Version in base suite: 7.1.2-0+deb13u1 Base version: ffmpeg_7.1.2-0+deb13u1 Target version: ffmpeg_7.1.3-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/ffmpeg/ffmpeg_7.1.2-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/ffmpeg/ffmpeg_7.1.3-0+deb13u1.dsc Changelog | 40 +++++++++++++++++++++++++ RELEASE | 2 - VERSION | 2 - debian/changelog | 6 +++ doc/Doxyfile | 2 - fftools/ffmpeg_sched.c | 46 +++++++++++++++++++++++++++++ libavcodec/aarch64/h264pred_neon.S | 13 +++----- libavcodec/decode.c | 2 + libavcodec/exr.c | 57 +++++++++++++++++++++++++++++-------- libavcodec/g723_1.h | 2 - libavcodec/g723_1enc.c | 2 - libavcodec/hevc/sei.c | 8 +++-- libavcodec/mediacodecdec_common.c | 6 +++ libavcodec/mjpegdec.c | 2 + libavcodec/mlpdec.c | 18 +++++------ libavcodec/osq.c | 2 - libavcodec/ppc/svq1enc_altivec.c | 8 ++--- libavcodec/pthread_frame.c | 11 ------- libavcodec/utvideodec.c | 2 - libavcodec/vlc.c | 2 - libavcodec/x86/pngdsp.asm | 1 libavfilter/vf_drawtext.c | 11 ++----- libavformat/avformat.c | 1 libavformat/aviobuf.c | 2 - libavformat/demux.c | 28 ++++++++++++++++-- libavformat/http.c | 2 - libavformat/rtmpproto.c | 28 ++++++++++++++++-- libavformat/rtpdec_rfc4175.c | 28 +++++++++++++----- libavformat/rtpenc_h264_hevc.c | 3 + libavformat/sctp.c | 3 + libavutil/arm/cpu.c | 40 ++++++++++++++----------- libavutil/common.h | 8 ++--- libswscale/output.c | 4 +- 33 files changed, 294 insertions(+), 98 deletions(-) diff -Nru ffmpeg-7.1.2/Changelog ffmpeg-7.1.3/Changelog --- ffmpeg-7.1.2/Changelog 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/Changelog 2025-11-21 01:15:24.000000000 +0000 @@ -1,6 +1,46 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 7.1.3: + avutil/common: cast GET_BYTE/GET_16BIT returned value + avfilter/vf_drawtext: fix call GET_UTF8 with invalid argument + avfilter/vf_drawtext: fix incorrect text length + avformat/avformat: also clear FFFormatContext packet queue when closing a muxer + avfilter/vf_drawtext: Account for bbox text seperator + avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size + avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il() + avcodec/osq: Fix 32bit sample overflow + avformat/rtpdec_rfc4175: Only change PayloadContext on success + avformat/rtpdec_rfc4175: Check dimensions + avformat/rtpdec_rfc4175: Fix memleak of sampling + avformat/http: Fix off by 1 error + avcodec/exr: spelling + avcodec/exr: use tile dimensions in pxr24 UINT case + avcodec/exr: Simple check for available channels + avformat/sctp: Check size in sctp_write() + avformat/rtmpproto: consider command line argument lengths + avformat/rtmpproto_ Check tcurl and flashver length + avcodec/g723_1enc: Make min_err 64bit + avcodec/vlc: Clear val8/16 in vlc_multi_gen() by av_mallocz() + avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc() + swscale/output: Fix integer overflow in yuv2ya16_X_c_template() + avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI + avcodec/exr: Check that DWA has 3 channels + avcodec/exr: check ac_size + avcodec/exr: Round dc_w/h up + avcodec/mjpegdec: Explain buf_size/width/height check + avformat/aviobuf: Keep checksum_ptr consistent in avio_seek() + fftools/ffmpeg_sched: prevent demuxers from getting stuck + lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10 + avcodec/mlpdec: don't depend on context channel layout when setting substream masks + avformat/demux: pass new extradata to the parser + avcodec/svq1enc: restrict Altivec acceleration to big-endian POWER configurations + libavutil/arm: Rename the HWCAP defines + libavutil/arm: Make use of elf_aux_info() on FreeBSD/OpenBSD + avcodec/decode: sync initial_pict_type and intra_only_flag with thread worker's avctx + avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction + + version 7.1.2: doc/examples/vaapi_encode: fix invalid check on fwrite avcodec/librsvgdec: fix compilation with librsvg 2.50.3 diff -Nru ffmpeg-7.1.2/RELEASE ffmpeg-7.1.3/RELEASE --- ffmpeg-7.1.2/RELEASE 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/RELEASE 2025-11-21 01:15:24.000000000 +0000 @@ -1 +1 @@ -7.1.2 +7.1.3 diff -Nru ffmpeg-7.1.2/VERSION ffmpeg-7.1.3/VERSION --- ffmpeg-7.1.2/VERSION 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/VERSION 2025-11-21 