Version in base suite: 7.1.3-0+deb13u1 Version in overlay suite: 7.1.4-0+deb13u1 Base version: ffmpeg_7.1.4-0+deb13u1 Target version: ffmpeg_7.1.5-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/ffmpeg/ffmpeg_7.1.4-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/ffmpeg/ffmpeg_7.1.5-0+deb13u1.dsc Changelog | 148 +++++++++++++++++++++++++++ RELEASE | 2 VERSION | 2 debian/changelog | 7 + doc/Doxyfile | 2 fftools/ffmpeg.h | 2 fftools/ffmpeg_dec.c | 13 ++ libavcodec/aac/aacdec.c | 6 + libavcodec/aac/aacdec_usac.c | 2 libavcodec/adpcm.c | 2 libavcodec/agm.c | 16 +- libavcodec/av1dec.c | 2 libavcodec/cbs_av1_syntax_template.c | 3 libavcodec/cbs_h266_syntax_template.c | 122 +++++++++++----------- libavcodec/cook.c | 7 - libavcodec/cri.c | 1 libavcodec/diracdec.c | 8 - libavcodec/fastaudio.c | 2 libavcodec/g2meet.c | 5 libavcodec/h2645_sei.c | 8 - libavcodec/h264_slice.c | 6 - libavcodec/hdrdec.c | 2 libavcodec/hevc/ps.c | 56 ++++++---- libavcodec/hevc/ps.h | 5 libavcodec/hevc/refs.c | 5 libavcodec/imm5.c | 2 libavcodec/jpeg2000dec.c | 9 + libavcodec/jpeglsdec.c | 2 libavcodec/magicyuv.c | 18 ++- libavcodec/misc4.c | 6 + libavcodec/mwsc.c | 14 ++ libavcodec/on2avc.c | 6 + libavcodec/options_table.h | 2 libavcodec/rv10.c | 3 libavcodec/rv34.c | 15 +- libavcodec/snowenc.c | 24 ++-- libavcodec/tdsc.c | 1 libavcodec/truespeech.c | 5 libavcodec/vc2enc_dwt.c | 66 ++++++------ libavcodec/vp8.c | 11 +- libavcodec/vvc/ctu.c | 14 +- libavcodec/vvc/dec.c | 5 libavcodec/vvc/inter_template.c | 33 +++--- libavcodec/vvc/intra.c | 36 ++++-- libavcodec/vvc/ps.c | 166 ++++++++++++++++++++++++------- libavcodec/vvc/refs.c | 25 +++- libavcodec/vvc/refs.h | 6 + libavcodec/vvc/thread.c | 11 +- libavcodec/x86/vorbisdsp.asm | 4 libavfilter/aap_template.c | 4 libavfilter/adynamicequalizer_template.c | 4 libavfilter/af_acrossover.c | 4 libavfilter/af_adecorrelate.c | 4 libavfilter/af_adenorm.c | 4 libavfilter/af_adrc.c | 4 libavfilter/af_aemphasis.c | 4 libavfilter/af_afftdn.c | 4 libavfilter/af_afftfilt.c | 8 - libavfilter/af_afir.c | 4 libavfilter/af_afreqshift.c | 4 libavfilter/af_anequalizer.c | 4 libavfilter/af_apsyclip.c | 4 libavfilter/af_arnndn.c | 4 libavfilter/af_asdr.c | 12 +- libavfilter/af_asoftclip.c | 4 libavfilter/af_aspectralstats.c | 4 libavfilter/af_astats.c | 4 libavfilter/af_asubboost.c | 4 libavfilter/af_asupercut.c | 4 libavfilter/af_atilt.c | 4 libavfilter/af_biquads.c | 4 libavfilter/af_crystalizer.c | 4 libavfilter/af_dynaudnorm.c | 8 - libavfilter/af_join.c | 2 libavfilter/af_surround.c | 8 - libavfilter/anlms_template.c | 4 libavfilter/arls_template.c | 4 libavfilter/avf_avectorscope.c | 4 libavfilter/avf_showcwt.c | 31 ++--- libavfilter/avf_showspectrum.c | 10 - libavfilter/boxblur.c | 4 libavfilter/colorchannelmixer_template.c | 8 - libavfilter/f_zmq.c | 2 libavfilter/filters.h | 15 ++ libavfilter/vf_amplify.c | 4 libavfilter/vf_atadenoise.c | 4 libavfilter/vf_backgroundkey.c | 8 - libavfilter/vf_bilateral.c | 16 +- libavfilter/vf_blackdetect.c | 4 libavfilter/vf_blend.c | 4 libavfilter/vf_bm3d.c | 4 libavfilter/vf_bwdif.c | 2 libavfilter/vf_cas.c | 8 - libavfilter/vf_chromakey.c | 16 +- libavfilter/vf_chromanr.c | 4 libavfilter/vf_chromashift.c | 16 +- libavfilter/vf_colorbalance.c | 16 +- libavfilter/vf_colorconstancy.c | 12 +- libavfilter/vf_colorcontrast.c | 16 +- libavfilter/vf_colorcorrect.c | 24 ++-- libavfilter/vf_colorize.c | 16 +- libavfilter/vf_colorkey.c | 8 - libavfilter/vf_colorlevels.c | 4 libavfilter/vf_colormap.c | 4 libavfilter/vf_colormatrix.c | 16 +- libavfilter/vf_colortemperature.c | 20 +-- libavfilter/vf_convolution.c | 96 ++++++++--------- libavfilter/vf_convolve.c | 28 ++--- libavfilter/vf_corr.c | 8 - libavfilter/vf_curves.c | 8 - libavfilter/vf_datascope.c | 12 +- libavfilter/vf_dctdnoiz.c | 4 libavfilter/vf_deband.c | 16 +- libavfilter/vf_dedot.c | 8 - libavfilter/vf_despill.c | 4 libavfilter/vf_displace.c | 8 - libavfilter/vf_drawtext.c | 81 +++++++++------ libavfilter/vf_epx.c | 8 - libavfilter/vf_estdif.c | 4 libavfilter/vf_exposure.c | 4 libavfilter/vf_fade.c | 28 ++--- libavfilter/vf_fftdnoiz.c | 4 libavfilter/vf_fftfilt.c | 36 +++--- libavfilter/vf_gblur.c | 12 +- libavfilter/vf_geq.c | 4 libavfilter/vf_grayworld.c | 8 - libavfilter/vf_guided.c | 4 libavfilter/vf_hqx.c | 4 libavfilter/vf_hsvkey.c | 16 +- libavfilter/vf_huesaturation.c | 4 libavfilter/vf_identity.c | 8 - libavfilter/vf_lagfun.c | 4 libavfilter/vf_lensfun.c | 8 - libavfilter/vf_limitdiff.c | 4 libavfilter/vf_limiter.c | 4 libavfilter/vf_lumakey.c | 8 - libavfilter/vf_lut.c | 8 - libavfilter/vf_lut2.c | 4 libavfilter/vf_lut3d.c | 24 ++-- libavfilter/vf_maskedclamp.c | 4 libavfilter/vf_maskedmerge.c | 4 libavfilter/vf_maskedminmax.c | 4 libavfilter/vf_maskedthreshold.c | 4 libavfilter/vf_maskfun.c | 4 libavfilter/vf_median.c | 4 libavfilter/vf_mix.c | 8 - libavfilter/vf_monochrome.c | 16 +- libavfilter/vf_morpho.c | 8 - libavfilter/vf_multiply.c | 4 libavfilter/vf_negate.c | 4 libavfilter/vf_neighbor.c | 4 libavfilter/vf_nlmeans.c | 4 libavfilter/vf_nnedi.c | 4 libavfilter/vf_noise.c | 4 libavfilter/vf_overlay.c | 13 +- libavfilter/vf_photosensitivity.c | 8 - libavfilter/vf_pixelize.c | 8 - libavfilter/vf_premultiply.c | 4 libavfilter/vf_pseudocolor.c | 6 - libavfilter/vf_psnr.c | 4 libavfilter/vf_remap.c | 8 - libavfilter/vf_removegrain.c | 4 libavfilter/vf_scroll.c | 4 libavfilter/vf_selectivecolor.c | 4 libavfilter/vf_shear.c | 8 - libavfilter/vf_shufflepixels.c | 12 +- libavfilter/vf_signalstats.c | 32 ++--- libavfilter/vf_ssim.c | 8 - libavfilter/vf_stereo3d.c | 4 libavfilter/vf_super2xsai.c | 4 libavfilter/vf_threshold.c | 4 libavfilter/vf_thumbnail.c | 8 - libavfilter/vf_tonemap.c | 4 libavfilter/vf_transpose.c | 4 libavfilter/vf_unsharp.c | 4 libavfilter/vf_v360.c | 60 ++++++++--- libavfilter/vf_varblur.c | 4 libavfilter/vf_vibrance.c | 16 +- libavfilter/vf_vif.c | 4 libavfilter/vf_w3fdif.c | 4 libavfilter/vf_waveform.c | 96 ++++++++--------- libavfilter/vf_weave.c | 4 libavfilter/vf_xbr.c | 4 libavfilter/vf_xfade.c | 4 libavfilter/vf_xmedian.c | 4 libavfilter/vf_yadif.c | 4 libavfilter/vf_yaepblur.c | 12 +- libavfilter/x86/vf_lut3d_init.c | 5 libavformat/assenc.c | 2 libavformat/avc.c | 52 +++------ libavformat/dashdec.c | 12 +- libavformat/dashenc.c | 4 libavformat/demux.c | 2 libavformat/ftp.c | 23 +++- libavformat/gxfenc.c | 12 +- libavformat/hls.c | 16 ++ libavformat/hlsenc.c | 8 - libavformat/http.c | 4 libavformat/iamf_parse.c | 7 + libavformat/icecast.c | 8 + libavformat/iff.c | 2 libavformat/matroskadec.c | 15 ++ libavformat/mov.c | 36 ++++-- libavformat/mov_chan.c | 36 ++++-- libavformat/mpegts.c | 14 ++ libavformat/mxfdec.c | 2 