps; i++) - s->predictor_k[i] *= s->tap_quant[i]; + s->predictor_k[i] *= (unsigned) s->tap_quant[i]; if (s->lossless) quant = 1; diff -Nru ffmpeg-4.1.8/libavcodec/takdsp.c ffmpeg-4.1.9/libavcodec/takdsp.c --- ffmpeg-4.1.8/libavcodec/takdsp.c 2021-10-16 18:49:20.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/takdsp.c 2022-04-17 14:18:59.000000000 +0000 @@ -65,7 +65,7 @@ for (i = 0; i < length; i++) { int32_t a = p1[i]; int32_t b = p2[i]; - b = (unsigned)(dfactor * (b >> dshift) + 128 >> 8) << dshift; + b = (unsigned)((int)(dfactor * (unsigned)(b >> dshift) + 128) >> 8) << dshift; p1[i] = b - a; } } diff -Nru ffmpeg-4.1.8/libavcodec/ttadsp.c ffmpeg-4.1.9/libavcodec/ttadsp.c --- ffmpeg-4.1.8/libavcodec/ttadsp.c 2020-07-09 09:17:46.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/ttadsp.c 2022-04-17 14:18:59.000000000 +0000 @@ -47,9 +47,9 @@ *error = *in; *in += (round >> shift); - dl[4] = -dl[5]; dl[5] = -dl[6]; - dl[6] = *in - dl[7]; dl[7] = *in; - dl[5] += dl[6]; dl[4] += dl[5]; + dl[4] = -(unsigned)dl[5]; dl[5] = -(unsigned)dl[6]; + dl[6] = *in -(unsigned)dl[7]; dl[7] = *in; + dl[5] += (unsigned)dl[6]; dl[4] += (unsigned)dl[5]; } av_cold void ff_ttadsp_init(TTADSPContext *c) diff -Nru ffmpeg-4.1.8/libavcodec/vqavideo.c ffmpeg-4.1.9/libavcodec/vqavideo.c --- ffmpeg-4.1.8/libavcodec/vqavideo.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavcodec/vqavideo.c 2022-04-17 14:18:59.000000000 +0000 @@ -588,13 +588,14 @@ if (s->partial_countdown <= 0) { bytestream2_init(&s->gb, s->next_codebook_buffer, s->next_codebook_buffer_index); /* decompress codebook */ - if ((res = decode_format80(s, s->next_codebook_buffer_index, - s->codebook, s->codebook_size, 0)) < 0) - return res; + res = decode_format80(s, s->next_codebook_buffer_index, + s->codebook, s->codebook_size, 0); /* reset accounting */ s->next_codebook_buffer_index = 0; s->partial_countdown = s->partial_count; + if (res < 0) + return res; } } diff -Nru ffmpeg-4.1.8/libavfilter/vf_gblur.c ffmpeg-4.1.9/libavfilter/vf_gblur.c --- ffmpeg-4.1.8/libavfilter/vf_gblur.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavfilter/vf_gblur.c 2022-04-17 14:18:59.000000000 +0000 @@ -222,7 +222,7 @@ s->nb_planes = av_pix_fmt_count_planes(inlink->format); - s->buffer = av_malloc_array(inlink->w, inlink->h * sizeof(*s->buffer)); + s->buffer = av_malloc_array(FFALIGN(inlink->w, 16), FFALIGN(inlink->h, 16) * sizeof(*s->buffer)); if (!s->buffer) return AVERROR(ENOMEM); diff -Nru ffmpeg-4.1.8/libavfilter/vf_lenscorrection.c ffmpeg-4.1.9/libavfilter/vf_lenscorrection.c --- ffmpeg-4.1.8/libavfilter/vf_lenscorrection.c 2021-09-11 18:47:51.000000000 +0000 +++ ffmpeg-4.1.9/libavfilter/vf_lenscorrection.c 2022-04-17 14:18:59.000000000 +0000 @@ -36,8 +36,8 @@ typedef struct LenscorrectionCtx { const AVClass *av_class; - unsigned int width; - unsigned int height; + int width; + int height; int hsub, vsub; int nb_planes; double cx, cy, k1, k2; @@ -155,10 +155,8 @@ for (plane = 0; plane < rect->nb_planes; ++plane) { int hsub = plane == 1 || plane == 2 ? rect->hsub : 0; int vsub = plane == 1 || plane == 2 ? rect->vsub : 0; - int hdiv = 1 << hsub; - int vdiv = 1 << vsub; - int w = rect->width / hdiv; - int h = rect->height / vdiv; + int w = AV_CEIL_RSHIFT(rect->width, hsub); + int h = AV_CEIL_RSHIFT(rect->height, vsub); int xcenter = rect->cx * w; int ycenter = rect->cy * h; int k1 = rect->k1 * (1<<24); diff -Nru ffmpeg-4.1.8/libavfilter/vf_subtitles.c ffmpeg-4.1.9/libavfilter/vf_subtitles.c --- ffmpeg-4.1.8/libavfilter/vf_subtitles.