01:15:24.000000000 +0000 @@ -1 +1 @@ -7.1.2 +7.1.3 diff -Nru ffmpeg-7.1.2/debian/changelog ffmpeg-7.1.3/debian/changelog --- ffmpeg-7.1.2/debian/changelog 2025-09-20 21:55:13.000000000 +0000 +++ ffmpeg-7.1.3/debian/changelog 2025-12-05 21:04:11.000000000 +0000 @@ -1,3 +1,9 @@ +ffmpeg (7:7.1.3-0+deb13u1) trixie-security; urgency=medium + + * New upstream version 7.1.3 + + -- Sebastian Ramacher Fri, 05 Dec 2025 22:04:11 +0100 + ffmpeg (7:7.1.2-0+deb13u1) trixie-security; urgency=medium * New upstream version 7.1.2 diff -Nru ffmpeg-7.1.2/doc/Doxyfile ffmpeg-7.1.3/doc/Doxyfile --- ffmpeg-7.1.2/doc/Doxyfile 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/doc/Doxyfile 2025-11-21 01:15:24.000000000 +0000 @@ -38,7 +38,7 @@ # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 7.1.2 +PROJECT_NUMBER = 7.1.3 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a diff -Nru ffmpeg-7.1.2/fftools/ffmpeg_sched.c ffmpeg-7.1.3/fftools/ffmpeg_sched.c --- ffmpeg-7.1.2/fftools/ffmpeg_sched.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/fftools/ffmpeg_sched.c 2025-11-21 01:15:24.000000000 +0000 @@ -1242,6 +1242,45 @@ return 0; } +static void unchoke_for_stream(Scheduler *sch, SchedulerNode src); + +// Unchoke any filter graphs that are downstream of this node, to prevent it +// from getting stuck trying to push data to a full queue +static void unchoke_downstream(Scheduler *sch, SchedulerNode *dst) +{ + SchFilterGraph *fg; + SchDec *dec; + SchEnc *enc; + switch (dst->type) { + case SCH_NODE_TYPE_DEC: + dec = &sch->dec[dst->idx]; + for (int i = 0; i < dec->nb_outputs; i++) + unchoke_downstream(sch, dec->outputs[i].dst); + break; + case SCH_NODE_TYPE_ENC: + enc = &sch->enc[dst->idx]; + for (int i = 0; i < enc->nb_dst; i++) + unchoke_downstream(sch, &enc->dst[i]); + break; + case SCH_NODE_TYPE_MUX: + // muxers are never choked + break; + case SCH_NODE_TYPE_FILTER_IN: + fg = &sch->filters[dst->idx]; + if (fg->best_input == fg->nb_inputs) { + fg->waiter.choked_next = 0; + } else { + // ensure that this filter graph is not stuck waiting for + // input from a different upstream demuxer + unchoke_for_stream(sch, fg->inputs[fg->best_input].src_sched); + } + break; + default: + av_assert0(!"Invalid destination node type?"); + break; + } +} + static void unchoke_for_stream(Scheduler *sch, SchedulerNode src) { while (1) { @@ -1249,7 +1288,12 @@ // fed directly by a demuxer (i.e. not through a filtergraph) if (src.type == SCH_NODE_TYPE_DEMUX) { - sch->demux[src.idx].waiter.choked_next = 0; + SchDemux *demux = &sch->demux[src.idx]; + if (demux->waiter.choked_next == 0) + return; // prevent infinite loop + demux->waiter.choked_next = 0; + for (int i = 0; i < demux->nb_streams; i++) + unchoke_downstream(sch, demux->streams[i].dst); return; } diff -Nru ffmpeg-7.1.2/libavcodec/aarch64/h264pred_neon.S ffmpeg-7.1.3/libavcodec/aarch64/h264pred_neon.S --- ffmpeg-7.1.2/libavcodec/aarch64/h264pred_neon.S 2025-08-14 23:31:21.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/aarch64/h264pred_neon.S 2025-11-21 01:15:24.000000000 +0000 @@ -489,10 +489,10 @@ mul v2.8h, v2.8h, v0.8h mul v3.8h, v3.8h, v0.8h addp v2.8h, v2.8h, v3.8h - addp v2.8h, v2.8h, v2.8h - addp v2.4h, v2.4h, v2.4h - sshll v3.4s, v2.4h, #2 - saddw v2.4s, v3.4s, v2.4h + saddlp v2.4s, v2.8h + addp v2.4s, v2.4s, v2.4s + shl v3.4s, v2.4s, #2 + add v2.4s, v3.4s, v2.4s rshrn v4.4h, v2.4s, #6 trn2 v5.4h, v4.4h, v4.4h add v2.4h, v4.4h, v5.4h @@ -506,14 +506,13 @@ sxtl v6.4s, v5.4h // c mov v0.h[0], wzr - mul v0.8h, v0.8h, v4.h[0] dup v16.4s, v2.s[0] dup v17.4s, v2.s[0] dup v2.8h, v4.h[0] // b dup v3.4s, v6.s[0] // c sshll v2.4s, v2.4h, #3 // b * 8 - saddw v16.4s, v16.4s, v0.4h - saddw2 v17.4s, v17.4s, v0.8h + smlal v16.4s, v0.4h, v4.h[0] + smlal2 v17.4s, v0.8h, v4.h[0] sub v3.4s, v3.4s, v2.4s mov w3, #16 diff -Nru ffmpeg-7.1.2/libavcodec/decode.c ffmpeg-7.1.3/libavcodec/decode.c --- ffmpeg-7.1.2/libavcodec/decode.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/decode.c 2025-11-21 01:15:24.000000000 +0000 @@ -2329,6 +2329,8 @@ const DecodeContext *src_dc = decode_ctx(src->internal); DecodeContext *dst_dc = decode_ctx(dst->internal); + dst_dc->initial_pict_type = src_dc->initial_pict_type; + dst_dc->intra_only_flag = src_dc->intra_only_flag; ff_refstruct_replace(&dst_dc->lcevc, src_dc->lcevc); } diff -Nru ffmpeg-7.1.2/libavcodec/exr.c ffmpeg-7.1.3/libavcodec/exr.c --- ffmpeg-7.1.2/libavcodec/exr.