Version in base suite: 7.1.1-1 Base version: ffmpeg_7.1.1-1 Target version: ffmpeg_7.1.2-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/ffmpeg/ffmpeg_7.1.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/ffmpeg/ffmpeg_7.1.2-0+deb13u1.dsc Changelog | 152 ++++++++++++++++++++ MAINTAINERS | 1 RELEASE | 2 VERSION | 2 configure | 24 +++ debian/changelog | 7 debian/gbp.conf | 4 doc/Doxyfile | 2 doc/examples/avio_read_callback.c | 1 doc/examples/decode_audio.c | 6 doc/examples/vaapi_encode.c | 2 doc/fate_config.sh.template | 2 doc/git-howto.texi | 2 fftools/cmdutils.c | 5 fftools/ffmpeg.c | 5 fftools/ffmpeg_demux.c | 24 +++ fftools/ffmpeg_filter.c | 4 fftools/ffmpeg_mux_init.c | 8 - libavcodec/Makefile | 2 libavcodec/aac/aacdec.c | 31 +++- libavcodec/aac/aacdec.h | 4 libavcodec/aac/aacdec_usac.c | 37 +++-- libavcodec/aacenc_tns.c | 33 +++- libavcodec/aacsbr_template.c | 6 libavcodec/alsdec.c | 8 - libavcodec/bsf/h264_mp4toannexb.c | 22 +-- libavcodec/cbs_h266_syntax_template.c | 24 +-- libavcodec/cfhd.c | 4 libavcodec/cri.c | 10 - libavcodec/d3d12va_encode.c | 13 - libavcodec/decode.c | 39 ++++- libavcodec/dxv.c | 48 ++++-- libavcodec/exr.c | 30 +++- libavcodec/ffv1.c | 2 libavcodec/ffv1dec.c | 21 ++ libavcodec/fits.c | 2 libavcodec/g726.c | 2 libavcodec/h264_mb.c | 2 libavcodec/h264_slice.c | 7 libavcodec/hevc/hevcdec.c | 6 libavcodec/hevc/ps.c | 4 libavcodec/iff.c | 2 libavcodec/ilbcdec.c | 2 libavcodec/imc.c | 2 libavcodec/ivi.c | 8 - libavcodec/jpeg2000dec.c | 35 +++- libavcodec/jpegxl_parser.c | 9 + libavcodec/lcevcdec.c | 69 +++++---- libavcodec/lcevcdec.h | 5 libavcodec/librsvgdec.c | 4 libavcodec/libsvtav1.c | 4 libavcodec/libtheoraenc.c | 2 libavcodec/libvorbisdec.c | 6 libavcodec/libzvbi-teletextdec.c | 6 libavcodec/lzf.c | 28 +++ libavcodec/lzf.h | 2 libavcodec/mediacodecdec_common.c | 3 libavcodec/mjpegdec.c | 12 - libavcodec/motion_est.c | 6 libavcodec/mpc8.c | 8 - libavcodec/mpegvideo_dec.c | 2 libavcodec/mss2dsp.c | 2 libavcodec/notchlc.c | 5 libavcodec/opus/dec.c | 3 libavcodec/osq.c | 13 + libavcodec/psd.c | 6 libavcodec/sanm.c | 5 libavcodec/scpr3.c | 2 libavcodec/shorten.c | 7 libavcodec/smacker.c | 10 - libavcodec/sonic.c | 3 libavcodec/speexdec.c | 16 +- libavcodec/svq3.c | 1 libavcodec/takdec.c | 3 libavcodec/tests/avpacket.c | 4 libavcodec/tests/motion.c | 4 libavcodec/tests/snowenc.c | 7 libavcodec/utvideodec.c | 4 libavcodec/videotoolbox_vp9.c | 6 libavcodec/vorbisdec.c | 6 libavcodec/vqavideo.c | 10 - libavcodec/vvc/intra.c | 6 libavfilter/af_firequalizer.c | 2 libavfilter/avf_showcqt.c | 4 libavfilter/avfilter.c | 16 -- libavfilter/avfiltergraph.c | 4 libavfilter/dnn/dnn_backend_tf.c | 2 libavfilter/vaf_spectrumsynth.c | 4 libavfilter/vf_setparams.c | 2 libavformat/asfdec_f.c | 6 libavformat/avidec.c | 4 libavformat/concatdec.c | 2 libavformat/dashdec.c | 13 + libavformat/hls.c | 40 +++-- libavformat/iamf_parse.c | 24 ++- libavformat/iff.c | 4 libavformat/imf_cpl.c | 46 +++--- libavformat/libopenmpt.c | 10 + libavformat/lrcdec.c | 18 +- libavformat/matroska.c | 1 libavformat/matroskadec.c | 7 libavformat/matroskaenc.c | 4 libavformat/mov.c | 13 + libavformat/movenc.c | 4 libavformat/mxg.c | 2 libavformat/vqf.c | 5 libavformat/wavdec.c | 2 libpostproc/postprocess.c | 5 libpostproc/postprocess_altivec_template.c | 5 libpostproc/postprocess_template.c | 20 +- libswscale/output.c | 6 libswscale/ppc/yuv2rgb_altivec.c | 4 libswscale/swscale_unscaled.c | 9 - tests/fate/filter-video.mak | 2 tests/fate/h264.mak | 4 tests/ref/fate/copy-trac3074 | 4 tests/ref/fate/sub-scc | 212 ++++++++++++++--------------- 117 files changed, 1016 insertions(+), 442 deletions(-) diff -Nru ffmpeg-7.1.1/Changelog ffmpeg-7.1.2/Changelog --- ffmpeg-7.1.1/Changelog 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/Changelog 2025-09-14 19:20:09.000000000 +0000 @@ -1,6 +1,158 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 7.1.2: + doc/examples/vaapi_encode: fix invalid check on fwrite + avcodec/librsvgdec: fix compilation with librsvg 2.50.3 + fftools/ffmpeg: fix gracefully shutdown + fftools/ffmpeg_demux: ensure the display_rotation option is honored + avcodec/mjpegdec: use ff_frame_new_side_data() to export display matrix + aacdec_usac: use RefStruct to track unfinished extension buffers + avcode: Use av_fast_realloc() in ff_lzf_uncompress() + avcodec/dxv: Check coded_height, to avoid invalid av_clip() + avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame + avformat/lrcdec: Fix fate-sub-lrc-ms-remux on x86-32 + avcodec/sanm: Check w,h,left,top + avcodec/utvideodec: Clear plane_start array + fftools/ffmpeg_mux_init: Use 64bit for score computation in map_auto_video() + libavfilter/dnn/dnn_backend_tf: Remove redundant av_freep() to avoid double free + avcodec/dxv: Use av_fast_realloc() for op_data + avcodec/dxv: Use av_fast_realloc() and clear all new space + avcodec/dxv: Clear ctex + avcodec/dxv: Check that we initialize op_data + avcodec/exr: Check for pixel type consistency in DWA + avcodec/d3d12va_encode: fix label followed by a declaration warning + avcodec/libvorbisdec: avoid overflow when assinging sample rate from long to int + avcodec/g726: init missing sample rate + avformat/lrcdec: limit input timestamp range to avoid overflows + avcodec/scpr3: Clear clr + avcodec/ilbcdec: Clear cbvec when used with create_augmented_vector() + avcodec/jpeg2000dec: Make sure the 4 extra bytes allocated are initialized + avfilter/avf_showcqt: fix unbounded index when copying to fft_data + avcodec/aac/aacdec_usac: Limit sfo from noise offset to be above -200 + avcodec/aacsbr_template: Check ilb + avcodec/utvideodec: Set B for the width= 1 case + avcodec/ffv1: Clear state on alloc + avcodec/jpeg2000dec: implement cdef remapping during pixel format matching + avcodec/jpeg2000dec: move cdef default check into get_siz() + avcodec/exr: Check rle_raw_data and surroundings + avcodec/exr: Dont access outside xsize/ysize + examples: Add check and replace av_free() to avoid potential memory errors + libavcodec/tests/snowenc: Add av_free() to avoid memory leak + libavfilter/af_firequalizer: Add check for av_malloc_array() + libavcodec/videotoolbox_vp9: Move av_malloc() to avoid memory leak + avcodec/mpc8: init avctx->sample_rate + avcodec/cbs_h266_syntax_template: fix out of bounds access + avformat/libopenmpt: fix seeking weirdness + avformat/hls: add cmfv/cmfa exceptions + avformat/lrcdec: support arbitrary precision timestamp + libavcodec/tests/motion: Add check for avcodec_alloc_context3() + avcodec/tests/avpacket: Add av_free() to avoid memory leak + examples: Add av_freep to avoid potential memory leak + avcodec/tests/avpacket: Add av_packet_free() to avoid memory leak + avcodec/fits: Clear naxis + avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer + avcodec/lzf: Check for input space + avcodec/imc: Clear padding of buf16 + avcodec/iff: Clear ham_buf + avcodec/cri: Check bytestream2_get_buffer() for end + avcodec/cri: Factor read_len out + avformat/dashdec: Allocate space for appended "/" + avcodec/mpegvideo_dec: Fix lowres=3 field select interlaced mpeg4 frame + avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE + avcodec/shorten: Clear the additionally allocated space on realloc + avformat/vqf: Ensure that comm_chunk is fully read + avformat/mov: make sure file_checksum is fully initialized + avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation + avformat/asfdec_f: Check amount of value read + avcodec/jpegxl_parser: add sanity check for frame size + avcodec/ffv1dec: don't check chroma_planes for f->colorspace > 0 + avcodec/ffv1dec: don't add offsets to more NULL pointers + avformat/concatdec: Clip duration in one more case in get_best_effort_duration() + avcodec/ffv1dec: Check k in get_vlc_symbol() + avcodec/cfhd: Check idwt_buf size before allocation + avcodec/ivi: Check luma/chroma mb_size + avfilter/vaf_spectrumsynth: don't use uninitialized variable as scale + avcodec/motion_est: don't add offsets to NULL pointers + swscale/swscale_unscaled: don't add offsets to NULL pointers + avcodec/ffv1dec: don't add offsets to NULL pointers + libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc() + avcodec/psd: Move frame allocation after RLE processing + avcodec/smacker: Move buffer allocation to later + fftools/cmdutils: don't try to load arguments from file if not needed + avcodec/opus: don't materialize buf pointer from null + avfilter/avfilter: fix forwarding EOF for simple API filters in filter_activate_default + avcodec/speexdec: consider differing frame sizes in remaining space check + lavc/vvc: Fix condition for using default scaling factor + avformat/mov: Check that sample_count is allocated in mov_parse_heif_items() + avformat/iff: Check nb_channels == 0 in CHNL + avcodec/osq: Request a coding mode 2 sample + avcodec/osq: Switch back to av_ceil_log2() + avcodec/osq: Add note about update_stats() count + avcodec/osq: Fix signed integer overflow in update_stats() + avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer + avformat/movenc: fix writing reserved bits in EC3SpecificBox + avcodec/hevc/hevcdec: Check num_entry_point_offsets + avcodec/speexdec: Pass and check remaining packets to decode functions + swscale/swscale_unscaled: use 8 line alignment for planarCopyWrapper with dithering + aacenc_tns: clamp filter direction energy measurement + fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated + avformat/iamf_parse: prevent overreads in update_extradata + avformat/iamf_parse: increase PutBytes buffer when writing AAC extradata + avformat/matroskadec: check that channels fit in signed 32bit int + avcodec/takdec: Check remaining space for first predictors + avcodec/svq3: Check there are bits left before decompression + avcodec/sonic: Check num_taps + avformat/imf_cpl: fix indention after previous commit + avformat/imf_cpl: do not continue looping forever + avformat/mov: reject negative ELST durations + avformat/avidec: Ignore duplicate GAB2 + MAINTAINERS: Add entry for samples-request + avcodec/h264_mb: Fix tmp_cr for arm + avcodec/vorbisdec: Dont treat overread as error + avcodec/hevc/ps: Fix dependant layer id check + avformat/iff: Check nb_channels == 0 in MHDR + tests/fate/filter-video: Fix dependancy for codecview + postproc/postprocess_template: fix dering with a 16x16 image + libpostproc: check minimum size + avformat/hls: Fix flash1.bogulus.cfd support + avformat/hls: Split allowed_segment_extensions off allowed_extensions + avformat/hls: Fix Youtube AAC + avformat/hls: add fmp4 to allowed_extensions + avformat/hls: Add ec3 to allowed_extensions + avformat/hls: Add cmfv and cmfa to allowed_extensions + postproc/postprocess_template: fix handling of first row of dering_C + postproc/postprocess_template: Fix reading uninitialized pixels in dering_C() + configure: Clearer documentation for "disable-safe-bitstream-reader" + avcodec/osq: avoid undefined negation + swscale/output: Fix integer overflow in yuv2gbrp_full_X_c() + avcodec/libtheora: fix setting keyframe_mask + doc: replace http/git by https urls + Revert "avformat/mpegts: update stream info when PMT ES stream_type changes" + avformat/matroska: Support JPEG2000 for demuxing + avformat/matroskadec: Fix VfW extradata size + configure: Use MSYSTEM_CARCH for default arch on msys2 + avcodec/lcevcdec: don't try to write to output frames directly + avfilter/avfiltergraph: fix regression in picking channel layout + avformat/mpegts: update stream info when PMT ES stream_type changes + avcodec/libzvbi-teletextdec: change new lines to \n in ASS header + avformat/wavdec: increase requested probe score for codec probe + avcodec/h264_slice: insert LCEVC side data before get_buffer() call + avformat/hls: Fix get key file error + avcodec/bsf/h264_mp4toannexb: Fix mixed bitstream format + avformat/mov: Reduce seek when interleaved_read is disabled + avfilter/vf_setparams: Fix chroma_location being cleared + configure: Enable -fno-common for Darwin targets, avoid linker warnings + configure: Only try to use the -no_warn_duplicate_libraries flag on Darwin + configure: Silence Xcode warnings about duplicate libraries + avcodec/mediacodecdec_common: Workaround MTK broken crop implementation + avcodec/Makefile: include aom_film_grain.o file for h264_sei component + lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang v2 + lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang + avcodec/libsvtav1: unbreak build with latest svtav1 + fftools/ffmpeg_filter: also remove display matrix side data from buffered frames + + version 7.1.1: avformat/hls: Partially revert "reduce default max reload to 3" avformat/mov: (v4) fix get_eia608_packet diff -Nru ffmpeg-7.1.1/MAINTAINERS ffmpeg-7.1.2/MAINTAINERS --- ffmpeg-7.1.1/MAINTAINERS 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/MAINTAINERS 2025-09-14 19:20:09.000000000 +0000 @@ -56,6 +56,7 @@ metadata subsystem Aurelien Jacobs release management Michael Niedermayer API tests [0] +samples-request [2] Thilo Borgmann, James Almer, Ben Littler Communication diff -Nru ffmpeg-7.1.1/RELEASE ffmpeg-7.1.2/RELEASE --- ffmpeg-7.1.1/RELEASE 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/RELEASE 2025-09-14 19:20:09.000000000 +0000 @@ -1 +1 @@ -7.1.1 +7.1.2 diff -Nru ffmpeg-7.1.1/VERSION ffmpeg-7.1.2/VERSION --- ffmpeg-7.1.1/VERSION 2025-03-03 00:22:08.000000000 +0000 +++ ffmpeg-7.1.2/VERSION 2025-09-14 19:20:09.000000000 +0000 @@ -1 +1 @@ -7.1.1 +7.1.2 diff -Nru ffmpeg-7.1.1/configure ffmpeg-7.1.2/configure --- ffmpeg-7.1.1/configure 2025-03-03 00:22:08.000000000 +0000 +++ ffmpeg-7.1.2/configure 2025-09-14 19:20:09.000000000 +0000 @@ -434,7 +434,9 @@ --enable-hardcoded-tables use hardcoded tables instead of runtime generation --disable-safe-bitstream-reader disable buffer boundary checking in bitreaders - (faster, but may crash) + (This disables some security checks and can cause undefined behavior, + crashes and arbitrary code execution, it may be faster, but + should only be used with trusted input) --sws-max-filter-size=N the max filter size swscale uses [$sws_max_filter_size_default] Optimization options (experts only): @@ -2212,6 +2214,7 @@ ldbrx power8 ppc4xx + vec_xl vsx " @@ -2759,6 +2762,7 @@ dcbzl_deps="ppc" ldbrx_deps="ppc" ppc4xx_deps="ppc" +vec_xl_deps="altivec" vsx_deps="altivec" power8_deps="vsx" @@ -4110,6 +4114,8 @@ arch_default=$(uname -p) strip_default="strip -X32_64" nm_default="nm -g -X32_64" +elif test "$MSYSTEM_CARCH" != ""; then + arch_default="$MSYSTEM_CARCH" else arch_default=$(uname -m) fi @@ -5805,6 +5811,13 @@ clang_version=$($cc -dumpversion) test ${clang_version%%.*} -eq 11 && add_cflags -fno-stack-check fi + + # Xcode Clang doesn't default to -fno-common while upstream llvm.org + # Clang (and GCC) do. This avoids linker warnings on Xcode 16.3 about + # "reducing alignment of section __DATA,__common from 0x8000 to 0x4000 + # because it exceeds segment maximum alignment". + check_cflags -fno-common + ;; msys*) die "Native MSYS builds are discouraged, please use the MINGW environment." @@ -6389,6 +6402,11 @@ check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)" fi + if enabled altivec; then + check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 }; + vector unsigned char y0 = vec_xl(0, y1i);" + fi + elif enabled riscv; then enabled rv && check_inline_asm rv '".option arch, +zbb\nrev8 t0, t1"' @@ -6480,6 +6498,9 @@ check_ldflags -Wl,--as-needed check_ldflags -Wl,-z,noexecstack +if [ $target_os = "darwin" ]; then + check_ldflags -Wl,-no_warn_duplicate_libraries +fi if ! disabled network; then check_func getaddrinfo $network_extralibs @@ -7941,6 +7962,7 @@ echo "POWER8 enabled ${power8-no}" echo "PPC 4xx optimizations ${ppc4xx-no}" echo "dcbzl available ${dcbzl-no}" + echo "vec_xl available ${vec_xl-no}" fi if enabled loongarch; then echo "LSX enabled ${lsx-no}" diff -Nru ffmpeg-7.1.1/debian/changelog ffmpeg-7.1.2/debian/changelog --- ffmpeg-7.1.1/debian/changelog 2025-03-08 09:34:57.000000000 +0000 +++ ffmpeg-7.1.2/debian/changelog 2025-09-20 21:55:13.000000000 +0000 @@ -1,3 +1,10 @@ +ffmpeg (7:7.1.2-0+deb13u1) trixie-security; urgency=medium + + * New upstream version 7.1.2 + - Fixes CVE-2025-1594 + + -- Sebastian Ramacher Sat, 20 Sep 2025 23:55:13 +0200 + ffmpeg (7:7.1.1-1) unstable; urgency=medium * New upstream version 7.1.1 diff -Nru ffmpeg-7.1.1/debian/gbp.conf ffmpeg-7.1.2/debian/gbp.conf --- ffmpeg-7.1.1/debian/gbp.conf 2024-08-09 21:39:31.000000000 +0000 +++ ffmpeg-7.1.2/debian/gbp.conf 2025-09-20 21:55:13.000000000 +0000 @@ -1,6 +1,6 @@ [DEFAULT] pristine-tar = True -debian-branch = debian/master -upstream-branch = upstream/latest +debian-branch = debian/trixie +upstream-branch = upstream/trixie sign-tags = True filter = */.git* diff -Nru ffmpeg-7.1.1/doc/Doxyfile ffmpeg-7.1.2/doc/Doxyfile --- ffmpeg-7.1.1/doc/Doxyfile 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/doc/Doxyfile 2025-09-14 19:20:09.000000000 +0000 @@ -38,7 +38,7 @@ # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 7.1.1 +PROJECT_NUMBER = 7.1.2 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a diff -Nru ffmpeg-7.1.1/doc/examples/avio_read_callback.c ffmpeg-7.1.2/doc/examples/avio_read_callback.c --- ffmpeg-7.1.1/doc/examples/avio_read_callback.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/doc/examples/avio_read_callback.c 2025-09-14 19:20:09.000000000 +0000 @@ -96,6 +96,7 @@ avio_ctx = avio_alloc_context(avio_ctx_buffer, avio_ctx_buffer_size, 0, &bd, &read_packet, NULL, NULL); if (!avio_ctx) { + av_freep(&avio_ctx_buffer); ret = AVERROR(ENOMEM); goto end; } diff -Nru ffmpeg-7.1.1/doc/examples/decode_audio.c ffmpeg-7.1.2/doc/examples/decode_audio.c --- ffmpeg-7.1.1/doc/examples/decode_audio.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/doc/examples/decode_audio.c 2025-09-14 19:20:09.000000000 +0000 @@ -128,6 +128,10 @@ outfilename = argv[2]; pkt = av_packet_alloc(); + if (!pkt) { + fprintf(stderr, "Could not allocate AVPacket\n"); + exit(1); /* or proper cleanup and returning */ + } /* find the MPEG audio decoder */ codec = avcodec_find_decoder(AV_CODEC_ID_MP2); @@ -161,7 +165,7 @@ } outfile = fopen(outfilename, "wb"); if (!outfile) { - av_free(c); + fprintf(stderr, "Could not open %s\n", outfilename); exit(1); } diff -Nru ffmpeg-7.1.1/doc/examples/vaapi_encode.c ffmpeg-7.1.2/doc/examples/vaapi_encode.c --- ffmpeg-7.1.1/doc/examples/vaapi_encode.