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavfilter/vf_subtitles.c 2022-04-17 14:18:59.000000000 +0000 @@ -145,9 +145,16 @@ ff_draw_init(&ass->draw, inlink->format, ass->alpha ? FF_DRAW_PROCESS_ALPHA : 0); ass_set_frame_size (ass->renderer, inlink->w, inlink->h); - if (ass->original_w && ass->original_h) + if (ass->original_w && ass->original_h) { ass_set_aspect_ratio(ass->renderer, (double)inlink->w / inlink->h, (double)ass->original_w / ass->original_h); +#if LIBASS_VERSION > 0x01010000 + ass_set_storage_size(ass->renderer, ass->original_w, ass->original_h); + } else { + ass_set_storage_size(ass->renderer, inlink->w, inlink->h); +#endif + } + if (ass->shaping != -1) ass_set_shaper(ass->renderer, ass->shaping); diff -Nru ffmpeg-4.1.8/libavformat/4xm.c ffmpeg-4.1.9/libavformat/4xm.c --- ffmpeg-4.1.8/libavformat/4xm.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/4xm.c 2022-04-17 14:18:59.000000000 +0000 @@ -137,7 +137,8 @@ return AVERROR_INVALIDDATA; track = AV_RL32(buf + 8); - if ((unsigned)track >= UINT_MAX / sizeof(AudioTrack) - 1) { + if ((unsigned)track >= UINT_MAX / sizeof(AudioTrack) - 1 || + track >= s->max_streams) { av_log(s, AV_LOG_ERROR, "current_track too large\n"); return AVERROR_INVALIDDATA; } @@ -148,6 +149,9 @@ memset(&fourxm->tracks[fourxm->track_count], 0, sizeof(AudioTrack) * (track + 1 - fourxm->track_count)); fourxm->track_count = track + 1; + } else { + if (fourxm->tracks[track].bits) + return AVERROR_INVALIDDATA; } fourxm->tracks[track].adpcm = AV_RL32(buf + 12); fourxm->tracks[track].channels = AV_RL32(buf + 36); diff -Nru ffmpeg-4.1.8/libavformat/aiffdec.c ffmpeg-4.1.9/libavformat/aiffdec.c --- ffmpeg-4.1.8/libavformat/aiffdec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/aiffdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -121,6 +121,9 @@ sample_rate = val << exp; else sample_rate = (val + (1ULL<<(-exp-1))) >> -exp; + if (sample_rate <= 0) + return AVERROR_INVALIDDATA; + par->sample_rate = sample_rate; if (size < 18) return AVERROR_INVALIDDATA; @@ -183,8 +186,10 @@ par->block_align = (av_get_bits_per_sample(par->codec_id) * par->channels) >> 3; if (aiff->block_duration) { - par->bit_rate = (int64_t)par->sample_rate * (par->block_align << 3) / - aiff->block_duration; + par->bit_rate = av_rescale(par->sample_rate, par->block_align * 8LL, + aiff->block_duration); + if (par->bit_rate < 0) + par->bit_rate = 0; } /* Chunk is over */ @@ -359,7 +364,7 @@ if (!st->codecpar->block_align && st->codecpar->codec_id == AV_CODEC_ID_QCELP) { av_log(s, AV_LOG_WARNING, "qcelp without wave chunk, assuming full rate\n"); st->codecpar->block_align = 35; - } else if (!st->codecpar->block_align) { + } else if (st->codecpar->block_align <= 0) { av_log(s, AV_LOG_ERROR, "could not find COMM tag or invalid block_align value\n"); return -1; } diff -Nru ffmpeg-4.1.8/libavformat/aqtitledec.c ffmpeg-4.1.9/libavformat/aqtitledec.c --- ffmpeg-4.1.8/libavformat/aqtitledec.c 2021-10-16 18:49:20.