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/exr.c 2025-11-21 01:15:24.000000000 +0000 @@ -174,6 +174,9 @@ int is_luma;/* 1 if there is an Y plane */ +#define M(chr) (1<xdelta; - ptr[2] = ptr[1] + s->xdelta; - ptr[3] = ptr[2] + s->xdelta; - in = ptr[3] + s->xdelta; + ptr[1] = ptr[0] + td->xsize; + ptr[2] = ptr[1] + td->xsize; + ptr[3] = ptr[2] + td->xsize; + in = ptr[3] + td->xsize; - for (j = 0; j < s->xdelta; ++j) { + for (j = 0; j < td->xsize; ++j) { uint32_t diff = ((uint32_t)*(ptr[0]++) << 24) | (*(ptr[1]++) << 16) | (*(ptr[2]++) << 8 ) | @@ -987,8 +990,8 @@ int64_t version, lo_usize, lo_size; int64_t ac_size, dc_size, rle_usize, rle_csize, rle_raw_size; int64_t ac_count, dc_count, ac_compression; - const int dc_w = td->xsize >> 3; - const int dc_h = td->ysize >> 3; + const int dc_w = (td->xsize + 7) >> 3; + const int dc_h = (td->ysize + 7) >> 3; GetByteContext gb, agb; int skip, ret; int have_rle = 0; @@ -1000,6 +1003,11 @@ if (version != 2) return AVERROR_INVALIDDATA; + if (s->nb_channels < 3) { + avpriv_request_sample(s->avctx, "Gray DWA"); + return AVERROR_PATCHWELCOME; + } + lo_usize = AV_RL64(src + 8); lo_size = AV_RL64(src + 16); ac_size = AV_RL64(src + 24); @@ -1016,11 +1024,20 @@ ) return AVERROR_INVALIDDATA; + if (ac_size <= 0) { + avpriv_request_sample(s->avctx, "Zero ac_size"); + return AVERROR_INVALIDDATA; + } + if ((uint64_t)rle_raw_size > INT_MAX) { avpriv_request_sample(s->avctx, "Too big rle_raw_size"); return AVERROR_INVALIDDATA; } + if (td->xsize % 8 || td->ysize % 8) { + avpriv_request_sample(s->avctx, "odd dimensions DWA"); + } + bytestream2_init(&gb, src + 88, compressed_size - 88); skip = bytestream2_get_le16(&gb); if (skip < 2) @@ -1581,6 +1598,7 @@ s->is_tile = 0; s->is_multipart = 0; s->is_luma = 0; + s->has_channel = 0; s->current_part = 0; if (bytestream2_get_bytes_left(gb) < 10) { @@ -1684,23 +1702,26 @@ } if (layer_match) { /* only search channel if the layer match is valid */ + if (strlen(ch_gb.buffer) == 1) { + int ch_chr = av_toupper(*ch_gb.buffer); + if (ch_chr >= 'A' && ch_chr <= 'Z') + s->has_channel |= M(ch_chr); + av_log(s->avctx, AV_LOG_DEBUG, "%c\n", ch_chr); + } + if (!av_strcasecmp(ch_gb.buffer, "R") || !av_strcasecmp(ch_gb.buffer, "X") || !av_strcasecmp(ch_gb.buffer, "U")) { channel_index = 0; - s->is_luma = 0; } else if (!av_strcasecmp(ch_gb.buffer, "G") || !av_strcasecmp(ch_gb.buffer, "V")) { channel_index = 1; - s->is_luma = 0; } else if (!av_strcasecmp(ch_gb.buffer, "Y")) { channel_index = 1; - s->is_luma = 1; } else if (!av_strcasecmp(ch_gb.buffer, "B") || !av_strcasecmp(ch_gb.buffer, "Z") || !av_strcasecmp(ch_gb.buffer, "W")) { channel_index = 2; - s->is_luma = 0; } else if (!av_strcasecmp(ch_gb.buffer, "A")) { channel_index = 3; } else { @@ -1776,6 +1797,20 @@ s->current_channel_offset += 4; } } + if (!((M('R') + M('G') + M('B')) & ~s->has_channel)) { + s->is_luma = 0; + } else if (!((M('X') + M('Y') + M('Z')) & ~s->has_channel)) { + s->is_luma = 0; + } else if (!((M('Y') + M('U') + M('V')) & ~s->has_channel)) { + s->is_luma = 0; + } else if (!((M('Y') ) & ~s->has_channel) && + !((M('R') + M('G') + M('B') + M('U') + M('V') + M('X') + M('Z')) & s->has_channel)) { + s->is_luma = 1; + } else { + avpriv_request_sample(s->avctx, "Uncommon channel combination"); + ret = AVERROR(AVERROR_PATCHWELCOME); + goto fail; + } /* Check if all channels are set with an offset or if the channels * are causing an overflow */ diff -Nru ffmpeg-7.1.2/libavcodec/g723_1.h ffmpeg-7.1.3/libavcodec/g723_1.h --- ffmpeg-7.1.2/libavcodec/g723_1.h 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/g723_1.h 2025-11-21 01:15:24.000000000 +0000 @@ -108,7 +108,7 @@ * Optimized fixed codebook excitation parameters */ typedef struct FCBParam { - int min_err; + int64_t min_err; int amp_index; int grid_index; int dirac_train; diff -Nru ffmpeg-7.1.2/libavcodec/g723_1enc.c ffmpeg-7.1.3/libavcodec/g723_1enc.c --- ffmpeg-7.1.2/libavcodec/g723_1enc.