libavformat/oggparsecelt.c | 9 + libavformat/oggparsevorbis.c | 5 libavformat/rtmppkt.c | 28 +++-- libavformat/rtpenc_aac.c | 4 libavformat/rtpenc_amr.c | 4 libavformat/rtpenc_xiph.c | 4 libavformat/rtspdec.c | 2 libavformat/sctp.c | 3 libavformat/soxdec.c | 2 libavformat/ty.c | 6 - libavformat/version.h | 2 libavformat/vividas.c | 2 libavformat/wavdec.c | 21 ++- libswresample/x86/resample.asm | 6 - libswscale/alphablend.c | 32 +++-- libswscale/loongarch/yuv2rgb_lasx.c | 108 +++++++++++++++++--- libswscale/ppc/swscale_ppc_template.c | 2 libswscale/ppc/swscale_vsx.c | 2 libswscale/rgb2rgb_template.c | 4 libswscale/x86/rgb_2_rgb.asm | 14 ++ tests/checkasm/sw_rgb.c | 2 tests/tiny_ssim.c | 4 tools/target_dem_fuzzer.c | 7 - tools/zmqsend.c | 3 230 files changed, 1770 insertions(+), 1046 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmph15gdlxb/ffmpeg_7.1.4-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmph15gdlxb/ffmpeg_7.1.5-0+deb13u1.dsc: no acceptable signature found diff -Nru ffmpeg-7.1.4/Changelog ffmpeg-7.1.5/Changelog --- ffmpeg-7.1.4/Changelog 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/Changelog 2026-06-20 02:25:39.000000000 +0000 @@ -1,6 +1,154 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 7.1.5: + tests/checkasm/sw_rgb: don't write random data past the end of the buffer + swscale/alphablend: don't overread alpha plane on subsampled odd size + avcodec/vp8: Maintain consistency of frame pointers + avcodec/jpeg2000dec: clear array length when freeing it + av1dec: Don't crash if decoding of some frames have failed + avcodec/tdsc: propagate max_pixels to the JPEG tile decoder + avcodec/imm5: propagate max_pixels to the H264/HEVC sub-decoders + avcodec/cri: propagate max_pixels to the JPEG tile decoder + swscale: Fix out-of-bounds write errors in yuv2rgb_lasx.c file. + update for 7.1.5 + avformat/mov: fix crash when stsz_sample_size is zero and sample_sizes is null + avformat/dashdec: Fail with any inner stream count being 0 + swscale/x86/rgb_2_rgb: fix uyvytoyuv422 overwrite on odd width + avcodec/snowenc: fix SIGFPE in get_dc() when a block lies outside the plane + avcodec/snowenc: fix out-of-bounds OBMC read in get_dc() for narrow planes + avcodec/snowenc: fix out-of-bounds memcpy in get_block_rd() for narrow planes + avformat/icecast: reject CR/LF in metadata header values + avfilter/avf_showspectrum: Fix allocation check + avformat/sctp: add size check in sctp_read() matching sctp_write() + avcodec/cbs_av1_syntax_template: reset seen_frame_header on sequence headers + avfilter/convolution: compute user matrix products in unsigned + avformat/mpegts: use av_fast_realloc() for prg + avfilter/avf_showcwt: fix DIRECTION_DU EOF fill clearing the wrong rows + avfilter/avf_showcwt: fix DIRECTION_RL EOF fill clearing the wrong columns + avfilter/avf_showcwt: avoid undefined float to int conversion of nb_consumed_samples + avfilter/avf_showcwt: fix out of array read in compute_kernel + avfilter/v360: compute remap table offsets in 64bit + avfilter/v360: reject out-of-range dimensions + swresample/x86/resample: write only int16 in the int16 resampler + avformat/rtpenc_amr: Check input size + swscale/ppc: fix ASAN stack-buffer-overflow in yuv2planeX + swscale/ppc: fix LOAD_FILTER overread in VSX path + avfilter: use ff_slice_pos() for per-slice boundary