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/aqtitledec.c 2022-04-17 14:18:59.000000000 +0000 @@ -74,7 +74,8 @@ new_event = 1; pos = avio_tell(s->pb); if (sub) { - sub->duration = frame - sub->pts; + if (frame >= sub->pts && (uint64_t)frame - sub->pts < INT64_MAX) + sub->duration = frame - sub->pts; sub = NULL; } } else if (*line) { diff -Nru ffmpeg-4.1.8/libavformat/avidec.c ffmpeg-4.1.9/libavformat/avidec.c --- ffmpeg-4.1.8/libavformat/avidec.c 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/avidec.c 2022-04-17 14:18:59.000000000 +0000 @@ -232,6 +232,8 @@ } else { int64_t offset, pos; int duration; + int ret; + offset = avio_rl64(pb); avio_rl32(pb); /* size */ duration = avio_rl32(pb); @@ -249,7 +251,7 @@ if (avio_seek(pb, offset + 8, SEEK_SET) < 0) return -1; avi->odml_depth++; - read_odml_index(s, frame_num); + ret = read_odml_index(s, frame_num); avi->odml_depth--; frame_num += duration; @@ -257,7 +259,8 @@ av_log(s, AV_LOG_ERROR, "Failed to restore position after reading index\n"); return -1; } - + if (ret < 0) + return ret; } } avi->index_loaded = 2; @@ -840,6 +843,8 @@ memcpy(st->codecpar->extradata + st->codecpar->extradata_size - 9, "BottomUp", 9); } + if (st->codecpar->height == INT_MIN) + return AVERROR_INVALIDDATA; st->codecpar->height = FFABS(st->codecpar->height); // avio_skip(pb, size - 5 * 4); diff -Nru ffmpeg-4.1.8/libavformat/cafdec.c ffmpeg-4.1.9/libavformat/cafdec.c --- ffmpeg-4.1.8/libavformat/cafdec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/cafdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -243,6 +243,8 @@ char value[1024]; avio_get_str(pb, INT_MAX, key, sizeof(key)); avio_get_str(pb, INT_MAX, value, sizeof(value)); + if (!*key) + continue; av_dict_set(&s->metadata, key, value, 0); } } diff -Nru ffmpeg-4.1.8/libavformat/flvdec.c ffmpeg-4.1.9/libavformat/flvdec.c --- ffmpeg-4.1.8/libavformat/flvdec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/flvdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -434,6 +434,8 @@ d = av_int2double(avio_rb64(ioc)); if (isnan(d) || d < INT64_MIN || d > INT64_MAX) goto invalid; + if (current_array == × && (d <= INT64_MIN / 1000 || d >= INT64_MAX / 1000)) + goto invalid; current_array[0][i] = d; } if (times && filepositions) { diff -Nru ffmpeg-4.1.8/libavformat/hls.c ffmpeg-4.1.9/libavformat/hls.c --- ffmpeg-4.1.8/libavformat/hls.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/hls.c 2022-04-17 14:18:59.000000000 +0000 @@ -786,10 +786,16 @@ &info); new_rendition(c, &info, url); } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", &ptr)) { + int64_t t; ret = ensure_playlist(c, &pls, url); if (ret < 0) goto fail; - pls->target_duration = strtoll(ptr, NULL, 10) * AV_TIME_BASE; + t = strtoll(ptr, NULL, 10); + if (t < 0 || t >= INT64_MAX / AV_TIME_BASE) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + pls->target_duration = t * AV_TIME_BASE; } else if (av_strstart(line, "#EXT-X-MEDIA-SEQUENCE:", &ptr)) { ret = ensure_playlist(c, &pls, url); if (ret < 0) diff -Nru ffmpeg-4.1.8/libavformat/latmenc.c ffmpeg-4.1.9/libavformat/latmenc.c --- ffmpeg-4.1.8/libavformat/latmenc.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/latmenc.c 2022-04-17 14:18:59.000000000 +0000 @@ -172,7 +172,8 @@ if (ret < 0) return ret; memcpy(par->extradata, side_data, side_data_size); - } + } else + return AVERROR_INVALIDDATA; } } diff -Nru ffmpeg-4.1.8/libavformat/matroskadec.c ffmpeg-4.1.9/libavformat/matroskadec.c --- ffmpeg-4.1.8/libavformat/matroskadec.