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/doc/examples/vaapi_encode.c 2025-09-14 19:20:09.000000000 +0000 @@ -88,7 +88,7 @@ enc_pkt->stream_index = 0; ret = fwrite(enc_pkt->data, enc_pkt->size, 1, fout); av_packet_unref(enc_pkt); - if (ret != enc_pkt->size) { + if (!ret) { ret = AVERROR(errno); break; } diff -Nru ffmpeg-7.1.1/doc/fate_config.sh.template ffmpeg-7.1.2/doc/fate_config.sh.template --- ffmpeg-7.1.1/doc/fate_config.sh.template 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/doc/fate_config.sh.template 2025-09-14 19:20:09.000000000 +0000 @@ -1,5 +1,5 @@ slot= # some unique identifier -repo=git://source.ffmpeg.org/ffmpeg.git # the source repository +repo=https://git.ffmpeg.org/ffmpeg.git # the source repository #branch=release/2.6 # the branch to test samples= # path to samples directory workdir= # directory in which to do all the work diff -Nru ffmpeg-7.1.1/doc/git-howto.texi ffmpeg-7.1.2/doc/git-howto.texi --- ffmpeg-7.1.1/doc/git-howto.texi 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/doc/git-howto.texi 2025-09-14 19:20:09.000000000 +0000 @@ -143,7 +143,7 @@ @end example You may also use the graphical tools like @command{gitview} or @command{gitk} -or the web interface available at @url{http://source.ffmpeg.org/}. +or the web interface available at @url{https://git.ffmpeg.org/ffmpeg.git}. @section Checking source tree status diff -Nru ffmpeg-7.1.1/fftools/cmdutils.c ffmpeg-7.1.2/fftools/cmdutils.c --- ffmpeg-7.1.1/fftools/cmdutils.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/fftools/cmdutils.c 2025-09-14 19:20:09.000000000 +0000 @@ -255,9 +255,10 @@ if (*opt == '/') { opt++; - if (po->type == OPT_TYPE_BOOL) { + if (!opt_has_arg(po)) { av_log(NULL, AV_LOG_FATAL, - "Requested to load an argument from file for a bool option '%s'\n", + "Requested to load an argument from file for an option '%s'" + " which does not take an argument\n", po->name); return AVERROR(EINVAL); } diff -Nru ffmpeg-7.1.1/fftools/ffmpeg.c ffmpeg-7.1.2/fftools/ffmpeg.c --- ffmpeg-7.1.1/fftools/ffmpeg.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/fftools/ffmpeg.c 2025-09-14 19:20:09.000000000 +0000 @@ -789,8 +789,6 @@ { int i, key; static int64_t last_time; - if (received_nb_signals) - return AVERROR_EXIT; /* read_key() returns 0 on EOF */ if (cur_time - last_time >= 100000) { key = read_key(); @@ -874,6 +872,9 @@ while (!sch_wait(sch, stats_period, &transcode_ts)) { int64_t cur_time= av_gettime_relative(); + if (received_nb_signals) + break; + /* if 'q' pressed, exits */ if (stdin_interaction) if (check_keyboard_interaction(cur_time) < 0) diff -Nru ffmpeg-7.1.1/fftools/ffmpeg_demux.c ffmpeg-7.1.2/fftools/ffmpeg_demux.c --- ffmpeg-7.1.1/fftools/ffmpeg_demux.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/fftools/ffmpeg_demux.c 2025-09-14 19:20:09.000000000 +0000 @@ -67,6 +67,7 @@ int reinit_filters; int autorotate; int apply_cropping; + int force_display_matrix; int wrap_correction_done; @@ -912,9 +913,18 @@ if (decoding_needed && ds->sch_idx_dec < 0) { int is_audio = ist->st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO; + int is_unreliable = !!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS); + int64_t use_wallclock_as_timestamps; + + ret = av_opt_get_int(d->f.ctx, "use_wallclock_as_timestamps", 0, &use_wallclock_as_timestamps); + if (ret < 0) + return ret; + + if (use_wallclock_as_timestamps) + is_unreliable = 0; ds->dec_opts.flags |= (!!ist->fix_sub_duration * DECODER_FLAG_FIX_SUB_DURATION) | - (!!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS) * DECODER_FLAG_TS_UNRELIABLE) | + (!!is_unreliable * DECODER_FLAG_TS_UNRELIABLE) | (!!(d->loop && is_audio) * DECODER_FLAG_SEND_END_TS) #if FFMPEG_OPT_TOP | ((ist->top_field_first >= 0) * DECODER_FLAG_TOP_FIELD_FIRST) @@ -1159,6 +1169,7 @@ AVFormatContext *ctx, InputStream *ist) { AVStream *st = ist->st; + DemuxStream *ds = ds_from_ist(ist); AVPacketSideData *sd; double rotation = DBL_MAX; int hflip = -1, vflip = -1; @@ -1193,6 +1204,8 @@ hflip_set ? hflip : 0, vflip_set ? vflip : 0); + ds->force_display_matrix = 1; + return 0; } @@ -1420,6 +1433,15 @@ av_dict_set_int(&ds->decoder_opts, "apply_cropping", ds->apply_cropping && ds->apply_cropping != CROP_CONTAINER, 0); + if (ds->force_display_matrix) { + char buf[32]; + if (av_dict_get(ds->decoder_opts, "side_data_prefer_packet", NULL, 0)) + buf[0] = ','; + else + buf[0] = '\0'; + av_strlcat(buf, "displaymatrix", sizeof(buf)); + av_dict_set(&ds->decoder_opts, "side_data_prefer_packet", buf, AV_DICT_APPEND); + } /* Attached pics are sparse, therefore we would not want to delay their decoding * till EOF. */ if (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC) diff -Nru ffmpeg-7.1.1/fftools/ffmpeg_filter.c ffmpeg-7.1.2/fftools/ffmpeg_filter.c --- ffmpeg-7.1.1/fftools/ffmpeg_filter.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/fftools/ffmpeg_filter.c 2025-09-14 19:20:09.000000000 +0000 @@ -1998,6 +1998,10 @@ if (ifp->type_src == AVMEDIA_TYPE_SUBTITLE) { sub2video_frame(&ifp->ifilter, tmp, !fgt->graph); } else { + if (ifp->type_src == AVMEDIA_TYPE_VIDEO) { + if (ifp->displaymatrix_applied) + av_frame_remove_side_data(tmp, AV_FRAME_DATA_DISPLAYMATRIX); + } ret = av_buffersrc_add_frame(ifp->filter, tmp); } av_frame_free(&tmp); diff -Nru ffmpeg-7.1.1/fftools/ffmpeg_mux_init.c ffmpeg-7.1.2/fftools/ffmpeg_mux_init.c --- ffmpeg-7.1.1/fftools/ffmpeg_mux_init.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/fftools/ffmpeg_mux_init.c 2025-09-14 19:20:09.000000000 +0000 @@ -1557,7 +1557,7 @@ { AVFormatContext *oc = mux->fc; InputStream *best_ist = NULL; - int best_score = 0; + int64_t best_score = 0; int qcr; /* video: highest resolution */ @@ -1568,16 +1568,16 @@ for (int j = 0; j < nb_input_files; j++) { InputFile *ifile = input_files[j]; InputStream *file_best_ist = NULL; - int file_best_score = 0; + int64_t file_best_score = 0; for (int i = 0; i < ifile->nb_streams; i++) { InputStream *ist = ifile->streams[i]; - int score; + int64_t score; if (ist->user_set_discard == AVDISCARD_ALL || ist->st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO) continue; - score = ist->st->codecpar->width * ist->st->codecpar->height + score = ist->st->codecpar->width * (int64_t)ist->st->codecpar->height + 100000000 * !!(ist->st->event_flags & AVSTREAM_EVENT_FLAG_NEW_PACKETS) + 5000000*!!(ist->st->disposition & AV_DISPOSITION_DEFAULT); if((qcr!=MKTAG('A', 'P', 'I', 'C')) && (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC)) diff -Nru ffmpeg-7.1.1/libavcodec/Makefile ffmpeg-7.1.2/libavcodec/Makefile --- ffmpeg-7.1.1/libavcodec/Makefile 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/Makefile 2025-09-14 19:20:09.000000000 +0000 @@ -108,7 +108,7 @@ h2645data.o h2645_parse.o h2645_vui.o OBJS-$(CONFIG_H264PRED) += h264pred.o OBJS-$(CONFIG_H264QPEL) += h264qpel.o -OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o +OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o aom_film_grain.o OBJS-$(CONFIG_HEVCPARSE) += h2645data.o h2645_parse.o h2645_vui.o OBJS-$(CONFIG_HEVC_SEI) += h2645_sei.o aom_film_grain.o \ dynamic_hdr_vivid.o diff -Nru ffmpeg-7.1.1/libavcodec/aac/aacdec.c ffmpeg-7.1.2/libavcodec/aac/aacdec.c --- ffmpeg-7.1.1/libavcodec/aac/aacdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/aac/aacdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -62,6 +62,7 @@ #include "libavutil/opt.h" #include "libavutil/tx.h" #include "libavutil/version.h" +#include "libavcodec/refstruct.h" /* * supported tools @@ -421,6 +422,26 @@ return layout; } +static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src) +{ + int i; + + for (i = 0; i < src->usac.nb_elems; i++) { + AACUsacElemConfig *src_e = &src->usac.elems[i]; + AACUsacElemConfig *dst_e = &dst->usac.elems[i]; + /* dst_e->ext.pl_buf is guaranteed to be set to src_e->ext.pl_buf + * upon this function's return */ + ff_refstruct_replace(&dst_e->ext.pl_buf, src_e->ext.pl_buf); + } + + /* Unref all additional buffers to close leaks */ + for (; i < dst->usac.nb_elems; i++) + ff_refstruct_unref(&dst->usac.elems[i].ext.pl_buf); + + /* Set all other properties */ + *dst = *src; +} + /** * Save current output configuration if and only if it has been locked. */ @@ -429,7 +450,7 @@ int pushed = 0; if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) { - ac->oc[0] = ac->oc[1]; + copy_oc(&ac->oc[0], &ac->oc[1]); pushed = 1; } ac->oc[1].status = OC_NONE; @@ -443,7 +464,8 @@ static void pop_output_configuration(AACDecContext *ac) { if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) { - ac->oc[1] = ac->oc[0]; + copy_oc(&ac->oc[1], &ac->oc[0]); + ac->avctx->ch_layout = ac->oc[1].ch_layout; ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags, ac->oc[1].status, 0); @@ -466,6 +488,9 @@ uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }}; uint8_t type_counts[TYPE_END] = { 0 }; + if (get_new_frame && !ac->frame) + return AVERROR_INVALIDDATA; + if (ac->oc[1].layout_map != layout_map) { memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0])); ac->oc[1].layout_map_tags = tags; @@ -1107,7 +1132,7 @@ AACUSACConfig *usac = &oc->usac; for (int j = 0; j < usac->nb_elems; j++) { AACUsacElemConfig *ec = &usac->elems[j]; - av_freep(&ec->ext.pl_data); + ff_refstruct_unref(&ec->ext.pl_buf); } } diff -Nru ffmpeg-7.1.1/libavcodec/aac/aacdec.h ffmpeg-7.1.2/libavcodec/aac/aacdec.h --- ffmpeg-7.1.1/libavcodec/aac/aacdec.h 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/aac/aacdec.h 2025-09-14 19:20:09.000000000 +0000 @@ -344,7 +344,7 @@ uint8_t payload_frag; uint32_t default_len; uint32_t pl_data_offset; - uint8_t *pl_data; + uint8_t *pl_buf; } ext; } AACUsacElemConfig; @@ -353,7 +353,7 @@ uint16_t core_frame_len; uint16_t stream_identifier; - AACUsacElemConfig elems[64]; + AACUsacElemConfig elems[MAX_ELEM_ID]; int nb_elems; struct { diff -Nru ffmpeg-7.1.1/libavcodec/aac/aacdec_usac.c ffmpeg-7.1.2/libavcodec/aac/aacdec_usac.c --- ffmpeg-7.1.1/libavcodec/aac/aacdec_usac.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/aac/aacdec_usac.c 2025-09-14 19:20:09.000000000 +0000 @@ -24,12 +24,13 @@ #include "aacdec_ac.h" #include "libavcodec/aacsbr.h" - #include "libavcodec/aactab.h" -#include "libavutil/mem.h" #include "libavcodec/mpeg4audio.h" #include "libavcodec/unary.h" +#include "libavutil/mem.h" +#include "libavcodec/refstruct.h" + /* Number of scalefactor bands per complex prediction band, equal to 2. */ #define SFB_PER_PRED_BAND 2 @@ -1023,8 +1024,9 @@ } } - if (band_quantized_to_zero) - sce->sfo[g*ics->max_sfb + sfb] += noise_offset; + if (band_quantized_to_zero) { + sce->sfo[g*ics->max_sfb + sfb] = FFMAX(sce->sfo[g*ics->max_sfb + sfb] + noise_offset, -200); + } } coef += g_len << 7; } @@ -1573,7 +1575,6 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e, GetBitContext *gb) { - uint8_t *tmp; uint8_t pl_frag_start = 1; uint8_t pl_frag_end = 1; uint32_t len; @@ -1600,18 +1601,26 @@ if (pl_frag_start) e->ext.pl_data_offset = 0; - /* If an extension starts and ends this packet, we can directly use it */ + /* If an extension starts and ends this packet, we can directly use it below. + * Otherwise, we have to copy it to a buffer and accumulate it. */ if (!(pl_frag_start && pl_frag_end)) { - tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len); - if (!tmp) { - av_free(e->ext.pl_data); + /* Reallocate the data */ + uint8_t *tmp_buf = ff_refstruct_alloc_ext(e->ext.pl_data_offset + len, + FF_REFSTRUCT_FLAG_NO_ZEROING, + NULL, NULL); + if (!tmp_buf) return AVERROR(ENOMEM); - } - e->ext.pl_data = tmp; + + /* Copy the data over only if we had saved data to begin with */ + if (e->ext.pl_buf) + memcpy(tmp_buf, e->ext.pl_buf, e->ext.pl_data_offset); + + ff_refstruct_unref(&e->ext.pl_buf); + e->ext.pl_buf = tmp_buf; /* Readout data to a buffer */ for (int i = 0; i < len; i++) - e->ext.pl_data[e->ext.pl_data_offset + i] = get_bits(gb, 8); + e->ext.pl_buf[e->ext.pl_data_offset + i] = get_bits(gb, 8); } e->ext.pl_data_offset += len; @@ -1623,7 +1632,7 @@ GetBitContext *gb2 = gb; GetBitContext gbc; if (!(pl_frag_start && pl_frag_end)) { - ret = init_get_bits8(&gbc, e->ext.pl_data, pl_len); + ret = init_get_bits8(&gbc, e->ext.pl_buf, pl_len); if (ret < 0) return ret; @@ -1641,7 +1650,7 @@ /* This should never happen */ av_assert0(0); } - av_freep(&e->ext.pl_data); + ff_refstruct_unref(&e->ext.pl_buf); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.1/libavcodec/aacenc_tns.c ffmpeg-7.1.2/libavcodec/aacenc_tns.c --- ffmpeg-7.1.1/libavcodec/aacenc_tns.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/aacenc_tns.c 2025-09-14 19:20:09.000000000 +0000 @@ -173,6 +173,7 @@ sce->ics.window_sequence[0] == LONG_START_SEQUENCE ? 0 : 2; const int sfb_len = sfb_end - sfb_start; const int coef_len = sce->ics.swb_offset[sfb_end] - sce->ics.swb_offset[sfb_start]; + const int n_filt = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3; if (coef_len <= 0 || sfb_len <= 0) { sce->tns.present = 0; @@ -180,16 +181,30 @@ } for (w = 0; w < sce->ics.num_windows; w++) { - float en[2] = {0.0f, 0.0f}; + float en[4] = {0.0f, 0.0f, 0.0f, 0.0f}; int oc_start = 0; int coef_start = sce->ics.swb_offset[sfb_start]; - for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) { - FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g]; - if (g > sfb_start + (sfb_len/2)) - en[1] += band->energy; - else - en[0] += band->energy; + if (n_filt == 2) { + for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) { + FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g]; + if (g > sfb_start + (sfb_len/2)) + en[1] += band->energy; /* End */ + else + en[0] += band->energy; /* Start */ + } + en[2] = en[0]; + } else { + for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) { + FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g]; + if (g > sfb_start + (sfb_len/2) + (sfb_len/4)) + en[2] += band->energy; /* End */ + else if (g > sfb_start + (sfb_len/2) - (sfb_len/4)) + en[1] += band->energy; /* Middle */ + else + en[0] += band->energy; /* Start */ + } + en[3] = en[0]; } /* LPC */ @@ -199,9 +214,9 @@ if (!order || !isfinite(gain) || gain < TNS_GAIN_THRESHOLD_LOW || gain > TNS_GAIN_THRESHOLD_HIGH) continue; - tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3; + tns->n_filt[w] = n_filt; for (g = 0; g < tns->n_filt[w]; g++) { - tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g]; + tns->direction[w][g] = slant != 2 ? slant : en[g] < en[g + 1]; tns->order[w][g] = order/tns->n_filt[w]; tns->length[w][g] = sfb_len/tns->n_filt[w]; quantize_coefs(&coefs[oc_start], tns->coef_idx[w][g], tns->coef[w][g], diff -Nru ffmpeg-7.1.1/libavcodec/aacsbr_template.c ffmpeg-7.1.2/libavcodec/aacsbr_template.c --- ffmpeg-7.1.1/libavcodec/aacsbr_template.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/aacsbr_template.c 2025-09-14 19:20:09.000000000 +0000 @@ -1626,6 +1626,9 @@ int ilb = ch_data->t_env[e] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; + if (ilb >= 40) + return; + for (m = 0; m < sbr->m[1]; m++) { AAC_FLOAT sum = sbr->dsp.sum_square(X_high[m+kx1] + ilb, iub - ilb); #if USE_FIXED @@ -1644,6 +1647,9 @@ int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; const uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow; + if (ilb >= 40) + return; + for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) { #if USE_FIXED SoftFloat sum = FLOAT_0; diff -Nru ffmpeg-7.1.1/libavcodec/alsdec.c ffmpeg-7.1.2/libavcodec/alsdec.c --- ffmpeg-7.1.1/libavcodec/alsdec.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/alsdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -2119,8 +2119,8 @@ ctx->nbits = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits)); ctx->mlz = av_mallocz(sizeof(*ctx->mlz)); - if (!ctx->mlz || !ctx->acf || !ctx->shift_value || !ctx->last_shift_value - || !ctx->last_acf_mantissa || !ctx->raw_mantissa) { + if (!ctx->larray || !ctx->nbits || !ctx->mlz || !ctx->acf || !ctx->shift_value + || !ctx->last_shift_value || !ctx->last_acf_mantissa || !ctx->raw_mantissa) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); return AVERROR(ENOMEM); } @@ -2132,6 +2132,10 @@ for (c = 0; c < channels; ++c) { ctx->raw_mantissa[c] = av_calloc(ctx->cur_frame_length, sizeof(**ctx->raw_mantissa)); + if (!ctx->raw_mantissa[c]) { + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + return AVERROR(ENOMEM); + } } } diff -Nru ffmpeg-7.1.1/libavcodec/bsf/h264_mp4toannexb.c ffmpeg-7.1.2/libavcodec/bsf/h264_mp4toannexb.c --- ffmpeg-7.1.1/libavcodec/bsf/h264_mp4toannexb.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/bsf/h264_mp4toannexb.c 2025-09-14 19:20:09.000000000 +0000 @@ -93,6 +93,11 @@ const int padding = AV_INPUT_BUFFER_PADDING_SIZE; int length_size, pps_offset = 0; + if (extradata_size < 7) { + av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extradata_size); + return AVERROR_INVALIDDATA; + } + bytestream2_init(gb, extradata, extradata_size); bytestream2_skipu(gb, 4); @@ -262,16 +267,11 @@ (extra_size >= 4 && AV_RB32(ctx->par_in->extradata) == 1)) { av_log(ctx, AV_LOG_VERBOSE, "The input looks like it is Annex B already\n"); - } else if (extra_size >= 7) { - return h264_extradata_to_annexb(ctx, - ctx->par_in->extradata, - ctx->par_in->extradata_size); - } else { - av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extra_size); - return AVERROR_INVALIDDATA; + return 0; } - - return 0; + return h264_extradata_to_annexb(ctx, + ctx->par_in->extradata, + ctx->par_in->extradata_size); } static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt) @@ -293,10 +293,12 @@ extradata = av_packet_get_side_data(in, AV_PKT_DATA_NEW_EXTRADATA, &extradata_size); - if (extradata) { + if (extradata && extradata[0] == 1) { ret = h264_extradata_to_annexb(ctx, extradata, extradata_size); if (ret < 0) goto fail; + av_packet_side_data_remove(in->side_data, &in->side_data_elems, + AV_PKT_DATA_NEW_EXTRADATA); } /* nothing to filter */ diff -Nru ffmpeg-7.1.1/libavcodec/cbs_h266_syntax_template.c ffmpeg-7.1.2/libavcodec/cbs_h266_syntax_template.c --- ffmpeg-7.1.1/libavcodec/cbs_h266_syntax_template.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/cbs_h266_syntax_template.c 2025-09-14 19:20:09.000000000 +0000 @@ -1899,10 +1899,10 @@ } unified_size = current->pps_tile_column_width_minus1[i - 1] + 1; while (remaining_size > 0) { - if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) { + if (i == VVC_MAX_TILE_COLUMNS) { av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n", - current->num_tile_columns, VVC_MAX_TILE_COLUMNS); + "Exceeded maximum tile columns (%d) (remaining size: %u)\n", + VVC_MAX_TILE_COLUMNS, remaining_size); return AVERROR_INVALIDDATA; } unified_size = FFMIN(remaining_size, unified_size); @@ -1911,12 +1911,6 @@ i++; } current->num_tile_columns = i; - if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) { - av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n", - current->num_tile_columns, VVC_MAX_TILE_COLUMNS); - return AVERROR_INVALIDDATA; - } remaining_size = pic_height_in_ctbs_y; for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) { @@ -1931,18 +1925,18 @@ unified_size = current->pps_tile_row_height_minus1[i - 1] + 1; while (remaining_size > 0) { + if (i == VVC_MAX_TILE_ROWS) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "Exceeded maximum tile rows (%d) (remaining size: %u)\n", + VVC_MAX_TILE_ROWS, remaining_size); + return AVERROR_INVALIDDATA; + } unified_size = FFMIN(remaining_size, unified_size); current->row_height_val[i] = unified_size; remaining_size -= unified_size; i++; } current->num_tile_rows=i; - if (current->num_tile_rows > VVC_MAX_TILE_ROWS) { - av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n", - current->num_tile_rows, VVC_MAX_TILE_ROWS); - return AVERROR_INVALIDDATA; - } current->num_tiles_in_pic = current->num_tile_columns * current->num_tile_rows; diff -Nru ffmpeg-7.1.1/libavcodec/cfhd.c ffmpeg-7.1.2/libavcodec/cfhd.c --- ffmpeg-7.1.1/libavcodec/cfhd.c 2024-09-29 23:31:47.