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/g723_1enc.c 2025-11-21 01:15:24.000000000 +0000 @@ -1013,7 +1013,7 @@ int pulse_cnt = pulses[index]; int i; - optim.min_err = 1 << 30; + optim.min_err = 1LL << 31; get_fcb_param(&optim, impulse_resp, buf, pulse_cnt, SUBFRAME_LEN); if (p->pitch_lag[index >> 1] < SUBFRAME_LEN - 2) { diff -Nru ffmpeg-7.1.2/libavcodec/hevc/sei.c ffmpeg-7.1.3/libavcodec/hevc/sei.c --- ffmpeg-7.1.2/libavcodec/hevc/sei.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/hevc/sei.c 2025-11-21 01:15:24.000000000 +0000 @@ -152,6 +152,8 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitContext *gb) { + unsigned num_ref_displays; + s->prec_ref_display_width = get_ue_golomb(gb); if (s->prec_ref_display_width > 31) return AVERROR_INVALIDDATA; @@ -161,10 +163,10 @@ if (s->prec_ref_viewing_dist > 31) return AVERROR_INVALIDDATA; } - s->num_ref_displays = get_ue_golomb(gb); - if (s->num_ref_displays > 31) + num_ref_displays = get_ue_golomb(gb); + if (num_ref_displays > 31) return AVERROR_INVALIDDATA; - s->num_ref_displays += 1; + s->num_ref_displays = num_ref_displays + 1; for (int i = 0; i < s->num_ref_displays; i++) { int length; diff -Nru ffmpeg-7.1.2/libavcodec/mediacodecdec_common.c ffmpeg-7.1.3/libavcodec/mediacodecdec_common.c --- ffmpeg-7.1.2/libavcodec/mediacodecdec_common.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/mediacodecdec_common.c 2025-11-21 01:15:24.000000000 +0000 @@ -385,6 +385,12 @@ goto done; } + if (info->size % (sample_size * avctx->ch_layout.nb_channels)) { + av_log(avctx, AV_LOG_ERROR, "input is not a multiple of channels * sample_size\n"); + ret = AVERROR(EINVAL); + goto done; + } + frame->format = avctx->sample_fmt; frame->sample_rate = avctx->sample_rate; frame->nb_samples = info->size / (sample_size * avctx->ch_layout.nb_channels); diff -Nru ffmpeg-7.1.2/libavcodec/mjpegdec.c ffmpeg-7.1.3/libavcodec/mjpegdec.c --- ffmpeg-7.1.2/libavcodec/mjpegdec.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/mjpegdec.c 2025-11-21 01:15:24.000000000 +0000 @@ -343,6 +343,8 @@ av_log(s->avctx, AV_LOG_DEBUG, "sof0: picture: %dx%d\n", width, height); if (av_image_check_size(width, height, 0, s->avctx) < 0) return AVERROR_INVALIDDATA; + + // A valid frame requires at least 1 bit for DC + 1 bit for AC for each 8x8 block. if (s->buf_size && (width + 7) / 8 * ((height + 7) / 8) > s->buf_size * 4LL) return AVERROR_INVALIDDATA; diff -Nru ffmpeg-7.1.2/libavcodec/mlpdec.c ffmpeg-7.1.3/libavcodec/mlpdec.c --- ffmpeg-7.1.2/libavcodec/mlpdec.c 2025-08-22 09:24:18.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/mlpdec.c 2025-11-21 01:15:24.000000000 +0000 @@ -318,8 +318,10 @@ av_channel_layout_uninit(&avctx->ch_layout); avctx->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_5POINT1; } - else + else { av_log(avctx, AV_LOG_WARNING, "Invalid downmix layout\n"); + av_channel_layout_uninit(&m->downmix_layout); + } } ff_thread_once(&init_static_once, init_static); @@ -452,26 +454,22 @@ } m->substream[1].mask = mh.channel_layout_thd_stream1; if (mh.channels_thd_stream1 == 2 && - mh.channels_thd_stream2 == 2 && - m->avctx->ch_layout.nb_channels == 2) + mh.channels_thd_stream2 == 2) m->substream[0].mask = AV_CH_LAYOUT_STEREO; if ((substr = (mh.num_substreams > 1))) m->substream[0].mask = AV_CH_LAYOUT_STEREO; if (mh.num_substreams == 1 && mh.channels_thd_stream1 == 1 && - mh.channels_thd_stream2 == 1 && - m->avctx->ch_layout.nb_channels == 1) + mh.channels_thd_stream2 == 1) m->substream[0].mask = AV_CH_LAYOUT_MONO; if (mh.num_substreams > 2) if (mh.channel_layout_thd_stream2) m->substream[2].mask = mh.channel_layout_thd_stream2; else m->substream[2].mask = mh.channel_layout_thd_stream1; - if (m->avctx->ch_layout.nb_channels > 2) - if (mh.num_substreams > 2) - m->substream[1].mask = mh.channel_layout_thd_stream1; - else - m->substream[mh.num_substreams > 1].mask = mh.channel_layout_thd_stream2; + if (mh.num_substreams == 2 && (!m->downmix_layout.nb_channels || + m->downmix_layout.nb_channels > 2)) + m->substream[1].mask = mh.channel_layout_thd_stream2; } m->needs_reordering = mh.channel_arrangement >= 18 && mh.channel_arrangement <= 20; diff -Nru ffmpeg-7.1.2/libavcodec/osq.c ffmpeg-7.1.3/libavcodec/osq.c --- ffmpeg-7.1.2/libavcodec/osq.