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/matroskadec.c 2022-04-17 14:18:59.000000000 +0000 @@ -1399,7 +1399,7 @@ case MATROSKA_TRACK_ENCODING_COMP_ZLIB: { z_stream zstream = { 0 }; - if (inflateInit(&zstream) != Z_OK) + if (!pkt_size || inflateInit(&zstream) != Z_OK) return -1; zstream.next_in = data; zstream.avail_in = isize; @@ -1432,7 +1432,7 @@ case MATROSKA_TRACK_ENCODING_COMP_BZLIB: { bz_stream bzstream = { 0 }; - if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK) + if (!pkt_size || BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK) return -1; bzstream.next_in = data; bzstream.avail_in = isize; @@ -2661,6 +2661,8 @@ if (!matroska->time_scale) matroska->time_scale = 1000000; + if (isnan(matroska->duration)) + matroska->duration = 0; if (matroska->duration) matroska->ctx->duration = matroska->duration * matroska->time_scale * 1000 / AV_TIME_BASE; @@ -3657,7 +3659,9 @@ int i; int nb_index_entries = s->streams[0]->nb_index_entries; AVIndexEntry *index_entries = s->streams[0]->index_entries; - if (ts >= matroska->duration * matroska->time_scale) return (CueDesc) {-1, -1, -1, -1}; + + if (ts >= (int64_t)(matroska->duration * matroska->time_scale)) + return (CueDesc) {-1, -1, -1, -1}; for (i = 1; i < nb_index_entries; i++) { if (index_entries[i - 1].timestamp * matroska->time_scale <= ts && index_entries[i].timestamp * matroska->time_scale > ts) { @@ -3839,6 +3843,8 @@ // prebuffered. pre_bytes = desc_end.end_offset - desc_end.start_offset; pre_ns = desc_end.end_time_ns - desc_end.start_time_ns; + if (pre_ns <= 0) + return -1; pre_sec = pre_ns / nano_seconds_per_second; prebuffer_bytes += pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / pre_sec); @@ -3850,12 +3856,16 @@ do { int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; - double desc_sec = desc_ns / nano_seconds_per_second; - double calc_bits_per_second = (desc_bytes * 8) / desc_sec; + double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; + if (desc_bytes <= 0) + return -1; + + desc_sec = desc_ns / nano_seconds_per_second; + calc_bits_per_second = (desc_bytes * 8) / desc_sec; // Drop the bps by the percentage of bytes buffered. - double percent = (desc_bytes - prebuffer_bytes) / desc_bytes; - double mod_bits_per_second = calc_bits_per_second * percent; + percent = (desc_bytes - prebuffer_bytes) / desc_bytes; + mod_bits_per_second = calc_bits_per_second * percent; if (prebuffer < desc_sec) { double search_sec = diff -Nru ffmpeg-4.1.8/libavformat/mov.c ffmpeg-4.1.9/libavformat/mov.c --- ffmpeg-4.1.8/libavformat/mov.c 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/mov.c 2022-04-17 14:18:59.000000000 +0000 @@ -603,11 +603,13 @@ for (i = 0; i < entries; i++) { MOVDref *dref = &sc->drefs[i]; uint32_t size = avio_rb32(pb); - int64_t next = avio_tell(pb) + size - 4; + int64_t next = avio_tell(pb); - if (size < 12) + if (size < 12 || next < 0 || next > INT64_MAX - size) return AVERROR_INVALIDDATA; + next += size - 4; + dref->type = avio_rl32(pb); avio_rb32(pb); // version + flags @@ -1907,6 +1909,8 @@ // wrap a whole fiel atom inside of a glbl atom. unsigned size = avio_rb32(pb); unsigned type = avio_rl32(pb); + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; avio_seek(pb, -8, SEEK_CUR); if (type == MKTAG('f','i','e','l') && size == atom.size) return mov_read_default(c, pb, atom); @@ -2524,6 +2528,10 @@ av_log(c->fc, AV_LOG_ERROR, "Invalid sample rate %d\n", st->codecpar->sample_rate); return