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/cfhd.c 2025-09-14 19:20:09.000000000 +0000 @@ -25,6 +25,7 @@ #include "libavutil/attributes.h" #include "libavutil/common.h" +#include "libavutil/imgutils.h" #include "libavutil/intreadwrite.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" @@ -275,6 +276,9 @@ int height = (i || bayer) ? s->coded_height >> chroma_y_shift : s->coded_height; ptrdiff_t stride = (FFALIGN(width / 8, 8) + 64) * 8; + if ((ret = av_image_check_size2(stride, height, avctx->max_pixels, s->coded_format, 0, avctx)) < 0) + return ret; + if (chroma_y_shift && !bayer) height = FFALIGN(height / 8, 2) * 8; s->plane[i].width = width; diff -Nru ffmpeg-7.1.1/libavcodec/cri.c ffmpeg-7.1.2/libavcodec/cri.c --- ffmpeg-7.1.1/libavcodec/cri.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/cri.c 2025-09-14 19:20:09.000000000 +0000 @@ -220,10 +220,12 @@ if (bytestream2_get_le32(gb) != 0) return AVERROR_INVALIDDATA; break; - case 102: - bytestream2_get_buffer(gb, codec_name, FFMIN(length, sizeof(codec_name) - 1)); - length -= FFMIN(length, sizeof(codec_name) - 1); - if (strncmp(codec_name, "cintel_craw", FFMIN(length, sizeof(codec_name) - 1))) + case 102:; + int read_len = FFMIN(length, sizeof(codec_name) - 1); + if (read_len != bytestream2_get_buffer(gb, codec_name, read_len)) + return AVERROR_INVALIDDATA; + length -= read_len; + if (strncmp(codec_name, "cintel_craw", read_len)) return AVERROR_INVALIDDATA; compressed = 1; goto skip; diff -Nru ffmpeg-7.1.1/libavcodec/d3d12va_encode.c ffmpeg-7.1.2/libavcodec/d3d12va_encode.c --- ffmpeg-7.1.1/libavcodec/d3d12va_encode.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/d3d12va_encode.c 2025-09-14 19:20:09.000000000 +0000 @@ -974,8 +974,7 @@ case RC_MODE_CQP: // cqp ConfigParams will be updated in ctx->codec->configure. break; - - case RC_MODE_CBR: + case RC_MODE_CBR: { D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR *cbr_ctl; ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR); @@ -996,8 +995,8 @@ ctx->rc.ConfigParams.pConfiguration_CBR = cbr_ctl; break; - - case RC_MODE_VBR: + } + case RC_MODE_VBR: { D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR *vbr_ctl; ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR); @@ -1019,8 +1018,8 @@ ctx->rc.ConfigParams.pConfiguration_VBR = vbr_ctl; break; - - case RC_MODE_QVBR: + } + case RC_MODE_QVBR: { D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR *qvbr_ctl; ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR); @@ -1040,7 +1039,7 @@ ctx->rc.ConfigParams.pConfiguration_QVBR = qvbr_ctl; break; - + } default: break; } diff -Nru ffmpeg-7.1.1/libavcodec/decode.c ffmpeg-7.1.2/libavcodec/decode.c --- ffmpeg-7.1.1/libavcodec/decode.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/decode.c 2025-09-14 19:20:09.000000000 +0000 @@ -1671,22 +1671,49 @@ } } -static void attach_post_process_data(AVCodecContext *avctx, AVFrame *frame) +static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame) { AVCodecInternal *avci = avctx->internal; DecodeContext *dc = decode_ctx(avci); if (dc->lcevc_frame) { FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data; + FFLCEVCFrame *frame_ctx; + int ret; - fdd->post_process_opaque = ff_refstruct_ref(dc->lcevc); - fdd->post_process_opaque_free = ff_lcevc_unref; - fdd->post_process = ff_lcevc_process; + frame_ctx = av_mallocz(sizeof(*frame_ctx)); + if (!frame_ctx) + return AVERROR(ENOMEM); + + frame_ctx->frame = av_frame_alloc(); + if (!frame_ctx->frame) { + av_free(frame_ctx); + return AVERROR(ENOMEM); + } + + frame_ctx->lcevc = ff_refstruct_ref(dc->lcevc); + frame_ctx->frame->width = frame->width; + frame_ctx->frame->height = frame->height; + frame_ctx->frame->format = frame->format; frame->width = dc->width; frame->height = dc->height; + + ret = avctx->get_buffer2(avctx, frame_ctx->frame, 0); + if (ret < 0) { + ff_lcevc_unref(frame_ctx); + return ret; + } + + validate_avframe_allocation(avctx, frame_ctx->frame); + + fdd->post_process_opaque = frame_ctx; + fdd->post_process_opaque_free = ff_lcevc_unref; + fdd->post_process = ff_lcevc_process; } dc->lcevc_frame = 0; + + return 0; } int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags) @@ -1747,7 +1774,9 @@ if (ret < 0) goto fail; - attach_post_process_data(avctx, frame); + ret = attach_post_process_data(avctx, frame); + if (ret < 0) + goto fail; end: if (avctx->codec_type == AVMEDIA_TYPE_VIDEO && !override_dimensions && diff -Nru ffmpeg-7.1.1/libavcodec/dxv.c ffmpeg-7.1.2/libavcodec/dxv.c --- ffmpeg-7.1.1/libavcodec/dxv.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/dxv.c 2025-09-14 19:20:09.000000000 +0000 @@ -38,12 +38,15 @@ GetByteContext gbc; uint8_t *tex_data; // Compressed texture + unsigned tex_data_size; uint8_t *ctex_data; // Compressed chroma texture + unsigned ctex_data_size; - int64_t tex_size; // Texture size + size_t tex_size; // Texture size int64_t ctex_size; // Chroma texture size uint8_t *op_data[4]; // Opcodes + unsigned op_data_size[4]; int64_t op_size[4]; // Opcodes size } DXVContext; @@ -274,7 +277,9 @@ if ((flag & 3) == 0) { bytestream2_skip(gb, 1); - bytestream2_get_buffer(gb, dstp, op_size); + int read_size = bytestream2_get_buffer(gb, dstp, op_size); + if (read_size != op_size) + return AVERROR_INVALIDDATA; } else if ((flag & 3) == 1) { bytestream2_skip(gb, 1); memset(dstp, bytestream2_get_byte(gb), op_size); @@ -823,7 +828,7 @@ static int dxv_decompress_lzf(AVCodecContext *avctx) { DXVContext *ctx = avctx->priv_data; - return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size); + return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size); } static int dxv_decompress_raw(AVCodecContext *avctx) @@ -935,6 +940,8 @@ } break; } + if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1) + return AVERROR_INVALIDDATA; texdsp_ctx.slice_count = av_clip(avctx->thread_count, 1, avctx->coded_height / TEXTURE_BLOCK_H); @@ -969,9 +976,14 @@ ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) * avctx->coded_height / TEXTURE_BLOCK_H * texdsp_ctx.tex_ratio; - ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE); - if (ret < 0) - return ret; + unsigned old_size = ctx->tex_data_size; + void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE); + if (!ptr) + return AVERROR(ENOMEM); + ctx->tex_data = ptr; + + if (ctx->tex_data_size > old_size) + memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size); if (avctx->pix_fmt != AV_PIX_FMT_RGBA) { int i; @@ -985,13 +997,20 @@ ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32; ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16; - ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); - if (ret < 0) - return ret; + old_size = ctx->ctex_data_size; + ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE); + if (!ptr) + return AVERROR(ENOMEM); + ctx->ctex_data = ptr; + if (old_size < ctx->ctex_data_size) + memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size); + for (i = 0; i < 4; i++) { - ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]); - if (ret < 0) - return ret; + old_size = ctx->op_data_size[i]; + ptr = av_fast_realloc(ctx->op_data[i], &ctx->op_data_size[i], ctx->op_size[i]); + if (!ptr) + return AVERROR(ENOMEM); + ctx->op_data[i] = ptr; } } @@ -1078,11 +1097,16 @@ DXVContext *ctx = avctx->priv_data; av_freep(&ctx->tex_data); + ctx->tex_data_size = 0; + av_freep(&ctx->ctex_data); + ctx->ctex_data_size = 0; + av_freep(&ctx->op_data[0]); av_freep(&ctx->op_data[1]); av_freep(&ctx->op_data[2]); av_freep(&ctx->op_data[3]); + memset(ctx->op_data_size, 0, sizeof(ctx->op_data_size)); return 0; } diff -Nru ffmpeg-7.1.1/libavcodec/exr.c ffmpeg-7.1.2/libavcodec/exr.c --- ffmpeg-7.1.1/libavcodec/exr.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/exr.c 2025-09-14 19:20:09.000000000 +0000 @@ -991,6 +991,7 @@ const int dc_h = td->ysize >> 3; GetByteContext gb, agb; int skip, ret; + int have_rle = 0; if (compressed_size <= 88) return AVERROR_INVALIDDATA; @@ -1015,6 +1016,11 @@ ) return AVERROR_INVALIDDATA; + if ((uint64_t)rle_raw_size > INT_MAX) { + avpriv_request_sample(s->avctx, "Too big rle_raw_size"); + return AVERROR_INVALIDDATA; + } + bytestream2_init(&gb, src + 88, compressed_size - 88); skip = bytestream2_get_le16(&gb); if (skip < 2) @@ -1085,6 +1091,9 @@ if (rle_raw_size > 0 && rle_csize > 0 && rle_usize > 0) { unsigned long dest_len = rle_usize; + if (2LL * td->xsize * td->ysize > rle_raw_size) + return AVERROR_INVALIDDATA; + av_fast_padded_malloc(&td->rle_data, &td->rle_size, rle_usize); if (!td->rle_data) return AVERROR(ENOMEM); @@ -1101,12 +1110,17 @@ if (ret < 0) return ret; bytestream2_skip(&gb, rle_csize); + + have_rle = 1; } bytestream2_init(&agb, td->ac_data, ac_count * 2); for (int y = 0; y < td->ysize; y += 8) { for (int x = 0; x < td->xsize; x += 8) { + int bw = FFMIN(8, td->xsize - x); + int bh = FFMIN(8, td->ysize - y); + memset(td->block, 0, sizeof(td->block)); for (int j = 0; j < 3; j++) { @@ -1134,8 +1148,8 @@ float *ub = td->block[1]; float *vb = td->block[2]; - for (int yy = 0; yy < 8; yy++) { - for (int xx = 0; xx < 8; xx++) { + for (int yy = 0; yy < bh; yy++) { + for (int xx = 0; xx < bw; xx++) { const int idx = xx + yy * 8; convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]); @@ -1156,7 +1170,7 @@ if (s->nb_channels < 4) return 0; - for (int y = 0; y < td->ysize && td->rle_raw_data; y++) { + for (int y = 0; y < td->ysize && have_rle; y++) { uint32_t *ao = ((uint32_t *)td->uncompressed_data) + y * td->xsize * s->nb_channels; uint8_t *ai0 = td->rle_raw_data + y * td->xsize; uint8_t *ai1 = td->rle_raw_data + y * td->xsize + rle_raw_size / 2; @@ -2051,6 +2065,16 @@ for (int i = 0; i < 4; i++) s->channel_offsets[i] *= 2; } + if (s->compression == EXR_DWAA || + s->compression == EXR_DWAB) { + for (int i = 0; inb_channels; i++) { + EXRChannel *channel = &s->channels[i]; + if (channel->pixel_type != s->pixel_type) { + avpriv_request_sample(s->avctx, "mixed pixel type DWA"); + return AVERROR_PATCHWELCOME; + } + } + } switch (s->pixel_type) { case EXR_FLOAT: diff -Nru ffmpeg-7.1.1/libavcodec/ffv1.c ffmpeg-7.1.2/libavcodec/ffv1.c --- ffmpeg-7.1.1/libavcodec/ffv1.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/ffv1.c 2025-09-14 19:20:09.000000000 +0000 @@ -81,7 +81,7 @@ if (f->ac != AC_GOLOMB_RICE) { if (!p->state) - p->state = av_malloc_array(p->context_count, CONTEXT_SIZE * + p->state = av_calloc(p->context_count, CONTEXT_SIZE * sizeof(uint8_t)); if (!p->state) return AVERROR(ENOMEM); diff -Nru ffmpeg-7.1.1/libavcodec/ffv1dec.c ffmpeg-7.1.2/libavcodec/ffv1dec.c --- ffmpeg-7.1.1/libavcodec/ffv1dec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/ffv1dec.c 2025-09-14 19:20:09.000000000 +0000 @@ -81,6 +81,11 @@ k++; i += i; } + if (k > bits) { + ff_dlog(NULL, "k-overflow bias:%d error:%d drift:%d count:%d k:%d", + state->bias, state->error_sum, state->drift, state->count, k); + k = bits; + } v = get_sr_golomb(gb, k, 12, bits); ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d", @@ -334,14 +339,18 @@ } else if (f->use32bit) { uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0], p->data[1] + ps * x + y * p->linesize[1], - p->data[2] + ps * x + y * p->linesize[2], - p->data[3] + ps * x + y * p->linesize[3] }; + p->data[2] + ps * x + y * p->linesize[2] }; + if (f->transparency) + planes[3] = p->data[3] + ps * x + y * p->linesize[3]; decode_rgb_frame32(f, sc, &gb, planes, width, height, p->linesize); } else { - uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0], - p->data[1] + ps * x + y * p->linesize[1], - p->data[2] + ps * x + y * p->linesize[2], - p->data[3] + ps * x + y * p->linesize[3] }; + uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0] }; + if (f->avctx->bits_per_raw_sample > 8) { + planes[1] = p->data[1] + ps * x + y * p->linesize[1]; + planes[2] = p->data[2] + ps * x + y * p->linesize[2]; + if (f->transparency) + planes[3] = p->data[3] + ps * x + y * p->linesize[3]; + } decode_rgb_frame(f, sc, &gb, planes, width, height, p->linesize); } if (f->ac != AC_GOLOMB_RICE && f->version > 2) { diff -Nru ffmpeg-7.1.1/libavcodec/fits.c ffmpeg-7.1.2/libavcodec/fits.c --- ffmpeg-7.1.1/libavcodec/fits.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/fits.c 2025-09-14 19:20:09.000000000 +0000 @@ -32,6 +32,8 @@ { header->state = state; header->naxis_index = 0; + header->naxis = 0; + memset(header->naxisn, 0, sizeof(header->naxisn)); header->blank_found = 0; header->pcount = 0; header->gcount = 1; diff -Nru ffmpeg-7.1.1/libavcodec/g726.c ffmpeg-7.1.2/libavcodec/g726.c --- ffmpeg-7.1.1/libavcodec/g726.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/g726.c 2025-09-14 19:20:09.000000000 +0000 @@ -457,6 +457,8 @@ g726_reset(c); avctx->sample_fmt = AV_SAMPLE_FMT_S16; + if (!avctx->sample_rate) + avctx->sample_rate = 8000; return 0; } diff -Nru ffmpeg-7.1.1/libavcodec/h264_mb.c ffmpeg-7.1.2/libavcodec/h264_mb.c --- ffmpeg-7.1.1/libavcodec/h264_mb.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/h264_mb.c 2025-09-14 19:20:09.000000000 +0000 @@ -407,7 +407,7 @@ /* don't optimize for luma-only case, since B-frames usually * use implicit weights => chroma too. */ uint8_t *tmp_cb = sl->bipred_scratchpad; - uint8_t *tmp_cr = sl->bipred_scratchpad + (16 << pixel_shift); + uint8_t *tmp_cr = sl->bipred_scratchpad + (8 << pixel_shift + (chroma_idc == 3)); uint8_t *tmp_y = sl->bipred_scratchpad + 16 * sl->mb_uvlinesize; int refn0 = sl->ref_cache[0][scan8[n]]; int refn1 = sl->ref_cache[1][scan8[n]]; diff -Nru ffmpeg-7.1.1/libavcodec/h264_slice.c ffmpeg-7.1.2/libavcodec/h264_slice.c --- ffmpeg-7.1.1/libavcodec/h264_slice.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/h264_slice.c 2025-09-14 19:20:09.000000000 +0000 @@ -191,6 +191,13 @@ av_assert0(!pic->f->data[0]); + if (h->sei.common.lcevc.info) { + HEVCSEILCEVC *lcevc = &h->sei.common.lcevc; + ret = ff_frame_new_side_data_from_buf(h->avctx, pic->f, AV_FRAME_DATA_LCEVC, &lcevc->info); + if (ret < 0) + return ret; + } + pic->tf.f = pic->f; ret = ff_thread_get_ext_buffer(h->avctx, &pic->tf, pic->reference ? AV_GET_BUFFER_FLAG_REF : 0); diff -Nru ffmpeg-7.1.1/libavcodec/hevc/hevcdec.c ffmpeg-7.1.2/libavcodec/hevc/hevcdec.c --- ffmpeg-7.1.1/libavcodec/hevc/hevcdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/hevc/hevcdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -151,10 +151,10 @@ int w = sps->width >> sps->hshift[c_idx]; int h = sps->height >> sps->vshift[c_idx]; l->sao_pixel_buffer_h[c_idx] = - av_malloc((w * 2 * sps->ctb_height) << + av_mallocz((w * 2 * sps->ctb_height) << sps->pixel_shift); l->sao_pixel_buffer_v[c_idx] = - av_malloc((h * 2 * sps->ctb_width) << + av_mallocz((h * 2 * sps->ctb_width) << sps->pixel_shift); if (!l->sao_pixel_buffer_h[c_idx] || !l->sao_pixel_buffer_v[c_idx]) @@ -1048,7 +1048,7 @@ if (pps->tiles_enabled_flag || pps->entropy_coding_sync_enabled_flag) { unsigned num_entry_point_offsets = get_ue_golomb_long(gb); // It would be possible to bound this tighter but this here is simpler - if (num_entry_point_offsets > get_bits_left(gb)) { + if (num_entry_point_offsets > get_bits_left(gb) || num_entry_point_offsets > UINT16_MAX) { av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets); return AVERROR_INVALIDDATA; } diff -Nru ffmpeg-7.1.1/libavcodec/hevc/ps.c ffmpeg-7.1.2/libavcodec/hevc/ps.c --- ffmpeg-7.1.1/libavcodec/hevc/ps.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/hevc/ps.c 2025-09-14 19:20:09.000000000 +0000 @@ -612,8 +612,8 @@ } /* Consequence of established layer dependencies */ - if (layer1_id_included != ((1 << vps->layer_id_in_nuh[0]) | - (1 << vps->layer_id_in_nuh[1]))) { + if (layer1_id_included != ((1ULL << vps->layer_id_in_nuh[0]) | + (1ULL << vps->layer_id_in_nuh[1]))) { av_log(avctx, AV_LOG_ERROR, "Dependent layer not included in layer ID?\n"); return AVERROR_PATCHWELCOME; } diff -Nru ffmpeg-7.1.1/libavcodec/iff.c ffmpeg-7.1.2/libavcodec/iff.c --- ffmpeg-7.1.1/libavcodec/iff.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/iff.c 2025-09-14 19:20:09.000000000 +0000 @@ -279,7 +279,7 @@ if (avctx->codec_tag == MKTAG('P', 'B', 'M', ' ') && s->ham == 4) extra_space = 4; - s->ham_buf = av_malloc((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE); + s->ham_buf = av_mallocz((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->ham_buf) return AVERROR(ENOMEM); diff -Nru ffmpeg-7.1.1/libavcodec/ilbcdec.c ffmpeg-7.1.2/libavcodec/ilbcdec.c --- ffmpeg-7.1.1/libavcodec/ilbcdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/ilbcdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -675,6 +675,7 @@ /* get vector */ memcpy(cbvec, mem + lMem - k, cbveclen * 2); } else if (index < base_size) { + memset(cbvec, 0, cbveclen * 2); /* Calculate lag */ @@ -701,6 +702,7 @@ filter_mafq12(&mem[memIndTest + 4], cbvec, kCbFiltersRev, CB_FILTERLEN, cbveclen); } else { + memset(cbvec, 0, cbveclen * 2); /* interpolated vectors */ /* Stuff zeros outside memory buffer */ memIndTest = lMem - cbveclen - CB_FILTERLEN; diff -Nru ffmpeg-7.1.1/libavcodec/imc.c ffmpeg-7.1.2/libavcodec/imc.c --- ffmpeg-7.1.1/libavcodec/imc.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/imc.c 2025-09-14 19:20:09.000000000 +0000 @@ -966,6 +966,8 @@ LOCAL_ALIGNED_16(uint16_t, buf16, [(IMC_BLOCK_SIZE + AV_INPUT_BUFFER_PADDING_SIZE) / 2]); + memset(buf16 + IMC_BLOCK_SIZE/2, 0, AV_INPUT_BUFFER_PADDING_SIZE); + q->avctx = avctx; if (buf_size < IMC_BLOCK_SIZE * avctx->ch_layout.nb_channels) { diff -Nru ffmpeg-7.1.1/libavcodec/ivi.c ffmpeg-7.1.2/libavcodec/ivi.c --- ffmpeg-7.1.1/libavcodec/ivi.