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/osq.c 2025-11-21 01:15:24.000000000 +0000 @@ -390,7 +390,7 @@ int32_t *src = s->decode_buffer[ch] + OFFSET; for (int n = 0; n < nb_samples; n++) - dst[n] = av_clip_uint8(src[n] + 0x80); + dst[n] = av_clip_uint8(src[n] + 0x80ll); } break; case AV_SAMPLE_FMT_S16P: diff -Nru ffmpeg-7.1.2/libavcodec/ppc/svq1enc_altivec.c ffmpeg-7.1.3/libavcodec/ppc/svq1enc_altivec.c --- ffmpeg-7.1.2/libavcodec/ppc/svq1enc_altivec.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/ppc/svq1enc_altivec.c 2025-11-21 01:15:24.000000000 +0000 @@ -29,7 +29,7 @@ #include "libavcodec/svq1encdsp.h" -#if HAVE_ALTIVEC +#if HAVE_ALTIVEC && HAVE_BIGENDIAN static int ssd_int8_vs_int16_altivec(const int8_t *pix1, const int16_t *pix2, intptr_t size) { @@ -69,14 +69,14 @@ return u.score[3]; } -#endif /* HAVE_ALTIVEC */ +#endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */ av_cold void ff_svq1enc_init_ppc(SVQ1EncDSPContext *c) { -#if HAVE_ALTIVEC +#if HAVE_ALTIVEC && HAVE_BIGENDIAN if (!PPC_ALTIVEC(av_get_cpu_flags())) return; c->ssd_int8_vs_int16 = ssd_int8_vs_int16_altivec; -#endif /* HAVE_ALTIVEC */ +#endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */ } diff -Nru ffmpeg-7.1.2/libavcodec/pthread_frame.c ffmpeg-7.1.3/libavcodec/pthread_frame.c --- ffmpeg-7.1.2/libavcodec/pthread_frame.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/pthread_frame.c 2025-11-21 01:15:24.000000000 +0000 @@ -115,10 +115,6 @@ int hwaccel_threadsafe; atomic_int debug_threads; ///< Set if the FF_DEBUG_THREADS option is set. - - /// The following two fields have the same semantics as the DecodeContext field - int intra_only_flag; - enum AVPictureType initial_pict_type; } PerThreadContext; /** @@ -821,13 +817,6 @@ AVCodecContext *copy; int err; - p->initial_pict_type = AV_PICTURE_TYPE_NONE; - if (avctx->codec_descriptor->props & AV_CODEC_PROP_INTRA_ONLY) { - p->intra_only_flag = AV_FRAME_FLAG_KEY; - if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) - p->initial_pict_type = AV_PICTURE_TYPE_I; - } - atomic_init(&p->state, STATE_INPUT_READY); copy = av_memdup(avctx, sizeof(*avctx)); diff -Nru ffmpeg-7.1.2/libavcodec/utvideodec.c ffmpeg-7.1.3/libavcodec/utvideodec.c --- ffmpeg-7.1.2/libavcodec/utvideodec.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/utvideodec.c 2025-11-21 01:15:24.000000000 +0000 @@ -457,7 +457,7 @@ // second line - first element has top prediction, the rest uses median C = bsrc[-stride2]; bsrc[0] += C; - A = bsrc[0]; + A = B = bsrc[0]; for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */ B = bsrc[i - stride2]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); diff -Nru ffmpeg-7.1.2/libavcodec/vlc.c ffmpeg-7.1.3/libavcodec/vlc.c --- ffmpeg-7.1.2/libavcodec/vlc.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/vlc.c 2025-11-21 01:15:24.000000000 +0000 @@ -527,7 +527,7 @@ if (ret < 0) return ret; - multi->table = av_malloc(sizeof(*multi->table) << nb_bits); + multi->table = av_mallocz(sizeof(*multi->table) << nb_bits); if (!multi->table) goto fail; diff -Nru ffmpeg-7.1.2/libavcodec/x86/pngdsp.asm ffmpeg-7.1.3/libavcodec/x86/pngdsp.asm --- ffmpeg-7.1.2/libavcodec/x86/pngdsp.asm 2025-08-14 23:31:16.000000000 +0000 +++ ffmpeg-7.1.3/libavcodec/x86/pngdsp.asm 2025-11-21 01:15:24.000000000 +0000 @@ -151,6 +151,7 @@ dec cntrq jge .bpp_loop POP dstq + emms RET %endmacro diff -Nru ffmpeg-7.1.2/libavfilter/vf_drawtext.c ffmpeg-7.1.3/libavfilter/vf_drawtext.c --- ffmpeg-7.1.2/libavfilter/vf_drawtext.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavfilter/vf_drawtext.c 2025-11-21 01:15:24.000000000 +0000 @@ -1017,7 +1017,7 @@ av_log(ctx, AV_LOG_WARNING, "Multiple texts provided, will use text_source only\n"); av_free(s->text); } - s->text = av_mallocz(AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE * + s->text = av_mallocz((AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE + 1) * (AV_NUM_DETECTION_BBOX_CLASSIFY + 1)); if (!s->text) return AVERROR(ENOMEM); @@ -1394,8 +1394,7 @@ { DrawTextContext *s = ctx->priv; char *text = s->expanded_text.str; - char *textdup = NULL, *start = NULL; - int num_chars = 0; + char *textdup = NULL; int width64 = 0, w64 = 0; int cur_min_y64 = 0, first_max_y64 = -32000; int first_min_x64 = 32000, last_max_x64 = -32000; @@ -1405,7 +1404,7 @@ Glyph *glyph = NULL; int i, tab_idx = 0, last_tab_idx = 