AVERROR_INVALIDDATA; } + if (st->codecpar->channels < 0) { + av_log(c->fc, AV_LOG_ERROR, "Invalid channels %d\n", st->codecpar->channels); + return AVERROR_INVALIDDATA; + } } else if (st->codecpar->codec_type==AVMEDIA_TYPE_SUBTITLE){ mov_parse_stsd_subtitle(c, pb, st, sc, size - (avio_tell(pb) - start_pos)); @@ -5033,6 +5041,8 @@ avio_rb16(pb); // reserved item_count = avio_rb16(pb); + if (item_count == 0) + return AVERROR_INVALIDDATA; for (i = 0; i < item_count; i++) { int index; @@ -5339,6 +5349,9 @@ av_log(c->fc, AV_LOG_WARNING, "Unsupported Mastering Display Metadata box version %d\n", version); return 0; } + if (sc->mastering) + return AVERROR_INVALIDDATA; + avio_skip(pb, 3); /* flags */ sc->mastering = av_mastering_display_metadata_alloc(); @@ -6038,6 +6051,8 @@ } if (pb->eof_reached) { av_log(c->fc, AV_LOG_ERROR, "Hit EOF while reading senc\n"); + if (ret >= 0) + av_encryption_info_free(encryption_index->encrypted_samples[i]); ret = AVERROR_INVALIDDATA; } @@ -6886,6 +6901,8 @@ if (a.size == 0) { a.size = atom.size - total_size + 8; } + if (a.size < 0) + break; a.size -= 8; if (a.size < 0) break; diff -Nru ffmpeg-4.1.8/libavformat/movenc.c ffmpeg-4.1.9/libavformat/movenc.c --- ffmpeg-4.1.8/libavformat/movenc.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/movenc.c 2022-04-17 14:18:59.000000000 +0000 @@ -1534,6 +1534,10 @@ { unsigned int tag = track->par->codec_tag; + // "rtp " is used to distinguish internally created RTP-hint tracks + // (with rtp_ctx) from other tracks. + if (tag == MKTAG('r','t','p',' ')) + tag = 0; if (!tag || (s->strict_std_compliance >= FF_COMPLIANCE_NORMAL && (track->par->codec_id == AV_CODEC_ID_DVVIDEO || track->par->codec_id == AV_CODEC_ID_RAWVIDEO || diff -Nru ffmpeg-4.1.8/libavformat/mpegenc.c ffmpeg-4.1.9/libavformat/mpegenc.c --- ffmpeg-4.1.8/libavformat/mpegenc.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/mpegenc.c 2022-04-17 14:18:59.000000000 +0000 @@ -48,9 +48,9 @@ uint8_t id; int max_buffer_size; /* in bytes */ int buffer_index; - PacketDesc *predecode_packet; + PacketDesc *predecode_packet; /* start of packet queue */ + PacketDesc *last_packet; /* end of packet queue */ PacketDesc *premux_packet; - PacketDesc **next_packet; int packet_number; uint8_t lpcm_header[3]; int lpcm_align; @@ -966,6 +966,8 @@ } stream->buffer_index -= pkt_desc->size; stream->predecode_packet = pkt_desc->next; + if (!stream->predecode_packet) + stream->last_packet = NULL; av_freep(&pkt_desc); } } @@ -1157,12 +1159,16 @@ av_log(ctx, AV_LOG_TRACE, "dts:%f pts:%f flags:%d stream:%d nopts:%d\n", dts / 90000.0, pts / 90000.0, pkt->flags, pkt->stream_index, pts != AV_NOPTS_VALUE); - if (!stream->premux_packet) - stream->next_packet = &stream->premux_packet; - *stream->next_packet = pkt_desc = av_mallocz(sizeof(PacketDesc)); if (!pkt_desc) return AVERROR(ENOMEM); + if (!stream->predecode_packet) { + stream->predecode_packet = pkt_desc; + } else + stream->last_packet->next = pkt_desc; + stream->last_packet = pkt_desc; + if (!stream->premux_packet) + stream->premux_packet = pkt_desc; pkt_desc->pts = pts; pkt_desc->dts = dts; @@ -1180,9 +1186,6 @@ pkt_desc->unwritten_size = pkt_desc->size = size; - if (!stream->predecode_packet) - stream->predecode_packet = pkt_desc; - stream->next_packet = &pkt_desc->next; if (av_fifo_realloc2(stream->fifo, av_fifo_size(stream->fifo) + size) < 