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/ivi.c 2025-09-14 19:20:09.000000000 +0000 @@ -994,9 +994,11 @@ for (t = 0; t < band->num_tiles; t++) { tile = &band->tiles[t]; - if (tile->mb_size != band->mb_size) { - av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d\n", - band->mb_size, tile->mb_size); + if (tile->mb_size != band->mb_size || + ctx->planes[0].bands[0].mb_size < band->mb_size + ) { + av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d vs. %d\n", + band->mb_size, tile->mb_size, ctx->planes[0].bands[0].mb_size); return AVERROR_INVALIDDATA; } tile->is_empty = get_bits1(&ctx->gb); diff -Nru ffmpeg-7.1.1/libavcodec/jpeg2000dec.c ffmpeg-7.1.2/libavcodec/jpeg2000dec.c --- ffmpeg-7.1.1/libavcodec/jpeg2000dec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/jpeg2000dec.c 2025-09-14 19:20:09.000000000 +0000 @@ -271,6 +271,25 @@ return AVERROR_INVALIDDATA; } + for (i = 0; i < s->ncomponents; i++) { + if (s->cdef[i] < 0) { + for (i = 0; i < s->ncomponents; i++) { + s->cdef[i] = i + 1; + } + if ((s->ncomponents & 1) == 0) + s->cdef[s->ncomponents-1] = 0; + } + } + // after here we no longer have to consider negative cdef + + int cdef_used = 0; + for (i = 0; i < s->ncomponents; i++) + cdef_used |= 1<cdef[i]; + + // Check that the channels we have are what we expect for the number of components + if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents]) + return AVERROR_INVALIDDATA; + for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i uint8_t x = bytestream2_get_byteu(&s->g); s->cbps[i] = (x & 0x7f) + 1; @@ -283,7 +302,9 @@ av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]); return AVERROR_INVALIDDATA; } - log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2; + int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1); + + log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2; } s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width); @@ -1507,6 +1528,7 @@ bytestream2_get_bufferu(&s->g, cblk->data + cblk->length, cblk->lengthinc[cwsno]); cblk->length += cblk->lengthinc[cwsno]; + memset(cblk->data + cblk->length, 0, 4); cblk->lengthinc[cwsno] = 0; if (cblk->nb_terminationsinc) { cblk->nb_terminationsinc--; @@ -2853,17 +2875,6 @@ if (ret = jpeg2000_read_bitstream_packets(s)) goto end; - for (int x = 0; x < s->ncomponents; x++) { - if (s->cdef[x] < 0) { - for (x = 0; x < s->ncomponents; x++) { - s->cdef[x] = x + 1; - } - if ((s->ncomponents & 1) == 0) - s->cdef[s->ncomponents-1] = 0; - break; - } - } - avctx->execute2(avctx, jpeg2000_decode_tile, picture, NULL, s->numXtiles * s->numYtiles); jpeg2000_dec_cleanup(s); diff -Nru ffmpeg-7.1.1/libavcodec/jpegxl_parser.c ffmpeg-7.1.2/libavcodec/jpegxl_parser.c --- ffmpeg-7.1.1/libavcodec/jpegxl_parser.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/jpegxl_parser.c 2025-09-14 19:20:09.000000000 +0000 @@ -1315,6 +1315,13 @@ if (get_bits1(gb)) { JXLEntropyDecoder dec; int64_t end, lehmer = 0; + /* parser sanity check to prevent TOC perm from spinning cpu */ + if (width > meta->coded_width * 8 || height > meta->coded_height * 8) { + av_log(avctx, AV_LOG_WARNING, "frame of size %" PRIu32 "x%" PRIu32 + " exceeds max size of %" PRIu32 "x%" PRIu32 ", aborting parser\n", + width, height, meta->coded_width * 8, meta->coded_height * 8); + return AVERROR_INVALIDDATA; + } ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1331,7 +1338,7 @@ lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); - return AVERROR_BUFFER_TOO_SMALL; + return lehmer < 0 ? lehmer : AVERROR_BUFFER_TOO_SMALL; } } entropy_decoder_close(&dec); diff -Nru ffmpeg-7.1.1/libavcodec/lcevcdec.c ffmpeg-7.1.2/libavcodec/lcevcdec.c --- ffmpeg-7.1.1/libavcodec/lcevcdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/lcevcdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -45,7 +45,7 @@ return LCEVC_ColorFormat_Unknown; } -static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder, +static int alloc_base_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *frame, LCEVC_PictureHandle *picture) { LCEVC_PictureDesc desc; @@ -68,22 +68,22 @@ desc.sampleAspectRatioDen = frame->sample_aspect_ratio.den; /* Allocate LCEVC Picture */ - res = LCEVC_AllocPicture(decoder, &desc, picture); + res = LCEVC_AllocPicture(lcevc->decoder, &desc, picture); if (res != LCEVC_Success) { return AVERROR_EXTERNAL; } - res = LCEVC_LockPicture(decoder, *picture, LCEVC_Access_Write, &lock); + res = LCEVC_LockPicture(lcevc->decoder, *picture, LCEVC_Access_Write, &lock); if (res != LCEVC_Success) return AVERROR_EXTERNAL; - res = LCEVC_GetPicturePlaneCount(decoder, *picture, &planes); + res = LCEVC_GetPicturePlaneCount(lcevc->decoder, *picture, &planes); if (res != LCEVC_Success) return AVERROR_EXTERNAL; for (unsigned i = 0; i < planes; i++) { LCEVC_PicturePlaneDesc plane; - res = LCEVC_GetPictureLockPlaneDesc(decoder, lock, i, &plane); + res = LCEVC_GetPictureLockPlaneDesc(lcevc->decoder, lock, i, &plane); if (res != LCEVC_Success) return AVERROR_EXTERNAL; @@ -94,43 +94,43 @@ av_image_copy2(data, linesizes, frame->data, frame->linesize, frame->format, frame->width, frame->height); - res = LCEVC_UnlockPicture(decoder, lock); + res = LCEVC_UnlockPicture(lcevc->decoder, lock); if (res != LCEVC_Success) return AVERROR_EXTERNAL; return 0; } -static int alloc_enhanced_frame(void *logctx, LCEVC_DecoderHandle decoder, - const AVFrame *frame, LCEVC_PictureHandle *picture) +static int alloc_enhanced_frame(void *logctx, FFLCEVCFrame *frame_ctx, + LCEVC_PictureHandle *picture) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureDesc desc ; - LCEVC_ColorFormat fmt = map_format(frame->format); + LCEVC_ColorFormat fmt = map_format(frame_ctx->frame->format); LCEVC_PicturePlaneDesc planes[4] = { 0 }; - int width = frame->width * 2 / FFMAX(frame->sample_aspect_ratio.den, 1); - int height = frame->height * 2 / FFMAX(frame->sample_aspect_ratio.num, 1); LCEVC_ReturnCode res; - res = LCEVC_DefaultPictureDesc(&desc, fmt, width, height); + res = LCEVC_DefaultPictureDesc(&desc, fmt, frame_ctx->frame->width, frame_ctx->frame->height); if (res != LCEVC_Success) return AVERROR_EXTERNAL; /* Set plane description */ for (int i = 0; i < 4; i++) { - planes[i].firstSample = frame->data[i]; - planes[i].rowByteStride = frame->linesize[i]; + planes[i].firstSample = frame_ctx->frame->data[i]; + planes[i].rowByteStride = frame_ctx->frame->linesize[i]; } /* Allocate LCEVC Picture */ - res = LCEVC_AllocPictureExternal(decoder, &desc, NULL, planes, picture); + res = LCEVC_AllocPictureExternal(lcevc->decoder, &desc, NULL, planes, picture); if (res != LCEVC_Success) { return AVERROR_EXTERNAL; } return 0; } -static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *in) +static int lcevc_send_frame(void *logctx, FFLCEVCFrame *frame_ctx, const AVFrame *in) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; const AVFrameSideData *sd = av_frame_get_side_data(in, AV_FRAME_DATA_LCEVC); LCEVC_PictureHandle picture; LCEVC_ReturnCode res; @@ -143,7 +143,7 @@ if (res != LCEVC_Success) return AVERROR_EXTERNAL; - ret = alloc_base_frame(logctx, lcevc->decoder, in, &picture); + ret = alloc_base_frame(logctx, lcevc, in, &picture); if (ret < 0) return ret; @@ -152,7 +152,7 @@ return AVERROR_EXTERNAL; memset(&picture, 0, sizeof(picture)); - ret = alloc_enhanced_frame(logctx, lcevc->decoder, in, &picture); + ret = alloc_enhanced_frame(logctx, frame_ctx, &picture); if (ret < 0) return ret; @@ -163,8 +163,9 @@ return 0; } -static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) +static int generate_output(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureDesc desc; LCEVC_DecodeInformation info; LCEVC_PictureHandle picture; @@ -184,6 +185,11 @@ out->crop_right = desc.cropRight; out->sample_aspect_ratio.num = desc.sampleAspectRatioNum; out->sample_aspect_ratio.den = desc.sampleAspectRatioDen; + + av_frame_copy_props(frame_ctx->frame, out); + av_frame_unref(out); + av_frame_move_ref(out, frame_ctx->frame); + out->width = desc.width + out->crop_left + out->crop_right; out->height = desc.height + out->crop_top + out->crop_bottom; @@ -194,13 +200,14 @@ return 0; } -static int lcevc_receive_frame(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) +static int lcevc_receive_frame(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureHandle picture; LCEVC_ReturnCode res; int ret; - ret = generate_output(logctx, lcevc, out); + ret = generate_output(logctx, frame_ctx, out); if (ret < 0) return ret; @@ -247,12 +254,7 @@ #if CONFIG_LIBLCEVC_DEC LCEVC_AccelContextHandle dummy = { 0 }; const int32_t event = LCEVC_Log; -#endif - if (lcevc->initialized) - return 0; - -#if CONFIG_LIBLCEVC_DEC if (LCEVC_CreateDecoder(&lcevc->decoder, dummy) != LCEVC_Success) { av_log(logctx, AV_LOG_ERROR, "Failed to create LCEVC decoder\n"); return AVERROR_EXTERNAL; @@ -277,7 +279,8 @@ int ff_lcevc_process(void *logctx, AVFrame *frame) { FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data; - FFLCEVCContext *lcevc = fdd->post_process_opaque; + FFLCEVCFrame *frame_ctx = fdd->post_process_opaque; + FFLCEVCContext *lcevc = frame_ctx->lcevc; int ret; if (!lcevc->initialized) { @@ -287,11 +290,14 @@ } #if CONFIG_LIBLCEVC_DEC - ret = lcevc_send_frame(logctx, lcevc, frame); + av_assert0(frame_ctx->frame); + + + ret = lcevc_send_frame(logctx, frame_ctx, frame); if (ret) return ret < 0 ? ret : 0; - lcevc_receive_frame(logctx, lcevc, frame); + lcevc_receive_frame(logctx, frame_ctx, frame); if (ret < 0) return ret; @@ -315,5 +321,8 @@ void ff_lcevc_unref(void *opaque) { - ff_refstruct_unref(&opaque); + FFLCEVCFrame *lcevc = opaque; + ff_refstruct_unref(&lcevc->lcevc); + av_frame_free(&lcevc->frame); + av_free(opaque); } diff -Nru ffmpeg-7.1.1/libavcodec/lcevcdec.h ffmpeg-7.1.2/libavcodec/lcevcdec.h --- ffmpeg-7.1.1/libavcodec/lcevcdec.h 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/lcevcdec.h 2025-09-14 19:20:09.000000000 +0000 @@ -36,6 +36,11 @@ struct AVFrame; +typedef struct FFLCEVCFrame { + FFLCEVCContext *lcevc; + struct AVFrame *frame; +} FFLCEVCFrame; + int ff_lcevc_alloc(FFLCEVCContext **plcevc); int ff_lcevc_process(void *logctx, struct AVFrame *frame); void ff_lcevc_unref(void *opaque); diff -Nru ffmpeg-7.1.1/libavcodec/librsvgdec.c ffmpeg-7.1.2/libavcodec/librsvgdec.c --- ffmpeg-7.1.1/libavcodec/librsvgdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/librsvgdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -90,8 +90,6 @@ goto end; avctx->pix_fmt = AV_PIX_FMT_RGB32; - viewport.width = dimensions.width; - viewport.height = dimensions.height; ret = ff_get_buffer(avctx, frame, 0); if (ret < 0) @@ -116,6 +114,8 @@ cairo_restore(crender); #if LIBRSVG_MAJOR_VERSION > 2 || LIBRSVG_MAJOR_VERSION == 2 && LIBRSVG_MINOR_VERSION >= 52 + viewport.width = dimensions.width; + viewport.height = dimensions.height; gret = rsvg_handle_render_document(handle, crender, &viewport, &error); #else cairo_scale(crender, dimensions.width / (double)unscaled_dimensions.width, diff -Nru ffmpeg-7.1.1/libavcodec/libsvtav1.c ffmpeg-7.1.2/libavcodec/libsvtav1.c --- ffmpeg-7.1.1/libavcodec/libsvtav1.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/libsvtav1.c 2025-09-14 19:20:09.000000000 +0000 @@ -435,7 +435,11 @@ svt_enc->eos_flag = EOS_NOT_REACHED; +#if SVT_AV1_CHECK_VERSION(3, 0, 0) + svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, &svt_enc->enc_params); +#else svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, svt_enc, &svt_enc->enc_params); +#endif if (svt_ret != EB_ErrorNone) { return svt_print_error(avctx, svt_ret, "Error initializing encoder handle"); } diff -Nru ffmpeg-7.1.1/libavcodec/libtheoraenc.c ffmpeg-7.1.2/libavcodec/libtheoraenc.c --- ffmpeg-7.1.1/libavcodec/libtheoraenc.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/libtheoraenc.c 2025-09-14 19:20:09.000000000 +0000 @@ -234,7 +234,7 @@ return AVERROR_EXTERNAL; } - h->keyframe_mask = (1 << t_info.keyframe_granule_shift) - 1; + h->keyframe_mask = (1 << av_ceil_log2(avc_context->gop_size)) - 1; /* Clear up theora_info struct */ th_info_clear(&t_info); diff -Nru ffmpeg-7.1.1/libavcodec/libvorbisdec.c ffmpeg-7.1.2/libavcodec/libvorbisdec.c --- ffmpeg-7.1.1/libavcodec/libvorbisdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/libvorbisdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -113,6 +113,12 @@ } } + if (context->vi.rate <= 0 || context->vi.rate > INT_MAX) { + av_log(avccontext, AV_LOG_ERROR, "vorbis rate is invalid\n"); + ret = AVERROR_INVALIDDATA; + goto error; + } + av_channel_layout_uninit(&avccontext->ch_layout); avccontext->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC; avccontext->ch_layout.nb_channels = context->vi.channels; diff -Nru ffmpeg-7.1.1/libavcodec/libzvbi-teletextdec.c ffmpeg-7.1.2/libavcodec/libzvbi-teletextdec.c --- ffmpeg-7.1.1/libavcodec/libzvbi-teletextdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/libzvbi-teletextdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -91,7 +91,7 @@ if (ret < 0) return ret; - event_pos = strstr(avctx->subtitle_header, "\r\n[Events]\r\n"); + event_pos = strstr(avctx->subtitle_header, "\n[Events]\n"); if (!event_pos) return AVERROR_BUG; @@ -106,7 +106,7 @@ "0,0," /* Spacing, Angle */ "3,0.1,0," /* BorderStyle, Outline, Shadow */ "5,1,1,1," /* Alignment, Margin[LRV] */ - "0\r\n" /* Encoding */ + "0\n" /* Encoding */ "Style: " "Subtitle," /* Name */ "Monospace,16," /* Font{name,size} */ @@ -116,7 +116,7 @@ "0,0," /* Spacing, Angle */ "1,1,1," /* BorderStyle, Outline, Shadow */ "8,48,48,20," /* Alignment, Margin[LRV] */ - "0\r\n" /* Encoding */ + "0\n" /* Encoding */ , event_pos); if (!new_header) diff -Nru ffmpeg-7.1.1/libavcodec/lzf.c ffmpeg-7.1.2/libavcodec/lzf.c --- ffmpeg-7.1.1/libavcodec/lzf.c 2023-11-09 23:38:51.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/lzf.c 2025-09-14 19:20:09.000000000 +0000 @@ -37,7 +37,22 @@ #define LZF_LITERAL_MAX (1 << 5) #define LZF_LONG_BACKREF 7 + 2 -int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size) + +static inline int lzf_realloc(uint8_t **buf, size_t *size, int addition, unsigned *allocated_size) +{ + void *ptr = av_fast_realloc(*buf, allocated_size, *size + addition); + + if (!ptr) { + av_freep(buf); //probably not needed + return AVERROR(ENOMEM); + } + *buf = ptr; + *size += addition; + + return 0; +} + +int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size) { int ret = 0; uint8_t *p = *buf; @@ -49,14 +64,16 @@ if (s < LZF_LITERAL_MAX) { s++; if (s > *size - len) { - *size += s + *size /2; - ret = av_reallocp(buf, *size); + ret = lzf_realloc(buf, size, s, allocated_size); if (ret < 0) return ret; p = *buf + len; } - bytestream2_get_buffer(gb, p, s); + int s2 = bytestream2_get_buffer(gb, p, s); + if (s2 != s) + return AVERROR_INVALIDDATA; + p += s; len += s; } else { @@ -72,8 +89,7 @@ return AVERROR_INVALIDDATA; if (l > *size - len) { - *size += l + *size / 2; - ret = av_reallocp(buf, *size); + ret = lzf_realloc(buf, size, l, allocated_size); if (ret < 0) return ret; p = *buf + len; diff -Nru ffmpeg-7.1.1/libavcodec/lzf.h ffmpeg-7.1.2/libavcodec/lzf.h --- ffmpeg-7.1.1/libavcodec/lzf.h 2023-11-09 23:38:51.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/lzf.h 2025-09-14 19:20:09.000000000 +0000 @@ -24,6 +24,6 @@ #include "bytestream.h" -int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size); +int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size); #endif /* AVCODEC_LZF_H */ diff -Nru ffmpeg-7.1.1/libavcodec/mediacodecdec_common.c ffmpeg-7.1.2/libavcodec/mediacodecdec_common.c --- ffmpeg-7.1.1/libavcodec/mediacodecdec_common.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/mediacodecdec_common.c 2025-09-14 19:20:09.000000000 +0000 @@ -594,7 +594,8 @@ AMEDIAFORMAT_GET_INT32(s->crop_right, "crop-right", 0); // Try "crop" for NDK - if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec) + // MediaTek SOC return some default value like Rect(0, 0, 318, 238) + if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec && !strstr(s->codec_name, ".mtk.")) ff_AMediaFormat_getRect(s->format, "crop", &s->crop_left, &s->crop_top, &s->crop_right, &s->crop_bottom); if (s->crop_right && s->crop_bottom) { diff -Nru ffmpeg-7.1.1/libavcodec/mjpegdec.c ffmpeg-7.1.2/libavcodec/mjpegdec.c --- ffmpeg-7.1.1/libavcodec/mjpegdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/mjpegdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -2865,15 +2865,15 @@ AVFrameSideData *sd = NULL; if (orientation >= 2 && orientation <= 8) { - int32_t *matrix; - - sd = av_frame_new_side_data(frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9); - if (!sd) { + ret = ff_frame_new_side_data(avctx, frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9, &sd); + if (ret < 0) { av_log(avctx, AV_LOG_ERROR, "Could not allocate frame side data\n"); - return AVERROR(ENOMEM); + return ret; } + } - matrix = (int32_t *)sd->data; + if (sd) { + int32_t *matrix = (int32_t *)sd->data; switch (orientation) { case 2: diff -Nru ffmpeg-7.1.1/libavcodec/motion_est.c ffmpeg-7.1.2/libavcodec/motion_est.c --- ffmpeg-7.1.1/libavcodec/motion_est.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/motion_est.c 2025-09-14 19:20:09.000000000 +0000 @@ -90,12 +90,12 @@ }; int i; for(i=0; i<3; i++){ - c->src[0][i]= src [i] + offset[i]; - c->ref[0][i]= ref [i] + offset[i]; + c->src[0][i]= src[i] ? FF_PTR_ADD(src[i], offset[i]) : NULL; + c->ref[0][i]= ref[i] ? FF_PTR_ADD(ref[i], offset[i]) : NULL; } if(ref_index){ for(i=0; i<3; i++){ - c->ref[ref_index][i]= ref2[i] + offset[i]; + c->ref[ref_index][i]= ref2[i] ? FF_PTR_ADD(ref2[i], offset[i]) : NULL; } } } diff -Nru ffmpeg-7.1.1/libavcodec/mpc8.c ffmpeg-7.1.2/libavcodec/mpc8.c --- ffmpeg-7.1.1/libavcodec/mpc8.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/mpc8.c 2025-09-14 19:20:09.000000000 +0000 @@ -155,7 +155,13 @@ init_get_bits(&gb, avctx->extradata, 16); - skip_bits(&gb, 3);//sample rate + uint8_t sample_rate_idx = get_bits(&gb, 3); + static const int sample_rates[] = { 44100, 48000, 37800, 32000 }; + if (sample_rate_idx >= FF_ARRAY_ELEMS(sample_rates)) { + av_log(avctx, AV_LOG_ERROR, "invalid sample rate index (%u)\n", sample_rate_idx); + return AVERROR_INVALIDDATA; + } + avctx->sample_rate = sample_rates[sample_rate_idx]; c->maxbands = get_bits(&gb, 5) + 1; if (c->maxbands >= BANDS) { av_log(avctx,AV_LOG_ERROR, "maxbands %d too high\n", c->maxbands); diff -Nru ffmpeg-7.1.1/libavcodec/mpegvideo_dec.c ffmpeg-7.1.2/libavcodec/mpegvideo_dec.c --- ffmpeg-7.1.1/libavcodec/mpegvideo_dec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/mpegvideo_dec.c 2025-09-14 19:20:09.000000000 +0000 @@ -603,7 +603,7 @@ ptr_cr = ref_picture[2] + uvsrc_y * uvlinesize + uvsrc_x; if ((unsigned) src_x > FFMAX( h_edge_pos - (!!sx) - 2 * block_s, 0) || uvsrc_y<0 || - (unsigned) src_y > FFMAX((v_edge_pos >> field_based) - (!!sy) - FFMAX(h, hc<chroma_y_shift), 0)) { + (unsigned) src_y > FFMAX((v_edge_pos >> field_based) - (!!sy) - FFMAX(h, field_select + hc<chroma_y_shift), 0)) { s->vdsp.emulated_edge_mc(s->sc.edge_emu_buffer, ptr_y, linesize >> field_based, linesize >> field_based, 17, 17 + field_based, diff -Nru ffmpeg-7.1.1/libavcodec/mss2dsp.c ffmpeg-7.1.2/libavcodec/mss2dsp.c --- ffmpeg-7.1.1/libavcodec/mss2dsp.c 2023-11-09 23:38:51.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/mss2dsp.c 2025-09-14 19:20:09.000000000 +0000 @@ -56,7 +56,7 @@ } } } - mask += mask_stride; + mask = FF_PTR_ADD(mask, mask_stride); dst += dst_stride; srcy += srcy_stride; srcu += srcuv_stride * (r & 1); diff -Nru ffmpeg-7.1.1/libavcodec/notchlc.c ffmpeg-7.1.2/libavcodec/notchlc.c --- ffmpeg-7.1.1/libavcodec/notchlc.