0, line_offset = 0; - char* p; + uint8_t *start, *p; int ret = 0; // Count the lines and the tab characters @@ -1458,7 +1457,7 @@ TextLine *cur_line = &s->lines[line_count]; HarfbuzzData *hb = &cur_line->hb_data; cur_line->cluster_offset = line_offset; - ret = shape_text_hb(s, hb, start, num_chars); + ret = shape_text_hb(s, hb, start, p - start); if (ret != 0) { goto done; } @@ -1516,14 +1515,12 @@ if (w64 > width64) { width64 = w64; } - num_chars = -1; start = p; ++line_count; line_offset = i + 1; } if (code == 0) break; - ++num_chars; } metrics->line_height64 = s->face->size->metrics.height; diff -Nru ffmpeg-7.1.2/libavformat/avformat.c ffmpeg-7.1.3/libavformat/avformat.c --- ffmpeg-7.1.2/libavformat/avformat.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/avformat.c 2025-11-21 01:15:24.000000000 +0000 @@ -184,6 +184,7 @@ av_dict_free(&si->id3v2_meta); av_packet_free(&si->pkt); av_packet_free(&si->parse_pkt); + avpriv_packet_list_free(&si->packet_buffer); av_freep(&s->streams); av_freep(&s->stream_groups); ff_flush_packet_queue(s); diff -Nru ffmpeg-7.1.2/libavformat/aviobuf.c ffmpeg-7.1.3/libavformat/aviobuf.c --- ffmpeg-7.1.2/libavformat/aviobuf.c 2025-08-22 09:24:19.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/aviobuf.c 2025-11-21 01:15:24.000000000 +0000 @@ -308,7 +308,7 @@ ctx->seek_count++; if (!s->write_flag) s->buf_end = s->buffer; - s->buf_ptr = s->buf_ptr_max = s->buffer; + s->checksum_ptr = s->buf_ptr = s->buf_ptr_max = s->buffer; s->pos = offset; } s->eof_reached = 0; diff -Nru ffmpeg-7.1.2/libavformat/demux.c ffmpeg-7.1.3/libavformat/demux.c --- ffmpeg-7.1.2/libavformat/demux.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/demux.c 2025-11-21 01:15:24.000000000 +0000 @@ -1159,7 +1159,10 @@ AVPacket *out_pkt = si->parse_pkt; AVStream *st = s->streams[stream_index]; FFStream *const sti = ffstream(st); + const AVPacketSideData *sd = NULL; const uint8_t *data = pkt->data; + uint8_t *extradata = sti->avctx->extradata; + int extradata_size = sti->avctx->extradata_size; int size = pkt->size; int ret = 0, got_output = flush; @@ -1168,6 +1171,16 @@ compute_pkt_fields(s, st, sti->parser, pkt, AV_NOPTS_VALUE, AV_NOPTS_VALUE); } + if (pkt->side_data_elems) + sd = av_packet_side_data_get(pkt->side_data, pkt->side_data_elems, + AV_PKT_DATA_NEW_EXTRADATA); + if (sd) { + av_assert1(size && !flush); + + sti->avctx->extradata = sd->data; + sti->avctx->extradata_size = sd->size; + } + while (size > 0 || (flush && got_output)) { int64_t next_pts = pkt->pts; int64_t next_dts = pkt->dts; @@ -1261,6 +1274,11 @@ } fail: + if (sd) { + sti->avctx->extradata = extradata; + sti->avctx->extradata_size = extradata_size; + } + if (ret < 0) av_packet_unref(out_pkt); av_packet_unref(pkt); @@ -1353,6 +1371,11 @@ st->event_flags |= AVSTREAM_EVENT_FLAG_NEW_PACKETS; + int new_extradata = !!av_packet_side_data_get(pkt->side_data, pkt->side_data_elems, + AV_PKT_DATA_NEW_EXTRADATA); + if (new_extradata) + sti->need_context_update = 1; + /* update context if required */ if (sti->need_context_update) { if (avcodec_is_open(sti->avctx)) { @@ -1363,8 +1386,9 @@ return ret; } - /* close parser, because it depends on the codec */ - if (sti->parser && sti->avctx->codec_id != st->codecpar->codec_id) { + /* close parser, because it depends on the codec and extradata */ + if (sti->parser && + (sti->avctx->codec_id != st->codecpar->codec_id || new_extradata)) { av_parser_close(sti->parser); sti->parser = NULL; } diff -Nru ffmpeg-7.1.2/libavformat/http.c ffmpeg-7.1.3/libavformat/http.c --- ffmpeg-7.1.2/libavformat/http.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/http.c 2025-11-21 01:15:24.000000000 +0000 @@ -1849,7 +1849,7 @@ ret = http_read_stream_all(h, data, len); if (ret < 0) return ret; - data[len + 1] = 0; + data[len] = 0; if ((ret = av_opt_set(s, "icy_metadata_packet", data, 0)) < 0) return ret; update_metadata(h, data); diff -Nru ffmpeg-7.1.2/libavformat/rtmpproto.c ffmpeg-7.1.3/libavformat/rtmpproto.c --- ffmpeg-7.1.2/libavformat/rtmpproto.c 2025-09-14 19:20:04.