computation + avfilter: add ff_slice_pos() helper for slice boundaries + avfilter/estdif: avoid signed overflow in slice boundary calculation + avformat/rtspdec: bound Content-Length in the ANNOUNCE handler to SDP_MAX_SIZE + avcodec/cbs_h266_syntax_template: reject subpic info with res_change_in_clvs + avcodec/misc4: Check nb channels + avcodec/rv10, rv34: check init_get_bits8() before RealVideo bit access + avformat/http: reject request-line tokens not terminated by whitespace + avformat/mov: reject out of range ispe dimensions, avoid overflow summing HEIF tile dimensions + avcodec/agm: validate actual src_y against prev plane in decode_inter_plane + fftools/ffmpeg_dec: deep-copy subtitle_header to fix use-after-free + avcodec/hevc/ps: Check window parameters + avcodec/hevc/ps: Factor window reading out + avcodec/truespeech: reject iterations count whose * 240 product overflows 32-bit + libavcodec/options_table: gamma22 and gamma28 aliases + avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE product overflows 32-bit + avfilter/zmq: initialize send_buf before shared cleanup on parse failure + avcodec/adpcm: fix signed integer overflow in get_nb_samples() + avformat/matroskadec: avoid signed overflow in DASH cue time differences + avcodec/fastaudio: reject subframes count whose * 256 product overflows 32-bit + avcodec/vc2enc_dwt: avoid signed overflow in the 9/7 DWT lifting + avcodec/vc2enc_dwt: avoid signed overflow in the 5/3 and Haar DWT + avcodec/mwsc: do not dereference a missing reference frame + avcodec/misc4: reject invalid sample rate + tools/target_dem_fuzzer: do not exit on io_buffer allocation failure + avformat/gxfenc: Check timecode and propagate error + swscale/rgb2rgb_template: use unsigned for <<24 + avformat/iamf_parse: bound substream count by remaining OBU size + avformat/matroskadec: bound TRACKENTRY parsing by max_streams + avcodec/diracdec: fix heap buffer overflow in edge_emu_buffer + avformat/rtmppkt: Check recursion depth + avcodec/jpeglsdec: only apply color transform to decoded rows + avfilter/avf_showcwt: fix out-of-bounds read in du scroll + avcodec/aac/aacdec_usac: reject explicit usacSamplingFrequency of 0 + avcodec/aac/aacdec: reject decoded frame without a valid sample rate + avformat/iff: check av_get_packet() result in ANIM branch + avfilter/vf_drawtext: Avoid double free in glyph_enu_border_free() + avfilter/vf_drawtext: plug error-path leaks in measure_text/draw_text + avfilter/vf_drawtext: avoid double-free of aliased FT_Glyph in glyph_enu_free + avfilter/vf_drawtext: don't double-free glyph that has been cached in tree + avfilter/vf_drawtext: always check pixel_mode == FT_PIXEL_MODE_MONO + avcodec/cook: bound subpacket channel sum against channel count + avformat/mxfdec: Remove unneeded check + avformat/ftp: Check string used for RNTO + avformat/ftp: Check for Telnet IAC characters and other non printable ASCII chars + avformat/ftp: reject CR/LF in the URL path to prevent FTP command injection + avcodec/jpeg2000dec: Clear header derived variables + avformat/avc: Adjust get_ue_golomb() to handle 32 bit + avcodec/x86/vorbisdsp: change cmpleps to cmpltps in inverse coupling + avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free) + avcodec/h264_slice: guard color_frame() against chroma-width underflow + avcodec/magicyuv: reject slice_height