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/notchlc.c 2025-09-14 19:20:09.000000000 +0000 @@ -40,7 +40,8 @@ unsigned uncompressed_size; uint8_t *lzf_buffer; - int64_t lzf_size; + size_t lzf_size; + unsigned lzf_alloc_size; unsigned texture_size_x; unsigned texture_size_y; @@ -490,7 +491,7 @@ return AVERROR_PATCHWELCOME; if (s->format == 0) { - ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size); + ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size, &s->lzf_alloc_size); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.1/libavcodec/opus/dec.c ffmpeg-7.1.2/libavcodec/opus/dec.c --- ffmpeg-7.1.1/libavcodec/opus/dec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/opus/dec.c 2025-09-14 19:20:09.000000000 +0000 @@ -585,6 +585,9 @@ s->decoded_samples = ret; decoded_samples = FFMIN(decoded_samples, ret); + if (!buf) + continue; + buf += s->packet.packet_size; buf_size -= s->packet.packet_size; } diff -Nru ffmpeg-7.1.1/libavcodec/osq.c ffmpeg-7.1.2/libavcodec/osq.c --- ffmpeg-7.1.1/libavcodec/osq.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/osq.c 2025-09-14 19:20:09.000000000 +0000 @@ -146,10 +146,12 @@ static void update_stats(OSQChannel *cb, int val) { - cb->sum += FFABS(val) - cb->history[cb->pos]; - cb->history[cb->pos] = FFABS(val); + cb->sum += FFABS((int64_t)val) - cb->history[cb->pos]; + cb->history[cb->pos] = FFABS((int64_t)val); cb->pos++; cb->count++; + //NOTE for this to make sense count would need to be limited to FF_ARRAY_ELEMS(cb->history) + //Otherwise the average computation later makes no sense if (cb->pos >= FF_ARRAY_ELEMS(cb->history)) cb->pos = 0; } @@ -163,7 +165,8 @@ if (!sum) return 0; x = sum / cb->count; - rice_k = ceil(log2(x)); + av_assert2(x <= 0x80000000U); + rice_k = av_ceil_log2(x); if (rice_k >= 30) { double f = floor(sum / 1.4426952 + 0.5); if (f <= 1) { @@ -190,7 +193,7 @@ static int32_t get_srice(GetBitContext *gb, int x) { - int32_t y = get_urice(gb, x); + uint32_t y = get_urice(gb, x); return get_bits1(gb) ? -y : y; } @@ -209,6 +212,8 @@ cb->residue_parameter = get_urice(gb, 4); if (!cb->residue_parameter || cb->residue_parameter >= 31) return AVERROR_INVALIDDATA; + if (cb->coding_mode == 2) + avpriv_request_sample(avctx, "coding mode 2"); } else if (cb->coding_mode == 3) { cb->residue_bits = get_urice(gb, 4); if (!cb->residue_bits || cb->residue_bits >= 31) diff -Nru ffmpeg-7.1.1/libavcodec/psd.c ffmpeg-7.1.2/libavcodec/psd.c --- ffmpeg-7.1.1/libavcodec/psd.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/psd.c 2025-09-14 19:20:09.000000000 +0000 @@ -418,9 +418,6 @@ s->uncompressed_size = s->line_size * s->height * s->channel_count; - if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) - return ret; - /* decode picture if need */ if (s->compression == PSD_RLE) { s->tmp = av_malloc(s->uncompressed_size); @@ -443,6 +440,9 @@ ptr_data = s->gb.buffer; } + if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) + return ret; + /* Store data */ if ((avctx->pix_fmt == AV_PIX_FMT_YA8)||(avctx->pix_fmt == AV_PIX_FMT_YA16BE)){/* Interleaved */ ptr = picture->data[0]; diff -Nru ffmpeg-7.1.1/libavcodec/sanm.c ffmpeg-7.1.2/libavcodec/sanm.c --- ffmpeg-7.1.1/libavcodec/sanm.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/sanm.c 2025-09-14 19:20:09.000000000 +0000 @@ -974,6 +974,11 @@ } bytestream2_skip(&ctx->gb, 4); + if (w + FFMAX(left, 0) > ctx->avctx->width || h + FFMAX(top, 0) > ctx->avctx->height) { + avpriv_request_sample(ctx->avctx, "overly large frame\n"); + return AVERROR_PATCHWELCOME; + } + switch (codec) { case 1: case 3: diff -Nru ffmpeg-7.1.1/libavcodec/scpr3.c ffmpeg-7.1.2/libavcodec/scpr3.c --- ffmpeg-7.1.1/libavcodec/scpr3.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/scpr3.c 2025-09-14 19:20:09.000000000 +0000 @@ -1167,7 +1167,7 @@ } } else { int run, bx = x * 16 + sx1, by = y * 16 + sy1; - uint32_t clr, ptype = 0, r, g, b; + uint32_t clr = 0, ptype = 0, r, g, b; if (bx >= avctx->width) return AVERROR_INVALIDDATA; diff -Nru ffmpeg-7.1.1/libavcodec/shorten.c ffmpeg-7.1.2/libavcodec/shorten.c --- ffmpeg-7.1.1/libavcodec/shorten.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/shorten.c 2025-09-14 19:20:09.000000000 +0000 @@ -584,7 +584,7 @@ if (avpkt->size) { int max_framesize = s->blocksize * s->channels * 8; void *tmp_ptr; - + unsigned old_allocated_bitstream_size = s->allocated_bitstream_size; tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, max_framesize + AV_INPUT_BUFFER_PADDING_SIZE); if (!tmp_ptr) { @@ -592,9 +592,8 @@ return AVERROR(ENOMEM); } s->bitstream = tmp_ptr; - if (max_framesize > s->max_framesize) - memset(s->bitstream + s->max_framesize, 0, (max_framesize - s->max_framesize) + - AV_INPUT_BUFFER_PADDING_SIZE); + if (s->allocated_bitstream_size > old_allocated_bitstream_size) + memset(s->bitstream + old_allocated_bitstream_size, 0, s->allocated_bitstream_size - old_allocated_bitstream_size); s->max_framesize = FFMAX(s->max_framesize, max_framesize); *got_frame_ptr = 0; goto finish_frame; diff -Nru ffmpeg-7.1.1/libavcodec/smacker.c ffmpeg-7.1.2/libavcodec/smacker.c --- ffmpeg-7.1.1/libavcodec/smacker.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/smacker.c 2025-09-14 19:20:09.000000000 +0000 @@ -646,10 +646,6 @@ "The buffer does not contain an integer number of samples\n"); return AVERROR_INVALIDDATA; } - if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) - return ret; - samples = (int16_t *)frame->data[0]; - samples8 = frame->data[0]; // Initialize for(i = 0; i < (1 << (bits + stereo)); i++) { @@ -671,6 +667,12 @@ } else values[i] = h.entries[0].value; } + + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) + return ret; + samples = (int16_t *)frame->data[0]; + samples8 = frame->data[0]; + /* this codec relies on wraparound instead of clipping audio */ if(bits) { //decode 16-bit data for(i = stereo; i >= 0; i--) diff -Nru ffmpeg-7.1.1/libavcodec/sonic.c ffmpeg-7.1.2/libavcodec/sonic.c --- ffmpeg-7.1.1/libavcodec/sonic.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/sonic.c 2025-09-14 19:20:09.000000000 +0000 @@ -924,6 +924,9 @@ if (get_bits1(&gb)) // XXX FIXME av_log(avctx, AV_LOG_INFO, "Custom quant table\n"); + if (s->num_taps > 128) + return AVERROR_INVALIDDATA; + s->block_align = 2048LL*s->samplerate/(44100*s->downsampling); s->frame_size = s->channels*s->block_align*s->downsampling; // avctx->frame_size = s->block_align; diff -Nru ffmpeg-7.1.1/libavcodec/speexdec.c ffmpeg-7.1.2/libavcodec/speexdec.c --- ffmpeg-7.1.1/libavcodec/speexdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/speexdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -168,7 +168,7 @@ typedef struct SpeexMode { int modeID; /**< ID of the mode */ - int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out); + int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out, int packets_left); int frame_size; /**< Size of frames used for decoding */ int subframe_size; /**< Size of sub-frames used for decoding */ int lpc_size; /**< Order of LPC filter */ @@ -520,8 +520,8 @@ split_cb_shape_sign_unquant, &split_cb_high, -1.f }; -static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *); -static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *); +static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); +static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); static const SpeexMode speex_modes[SPEEX_NB_MODES] = { { @@ -866,7 +866,7 @@ } static int nb_decode(AVCodecContext *avctx, void *ptr_st, - GetBitContext *gb, float *out) + GetBitContext *gb, float *out, int packets_left) { DecoderState *st = ptr_st; float ol_gain = 0, ol_pitch_coef = 0, best_pitch_gain = 0, pitch_average = 0; @@ -1217,7 +1217,7 @@ } static int sb_decode(AVCodecContext *avctx, void *ptr_st, - GetBitContext *gb, float *out) + GetBitContext *gb, float *out, int packets_left) { SpeexContext *s = avctx->priv_data; DecoderState *st = ptr_st; @@ -1233,9 +1233,11 @@ mode = st->mode; if (st->modeID > 0) { + if (packets_left * s->frame_size < 2*st->frame_size) + return AVERROR_INVALIDDATA; low_innov_alias = out + st->frame_size; s->st[st->modeID - 1].innov_save = low_innov_alias; - ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out); + ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out, packets_left); if (ret < 0) return ret; } @@ -1558,7 +1560,7 @@ dst = (float *)frame->extended_data[0]; for (int i = 0; i < frames_per_packet; i++) { - ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size); + ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size, frames_per_packet - i); if (ret < 0) return ret; if (avctx->ch_layout.nb_channels == 2) diff -Nru ffmpeg-7.1.1/libavcodec/svq3.c ffmpeg-7.1.2/libavcodec/svq3.c --- ffmpeg-7.1.1/libavcodec/svq3.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/svq3.c 2025-09-14 19:20:09.000000000 +0000 @@ -1253,6 +1253,7 @@ uint8_t *buf; if (watermark_height <= 0 || + get_bits_left(&gb) <= 0 || (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) return AVERROR_INVALIDDATA; diff -Nru ffmpeg-7.1.1/libavcodec/takdec.c ffmpeg-7.1.2/libavcodec/takdec.c --- ffmpeg-7.1.1/libavcodec/takdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/takdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -434,6 +434,9 @@ return AVERROR_INVALIDDATA; } + if (get_bits_left(gb) < 2*10 + 2*size) + return AVERROR_INVALIDDATA; + s->predictors[0] = get_sbits(gb, 10); s->predictors[1] = get_sbits(gb, 10); s->predictors[2] = get_sbits(gb, size) * (1 << (10 - size)); diff -Nru ffmpeg-7.1.1/libavcodec/tests/avpacket.c ffmpeg-7.1.2/libavcodec/tests/avpacket.c --- ffmpeg-7.1.1/libavcodec/tests/avpacket.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/tests/avpacket.c 2025-09-14 19:20:09.000000000 +0000 @@ -51,6 +51,7 @@ ret = av_packet_add_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, extra_data, bytes); if(ret < 0){ + av_free(extra_data); fprintf(stderr, "Error occurred in av_packet_add_side_data: %s\n", av_err2str(ret)); @@ -101,11 +102,14 @@ if(!avpkt_clone) { av_log(NULL, AV_LOG_ERROR,"av_packet_clone failed to clone AVPacket\n"); + av_packet_free(&avpkt); return 1; } /*test av_grow_packet*/ if(av_grow_packet(avpkt_clone, 20) < 0){ av_log(NULL, AV_LOG_ERROR, "av_grow_packet failed\n"); + av_packet_free(&avpkt_clone); + av_packet_free(&avpkt); return 1; } if(av_grow_packet(avpkt_clone, INT_MAX) == 0){ diff -Nru ffmpeg-7.1.1/libavcodec/tests/motion.c ffmpeg-7.1.2/libavcodec/tests/motion.c --- ffmpeg-7.1.1/libavcodec/tests/motion.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/tests/motion.c 2025-09-14 19:20:09.000000000 +0000 @@ -129,6 +129,10 @@ printf("ffmpeg motion test\n"); ctx = avcodec_alloc_context3(NULL); + if (!ctx) { + return 1; + } + ctx->flags |= AV_CODEC_FLAG_BITEXACT; av_force_cpu_flags(0); ff_me_cmp_init(&cctx, ctx); diff -Nru ffmpeg-7.1.1/libavcodec/tests/snowenc.c ffmpeg-7.1.2/libavcodec/tests/snowenc.c --- ffmpeg-7.1.1/libavcodec/tests/snowenc.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/tests/snowenc.c 2025-09-14 19:20:09.000000000 +0000 @@ -45,7 +45,8 @@ if (!s.temp_dwt_buffer || !s.temp_idwt_buffer) { fprintf(stderr, "Failed to allocate memory\n"); - return 1; + ret = 1; + goto end; } av_lfg_init(&prng, 1); @@ -145,5 +146,9 @@ } } + +end: + av_free(s.temp_dwt_buffer); + av_free(s.temp_idwt_buffer); return ret; } diff -Nru ffmpeg-7.1.1/libavcodec/utvideodec.c ffmpeg-7.1.2/libavcodec/utvideodec.c --- ffmpeg-7.1.1/libavcodec/utvideodec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/utvideodec.c 2025-09-14 19:20:09.000000000 +0000 @@ -402,7 +402,7 @@ // second line - first element has top prediction, the rest uses median C = bsrc[-stride]; bsrc[0] += C; - A = bsrc[0]; + A = B = bsrc[0]; for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */ B = bsrc[i - stride]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); @@ -585,7 +585,7 @@ int buf_size = avpkt->size; UtvideoContext *c = avctx->priv_data; int i, j; - const uint8_t *plane_start[5]; + const uint8_t *plane_start[5] = {NULL}; int plane_size, max_slice_size = 0, slice_start, slice_end, slice_size; int ret; GetByteContext gb; diff -Nru ffmpeg-7.1.1/libavcodec/videotoolbox_vp9.c ffmpeg-7.1.2/libavcodec/videotoolbox_vp9.c --- ffmpeg-7.1.1/libavcodec/videotoolbox_vp9.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/videotoolbox_vp9.c 2025-09-14 19:20:09.000000000 +0000 @@ -71,12 +71,12 @@ uint8_t *vt_extradata; int subsampling = get_vpx_chroma_subsampling(avctx->sw_pix_fmt, avctx->chroma_sample_location); - vt_extradata_size = 1 + 3 + 6 + 2; - vt_extradata = av_malloc(vt_extradata_size); - if (subsampling < 0) return NULL; + vt_extradata_size = 1 + 3 + 6 + 2; + vt_extradata = av_malloc(vt_extradata_size); + if (!vt_extradata) return NULL; diff -Nru ffmpeg-7.1.1/libavcodec/vorbisdec.c ffmpeg-7.1.2/libavcodec/vorbisdec.c --- ffmpeg-7.1.1/libavcodec/vorbisdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/vorbisdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -1469,8 +1469,10 @@ unsigned step = FASTDIV(vr->partition_size << 1, dim << 1); vorbis_codebook codebook = vc->codebooks[vqbook]; - if (get_bits_left(gb) <= 0) - return AVERROR_INVALIDDATA; + if (get_bits_left(gb) < 0) { + av_log(vc->avctx, AV_LOG_ERROR, "Overread %d bits\n", -get_bits_left(gb)); + return 0; + } if (vr_type == 0) { diff -Nru ffmpeg-7.1.1/libavcodec/vqavideo.c ffmpeg-7.1.2/libavcodec/vqavideo.c --- ffmpeg-7.1.1/libavcodec/vqavideo.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/vqavideo.c 2025-09-14 19:20:09.000000000 +0000 @@ -571,8 +571,9 @@ } /* accumulate partial codebook */ - bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], - chunk_size); + if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], + chunk_size)) + return AVERROR_INVALIDDATA; s->next_codebook_buffer_index += chunk_size; s->partial_countdown--; @@ -600,8 +601,9 @@ } /* accumulate partial codebook */ - bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], - chunk_size); + if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index], + chunk_size)) + return AVERROR_INVALIDDATA; s->next_codebook_buffer_index += chunk_size; s->partial_countdown--; diff -Nru ffmpeg-7.1.1/libavcodec/vvc/intra.c ffmpeg-7.1.2/libavcodec/vvc/intra.c --- ffmpeg-7.1.1/libavcodec/vvc/intra.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavcodec/vvc/intra.c 2025-09-14 19:20:09.000000000 +0000 @@ -390,10 +390,10 @@ const int log2_matrix_size = (id < 2) ? 1 : (id < 8) ? 2 : 3; uint8_t *p = scale_m; - av_assert0(!sps->r->sps_scaling_matrix_for_alternative_colour_space_disabled_flag); - if (!rsh->sh_explicit_scaling_list_used_flag || tb->ts || - sps->r->sps_scaling_matrix_for_lfnst_disabled_flag && cu->apply_lfnst_flag[tb->c_idx]) + (sps->r->sps_scaling_matrix_for_lfnst_disabled_flag && cu->apply_lfnst_flag[tb->c_idx]) || + (sps->r->sps_scaling_matrix_for_alternative_colour_space_disabled_flag && + sps->r->sps_scaling_matrix_designated_colour_space_flag == cu->act_enabled_flag)) return ff_vvc_default_scale_m; if (!sl) { diff -Nru ffmpeg-7.1.1/libavfilter/af_firequalizer.c ffmpeg-7.1.2/libavfilter/af_firequalizer.c --- ffmpeg-7.1.1/libavfilter/af_firequalizer.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/af_firequalizer.c 2025-09-14 19:20:09.000000000 +0000 @@ -808,6 +808,8 @@ if ((ret = av_tx_init(&s->analysis_rdft, &s->analysis_rdft_fn, AV_TX_FLOAT_RDFT, 0, 1 << rdft_bits, &scale, 0)) < 0) return ret; s->dump_buf = av_malloc_array(s->analysis_rdft_len + 2, sizeof(*s->dump_buf)); + if (!s->dump_buf) + return AVERROR(ENOMEM); } s->analysis_buf = av_malloc_array((s->analysis_rdft_len + 2), sizeof(*s->analysis_buf)); diff -Nru ffmpeg-7.1.1/libavfilter/avf_showcqt.c ffmpeg-7.1.2/libavfilter/avf_showcqt.c --- ffmpeg-7.1.1/libavfilter/avf_showcqt.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/avf_showcqt.c 2025-09-14 19:20:09.000000000 +0000 @@ -1520,7 +1520,7 @@ i = insamples->nb_samples - remaining; j = s->fft_len/2 + s->remaining_fill_max - s->remaining_fill; if (remaining >= s->remaining_fill) { - for (m = 0; m < s->remaining_fill; m++) { + for (m = FFMAX(0, -j); m < s->remaining_fill; m++) { s->fft_data[j+m].re = audio_data[2*(i+m)]; s->fft_data[j+m].im = audio_data[2*(i+m)+1]; } @@ -1549,7 +1549,7 @@ s->fft_data[m] = s->fft_data[m+step]; s->remaining_fill = step; } else { - for (m = 0; m < remaining; m++) { + for (m = FFMAX(0, -j); m < remaining; m++) { s->fft_data[j+m].re = audio_data[2*(i+m)]; s->fft_data[j+m].im = audio_data[2*(i+m)+1]; } diff -Nru ffmpeg-7.1.1/libavfilter/avfilter.c ffmpeg-7.1.2/libavfilter/avfilter.c --- ffmpeg-7.1.1/libavfilter/avfilter.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/avfilter.c 2025-09-14 19:20:09.000000000 +0000 @@ -1213,16 +1213,14 @@ static int ff_filter_activate_default(AVFilterContext *filter) { unsigned i; + int nb_eofs = 0; - for (i = 0; i < filter->nb_outputs; i++) { - FilterLinkInternal *li = ff_link_internal(filter->outputs[i]); - int ret = li->status_in; - - if (ret) { - for (int j = 0; j < filter->nb_inputs; j++) - ff_inlink_set_status(filter->inputs[j], ret); - return 0; - } + for (i = 0; i < filter->nb_outputs; i++) + nb_eofs += ff_outlink_get_status(filter->outputs[i]) == AVERROR_EOF; + if (filter->nb_outputs && nb_eofs == filter->nb_outputs) { + for (int j = 0; j < filter->nb_inputs; j++) + ff_inlink_set_status(filter->inputs[j], AVERROR_EOF); + return 0; } for (i = 0; i < filter->nb_inputs; i++) { diff -Nru ffmpeg-7.1.1/libavfilter/avfiltergraph.c ffmpeg-7.1.2/libavfilter/avfiltergraph.c --- ffmpeg-7.1.1/libavfilter/avfiltergraph.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/avfiltergraph.c 2025-09-14 19:20:09.000000000 +0000 @@ -1067,8 +1067,8 @@ } /* no penalty for LFE channel mismatch */ - if (av_channel_layout_channel_from_index(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 && - av_channel_layout_channel_from_index(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0) + if (av_channel_layout_index_from_channel(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 && + av_channel_layout_index_from_channel(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0) score += 10; av_channel_layout_from_mask(&in_chlayout, av_channel_layout_subset(&in_chlayout, ~AV_CH_LOW_FREQUENCY)); av_channel_layout_from_mask(&out_chlayout, av_channel_layout_subset(&out_chlayout, ~AV_CH_LOW_FREQUENCY)); diff -Nru ffmpeg-7.1.1/libavfilter/dnn/dnn_backend_tf.c ffmpeg-7.1.2/libavfilter/dnn/dnn_backend_tf.c --- ffmpeg-7.1.1/libavfilter/dnn/dnn_backend_tf.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/dnn/dnn_backend_tf.c 2025-09-14 19:20:09.000000000 +0000 @@ -833,14 +833,12 @@ ret = extract_lltask_from_task(task, tf_model->lltask_queue); if (ret != 0) { - av_freep(&task); av_log(ctx, AV_LOG_ERROR, "unable to extract last level task from task.