0) return -1; diff -Nru ffmpeg-4.1.8/libavformat/mxfdec.c ffmpeg-4.1.9/libavformat/mxfdec.c --- ffmpeg-4.1.8/libavformat/mxfdec.c 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/mxfdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -1060,6 +1060,9 @@ { int i, length; + if (segment->temporal_offset_entries) + return AVERROR_INVALIDDATA; + segment->nb_index_entries = avio_rb32(pb); length = avio_rb32(pb); diff -Nru ffmpeg-4.1.8/libavformat/mxfenc.c ffmpeg-4.1.9/libavformat/mxfenc.c --- ffmpeg-4.1.8/libavformat/mxfenc.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/mxfenc.c 2022-04-17 14:18:59.000000000 +0000 @@ -1857,8 +1857,7 @@ index_byte_count = 80; if (index_byte_count) { - // add encoded ber length - index_byte_count += 16 + klv_ber_length(index_byte_count); + index_byte_count += 16 + 4; // add encoded ber4 length index_byte_count += klv_fill_size(index_byte_count); } diff -Nru ffmpeg-4.1.8/libavformat/rmdec.c ffmpeg-4.1.9/libavformat/rmdec.c --- ffmpeg-4.1.8/libavformat/rmdec.c 2021-10-17 17:49:41.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/rmdec.c 2022-04-17 14:18:59.000000000 +0000 @@ -127,10 +127,6 @@ uint32_t version; int ret; - // Duplicate tags - if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) - return AVERROR_INVALIDDATA; - /* ra type header */ version = avio_rb16(pb); /* version */ if (version == 3) { @@ -330,6 +326,11 @@ if (codec_data_size == 0) return 0; + // Duplicate tags + if ( st->codecpar->codec_type != AVMEDIA_TYPE_UNKNOWN + && st->codecpar->codec_type != AVMEDIA_TYPE_DATA) + return AVERROR_INVALIDDATA; + avpriv_set_pts_info(st, 64, 1, 1000); codec_pos = avio_tell(pb); v = avio_rb32(pb); diff -Nru ffmpeg-4.1.8/libavformat/tty.c ffmpeg-4.1.9/libavformat/tty.c --- ffmpeg-4.1.8/libavformat/tty.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/tty.c 2022-04-17 14:18:59.000000000 +0000 @@ -34,6 +34,13 @@ #include "internal.h" #include "sauce.h" +static int isansicode(int x) +{ + return x == 0x1B || x == 0x0A || x == 0x0D || (x >= 0x20 && x < 0x7f); +} + +static const char tty_extensions[31] = "ans,art,asc,diz,ice,nfo,txt,vt"; + typedef struct TtyDemuxContext { AVClass *class; int chars_per_frame; @@ -42,6 +49,17 @@ AVRational framerate; /**< Set by a private option. */ } TtyDemuxContext; +static int read_probe(const AVProbeData *p) +{ + int cnt = 0; + + for (int i = 0; i < p->buf_size; i++) + cnt += !!isansicode(p->buf[i]); + + return (cnt * 100LL / p->buf_size) * (cnt > 400) * + !!av_match_ext(p->filename, tty_extensions); +} + /** * Parse EFI header */ @@ -153,8 +171,9 @@ .name = "tty", .long_name = NULL_IF_CONFIG_SMALL("Tele-typewriter"), .priv_data_size = sizeof(TtyDemuxContext), + .read_probe = read_probe, .read_header = read_header, .read_packet = read_packet, - .extensions = "ans,art,asc,diz,ice,nfo,txt,vt", + .extensions = tty_extensions, .priv_class = &tty_demuxer_class, }; diff -Nru ffmpeg-4.1.8/libavformat/utils.c ffmpeg-4.1.9/libavformat/utils.c --- ffmpeg-4.1.8/libavformat/utils.