misaligned with chroma vshift + avcodec/magicyuv: Expand the s->interlaced slice-height sanity check + avcodec/magicyuv: Fix 1 line MEDIAN slices + avformat/mxfdec: zero-init Sony MPEG-4 extradata and add padding + avformat/soxdec: Check sample_rate for nan + tests/tiny_ssim: fixed mistake in ssim_c1 calculation + avformat/hls: Check TIME-OFFSET value + avformat/hls: Check url_offset and size + avformat/ty: check rec_size + avformat/rtpenc_xiph: bail out when the max payload size underflows + avformat/rtpenc_aac: reject packets smaller than the ADTS header + avcodec/jpeg2000dec: compute mask in decode_clnpass() like in decode_sigpass() + avformat/vividas: fix misaligned access + avcodec/g2meet: The stack is EPIC_PIX_STACK_SIZE + avcodec/h2645_sei: Initialize side data before deallocation + avfilter/boxblur: Fix off by one errors + avformat/assenc: Add the missing parentheses + avcodec/diracdec: Enlarge `mctmp` to cover the worst-case `blheight·ybsep + yblen` rows, and break the MC loop when no output rows remain + tools/zmqsend: free the AVBprint buffer after using it + [Wave] Fix issues with unaligned metadata chunks. + avcodec/hevc: limit missing-ref fill to coded planes + avformat/mov: Fix negative index given to can_seek_to_key_sample() + avcodec/hdrdec: fix pixel count decrement in RLE decompress loop + (fforge/pr/21328) avcodec/cbs_h266_syntax_template: Fix pps_exp_slice_height_in_ctus_minus1 range + lavc/vvc: Stricter bound on pps_exp_slice_height_in_ctus_minus1 + avcodec/cbs_h266_syntax_template: tighten sh_num_tiles_in_slice_minus1 upper bound + lavc/vvc: Use second definition of MinQtLog2SizeIntraC if relevant + avcodec/cbs_h266: fix wrong condition for chroma MTT depth in PH + lavc/vvc: Fix unchecked error codes from add_reconstructed_area + lavc/vvc: Fix unchecked error codes from set_qp_y + lavc/vvc: Error on inter slice with no reference pics + lavc/vvc: Mark SPS used if multiple CLVSSs use it + lavc/vvc: Fix divide-by-zero in LMCS param derivation + lavc/vvc: Detect subpic overlaps at CTU level + lavc/vvc: Fix pps_single_slice_picture + lavc/vvc: Ensure subpictures don't overlap + lavc/vvc: Fix slice map construction for small subpics + lavc/vvc: Fix derivation of inverse LMCS idx + lavc/vvc: Set fc->ref to NULL at top of decode_nal_units + lavc/vvcdec: ensure slices contain nonzero CTUs + avcodec/vvc: Add support for output_corrupt/showall flags + lavc/vvc: Check slice structure + avcodec/vvc decode: ALF filtering without CC-ALF + avcodec/cbs_h266: Fix typo + avcodec/vvcdec: return error if CTU size > 128 + avcodec/cbs_h266: stricter validation for subpicture's max width and height + avcodec/cbs_h266: improve readability in subpicture parser + avcodec/vvcdec: schedule next stage only if the current stage reports no error + avcodec/vvcdec: inter_data, check the return value from hls_merge_data + avcodec/vvcdec: ensure every CTU belongs to a slice + lavc/vvc_refs: Define VVC_FRAME_FLAG* to h header + avcodec/vvc/thread: Check frame to be non NULL + avcodec/vvc: Don't use large array on stack + (fforge/pr/23305) avformat/mov: don't abort on unsupported or invalid chnl boxes + avformat/mov_chan: keep the layout untouched on chan/chnl box failure + (fforge/pr/23242) avformat/oggparsevorbis.c: Prevent integer overflow when summing header lengths; add bounds