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/rtmpproto.c 2025-11-21 01:15:24.000000000 +0000 @@ -163,6 +163,13 @@ static int handle_window_ack_size(URLContext *s, RTMPPacket *pkt); static int handle_set_peer_bw(URLContext *s, RTMPPacket *pkt); +static size_t zstrlen(const char *c) +{ + if(c) + return strlen(c); + return 0; +} + static int add_tracked_method(RTMPContext *rt, const char *name, int id) { int err; @@ -327,7 +334,16 @@ int ret; if ((ret = ff_rtmp_packet_create(&pkt, RTMP_SYSTEM_CHANNEL, RTMP_PT_INVOKE, - 0, 4096 + APP_MAX_LENGTH)) < 0) + 0, 4096 + APP_MAX_LENGTH + + strlen(rt->auth_params) + strlen(rt->flashver) + + zstrlen(rt->enhanced_codecs)/5*7 + + zstrlen(rt->swfurl) + + zstrlen(rt->swfverify) + + zstrlen(rt->tcurl) + + zstrlen(rt->auth_params) + + zstrlen(rt->pageurl) + + zstrlen(rt->conn)*3 + )) < 0) return ret; p = pkt.data; @@ -1900,7 +1916,9 @@ if ((ret = ff_rtmp_packet_create(&spkt, RTMP_SYSTEM_CHANNEL, RTMP_PT_INVOKE, 0, - RTMP_PKTDATA_DEFAULT_SIZE)) < 0) { + RTMP_PKTDATA_DEFAULT_SIZE + + strlen(status) + strlen(description) + + zstrlen(details))) < 0) { av_log(s, AV_LOG_ERROR, "Unable to create response packet\n"); return ret; } @@ -2833,6 +2851,12 @@ "FMLE/3.0 (compatible; %s)", LIBAVFORMAT_IDENT); } } + if ( strlen(rt->flashver) > FLASHVER_MAX_LENGTH + || strlen(rt->tcurl ) > TCURL_MAX_LENGTH + ) { + ret = AVERROR(EINVAL); + goto fail; + } rt->receive_report_size = 1048576; rt->bytes_read = 0; diff -Nru ffmpeg-7.1.2/libavformat/rtpdec_rfc4175.c ffmpeg-7.1.3/libavformat/rtpdec_rfc4175.c --- ffmpeg-7.1.2/libavformat/rtpdec_rfc4175.c 2025-08-22 09:24:19.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/rtpdec_rfc4175.c 2025-11-21 01:15:24.000000000 +0000 @@ -23,7 +23,9 @@ #include "avio_internal.h" #include "rtpdec_formats.h" +#include "libavutil/avassert.h" #include "libavutil/avstring.h" +#include "libavutil/imgutils.h" #include "libavutil/mem.h" #include "libavutil/pixdesc.h" #include "libavutil/parseutils.h" @@ -128,7 +130,7 @@ data->width = atoi(value); else if (!strncmp(attr, "height", 6)) data->height = atoi(value); - else if (!strncmp(attr, "sampling", 8)) + else if (data->sampling == NULL && !strncmp(attr, "sampling", 8)) data->sampling = av_strdup(value); else if (!strncmp(attr, "depth", 5)) data->depth = atoi(value); @@ -172,30 +174,39 @@ } static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index, - PayloadContext *data, const char *line) + PayloadContext *data_arg, const char *line) { const char *p; if (st_index < 0) return 0; + av_assert0(!data_arg->sampling); + if (av_strstart(line, "fmtp:", &p)) { AVStream *stream = s->streams[st_index]; + PayloadContext data0 = *data_arg, *data = &data0; int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp); - if (ret < 0) - return ret; + if (!data->sampling || !data->depth || !data->width || !data->height) + ret = AVERROR(EINVAL); + if (ret < 0) + goto fail; - if (!data->sampling || !data->depth || !data->width || !data->height) - return AVERROR(EINVAL); + ret = av_image_check_size(data->width, data->height, 0, s); + if (ret < 0) + goto fail; stream->codecpar->width = data->width; stream->codecpar->height = data->height; ret = rfc4175_parse_format(stream, data); av_freep(&data->sampling); - + if (ret >= 0) + *data_arg = *data; +fail: + av_freep(&data->sampling); return ret; } @@ -296,6 +307,9 @@ if (data->interlaced) line = 2 * line + field; + if (line >= data->height) + return AVERROR_INVALIDDATA; + /* prevent ill-formed packets to write after buffer's end */ copy_offset = (line * data->width + offset) * data->pgroup / data->xinc; if (copy_offset + length > data->frame_size || !data->frame) diff -Nru ffmpeg-7.1.2/libavformat/rtpenc_h264_hevc.c ffmpeg-7.1.3/libavformat/rtpenc_h264_hevc.c --- ffmpeg-7.1.2/libavformat/rtpenc_h264_hevc.c 2025-08-22 09:24:19.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/rtpenc_h264_hevc.c 2025-11-21 01:15:24.000000000 +0000 @@ -196,6 +196,9 @@ r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size); if (!r1) r1 = end; + // Check that the last is not truncated + if (r1 - r < s->nal_length_size) + break; r += s->nal_length_size; } else { while (!