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/utils.c 2022-04-17 14:18:59.000000000 +0000 @@ -4951,7 +4951,7 @@ key_len = ptr - key; callback_get_buf(context, key, key_len, &dest, &dest_len); - dest_end = dest + dest_len - 1; + dest_end = dest ? dest + dest_len - 1 : NULL; if (*ptr == '\"') { ptr++; diff -Nru ffmpeg-4.1.8/libavformat/webmdashenc.c ffmpeg-4.1.9/libavformat/webmdashenc.c --- ffmpeg-4.1.8/libavformat/webmdashenc.c 2021-10-17 17:49:39.000000000 +0000 +++ ffmpeg-4.1.9/libavformat/webmdashenc.c 2022-04-17 14:18:59.000000000 +0000 @@ -104,7 +104,7 @@ } avio_printf(s->pb, " minBufferTime=\"PT%gS\"\n", min_buffer_time); avio_printf(s->pb, " profiles=\"%s\"%s", - w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : "urn:webm:dash:profile:webm-on-demand:2012", + w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : "urn:mpeg:dash:profile:webm-on-demand:2012", w->is_live ? "\n" : ">\n"); if (w->is_live) { time_t local_time = time(NULL); diff -Nru ffmpeg-4.1.8/libavutil/mathematics.h ffmpeg-4.1.9/libavutil/mathematics.h --- ffmpeg-4.1.8/libavutil/mathematics.h 2020-07-09 09:17:46.000000000 +0000 +++ ffmpeg-4.1.9/libavutil/mathematics.h 2022-04-17 14:18:59.000000000 +0000 @@ -134,6 +134,7 @@ * * The operation is mathematically equivalent to `a * b / c`, but writing that * directly can overflow, and does not support different rounding methods. + * If the result is not representable then INT64_MIN is returned. * * @see av_rescale(), av_rescale_q(), av_rescale_q_rnd() */ diff -Nru ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest --- ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest 2020-04-27 21:48:16.000000000 +0000 +++ ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest 2022-04-17 14:18:59.000000000 +0000 @@ -6,7 +6,7 @@ type="static" mediaPresentationDuration="PT32.501S" minBufferTime="PT1S" - profiles="urn:webm:dash:profile:webm-on-demand:2012"> + profiles="urn:mpeg:dash:profile:webm-on-demand:2012"> diff -Nru ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-representations ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-representations --- ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-representations 2020-04-27 21:48:16.000000000 +0000 +++ ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-representations 2022-04-17 14:18:59.000000000 +0000 @@ -6,7 +6,7 @@ type="static" mediaPresentationDuration="PT32.48S" minBufferTime="PT1S" - profiles="urn:webm:dash:profile:webm-on-demand:2012"> + profiles="urn:mpeg:dash:profile:webm-on-demand:2012"> diff -Nru ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-unaligned-audio-streams ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-unaligned-audio-streams --- ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-unaligned-audio-streams 2020-04-27 21:48:16.000000000 +0000 +++ ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-unaligned-audio-streams 2022-04-17 14:18:59.000000000 +0000 @@ -6,7 +6,7 @@ type="static" mediaPresentationDuration="PT32.501S" minBufferTime="PT1S" - profiles="urn:webm:dash:profile:webm-on-demand:2012"> + profiles="urn:mpeg:dash:profile:webm-on-demand:2012"> diff -Nru ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-unaligned-video-streams ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-unaligned-video-streams --- ffmpeg-4.1.8/tests/ref/fate/webm-dash-manifest-unaligned-video-streams 2020-04-27 21:48:16.000000000 +0000 +++ ffmpeg-4.1.9/tests/ref/fate/webm-dash-manifest-unaligned-video-streams 2022-04-17 14:18:59.000000000 +0000 @@ -6,7 +6,7 @@ type="static" mediaPresentationDuration="PT32.48S" minBufferTime="PT1S" - profiles="urn:webm:dash:profile:webm-on-demand:2012"> + profiles="urn:mpeg:dash:profile:webm-on-demand:2012">