\n"); return ret; } request = ff_safe_queue_pop_front(tf_model->request_queue); if (!request) { - av_freep(&task); av_log(ctx, AV_LOG_ERROR, "unable to get infer request.\n"); return AVERROR(EINVAL); } diff -Nru ffmpeg-7.1.1/libavfilter/vaf_spectrumsynth.c ffmpeg-7.1.2/libavfilter/vaf_spectrumsynth.c --- ffmpeg-7.1.1/libavfilter/vaf_spectrumsynth.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/vaf_spectrumsynth.c 2025-09-14 19:20:09.000000000 +0000 @@ -145,7 +145,7 @@ int height = ctx->inputs[0]->h; AVRational time_base = ctx->inputs[0]->time_base; AVRational frame_rate = inl0->frame_rate; - float factor, overlap, scale; + float factor, overlap; int i, ch, ret; outlink->sample_rate = s->sample_rate; @@ -180,7 +180,7 @@ s->win_size = s->size * 2; s->nb_freq = s->size; - ret = av_tx_init(&s->fft, &s->tx_fn, AV_TX_FLOAT_FFT, 1, s->win_size, &scale, 0); + ret = av_tx_init(&s->fft, &s->tx_fn, AV_TX_FLOAT_FFT, 1, s->win_size, NULL, 0); if (ret < 0) { av_log(ctx, AV_LOG_ERROR, "Unable to create FFT context. " "The window size might be too high.\n"); diff -Nru ffmpeg-7.1.1/libavfilter/vf_setparams.c ffmpeg-7.1.2/libavfilter/vf_setparams.c --- ffmpeg-7.1.1/libavfilter/vf_setparams.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavfilter/vf_setparams.c 2025-09-14 19:20:09.000000000 +0000 @@ -246,6 +246,7 @@ s->color_primaries = -1; s->color_trc = -1; s->colorspace = -1; + s->chroma_location = -1; return 0; } @@ -282,6 +283,7 @@ s->color_primaries = -1; s->color_trc = -1; s->colorspace = -1; + s->chroma_location = -1; return 0; } diff -Nru ffmpeg-7.1.1/libavformat/asfdec_f.c ffmpeg-7.1.2/libavformat/asfdec_f.c --- ffmpeg-7.1.1/libavformat/asfdec_f.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/asfdec_f.c 2025-09-14 19:20:09.000000000 +0000 @@ -240,8 +240,10 @@ case ASF_UNICODE: avio_get_str16le(s->pb, len, value, 2 * len + 1); break; - case -1: // ASCI - avio_read(s->pb, value, len); + case -1:; // ASCII + int ret = ffio_read_size(s->pb, value, len); + if (ret < 0) + goto finish; value[len]=0; break; case ASF_BYTE_ARRAY: diff -Nru ffmpeg-7.1.1/libavformat/avidec.c ffmpeg-7.1.2/libavformat/avidec.c --- ffmpeg-7.1.1/libavformat/avidec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/avidec.c 2025-09-14 19:20:09.000000000 +0000 @@ -1122,6 +1122,10 @@ int size; AVProbeData pd; unsigned int desc_len; + + if (ast->sub_ctx) + return 0; + AVIOContext *pb = avio_alloc_context(pkt->data + 7, pkt->size - 7, 0, NULL, NULL, NULL, NULL); diff -Nru ffmpeg-7.1.1/libavformat/concatdec.c ffmpeg-7.1.2/libavformat/concatdec.c --- ffmpeg-7.1.1/libavformat/concatdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/concatdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -326,7 +326,7 @@ if (file->outpoint != AV_NOPTS_VALUE) return av_sat_sub64(file->outpoint, file->file_inpoint); if (avf->duration > 0) - return avf->duration - (file->file_inpoint - file->file_start_time); + return av_sat_sub64(avf->duration, file->file_inpoint - file->file_start_time); if (file->next_dts != AV_NOPTS_VALUE) return file->next_dts - file->file_inpoint; return AV_NOPTS_VALUE; diff -Nru ffmpeg-7.1.1/libavformat/dashdec.c ffmpeg-7.1.2/libavformat/dashdec.c --- ffmpeg-7.1.1/libavformat/dashdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/dashdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -735,7 +735,7 @@ } tmp_max_url_size = aligned(tmp_max_url_size); - text = av_mallocz(tmp_max_url_size); + text = av_mallocz(tmp_max_url_size + 1); if (!text) { updated = AVERROR(ENOMEM); goto end; @@ -747,7 +747,7 @@ } av_free(text); - path = av_mallocz(tmp_max_url_size); + path = av_mallocz(tmp_max_url_size + 2); tmp_str = av_mallocz(tmp_max_url_size); if (!tmp_str || !path) { updated = AVERROR(ENOMEM); @@ -769,6 +769,15 @@ node = baseurl_nodes[rootId]; baseurl = xmlNodeGetContent(node); + if (baseurl) { + size_t len = xmlStrlen(baseurl)+2; + char *tmp = xmlRealloc(baseurl, len); + if (!tmp) { + updated = AVERROR(ENOMEM); + goto end; + } + baseurl = tmp; + } root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path; if (node) { xmlNodeSetContent(node, root_url); diff -Nru ffmpeg-7.1.1/libavformat/hls.c ffmpeg-7.1.2/libavformat/hls.c --- ffmpeg-7.1.1/libavformat/hls.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/hls.c 2025-09-14 19:20:09.000000000 +0000 @@ -223,6 +223,7 @@ AVDictionary *avio_opts; AVDictionary *seg_format_opts; char *allowed_extensions; + char *allowed_segment_extensions; int extension_picky; int max_reload; int http_persistent; @@ -741,12 +742,12 @@ if (!c->extension_picky) return 0; - if (strcmp(c->allowed_extensions, "ALL")) - matchA = av_match_ext (seg->url, c->allowed_extensions) - + 2*(ff_match_url_ext(seg->url, c->allowed_extensions) > 0); + if (strcmp(c->allowed_segment_extensions, "ALL")) + matchA = av_match_ext (seg->url, c->allowed_segment_extensions) + + 2*(ff_match_url_ext(seg->url, c->allowed_segment_extensions) > 0); if (!matchA) { - av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url); + av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_segment_extensions\n", seg->url); return AVERROR_INVALIDDATA; } @@ -754,13 +755,17 @@ if (in_fmt->extensions) { matchF = av_match_ext( seg->url, in_fmt->extensions) + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0); - if(av_match_name("mp4", in_fmt->name)) { - matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") - + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); + // Youtube uses aac files with .ts extension + if(av_match_name("mp4", in_fmt->name) || av_match_name("aac", in_fmt->name)) { + matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts,cmfv,cmfa") + + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts,cmfv,cmfa") > 0); } } else if (!strcmp(in_fmt->name, "mpegts")) { - matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") - + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); + const char *str = "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts" + ",html" // https://flash1.bogulus.cfd/ + ; + matchF = av_match_ext( seg->url, str) + + 2*(ff_match_url_ext(seg->url, str) > 0); } if (!(matchA & matchF)) { @@ -1351,7 +1356,7 @@ if (seg->key_type == KEY_AES_128 || seg->key_type == KEY_SAMPLE_AES) { if (strcmp(seg->key, pls->key_url)) { AVIOContext *pb = NULL; - if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, opts, NULL) == 0) { + if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, NULL, NULL) == 0) { ret = avio_read(pb, pls->key, sizeof(pls->key)); if (ret != sizeof(pls->key)) { av_log(pls->parent, AV_LOG_ERROR, "Unable to read key file %s\n", @@ -2628,7 +2633,20 @@ OFFSET(prefer_x_start), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, FLAGS}, {"allowed_extensions", "List of file extensions that hls is allowed to access", OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, - {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"}, + {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" + ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp + ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) + ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 + }, + INT_MIN, INT_MAX, FLAGS}, + {"allowed_segment_extensions", "List of file extensions that hls is allowed to access", + OFFSET(allowed_segment_extensions), AV_OPT_TYPE_STRING, + {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" + ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp + ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) + ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 + ",html" // https://flash1.bogulus.cfd/ + }, INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS}, diff -Nru ffmpeg-7.1.1/libavformat/iamf_parse.c ffmpeg-7.1.2/libavformat/iamf_parse.c --- ffmpeg-7.1.1/libavformat/iamf_parse.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/iamf_parse.c 2025-09-14 19:20:09.000000000 +0000 @@ -285,10 +285,11 @@ AV_WL16A(codecpar->extradata + 16, AV_RB16A(codecpar->extradata + 16)); // Byte swap Output Gain break; case AV_CODEC_ID_AAC: { - uint8_t buf[5]; + uint8_t buf[6]; + int size = FFMIN(codecpar->extradata_size, sizeof(buf)); init_put_bits(&pb, buf, sizeof(buf)); - ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); + ret = init_get_bits8(&gb, codecpar->extradata, size); if (ret < 0) return ret; @@ -303,7 +304,14 @@ skip_bits(&gb, 4); put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config - ret = put_bits_left(&pb); + ret = get_bits_left(&gb); + if (ret < 0) + return AVERROR_INVALIDDATA; + ret = FFMIN(ret, put_bits_left(&pb)); + while (ret >= 32) { + put_bits32(&pb, get_bits_long(&gb, 32)); + ret -= 32; + } put_bits(&pb, ret, get_bits_long(&gb, ret)); flush_put_bits(&pb); @@ -312,9 +320,10 @@ } case AV_CODEC_ID_FLAC: { uint8_t buf[13]; + int size = FFMIN(codecpar->extradata_size, sizeof(buf)); init_put_bits(&pb, buf, sizeof(buf)); - ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); + ret = init_get_bits8(&gb, codecpar->extradata, size); if (ret < 0) return ret; @@ -323,11 +332,14 @@ put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate skip_bits(&gb, 3); put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1); - ret = put_bits_left(&pb); + ret = get_bits_left(&gb); + if (ret < 0) + return AVERROR_INVALIDDATA; + ret = FFMIN(ret, put_bits_left(&pb)); put_bits(&pb, ret, get_bits(&gb, ret)); flush_put_bits(&pb); - memcpy(codecpar->extradata, buf, sizeof(buf)); + memcpy(codecpar->extradata, buf, put_bytes_output(&pb)); break; } } diff -Nru ffmpeg-7.1.1/libavformat/iff.c ffmpeg-7.1.2/libavformat/iff.c --- ffmpeg-7.1.1/libavformat/iff.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/iff.c 2025-09-14 19:20:09.000000000 +0000 @@ -280,7 +280,7 @@ return AVERROR_INVALIDDATA; st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC; st->codecpar->ch_layout.nb_channels = avio_rb16(pb); - if (size < 2 + st->codecpar->ch_layout.nb_channels * 4) + if (size < 2 + st->codecpar->ch_layout.nb_channels * 4 || !st->codecpar->ch_layout.nb_channels) return AVERROR_INVALIDDATA; if (st->codecpar->ch_layout.nb_channels > FF_ARRAY_ELEMS(dsd_layout)) { avpriv_request_sample(s, "channel layout"); @@ -497,6 +497,8 @@ st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_MONO; else if (st->codecpar->ch_layout.nb_channels == 2) st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; + else if (st->codecpar->ch_layout.nb_channels == 0) + return AVERROR_INVALIDDATA; break; case ID_ABIT: diff -Nru ffmpeg-7.1.1/libavformat/imf_cpl.c ffmpeg-7.1.2/libavformat/imf_cpl.c --- ffmpeg-7.1.1/libavformat/imf_cpl.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/imf_cpl.c 2025-09-14 19:20:09.000000000 +0000 @@ -709,31 +709,31 @@ av_log(log_ctx, AV_LOG_DEBUG, "Processing IMF CPL Segment\n"); sequence_list_elem = ff_imf_xml_get_child_element_by_name(segment_elem, "SequenceList"); - if (!sequence_list_elem) - continue; + if (sequence_list_elem) { - sequence_elem = xmlFirstElementChild(sequence_list_elem); - while (sequence_elem) { - if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0) - ret = push_marker_sequence(log_ctx, sequence_elem, cpl); - - else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0) - ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl); - - else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0) - ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl); - - else - av_log(log_ctx, - AV_LOG_INFO, - "The following Sequence is not supported and is ignored: %s\n", - sequence_elem->name); - - /* abort parsing only if memory error occurred */ - if (ret == AVERROR(ENOMEM)) - return ret; + sequence_elem = xmlFirstElementChild(sequence_list_elem); + while (sequence_elem) { + if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0) + ret = push_marker_sequence(log_ctx, sequence_elem, cpl); + + else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0) + ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl); + + else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0) + ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl); + + else + av_log(log_ctx, + AV_LOG_INFO, + "The following Sequence is not supported and is ignored: %s\n", + sequence_elem->name); + + /* abort parsing only if memory error occurred */ + if (ret == AVERROR(ENOMEM)) + return ret; - sequence_elem = xmlNextElementSibling(sequence_elem); + sequence_elem = xmlNextElementSibling(sequence_elem); + } } segment_elem = xmlNextElementSibling(segment_elem); diff -Nru ffmpeg-7.1.1/libavformat/libopenmpt.c ffmpeg-7.1.2/libavformat/libopenmpt.c --- ffmpeg-7.1.1/libavformat/libopenmpt.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/libopenmpt.c 2025-09-14 19:20:09.000000000 +0000 @@ -148,7 +148,8 @@ if (!st) return AVERROR(ENOMEM); avpriv_set_pts_info(st, 64, 1, AV_TIME_BASE); - st->duration = llrint(openmpt->duration*AV_TIME_BASE); + if (openmpt->duration >= 0 && openmpt->duration < ((double)INT64_MAX + 1) / AV_TIME_BASE) + st->duration = llrint(openmpt->duration*AV_TIME_BASE); st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_NE(AV_CODEC_ID_PCM_F32BE, AV_CODEC_ID_PCM_F32LE); @@ -171,6 +172,8 @@ if ((ret = av_new_packet(pkt, AUDIO_PKT_SIZE)) < 0) return ret; + double pos = openmpt_module_get_position_seconds(openmpt->module); + switch (openmpt->ch_layout.nb_channels) { case 1: ret = openmpt_module_read_float_mono(openmpt->module, openmpt->sample_rate, @@ -196,6 +199,9 @@ pkt->size = ret * (openmpt->ch_layout.nb_channels * 4); + if (pos >= 0 && pos < ((double)INT64_MAX + 1) / AV_TIME_BASE) + pkt->pts = llrint(pos * AV_TIME_BASE); + return 0; } @@ -212,6 +218,8 @@ static int read_seek_openmpt(AVFormatContext *s, int stream_idx, int64_t ts, int flags) { OpenMPTContext *openmpt = s->priv_data; + if (ts < 0) + ts = 0; openmpt_module_set_position_seconds(openmpt->module, (double)ts/AV_TIME_BASE); return 0; } diff -Nru ffmpeg-7.1.1/libavformat/lrcdec.c ffmpeg-7.1.2/libavformat/lrcdec.c --- ffmpeg-7.1.1/libavformat/lrcdec.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/lrcdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -78,7 +78,9 @@ static int64_t read_ts(const char *p, int64_t *start) { int64_t offset = 0; - uint64_t mm, ss, cs; + uint32_t mm; + double ss; + char prefix[3]; while(p[offset] == ' ' || p[offset] == '\t') { offset++; @@ -86,14 +88,14 @@ if(p[offset] != '[') { return 0; } - if(sscanf(p, "[-%"SCNu64":%"SCNu64".%"SCNu64"]", &mm, &ss, &cs) == 3) { - /* Just in case negative pts, players may drop it but we won't. */ - *start = -(int64_t) (mm*60000 + ss*1000 + cs*10); - } else if(sscanf(p, "[%"SCNu64":%"SCNu64".%"SCNu64"]", &mm, &ss, &cs) == 3) { - *start = mm*60000 + ss*1000 + cs*10; - } else { + int ret = sscanf(p, "%2[[-]%"SCNu32":%lf]", prefix, &mm, &ss); + if (ret != 3 || prefix[0] != '[' || ss < 0 || ss > 60) { return 0; } + *start = llrint((mm * 60 + ss) * AV_TIME_BASE); + if (prefix[1] == '-') { + *start = - *start; + } do { offset++; } while(p[offset] && p[offset-1] != ']'); @@ -164,7 +166,7 @@ if(!st) { return AVERROR(ENOMEM); } - avpriv_set_pts_info(st, 64, 1, 1000); + avpriv_set_pts_info(st, 64, 1, AV_TIME_BASE); lrc->ts_offset = 0; st->codecpar->codec_type = AVMEDIA_TYPE_SUBTITLE; st->codecpar->codec_id = AV_CODEC_ID_TEXT; diff -Nru ffmpeg-7.1.1/libavformat/matroska.c ffmpeg-7.1.2/libavformat/matroska.c --- ffmpeg-7.1.1/libavformat/matroska.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/matroska.c 2025-09-14 19:20:09.000000000 +0000 @@ -82,6 +82,7 @@ {"V_AVS3" , AV_CODEC_ID_AVS3}, {"V_DIRAC" , AV_CODEC_ID_DIRAC}, {"V_FFV1" , AV_CODEC_ID_FFV1}, + {"V_JPEG2000" , AV_CODEC_ID_JPEG2000}, {"V_MJPEG" , AV_CODEC_ID_MJPEG}, {"V_MPEG1" , AV_CODEC_ID_MPEG1VIDEO}, {"V_MPEG2" , AV_CODEC_ID_MPEG2VIDEO}, diff -Nru ffmpeg-7.1.1/libavformat/matroskadec.c ffmpeg-7.1.2/libavformat/matroskadec.c --- ffmpeg-7.1.1/libavformat/matroskadec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/matroskadec.c 2025-09-14 19:20:09.000000000 +0000 @@ -2843,6 +2843,8 @@ par->sample_rate = track->audio.out_samplerate; // channel layout may be already set by codec private checks above if (!av_channel_layout_check(&par->ch_layout)) { + if (track->audio.channels > INT32_MAX) + return AVERROR_PATCHWELCOME; par->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC; par->ch_layout.nb_channels = track->audio.channels; } @@ -2876,6 +2878,11 @@ { if (!strcmp(track->codec_id, "V_MS/VFW/FOURCC") && track->codec_priv.size >= 40) { + uint32_t size = AV_RL32A(track->codec_priv.data); + // VFW extradata is padded to an even length, yet + // the size field contains the real length. + if (size & 1 && size == track->codec_priv.size - 1) + --track->codec_priv.size; track->ms_compat = 1; par->bits_per_coded_sample = AV_RL16(track->codec_priv.data + 14); par->codec_tag = AV_RL32(track->codec_priv.data + 16); diff -Nru ffmpeg-7.1.1/libavformat/matroskaenc.c ffmpeg-7.1.2/libavformat/matroskaenc.c --- ffmpeg-7.1.1/libavformat/matroskaenc.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/matroskaenc.c 2025-09-14 19:20:09.000000000 +0000 @@ -1956,8 +1956,8 @@ // look for a codec ID string specific to mkv to use, // if none are found, use AVI codes - if (par->codec_id == AV_CODEC_ID_FFV1) { - /* FFV1 is actually supported natively in Matroska, + if (par->codec_id == AV_CODEC_ID_FFV1 || par->codec_id == AV_CODEC_ID_JPEG2000) { + /* FFV1 and JPEG2000 are actually supported natively in Matroska, * yet we use the VfW way to mux it for compatibility * with old demuxers. (FIXME: Are they really important?) */ } else if (par->codec_id != AV_CODEC_ID_RAWVIDEO || par->codec_tag) { diff -Nru ffmpeg-7.1.1/libavformat/mov.c ffmpeg-7.1.2/libavformat/mov.c --- ffmpeg-7.1.1/libavformat/mov.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/mov.c 2025-09-14 19:20:09.000000000 +0000 @@ -1370,7 +1370,9 @@ avio_read(pb, output, 8); // go to offset 8, absolute position 0x251 avio_read(pb, input, DRM_BLOB_SIZE); avio_read(pb, output, 4); // go to offset 4, absolute position 0x28d - avio_read(pb, file_checksum, 20); + ret = ffio_read_size(pb, file_checksum, 20); + if (ret < 0) + goto fail; // required by external tools ff_data_to_hex(checksum_string, file_checksum, sizeof(file_checksum), 1); @@ -6223,6 +6225,11 @@ c->fc->nb_streams-1, i, e->time); return AVERROR_INVALIDDATA; } + if (e->duration < 0) { + av_log(c->fc, AV_LOG_ERROR, "Track %d, edit %d: Invalid edit list duration=%"PRId64"\n", + c->fc->nb_streams-1, i, e->duration); + return AVERROR_INVALIDDATA; + } } sc->elst_count = i; @@ -10137,7 +10144,7 @@ st->codecpar->height = item->height; err = sanity_checks(s, sc, item->item_id); - if (err) + if (err || !sc->sample_count) return AVERROR_INVALIDDATA; sc->sample_sizes[0] = item->extent_length; @@ -10449,7 +10456,7 @@ ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && ((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb && dts != AV_NOPTS_VALUE && ((dtsdiff <= AV_TIME_BASE && current_sample->pos < sample->pos) || - (dtsdiff > AV_TIME_BASE && dts < best_dts)))))) { + (dtsdiff > AV_TIME_BASE && dts < best_dts && mov->interleaved_read)))))) { sample = current_sample; best_dts = dts; *st = avst; diff -Nru ffmpeg-7.1.1/libavformat/movenc.c ffmpeg-7.1.2/libavformat/movenc.c --- ffmpeg-7.1.1/libavformat/movenc.