*(r++)); diff -Nru ffmpeg-7.1.2/libavformat/sctp.c ffmpeg-7.1.3/libavformat/sctp.c --- ffmpeg-7.1.2/libavformat/sctp.c 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.3/libavformat/sctp.c 2025-11-21 01:15:24.000000000 +0000 @@ -334,6 +334,9 @@ } if (s->max_streams) { + if (size < 2) + return AVERROR(EINVAL); + /*StreamId is introduced as a 2byte code into the stream*/ struct sctp_sndrcvinfo info = { 0 }; info.sinfo_stream = AV_RB16(buf); diff -Nru ffmpeg-7.1.2/libavutil/arm/cpu.c ffmpeg-7.1.3/libavutil/arm/cpu.c --- ffmpeg-7.1.2/libavutil/arm/cpu.c 2025-08-22 09:24:19.000000000 +0000 +++ ffmpeg-7.1.3/libavutil/arm/cpu.c 2025-11-21 01:15:24.000000000 +0000 @@ -31,30 +31,32 @@ CORE_FLAG(VFPV3) | \ CORE_FLAG(NEON)) -#if defined __linux__ || defined __ANDROID__ +#if defined __linux__ || defined __ANDROID__ || HAVE_ELF_AUX_INFO #include #include #include #include "libavutil/avstring.h" -#if HAVE_GETAUXVAL +#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO #include #endif +#ifndef AT_HWCAP #define AT_HWCAP 16 +#endif /* Relevant HWCAP values from kernel headers */ -#define HWCAP_VFP (1 << 6) -#define HWCAP_EDSP (1 << 7) -#define HWCAP_THUMBEE (1 << 11) -#define HWCAP_NEON (1 << 12) -#define HWCAP_VFPv3 (1 << 13) -#define HWCAP_TLS (1 << 15) +#define HWCAP_ARM_VFP (1 << 6) +#define HWCAP_ARM_EDSP (1 << 7) +#define HWCAP_ARM_THUMBEE (1 << 11) +#define HWCAP_ARM_NEON (1 << 12) +#define HWCAP_ARM_VFPv3 (1 << 13) +#define HWCAP_ARM_TLS (1 << 15) static int get_auxval(uint32_t *hwcap) { -#if HAVE_GETAUXVAL +#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO unsigned long ret = ff_getauxval(AT_HWCAP); if (ret == 0) return -1; @@ -65,6 +67,7 @@ #endif } +#if defined __linux__ || defined __ANDROID__ static int get_hwcap(uint32_t *hwcap) { struct { uint32_t a_type; uint32_t a_val; } auxv; @@ -98,25 +101,26 @@ while (fgets(buf, sizeof(buf), f)) { if (av_strstart(buf, "Features", NULL)) { if (strstr(buf, " edsp ")) - *hwcap |= HWCAP_EDSP; + *hwcap |= HWCAP_ARM_EDSP; if (strstr(buf, " tls ")) - *hwcap |= HWCAP_TLS; + *hwcap |= HWCAP_ARM_TLS; if (strstr(buf, " thumbee ")) - *hwcap |= HWCAP_THUMBEE; + *hwcap |= HWCAP_ARM_THUMBEE; if (strstr(buf, " vfp ")) - *hwcap |= HWCAP_VFP; + *hwcap |= HWCAP_ARM_VFP; if (strstr(buf, " vfpv3 ")) - *hwcap |= HWCAP_VFPv3; + *hwcap |= HWCAP_ARM_VFPv3; if (strstr(buf, " neon ") || strstr(buf, " asimd ")) - *hwcap |= HWCAP_NEON; + *hwcap |= HWCAP_ARM_NEON; if (strstr(buf, " fp ")) // Listed on 64 bit ARMv8 kernels - *hwcap |= HWCAP_VFP | HWCAP_VFPv3; + *hwcap |= HWCAP_ARM_VFP | HWCAP_ARM_VFPv3; break; } } fclose(f); return 0; } +#endif int ff_get_cpu_flags_arm(void) { @@ -124,12 +128,14 @@ uint32_t hwcap; if (get_auxval(&hwcap) < 0) +#if defined __linux__ || defined __ANDROID__ if (get_hwcap(&hwcap) < 0) if (get_cpuinfo(&hwcap) < 0) +#endif return flags; #define check_cap(cap, flag) do { \ - if (hwcap & HWCAP_ ## cap) \ + if (hwcap & HWCAP_ARM_ ## cap) \ flags |= AV_CPU_FLAG_ ## flag; \ } while (0) diff -Nru ffmpeg-7.1.2/libavutil/common.h ffmpeg-7.1.3/libavutil/common.h --- ffmpeg-7.1.2/libavutil/common.h 2025-08-22 09:24:19.000000000 +0000 +++ ffmpeg-7.1.3/libavutil/common.h 2025-11-21 01:15:24.000000000 +0000 @@ -486,13 +486,13 @@ * to prevent undefined results. */ #define GET_UTF8(val, GET_BYTE, ERROR)\ - val= (GET_BYTE);\ + val= (uint8_t)(GET_BYTE);\ {\ uint32_t top = (val & 128) >> 1;\ if ((val & 0xc0) == 0x80 || val >= 0xFE)\ {ERROR}\ while (val & top) {\ - unsigned int tmp = (GET_BYTE) - 128;\ + unsigned int tmp = (uint8_t)(GET_BYTE) - 128;\ if(tmp>>6)\ {ERROR}\ val= (val<<6) + tmp;\ @@ -511,11 +511,11 @@ * typically a goto statement. */ #define GET_UTF16(val, GET_16BIT, ERROR)\ - val = (GET_16BIT);\ + val = (uint16_t)(GET_16BIT);\ {\ unsigned int hi = val - 0xD800;\ if (hi < 0x800) {\ - val = (GET_16BIT) - 0xDC00;\ + val = (uint16_t)(GET_16BIT) - 0xDC00;\ if (val > 0x3FFU || hi > 0x3FFU)\ {ERROR}\ val += (hi<<10) + 0x10000;\ diff -Nru ffmpeg-7.1.2/libswscale/output.c ffmpeg-7.1.3/libswscale/output.c --- ffmpeg-7.1.2/libswscale/output.c 2025-09-14 19:20:09.000000000 +0000 +++ ffmpeg-7.1.3/libswscale/output.c 2025-11-21 01:15:24.000000000 +0000 @@ -965,7 +965,7 @@ int A = 0xffff; for (j = 0; j < lumFilterSize; j++) - Y += lumSrc[j][i] * lumFilter[j]; + Y += lumSrc[j][i] * (unsigned)lumFilter[j]; Y >>= 15; Y += (1<<3) + 0x8000; @@ -974,7 +974,7 @@ if (hasAlpha) { A = -0x40000000 + (1<<14); for (j = 0; j < lumFilterSize; j++) - A += alpSrc[j][i] * lumFilter[j]; + A += alpSrc[j][i] * (unsigned)lumFilter[j]; A >>= 15; A += 0x8000;