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/movenc.c 2025-09-14 19:20:09.000000000 +0000 @@ -614,7 +614,7 @@ } info = track->eac3_priv; - size = 2 + ((34 * (info->num_ind_sub + 1) + 7) >> 3); + size = 2 + ((32 * (info->num_ind_sub + 1) + 7) >> 3); buf = av_malloc(size); if (!buf) { return AVERROR(ENOMEM); @@ -631,7 +631,7 @@ put_bits(&pbc, 3, info->substream[i].bsmod); put_bits(&pbc, 3, info->substream[i].acmod); put_bits(&pbc, 1, info->substream[i].lfeon); - put_bits(&pbc, 5, 0); /* reserved */ + put_bits(&pbc, 3, 0); /* reserved */ put_bits(&pbc, 4, info->substream[i].num_dep_sub); if (!info->substream[i].num_dep_sub) { put_bits(&pbc, 1, 0); /* reserved */ diff -Nru ffmpeg-7.1.1/libavformat/mxg.c ffmpeg-7.1.2/libavformat/mxg.c --- ffmpeg-7.1.1/libavformat/mxg.c 2024-09-29 23:31:48.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/mxg.c 2025-09-14 19:20:09.000000000 +0000 @@ -127,6 +127,8 @@ mxg->cache_size += ret; + memset(mxg->buffer_ptr + mxg->cache_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); + return ret; } diff -Nru ffmpeg-7.1.1/libavformat/vqf.c ffmpeg-7.1.2/libavformat/vqf.c --- ffmpeg-7.1.1/libavformat/vqf.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/vqf.c 2025-09-14 19:20:09.000000000 +0000 @@ -20,6 +20,7 @@ */ #include "avformat.h" +#include "avio_internal.h" #include "demux.h" #include "internal.h" #include "libavutil/intreadwrite.h" @@ -143,7 +144,9 @@ if (len < 12) return AVERROR_INVALIDDATA; - avio_read(s->pb, comm_chunk, 12); + ret = ffio_read_size(s->pb, comm_chunk, 12); + if (ret < 0) + return ret; st->codecpar->ch_layout.nb_channels = AV_RB32(comm_chunk) + 1; read_bitrate = AV_RB32(comm_chunk + 4); rate_flag = AV_RB32(comm_chunk + 8); diff -Nru ffmpeg-7.1.1/libavformat/wavdec.c ffmpeg-7.1.2/libavformat/wavdec.c --- ffmpeg-7.1.1/libavformat/wavdec.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libavformat/wavdec.c 2025-09-14 19:20:09.000000000 +0000 @@ -178,7 +178,7 @@ { if (st->codecpar->codec_id == AV_CODEC_ID_PCM_S16LE) { FFStream *const sti = ffstream(st); - sti->request_probe = AVPROBE_SCORE_EXTENSION; + sti->request_probe = AVPROBE_SCORE_EXTENSION + 1; sti->probe_packets = FFMIN(sti->probe_packets, 32); } } diff -Nru ffmpeg-7.1.1/libpostproc/postprocess.c ffmpeg-7.1.2/libpostproc/postprocess.c --- ffmpeg-7.1.1/libpostproc/postprocess.c 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/libpostproc/postprocess.c 2025-09-14 19:20:09.000000000 +0000 @@ -898,6 +898,11 @@ int minStride= FFMAX(FFABS(srcStride[0]), FFABS(dstStride[0])); int absQPStride = FFABS(QPStride); + if (width < 16 || height < 16) { + av_log(c, AV_LOG_ERROR, "Postproc is designed to filter 16x16 macroblock based formats, the minimum size is 1 macroblock\n"); + return; + } + // c->stride and c->QPStride are always positive if(c->stride < minStride || c->qpStride < absQPStride) reallocBuffers(c, width, height, diff -Nru ffmpeg-7.1.1/libpostproc/postprocess_altivec_template.c ffmpeg-7.1.2/libpostproc/postprocess_altivec_template.c --- ffmpeg-7.1.1/libpostproc/postprocess_altivec_template.c 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/libpostproc/postprocess_altivec_template.c 2025-09-14 19:20:09.000000000 +0000 @@ -530,7 +530,7 @@ STORE(5) } -static inline void dering_altivec(uint8_t src[], int stride, PPContext *c) { +static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder) { const vector signed int vsint32_8 = vec_splat_s32(8); const vector unsigned int vuint32_4 = vec_splat_u32(4); const vector signed char neg1 = vec_splat_s8(-1); @@ -577,6 +577,9 @@ const vector signed int zero = vec_splat_s32(0); vector unsigned char v_dt = vec_splat(vec_ld(0, dt), 0); + if (topborder) + return; + #define LOAD_LINE(i) \ const vector unsigned char perm##i = \ vec_lvsl(i * stride, srcCopy); \ diff -Nru ffmpeg-7.1.1/libpostproc/postprocess_template.c ffmpeg-7.1.2/libpostproc/postprocess_template.c --- ffmpeg-7.1.1/libpostproc/postprocess_template.c 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/libpostproc/postprocess_template.c 2025-09-14 19:20:09.000000000 +0000 @@ -831,9 +831,11 @@ #endif //TEMPLATE_PP_ALTIVEC #if !TEMPLATE_PP_ALTIVEC -static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c) +static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder) { #if TEMPLATE_PP_MMXEXT && HAVE_7REGS + if (topborder) + return; DECLARE_ALIGNED(8, uint64_t, tmp)[3]; __asm__ volatile( "pxor %%mm6, %%mm6 \n\t" @@ -1044,10 +1046,11 @@ if(max - min avg) t+= 1; + if(!leftborder && src[stride*y + 0] > avg) t+= 1; if(src[stride*y + 1] > avg) t+= 2; if(src[stride*y + 2] > avg) t+= 4; if(src[stride*y + 3] > avg) t+= 8; @@ -1056,7 +1059,7 @@ if(src[stride*y + 6] > avg) t+= 64; if(src[stride*y + 7] > avg) t+= 128; if(src[stride*y + 8] > avg) t+= 256; - if(src[stride*y + 9] > avg) t+= 512; + if(!rightborder && src[stride*y + 9] > avg) t+= 512; t |= (~t)<<16; t &= (t<<1) & (t>>1); @@ -1073,8 +1076,8 @@ int x; int t = s[y-1]; - p= src + stride*y; - for(x=1; x<9; x++){ + p= src + stride*y + leftborder; + for(x=1+leftborder; x<9-rightborder; x++){ p++; if(t & (1<0) RENAME(dering)(dstBlock - stride - 8, stride, c); + RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0, y<=0); } if(mode & TEMP_NOISE_FILTER) @@ -3233,7 +3235,7 @@ } if(mode & DERING){ - if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c); + RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, x<=8, 1, y<=0); } if((mode & TEMP_NOISE_FILTER)){ diff -Nru ffmpeg-7.1.1/libswscale/output.c ffmpeg-7.1.2/libswscale/output.c --- ffmpeg-7.1.1/libswscale/output.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libswscale/output.c 2025-09-14 19:20:09.000000000 +0000 @@ -2289,9 +2289,9 @@ Y -= c->yuv2rgb_y_offset; Y *= c->yuv2rgb_y_coeff; Y += 1 << (SH-1); - R = Y + V * c->yuv2rgb_v2r_coeff; - G = Y + V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff; - B = Y + U * c->yuv2rgb_u2b_coeff; + R = Y + V * (unsigned)c->yuv2rgb_v2r_coeff; + G = Y + V * (unsigned)c->yuv2rgb_v2g_coeff + U * (unsigned)c->yuv2rgb_u2g_coeff; + B = Y + U * (unsigned)c->yuv2rgb_u2b_coeff; if ((R | G | B) & 0xC0000000) { R = av_clip_uintp2(R, 30); diff -Nru ffmpeg-7.1.1/libswscale/ppc/yuv2rgb_altivec.c ffmpeg-7.1.2/libswscale/ppc/yuv2rgb_altivec.c --- ffmpeg-7.1.1/libswscale/ppc/yuv2rgb_altivec.c 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/libswscale/ppc/yuv2rgb_altivec.c 2025-09-14 19:20:09.000000000 +0000 @@ -284,7 +284,7 @@ * ------------------------------------------------------------------------------ */ -#if !HAVE_VSX +#if !HAVE_VEC_XL static inline vector unsigned char vec_xl(signed long long offset, const ubyte *addr) { const vector unsigned char *v_addr = (const vector unsigned char *) (addr + offset); @@ -292,7 +292,7 @@ return (vector unsigned char) vec_perm(v_addr[0], v_addr[1], align_perm); } -#endif /* !HAVE_VSX */ +#endif /* !HAVE_VEC_XL */ #define DEFCSP420_CVT(name, out_pixels) \ static int altivec_ ## name(SwsContext *c, const unsigned char **in, \ diff -Nru ffmpeg-7.1.1/libswscale/swscale_unscaled.c ffmpeg-7.1.2/libswscale/swscale_unscaled.c --- ffmpeg-7.1.1/libswscale/swscale_unscaled.c 2025-03-02 21:08:21.000000000 +0000 +++ ffmpeg-7.1.2/libswscale/swscale_unscaled.c 2025-09-14 19:20:09.000000000 +0000 @@ -772,7 +772,7 @@ return srcSliceH; } - for(i=0; i<4; i++) { + for (i = 0; i < 4 && dst[i]; i++) { dst2013[i] += stride2013[i] * srcSliceY / 2; dst1023[i] += stride1023[i] * srcSliceY / 2; } @@ -2267,10 +2267,13 @@ c->chrDstVSubSample == c->chrSrcVSubSample && !isSemiPlanarYUV(srcFormat) && !isSemiPlanarYUV(dstFormat)))) { - if (isPacked(c->srcFormat)) + if (isPacked(c->srcFormat)) { c->convert_unscaled = packedCopyWrapper; - else /* Planar YUV or gray */ + } else { /* Planar YUV or gray */ c->convert_unscaled = planarCopyWrapper; + if (c->dither != SWS_DITHER_NONE) + c->dst_slice_align = 8 << c->chrDstVSubSample; + } } #if ARCH_PPC diff -Nru ffmpeg-7.1.1/tests/fate/filter-video.mak ffmpeg-7.1.2/tests/fate/filter-video.mak --- ffmpeg-7.1.1/tests/fate/filter-video.mak 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/tests/fate/filter-video.mak 2025-09-14 19:20:09.000000000 +0000 @@ -498,7 +498,7 @@ FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, SPP, AVI, MPEG4) += spp fate-filter-spp: CMD = framecrc -flags bitexact -export_side_data venc_params -idct simple -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf "spp=idct=simple:dct=int" -FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, PP, AVI, MPEG4) += codecview +FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, CODECVIEW, AVI, MPEG4) += codecview fate-filter-codecview: CMD = framecrc -flags bitexact -idct simple -flags2 +export_mvs -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf codecview=mv=pf+bf+bb # The above tests use vsynth1-mpeg4-qprd.avi created by fate-vsynth1-mpeg4-qprd diff -Nru ffmpeg-7.1.1/tests/fate/h264.mak ffmpeg-7.1.2/tests/fate/h264.mak --- ffmpeg-7.1.1/tests/fate/h264.mak 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/tests/fate/h264.mak 2025-09-14 19:20:09.000000000 +0000 @@ -224,7 +224,7 @@ # this sample contains field-coded frames, with both fields in a single packet FATE_H264-$(call FRAMECRC, MOV, H264) += fate-h264-twofields-packet -FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata +FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF H264_METADATA_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF) += fate-h264-bsf-mp4toannexb \ fate-h264-bsf-mp4toannexb-2 \ @@ -438,7 +438,7 @@ fate-h264-bsf-mp4toannexb-2: CMD = md5 -i $(TARGET_SAMPLES)/h264/ps_prefix_first_idr.mp4 -c:v copy -f h264 fate-h264-bsf-mp4toannexb-2: CMP = oneline fate-h264-bsf-mp4toannexb-2: REF = cffcfa6a2d0b58c9de1f5785f099f41d -fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-map 0:v" +fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-bsf h264_mp4toannexb,h264_metadata -map 0:v" fate-h264-bsf-dts2pts: CMD = transcode "h264" $(TARGET_SAMPLES)/h264-conformance/CAPAMA3_Sand_F.264 \ mov "-c:v copy -bsf:v dts2pts -frames:v 50" "-c:v copy" fate-h264_mp4toannexb_ticket5927: CMD = transcode "mp4" $(TARGET_SAMPLES)/h264/thezerotheorem-cut.mp4 \ diff -Nru ffmpeg-7.1.1/tests/ref/fate/copy-trac3074 ffmpeg-7.1.2/tests/ref/fate/copy-trac3074 --- ffmpeg-7.1.1/tests/ref/fate/copy-trac3074 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/tests/ref/fate/copy-trac3074 2025-09-14 19:20:09.000000000 +0000 @@ -1,5 +1,5 @@ -36fcc0a62695bcf93068fcfe68283ee9 *tests/data/fate/copy-trac3074.mp4 -334016 tests/data/fate/copy-trac3074.mp4 +5b4a3ed9de3b2a92e5dcb127bca12e68 *tests/data/fate/copy-trac3074.mp4 +334015 tests/data/fate/copy-trac3074.mp4 #tb 0: 1/48000 #media_type 0: audio #codec_id 0: eac3 diff -Nru ffmpeg-7.1.1/tests/ref/fate/sub-scc ffmpeg-7.1.2/tests/ref/fate/sub-scc --- ffmpeg-7.1.1/tests/ref/fate/sub-scc 2024-09-29 23:31:49.000000000 +0000 +++ ffmpeg-7.1.2/tests/ref/fate/sub-scc 2025-08-14 23:31:16.000000000 +0000 @@ -1,106 +1,106 @@ -[Script Info] -; Script generated by FFmpeg/Lavc -ScriptType: v4.00+ -PlayResX: 384 -PlayResY: 288 -ScaledBorderAndShadow: yes -YCbCr Matrix: None - -[V4+ Styles] -Format: Name, Fontname, Fontsize, PrimaryColour, SecondaryColour, OutlineColour, BackColour, Bold, Italic, Underline, StrikeOut, ScaleX, ScaleY, Spacing, Angle, BorderStyle, Outline, Shadow, Alignment, MarginL, MarginR, MarginV, Encoding -Style: Default,Monospace,16,&Hffffff,&Hffffff,&H0,&H0,0,0,0,0,100,100,0,0,3,1,0,2,10,10,10,1 - -[Events] -Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text -Dialogue: 0,0:00:-2.-47,0:00:00.70,Default,,0,0,0,,{\an7}{\pos(76,228)}WE HAVE FOUND A WITCH !\N{\an7}{\pos(76,243)}MAY WE BURN HER ? -Dialogue: 0,0:00:00.69,0:00:03.29,Default,,0,0,0,,{\an7}{\pos(115,228)}[ Crowd ]\N{\an7}{\pos(115,243)}BURN HER ! BURN HER ! -Dialogue: 0,0:00:03.30,0:00:07.07,Default,,0,0,0,,{\an7}{\pos(38,197)}HOW DO YOU KNOW\N{\an7}{\pos(38,213)}SHE IS A WITCH ?\N{\an7}{\pos(153,243)}SHE LOOKS LIKE ONE ! -Dialogue: 0,0:00:07.07,0:00:09.27,Default,,0,0,0,,{\an7}{\pos(192,228)}[ Shouting\N{\an7}{\pos(192,243)}\h\hAffirmations ] -Dialogue: 0,0:00:09.26,0:00:11.06,Default,,0,0,0,,{\an7}{\pos(38,243)}BRING HER FORWARD. -Dialogue: 0,0:00:11.07,0:00:14.27,Default,,0,0,0,,{\an7}{\pos(115,228)}I’M NOT A WITCH.\N{\an7}{\pos(115,243)}\hI’M{\i1} NOT{\i0} A WITCH. -Dialogue: 0,0:00:14.26,0:00:16.03,Default,,0,0,0,,{\an7}{\pos(38,228)}BUT YOU ARE DRESSED\N{\an7}{\pos(38,243)}AS ONE. -Dialogue: 0,0:00:16.03,0:00:19.03,Default,,0,0,0,,{\an7}{\pos(76,197)}THEY DRESSED ME UP\N{\an7}{\pos(76,213)}LIKE THIS.\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hNO ! WE DIDN’T ! -Dialogue: 0,0:00:19.03,0:00:22.95,Default,,0,0,0,,{\an7}{\pos(115,228)}AND THIS ISN’T MY NOSE.\N{\an7}{\pos(115,243)}IT’S A FALSE ONE. -Dialogue: 0,0:00:25.30,0:00:28.43,Default,,0,0,0,,{\an7}{\pos(76,197)}WELL ?\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hWELL, WE DID\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hDO THE NOSE. -Dialogue: 0,0:00:28.43,0:00:30.07,Default,,0,0,0,,{\an7}{\pos(76,197)}THE NOSE ?\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hAND THE HAT. -Dialogue: 0,0:00:30.07,0:00:35.50,Default,,0,0,0,,{\an7}{\pos(115,197)}BUT SHE IS A WITCH.\N{\an7}{\pos(115,228)}YEAH ! BURN HER !\N{\an7}{\pos(115,243)}BURN HER ! BURN HER ! -Dialogue: 0,0:00:35.50,0:00:38.47,Default,,0,0,0,,{\an7}{\pos(76,213)}- DID YOU DRESS HER UP\N{\an7}{\pos(76,228)}\h\hLIKE THIS ?\N{\an7}{\pos(76,243)}- NO ! -Dialogue: 0,0:00:38.46,0:00:39.86,Default,,0,0,0,,{\an7}{\pos(192,197)}\h\h\h\h\h\h\h\hNO !\N{\an7}{\pos(192,213)}NO !\N{\an7}{\pos(192,243)}\h\h\h\hNO ! -Dialogue: 0,0:00:39.86,0:00:41.63,Default,,0,0,0,,{\an7}{\pos(153,228)}YES. YES.\N{\an7}{\pos(153,243)}YEAH, A BIT. -Dialogue: 0,0:00:41.63,0:00:44.83,Default,,0,0,0,,{\an7}{\pos(153,197)}\h\h\h\h\h\h\h\hA BIT.\N{\an7}{\pos(153,213)}\h\h\h\h\h\h\h\h\hA BIT.\N{\an7}{\pos(153,243)}SHE HAS GOT A WART. -Dialogue: 0,0:00:44.83,0:00:47.04,Default,,0,0,0,,{\an7}{\pos(38,228)}WHAT MAKES YOU THINK\N{\an7}{\pos(38,243)}SHE IS A WITCH ? -Dialogue: 0,0:00:47.03,0:00:49.53,Default,,0,0,0,,{\an7}{\pos(115,228)}WELL, SHE TURNED ME\N{\an7}{\pos(115,243)}INTO A NEWT ! -Dialogue: 0,0:00:49.53,0:00:52.30,Default,,0,0,0,,{\an7}{\pos(76,243)}A NEWT ? -Dialogue: 0,0:00:55.46,0:00:57.39,Default,,0,0,0,,{\an7}{\pos(115,243)}I GOT BETTER. -Dialogue: 0,0:00:57.40,0:00:58.90,Default,,0,0,0,,{\an7}{\pos(153,243)}BURN HER ANYWAY ! -Dialogue: 0,0:00:58.89,0:01:01.03,Default,,0,0,0,,{\an7}{\pos(76,197)}BURN HER !\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hBURN HER !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hCRACKLE, CRACKLE ! -Dialogue: 0,0:01:01.03,0:01:04.00,Default,,0,0,0,,{\an7}{\pos(38,197)}\h\h\h\h[ Shouting\N{\an7}{\pos(38,213)}\h\h\h\h\h\hContinues ]\N{\an7}{\pos(38,243)}QUIET. QUIET. -Dialogue: 0,0:01:04.00,0:01:05.43,Default,,0,0,0,,{\an7}{\pos(38,228)}QUIET !\N{\an7}{\pos(48,243)}QUIET ! -Dialogue: 0,0:01:05.43,0:01:09.13,Default,,0,0,0,,{\an7}{\pos(38,228)}THERE ARE WAYS OF TELLING\N{\an7}{\pos(38,243)}WHETHER SHE IS A WITCH. -Dialogue: 0,0:01:09.13,0:01:10.96,Default,,0,0,0,,{\an7}{\pos(38,228)}ARE THERE ?\N{\an7}{\pos(38,243)}WHAT ARE THEY ? -Dialogue: 0,0:01:10.96,0:01:13.30,Default,,0,0,0,,{\an7}{\pos(38,197)}TELL US !\N{\an7}{\pos(153,213)}TELL US !\N{\an7}{\pos(153,243)}\h\h\h\hDO THEY HURT ? -Dialogue: 0,0:01:13.30,0:01:16.23,Default,,0,0,0,,{\an7}{\pos(38,228)}TELL ME,\N{\an7}{\pos(38,243)}WHAT DO YOU DO WITH WITCHES ? -Dialogue: 0,0:01:16.23,0:01:19.20,Default,,0,0,0,,{\an7}{\pos(76,213)}\h\h\h\h\h\h\h\h\h\h\h\hBURN THEM !\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\h\h\h\h\h\hBURN THEM UP !\N{\an7}{\pos(76,243)}BURN ! -Dialogue: 0,0:01:19.20,0:01:22.33,Default,,0,0,0,,{\an7}{\pos(38,228)}AND WHAT DO YOU BURN,\N{\an7}{\pos(38,243)}APART FROM WITCHES ? -Dialogue: 0,0:01:22.33,0:01:24.59,Default,,0,0,0,,{\an7}{\pos(38,197)}MORE WITCHES !\N{\an7}{\pos(153,243)}SHH ! -Dialogue: 0,0:01:24.59,0:01:25.62,Default,,0,0,0,,{\an7}{\pos(192,243)}WOOD ! -Dialogue: 0,0:01:25.63,0:01:29.33,Default,,0,0,0,,{\an7}{\pos(38,228)}SO,\N{\an7}{\pos(38,243)}WHY DO WITCHES BURN ? -Dialogue: 0,0:01:32.69,0:01:35.03,Default,,0,0,0,,{\an7}{\pos(192,243)}B-- -Dialogue: 0,0:01:39.13,0:01:42.46,Default,,0,0,0,,{\an7}{\pos(76,213)}- ’CAUSE THEY’RE\N{\an7}{\pos(76,228)}\h\hMADE OF W-- WOOD ?\N{\an7}{\pos(76,243)}- GOOD ! -Dialogue: 0,0:01:42.46,0:01:44.00,Default,,0,0,0,,{\an7}{\pos(192,213)}OH, YEAH.\N{\an7}{\pos(192,243)}[ Murmuring ] -Dialogue: 0,0:01:44.00,0:01:48.50,Default,,0,0,0,,{\an7}{\pos(38,213)}SO, HOW DO WE TELL\N{\an7}{\pos(38,228)}WHETHER SHE\N{\an7}{\pos(38,243)}IS MADE OF WOOD ? -Dialogue: 0,0:01:48.50,0:01:50.10,Default,,0,0,0,,{\an7}{\pos(153,228)}BUILD A BRIDGE\N{\an7}{\pos(153,243)}OUT OF HER ! -Dialogue: 0,0:01:50.10,0:01:54.13,Default,,0,0,0,,{\an7}{\pos(38,228)}AH, BUT CAN YOU NOT ALSO\N{\an7}{\pos(38,243)}MAKE BRIDGES OUT OF STONE ? -Dialogue: 0,0:01:54.13,0:01:57.26,Default,,0,0,0,,{\an7}{\pos(76,197)}OH, YEAH.\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hOH, YEAH.\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hTRUE. UH-- -Dialogue: 0,0:01:57.26,0:01:59.72,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}DOES WOOD\N{\an7}{\pos(38,243)}SINK IN WATER ? -Dialogue: 0,0:01:59.73,0:02:02.17,Default,,0,0,0,,{\an7}{\pos(76,197)}NO, NO.\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hNO, IT FLOATS !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hIT FLOATS ! -Dialogue: 0,0:02:02.17,0:02:07.04,Default,,0,0,0,,{\an7}{\pos(76,197)}THROW HER INTO THE POND !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\h[ All Shouting ] -Dialogue: 0,0:02:07.36,0:02:10.49,Default,,0,0,0,,{\an7}{\pos(38,228)}WHAT ALSO FLOATS\N{\an7}{\pos(38,243)}IN WATER ? -Dialogue: 0,0:02:10.50,0:02:12.14,Default,,0,0,0,,{\an7}{\pos(76,197)}BREAD !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\h\h\h\h\hAPPLES ! -Dialogue: 0,0:02:12.13,0:02:13.23,Default,,0,0,0,,{\an7}{\pos(76,243)}UH, VERY SMALL ROCKS. -Dialogue: 0,0:02:13.23,0:02:16.49,Default,,0,0,0,,{\an7}{\pos(86,228)}{\i1}- CIDER ! CHERRIES !\N{\an7}{\pos(86,243)}{\i0}- UH, GRA-- GRAVY ! MUD ! -Dialogue: 0,0:02:16.50,0:02:18.76,Default,,0,0,0,,{\an7}{\pos(86,228)}- CHURCHES ! CHURCHES !\N{\an7}{\pos(86,243)}{\i1}- LEAD ! LEAD ! -Dialogue: 0,0:02:18.76,0:02:22.30,Default,,0,0,0,,{\an7}{\pos(76,228)}- A DUCK !\N{\an7}{\pos(76,243)}- [ Crowd Gasps, Murmurs ] -Dialogue: 0,0:02:22.30,0:02:24.63,Default,,0,0,0,,{\an7}{\pos(115,243)}EXACTLY ! -Dialogue: 0,0:02:25.36,0:02:27.59,Default,,0,0,0,,{\an7}{\pos(76,243)}SO, LOGICALLY-- -Dialogue: 0,0:02:27.59,0:02:29.76,Default,,0,0,0,,{\an7}{\pos(192,243)}IF... SHE... -Dialogue: 0,0:02:29.76,0:02:33.56,Default,,0,0,0,,{\an7}{\pos(192,213)}WEIGHS...\N{\an7}{\pos(192,228)}THE SAME\N{\an7}{\pos(192,243)}AS A DUCK... -Dialogue: 0,0:02:34.40,0:02:36.50,Default,,0,0,0,,{\an7}{\pos(153,243)}SHE’S MADE OF WOOD ! -Dialogue: 0,0:02:36.50,0:02:38.47,Default,,0,0,0,,{\an7}{\pos(38,243)}AND THEREFORE ? -Dialogue: 0,0:02:39.50,0:02:42.17,Default,,0,0,0,,{\an7}{\pos(38,228)}- A WITCH !\N{\an7}{\pos(38,243)}{\i1}- [ All ] A WITCH ! A WITCH ! -Dialogue: 0,0:02:42.17,0:02:44.07,Default,,0,0,0,,{\an7}{\pos(76,243)}[ Shouting Continues ] -Dialogue: 0,0:02:44.07,0:02:45.76,Default,,0,0,0,,{\an7}{\pos(192,213)}HERE’S A DUCK !\N{\an7}{\pos(192,243)}[ Quacking ] -Dialogue: 0,0:02:45.76,0:02:49.79,Default,,0,0,0,,{\an7}{\pos(76,213)}VERY GOOD.\N{\an7}{\pos(76,228)}WE SHALL USE\N{\an7}{\pos(76,243)}MY LARGEST SCALES. -Dialogue: 0,0:02:49.79,0:02:52.72,Default,,0,0,0,,{\an7}{\pos(76,243)}[ Shouting Continues ] -Dialogue: 0,0:02:52.73,0:02:55.17,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN !\N{\an7}{\pos(115,243)}\hBURN THE WITCH ! -Dialogue: 0,0:02:55.17,0:02:57.63,Default,,0,0,0,,{\an7}{\pos(153,228)}BURN HER !\N{\an7}{\pos(153,243)}\hBURN THE WITCH ! -Dialogue: 0,0:02:57.63,0:03:01.63,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN HER !\N{\an7}{\pos(115,243)}\hBURN HER ! BURN HER ! -Dialogue: 0,0:03:01.63,0:03:04.14,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN HER !\N{\an7}{\pos(115,243)}\hBURN HER ! -Dialogue: 0,0:03:04.13,0:03:06.59,Default,,0,0,0,,{\an7}{\pos(230,228)}BURN HER !\N{\an7}{\pos(230,243)}\hBURN HER ! -Dialogue: 0,0:03:06.59,0:03:08.00,Default,,0,0,0,,{\an7}{\pos(201,243)}{\i1}[ Man Grunts ] -Dialogue: 0,0:03:08.00,0:03:14.30,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}RIGHT !\N{\an7}{\pos(38,243)}REMOVE THE SUPPORTS ! -Dialogue: 0,0:03:17.07,0:03:19.17,Default,,0,0,0,,{\an7}{\pos(38,197)}A WITCH !\N{\an7}{\pos(230,243)}A WITCH ! -Dialogue: 0,0:03:19.17,0:03:20.04,Default,,0,0,0,,{\an7}{\pos(76,243)}IT’S A FAIR COP. -Dialogue: 0,0:03:20.03,0:03:25.29,Default,,0,0,0,,{\an7}{\pos(38,213)}- BURN HER !\N{\an7}{\pos(38,228)}- [ Crowd Continues Shouting ]\N{\an7}{\pos(57,243)}BURN HER ! BURN HER ! -Dialogue: 0,0:03:28.86,0:03:32.73,Default,,0,0,0,,{\an7}{\pos(38,213)}WHO ARE YOU,\N{\an7}{\pos(38,228)}WHO ARE SO WISE\N{\an7}{\pos(38,243)}IN THE WAYS OF SCIENCE ? -Dialogue: 0,0:03:32.73,0:03:35.76,Default,,0,0,0,,{\an7}{\pos(153,228)}I AM ARTHUR,\N{\an7}{\pos(153,243)}KING OF THE BRITONS. -Dialogue: 0,0:03:35.76,0:03:36.96,Default,,0,0,0,,{\an7}{\pos(76,243)}MY LIEGE ! -Dialogue: 0,0:03:36.96,0:03:40.37,Default,,0,0,0,,{\an7}{\pos(115,213)}GOOD SIR KNIGHT,\N{\an7}{\pos(115,228)}WILL YOU COME WITH ME\N{\an7}{\pos(115,243)}TO CAMELOT... -Dialogue: 0,0:03:40.36,0:03:43.39,Default,,0,0,0,,{\an7}{\pos(153,228)}AND JOIN US\N{\an7}{\pos(153,243)}AT THE ROUND TABLE ? -Dialogue: 0,0:03:43.40,0:03:45.53,Default,,0,0,0,,{\an7}{\pos(38,228)}MY LIEGE,\N{\an7}{\pos(38,243)}I WOULD BE HONORED ! -Dialogue: 0,0:03:45.53,0:03:48.70,Default,,0,0,0,,{\an7}{\pos(38,197)}\h\h\h\h\h\h\h\h\h\h\h\hWHAT IS YOUR NAME ?\N{\an7}{\pos(38,243)}BEDEVERE, MY LIEGE. -Dialogue: 0,0:03:48.69,0:03:52.49,Default,,0,0,0,,{\an7}{\pos(163,228)}THEN I DUB YOU\N{\an7}{\pos(163,243)}{\i1}SIR{\i0} BEDEVERE, -Dialogue: 0,0:03:52.50,0:03:54.86,Default,,0,0,0,,{\an7}{\pos(153,228)}KNIGHT\N{\an7}{\pos(153,243)}OF THE ROUND TABLE. -Dialogue: 0,0:03:54.86,0:03:56.76,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}[ Narrator ]\N{\an7}{\pos(38,243)}THE WISE SIR BEDEVERE... -Dialogue: 0,0:03:56.76,0:03:59.69,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WAS THE FIRST TO JOIN\N{\an7}{\pos(38,243)}KING ARTHUR’S KNIGHTS. -Dialogue: 0,0:03:59.69,0:04:03.26,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}BUT OTHER ILLUSTRIOUS NAMES\N{\an7}{\pos(38,243)}WERE SOON TO FOLLOW: -Dialogue: 0,0:04:03.26,0:04:06.03,Default,,0,0,0,,{\an7}{\pos(38,243)}{\i1}SIR LAUNCELOT THE BRAVE; -Dialogue: 0,0:04:06.03,0:04:07.95,Default,,0,0,0,,{\an7}{\pos(38,243)}{\i1}SIR GALAHAD THE PURE; -Dialogue: 0,0:04:07.96,0:04:11.27,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}AND SIR ROBIN\N{\an7}{\pos(38,228)}THE NOT-QUITE-SO-BRAVE-\N{\an7}{\pos(38,243)}AS-SIR-LAUNCELOT, -Dialogue: 0,0:04:11.26,0:04:13.92,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WHO HAD NEARLY FOUGHT\N{\an7}{\pos(38,243)}THE DRAGON OF ANGNOR, -Dialogue: 0,0:04:13.92,0:04:16.89,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}WHO HAD NEARLY\N{\an7}{\pos(38,228)}STOOD UP TO THE VICIOUS\N{\an7}{\pos(38,243)}CHICKEN OF BRISTOL... -Dialogue: 0,0:04:16.89,0:04:20.73,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}AND WHO HAD\N{\an7}{\pos(38,228)}PERSONALLY WET HIMSELF\N{\an7}{\pos(38,243)}AT THE BATTLE OF BADON HILL; -Dialogue: 0,0:04:20.73,0:04:25.43,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}AND THE APTLY NAMED\N{\an7}{\pos(38,243)}SIR NOT-APPEARING-IN-THIS-FILM. -Dialogue: 0,0:04:25.59,0:04:29.03,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}TOGETHER THEY FORMED A BAND\N{\an7}{\pos(38,243)}WHOSE NAMES AND DEEDS... -Dialogue: 0,0:04:29.03,0:04:31.72,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WERE TO BE RETOLD\N{\an7}{\pos(38,243)}THROUGHOUT THE CENTURIES. -Dialogue: 0,0:04:31.73,0:04:33.86,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}THE KNIGHTS\N{\an7}{\pos(38,243)}OF THE ROUND TABLE. +[Script Info] +; Script generated by FFmpeg/Lavc +ScriptType: v4.00+ +PlayResX: 384 +PlayResY: 288 +ScaledBorderAndShadow: yes +YCbCr Matrix: None + +[V4+ Styles] +Format: Name, Fontname, Fontsize, PrimaryColour, SecondaryColour, OutlineColour, BackColour, Bold, Italic, Underline, StrikeOut, ScaleX, ScaleY, Spacing, Angle, BorderStyle, Outline, Shadow, Alignment, MarginL, MarginR, MarginV, Encoding +Style: Default,Monospace,16,&Hffffff,&Hffffff,&H0,&H0,0,0,0,0,100,100,0,0,3,1,0,2,10,10,10,1 + +[Events] +Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text +Dialogue: 0,0:00:-2.-47,0:00:00.70,Default,,0,0,0,,{\an7}{\pos(76,228)}WE HAVE FOUND A WITCH !\N{\an7}{\pos(76,243)}MAY WE BURN HER ? +Dialogue: 0,0:00:00.69,0:00:03.29,Default,,0,0,0,,{\an7}{\pos(115,228)}[ Crowd ]\N{\an7}{\pos(115,243)}BURN HER ! BURN HER ! +Dialogue: 0,0:00:03.30,0:00:07.07,Default,,0,0,0,,{\an7}{\pos(38,197)}HOW DO YOU KNOW\N{\an7}{\pos(38,213)}SHE IS A WITCH ?\N{\an7}{\pos(153,243)}SHE LOOKS LIKE ONE ! +Dialogue: 0,0:00:07.07,0:00:09.27,Default,,0,0,0,,{\an7}{\pos(192,228)}[ Shouting\N{\an7}{\pos(192,243)}\h\hAffirmations ] +Dialogue: 0,0:00:09.26,0:00:11.06,Default,,0,0,0,,{\an7}{\pos(38,243)}BRING HER FORWARD. +Dialogue: 0,0:00:11.07,0:00:14.27,Default,,0,0,0,,{\an7}{\pos(115,228)}I’M NOT A WITCH.\N{\an7}{\pos(115,243)}\hI’M{\i1} NOT{\i0} A WITCH. +Dialogue: 0,0:00:14.26,0:00:16.03,Default,,0,0,0,,{\an7}{\pos(38,228)}BUT YOU ARE DRESSED\N{\an7}{\pos(38,243)}AS ONE. +Dialogue: 0,0:00:16.03,0:00:19.03,Default,,0,0,0,,{\an7}{\pos(76,197)}THEY DRESSED ME UP\N{\an7}{\pos(76,213)}LIKE THIS.\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hNO ! WE DIDN’T ! +Dialogue: 0,0:00:19.03,0:00:22.95,Default,,0,0,0,,{\an7}{\pos(115,228)}AND THIS ISN’T MY NOSE.\N{\an7}{\pos(115,243)}IT’S A FALSE ONE. +Dialogue: 0,0:00:25.30,0:00:28.43,Default,,0,0,0,,{\an7}{\pos(76,197)}WELL ?\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hWELL, WE DID\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hDO THE NOSE. +Dialogue: 0,0:00:28.43,0:00:30.07,Default,,0,0,0,,{\an7}{\pos(76,197)}THE NOSE ?\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hAND THE HAT. +Dialogue: 0,0:00:30.07,0:00:35.50,Default,,0,0,0,,{\an7}{\pos(115,197)}BUT SHE IS A WITCH.\N{\an7}{\pos(115,228)}YEAH ! BURN HER !\N{\an7}{\pos(115,243)}BURN HER ! BURN HER ! +Dialogue: 0,0:00:35.50,0:00:38.47,Default,,0,0,0,,{\an7}{\pos(76,213)}- DID YOU DRESS HER UP\N{\an7}{\pos(76,228)}\h\hLIKE THIS ?\N{\an7}{\pos(76,243)}- NO ! +Dialogue: 0,0:00:38.46,0:00:39.86,Default,,0,0,0,,{\an7}{\pos(192,197)}\h\h\h\h\h\h\h\hNO !\N{\an7}{\pos(192,213)}NO !\N{\an7}{\pos(192,243)}\h\h\h\hNO ! +Dialogue: 0,0:00:39.86,0:00:41.63,Default,,0,0,0,,{\an7}{\pos(153,228)}YES. YES.\N{\an7}{\pos(153,243)}YEAH, A BIT. +Dialogue: 0,0:00:41.63,0:00:44.83,Default,,0,0,0,,{\an7}{\pos(153,197)}\h\h\h\h\h\h\h\hA BIT.\N{\an7}{\pos(153,213)}\h\h\h\h\h\h\h\h\hA BIT.\N{\an7}{\pos(153,243)}SHE HAS GOT A WART. +Dialogue: 0,0:00:44.83,0:00:47.04,Default,,0,0,0,,{\an7}{\pos(38,228)}WHAT MAKES YOU THINK\N{\an7}{\pos(38,243)}SHE IS A WITCH ? +Dialogue: 0,0:00:47.03,0:00:49.53,Default,,0,0,0,,{\an7}{\pos(115,228)}WELL, SHE TURNED ME\N{\an7}{\pos(115,243)}INTO A NEWT ! +Dialogue: 0,0:00:49.53,0:00:52.30,Default,,0,0,0,,{\an7}{\pos(76,243)}A NEWT ? +Dialogue: 0,0:00:55.46,0:00:57.39,Default,,0,0,0,,{\an7}{\pos(115,243)}I GOT BETTER. +Dialogue: 0,0:00:57.40,0:00:58.90,Default,,0,0,0,,{\an7}{\pos(153,243)}BURN HER ANYWAY ! +Dialogue: 0,0:00:58.89,0:01:01.03,Default,,0,0,0,,{\an7}{\pos(76,197)}BURN HER !\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hBURN HER !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hCRACKLE, CRACKLE ! +Dialogue: 0,0:01:01.03,0:01:04.00,Default,,0,0,0,,{\an7}{\pos(38,197)}\h\h\h\h[ Shouting\N{\an7}{\pos(38,213)}\h\h\h\h\h\hContinues ]\N{\an7}{\pos(38,243)}QUIET. QUIET. +Dialogue: 0,0:01:04.00,0:01:05.43,Default,,0,0,0,,{\an7}{\pos(38,228)}QUIET !\N{\an7}{\pos(48,243)}QUIET ! +Dialogue: 0,0:01:05.43,0:01:09.13,Default,,0,0,0,,{\an7}{\pos(38,228)}THERE ARE WAYS OF TELLING\N{\an7}{\pos(38,243)}WHETHER SHE IS A WITCH. +Dialogue: 0,0:01:09.13,0:01:10.96,Default,,0,0,0,,{\an7}{\pos(38,228)}ARE THERE ?\N{\an7}{\pos(38,243)}WHAT ARE THEY ? +Dialogue: 0,0:01:10.96,0:01:13.30,Default,,0,0,0,,{\an7}{\pos(38,197)}TELL US !\N{\an7}{\pos(153,213)}TELL US !\N{\an7}{\pos(153,243)}\h\h\h\hDO THEY HURT ? +Dialogue: 0,0:01:13.30,0:01:16.23,Default,,0,0,0,,{\an7}{\pos(38,228)}TELL ME,\N{\an7}{\pos(38,243)}WHAT DO YOU DO WITH WITCHES ? +Dialogue: 0,0:01:16.23,0:01:19.20,Default,,0,0,0,,{\an7}{\pos(76,213)}\h\h\h\h\h\h\h\h\h\h\h\hBURN THEM !\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\h\h\h\h\h\hBURN THEM UP !\N{\an7}{\pos(76,243)}BURN ! +Dialogue: 0,0:01:19.20,0:01:22.33,Default,,0,0,0,,{\an7}{\pos(38,228)}AND WHAT DO YOU BURN,\N{\an7}{\pos(38,243)}APART FROM WITCHES ? +Dialogue: 0,0:01:22.33,0:01:24.59,Default,,0,0,0,,{\an7}{\pos(38,197)}MORE WITCHES !\N{\an7}{\pos(153,243)}SHH ! +Dialogue: 0,0:01:24.59,0:01:25.62,Default,,0,0,0,,{\an7}{\pos(192,243)}WOOD ! +Dialogue: 0,0:01:25.63,0:01:29.33,Default,,0,0,0,,{\an7}{\pos(38,228)}SO,\N{\an7}{\pos(38,243)}WHY DO WITCHES BURN ? +Dialogue: 0,0:01:32.69,0:01:35.03,Default,,0,0,0,,{\an7}{\pos(192,243)}B-- +Dialogue: 0,0:01:39.13,0:01:42.46,Default,,0,0,0,,{\an7}{\pos(76,213)}- ’CAUSE THEY’RE\N{\an7}{\pos(76,228)}\h\hMADE OF W-- WOOD ?\N{\an7}{\pos(76,243)}- GOOD ! +Dialogue: 0,0:01:42.46,0:01:44.00,Default,,0,0,0,,{\an7}{\pos(192,213)}OH, YEAH.\N{\an7}{\pos(192,243)}[ Murmuring ] +Dialogue: 0,0:01:44.00,0:01:48.50,Default,,0,0,0,,{\an7}{\pos(38,213)}SO, HOW DO WE TELL\N{\an7}{\pos(38,228)}WHETHER SHE\N{\an7}{\pos(38,243)}IS MADE OF WOOD ? +Dialogue: 0,0:01:48.50,0:01:50.10,Default,,0,0,0,,{\an7}{\pos(153,228)}BUILD A BRIDGE\N{\an7}{\pos(153,243)}OUT OF HER ! +Dialogue: 0,0:01:50.10,0:01:54.13,Default,,0,0,0,,{\an7}{\pos(38,228)}AH, BUT CAN YOU NOT ALSO\N{\an7}{\pos(38,243)}MAKE BRIDGES OUT OF STONE ? +Dialogue: 0,0:01:54.13,0:01:57.26,Default,,0,0,0,,{\an7}{\pos(76,197)}OH, YEAH.\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hOH, YEAH.\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hTRUE. UH-- +Dialogue: 0,0:01:57.26,0:01:59.72,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}DOES WOOD\N{\an7}{\pos(38,243)}SINK IN WATER ? +Dialogue: 0,0:01:59.73,0:02:02.17,Default,,0,0,0,,{\an7}{\pos(76,197)}NO, NO.\N{\an7}{\pos(76,228)}\h\h\h\h\h\h\h\hNO, IT FLOATS !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\hIT FLOATS ! +Dialogue: 0,0:02:02.17,0:02:07.04,Default,,0,0,0,,{\an7}{\pos(76,197)}THROW HER INTO THE POND !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\h[ All Shouting ] +Dialogue: 0,0:02:07.36,0:02:10.49,Default,,0,0,0,,{\an7}{\pos(38,228)}WHAT ALSO FLOATS\N{\an7}{\pos(38,243)}IN WATER ? +Dialogue: 0,0:02:10.50,0:02:12.14,Default,,0,0,0,,{\an7}{\pos(76,197)}BREAD !\N{\an7}{\pos(76,243)}\h\h\h\h\h\h\h\h\h\h\h\hAPPLES ! +Dialogue: 0,0:02:12.13,0:02:13.23,Default,,0,0,0,,{\an7}{\pos(76,243)}UH, VERY SMALL ROCKS. +Dialogue: 0,0:02:13.23,0:02:16.49,Default,,0,0,0,,{\an7}{\pos(86,228)}{\i1}- CIDER ! CHERRIES !\N{\an7}{\pos(86,243)}{\i0}- UH, GRA-- GRAVY ! MUD ! +Dialogue: 0,0:02:16.50,0:02:18.76,Default,,0,0,0,,{\an7}{\pos(86,228)}- CHURCHES ! CHURCHES !\N{\an7}{\pos(86,243)}{\i1}- LEAD ! LEAD ! +Dialogue: 0,0:02:18.76,0:02:22.30,Default,,0,0,0,,{\an7}{\pos(76,228)}- A DUCK !\N{\an7}{\pos(76,243)}- [ Crowd Gasps, Murmurs ] +Dialogue: 0,0:02:22.30,0:02:24.63,Default,,0,0,0,,{\an7}{\pos(115,243)}EXACTLY ! +Dialogue: 0,0:02:25.36,0:02:27.59,Default,,0,0,0,,{\an7}{\pos(76,243)}SO, LOGICALLY-- +Dialogue: 0,0:02:27.59,0:02:29.76,Default,,0,0,0,,{\an7}{\pos(192,243)}IF... SHE... +Dialogue: 0,0:02:29.76,0:02:33.56,Default,,0,0,0,,{\an7}{\pos(192,213)}WEIGHS...\N{\an7}{\pos(192,228)}THE SAME\N{\an7}{\pos(192,243)}AS A DUCK... +Dialogue: 0,0:02:34.40,0:02:36.50,Default,,0,0,0,,{\an7}{\pos(153,243)}SHE’S MADE OF WOOD ! +Dialogue: 0,0:02:36.50,0:02:38.47,Default,,0,0,0,,{\an7}{\pos(38,243)}AND THEREFORE ? +Dialogue: 0,0:02:39.50,0:02:42.17,Default,,0,0,0,,{\an7}{\pos(38,228)}- A WITCH !\N{\an7}{\pos(38,243)}{\i1}- [ All ] A WITCH ! A WITCH ! +Dialogue: 0,0:02:42.17,0:02:44.07,Default,,0,0,0,,{\an7}{\pos(76,243)}[ Shouting Continues ] +Dialogue: 0,0:02:44.07,0:02:45.76,Default,,0,0,0,,{\an7}{\pos(192,213)}HERE’S A DUCK !\N{\an7}{\pos(192,243)}[ Quacking ] +Dialogue: 0,0:02:45.76,0:02:49.79,Default,,0,0,0,,{\an7}{\pos(76,213)}VERY GOOD.\N{\an7}{\pos(76,228)}WE SHALL USE\N{\an7}{\pos(76,243)}MY LARGEST SCALES. +Dialogue: 0,0:02:49.79,0:02:52.72,Default,,0,0,0,,{\an7}{\pos(76,243)}[ Shouting Continues ] +Dialogue: 0,0:02:52.73,0:02:55.17,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN !\N{\an7}{\pos(115,243)}\hBURN THE WITCH ! +Dialogue: 0,0:02:55.17,0:02:57.63,Default,,0,0,0,,{\an7}{\pos(153,228)}BURN HER !\N{\an7}{\pos(153,243)}\hBURN THE WITCH ! +Dialogue: 0,0:02:57.63,0:03:01.63,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN HER !\N{\an7}{\pos(115,243)}\hBURN HER ! BURN HER ! +Dialogue: 0,0:03:01.63,0:03:04.14,Default,,0,0,0,,{\an7}{\pos(115,228)}BURN HER !\N{\an7}{\pos(115,243)}\hBURN HER ! +Dialogue: 0,0:03:04.13,0:03:06.59,Default,,0,0,0,,{\an7}{\pos(230,228)}BURN HER !\N{\an7}{\pos(230,243)}\hBURN HER ! +Dialogue: 0,0:03:06.59,0:03:08.00,Default,,0,0,0,,{\an7}{\pos(201,243)}{\i1}[ Man Grunts ] +Dialogue: 0,0:03:08.00,0:03:14.30,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}RIGHT !\N{\an7}{\pos(38,243)}REMOVE THE SUPPORTS ! +Dialogue: 0,0:03:17.07,0:03:19.17,Default,,0,0,0,,{\an7}{\pos(38,197)}A WITCH !\N{\an7}{\pos(230,243)}A WITCH ! +Dialogue: 0,0:03:19.17,0:03:20.04,Default,,0,0,0,,{\an7}{\pos(76,243)}IT’S A FAIR COP. +Dialogue: 0,0:03:20.03,0:03:25.29,Default,,0,0,0,,{\an7}{\pos(38,213)}- BURN HER !\N{\an7}{\pos(38,228)}- [ Crowd Continues Shouting ]\N{\an7}{\pos(57,243)}BURN HER ! BURN HER ! +Dialogue: 0,0:03:28.86,0:03:32.73,Default,,0,0,0,,{\an7}{\pos(38,213)}WHO ARE YOU,\N{\an7}{\pos(38,228)}WHO ARE SO WISE\N{\an7}{\pos(38,243)}IN THE WAYS OF SCIENCE ? +Dialogue: 0,0:03:32.73,0:03:35.76,Default,,0,0,0,,{\an7}{\pos(153,228)}I AM ARTHUR,\N{\an7}{\pos(153,243)}KING OF THE BRITONS. +Dialogue: 0,0:03:35.76,0:03:36.96,Default,,0,0,0,,{\an7}{\pos(76,243)}MY LIEGE ! +Dialogue: 0,0:03:36.96,0:03:40.37,Default,,0,0,0,,{\an7}{\pos(115,213)}GOOD SIR KNIGHT,\N{\an7}{\pos(115,228)}WILL YOU COME WITH ME\N{\an7}{\pos(115,243)}TO CAMELOT... +Dialogue: 0,0:03:40.36,0:03:43.39,Default,,0,0,0,,{\an7}{\pos(153,228)}AND JOIN US\N{\an7}{\pos(153,243)}AT THE ROUND TABLE ? +Dialogue: 0,0:03:43.40,0:03:45.53,Default,,0,0,0,,{\an7}{\pos(38,228)}MY LIEGE,\N{\an7}{\pos(38,243)}I WOULD BE HONORED ! +Dialogue: 0,0:03:45.53,0:03:48.70,Default,,0,0,0,,{\an7}{\pos(38,197)}\h\h\h\h\h\h\h\h\h\h\h\hWHAT IS YOUR NAME ?\N{\an7}{\pos(38,243)}BEDEVERE, MY LIEGE. +Dialogue: 0,0:03:48.69,0:03:52.49,Default,,0,0,0,,{\an7}{\pos(163,228)}THEN I DUB YOU\N{\an7}{\pos(163,243)}{\i1}SIR{\i0} BEDEVERE, +Dialogue: 0,0:03:52.50,0:03:54.86,Default,,0,0,0,,{\an7}{\pos(153,228)}KNIGHT\N{\an7}{\pos(153,243)}OF THE ROUND TABLE. +Dialogue: 0,0:03:54.86,0:03:56.76,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}[ Narrator ]\N{\an7}{\pos(38,243)}THE WISE SIR BEDEVERE... +Dialogue: 0,0:03:56.76,0:03:59.69,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WAS THE FIRST TO JOIN\N{\an7}{\pos(38,243)}KING ARTHUR’S KNIGHTS. +Dialogue: 0,0:03:59.69,0:04:03.26,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}BUT OTHER ILLUSTRIOUS NAMES\N{\an7}{\pos(38,243)}WERE SOON TO FOLLOW: +Dialogue: 0,0:04:03.26,0:04:06.03,Default,,0,0,0,,{\an7}{\pos(38,243)}{\i1}SIR LAUNCELOT THE BRAVE; +Dialogue: 0,0:04:06.03,0:04:07.95,Default,,0,0,0,,{\an7}{\pos(38,243)}{\i1}SIR GALAHAD THE PURE; +Dialogue: 0,0:04:07.96,0:04:11.27,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}AND SIR ROBIN\N{\an7}{\pos(38,228)}THE NOT-QUITE-SO-BRAVE-\N{\an7}{\pos(38,243)}AS-SIR-LAUNCELOT, +Dialogue: 0,0:04:11.26,0:04:13.92,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WHO HAD NEARLY FOUGHT\N{\an7}{\pos(38,243)}THE DRAGON OF ANGNOR, +Dialogue: 0,0:04:13.92,0:04:16.89,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}WHO HAD NEARLY\N{\an7}{\pos(38,228)}STOOD UP TO THE VICIOUS\N{\an7}{\pos(38,243)}CHICKEN OF BRISTOL... +Dialogue: 0,0:04:16.89,0:04:20.73,Default,,0,0,0,,{\an7}{\pos(38,213)}{\i1}AND WHO HAD\N{\an7}{\pos(38,228)}PERSONALLY WET HIMSELF\N{\an7}{\pos(38,243)}AT THE BATTLE OF BADON HILL; +Dialogue: 0,0:04:20.73,0:04:25.43,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}AND THE APTLY NAMED\N{\an7}{\pos(38,243)}SIR NOT-APPEARING-IN-THIS-FILM. +Dialogue: 0,0:04:25.59,0:04:29.03,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}TOGETHER THEY FORMED A BAND\N{\an7}{\pos(38,243)}WHOSE NAMES AND DEEDS... +Dialogue: 0,0:04:29.03,0:04:31.72,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}WERE TO BE RETOLD\N{\an7}{\pos(38,243)}THROUGHOUT THE CENTURIES. +Dialogue: 0,0:04:31.73,0:04:33.86,Default,,0,0,0,,{\an7}{\pos(38,228)}{\i1}THE KNIGHTS\N{\an7}{\pos(38,243)}OF THE ROUND TABLE.