check. + (fforge/pr/23189) avformat/oggparsecelt: bound extra_headers to avoid an effectively infinite loop + (fforge/pr/23113) avformat/demux: use correct close function for custom io + avformat/hlsenc: use correct close function for custom io + avformat/hlsenc: respect io_open set in AVFormatContext + avformat/dashenc: respect io_open set in AVFormatContext + avformat/dashdec: respect io_open set in AVFormatContext + + version 7.1.4: avcodec/dfpwmdec: Check nb_samples avcodec/alsdec: do not set nbits invalidly diff -Nru ffmpeg-7.1.4/RELEASE ffmpeg-7.1.5/RELEASE --- ffmpeg-7.1.4/RELEASE 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/RELEASE 2026-06-20 02:25:39.000000000 +0000 @@ -1 +1 @@ -7.1.4 +7.1.5 diff -Nru ffmpeg-7.1.4/VERSION ffmpeg-7.1.5/VERSION --- ffmpeg-7.1.4/VERSION 2026-05-05 01:56:29.000000000 +0000 +++ ffmpeg-7.1.5/VERSION 2026-06-20 02:25:39.000000000 +0000 @@ -1 +1 @@ -7.1.4 +7.1.5 diff -Nru ffmpeg-7.1.4/debian/changelog ffmpeg-7.1.5/debian/changelog --- ffmpeg-7.1.4/debian/changelog 2026-05-13 12:21:38.000000000 +0000 +++ ffmpeg-7.1.5/debian/changelog 2026-06-22 16:08:37.000000000 +0000 @@ -1,3 +1,10 @@ +ffmpeg (7:7.1.5-0+deb13u1) trixie-security; urgency=high + + * New upstream version 7.1.5 + - Fixes CVE-2026-8461 + + -- Sebastian Ramacher Mon, 22 Jun 2026 18:08:37 +0200 + ffmpeg (7:7.1.4-0+deb13u1) trixie-security; urgency=medium * New upstream version 7.1.4 diff -Nru ffmpeg-7.1.4/doc/Doxyfile ffmpeg-7.1.5/doc/Doxyfile --- ffmpeg-7.1.4/doc/Doxyfile 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/doc/Doxyfile 2026-06-20 02:25:39.000000000 +0000 @@ -38,7 +38,7 @@ # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 7.1.4 +PROJECT_NUMBER = 7.1.5 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a diff -Nru ffmpeg-7.1.4/fftools/ffmpeg.h ffmpeg-7.1.5/fftools/ffmpeg.h --- ffmpeg-7.1.4/fftools/ffmpeg.h 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/fftools/ffmpeg.h 2026-06-20 02:25:39.000000000 +0000 @@ -422,7 +422,7 @@ enum AVMediaType type; - const uint8_t *subtitle_header; + uint8_t *subtitle_header; int subtitle_header_size; // number of frames/samples retrieved from the decoder diff -Nru ffmpeg-7.1.4/fftools/ffmpeg_dec.c ffmpeg-7.1.5/fftools/ffmpeg_dec.c --- ffmpeg-7.1.4/fftools/ffmpeg_dec.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/fftools/ffmpeg_dec.c 2026-06-20 02:25:39.000000000 +0000 @@ -136,6 +136,8 @@ av_frame_free(&dp->sub_prev[i]); av_frame_free(&dp->sub_heartbeat); + av_freep(&dp->dec.subtitle_header); + av_freep(&dp->parent_name); av_freep(&dp->views_requested); @@ -1618,8 +1620,15 @@ dp->dec_ctx->extra_hw_frames = extra_frames; } - dp->dec.subtitle_header = dp->dec_ctx->subtitle_header; - dp->dec.subtitle_header_size = dp->dec_ctx->subtitle_header_size; + if (dp->dec_ctx->subtitle_header) { + /* ASS code assumes this buffer is null terminated so add extra byte. */ + dp->dec.subtitle_header = av_mallocz(dp->dec_ctx->subtitle_header_size + 1); + if (!dp->dec.subtitle_header) + return AVERROR(ENOMEM); + memcpy(dp->dec.subtitle_header, dp->dec_ctx->subtitle_header, + dp->dec_ctx->subtitle_header_size); + dp->dec.subtitle_header_size = dp->dec_ctx->subtitle_header_size; + } if (param_out) { if (dp->dec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) { diff -Nru ffmpeg-7.1.4/libavcodec/aac/aacdec.c ffmpeg-7.1.5/libavcodec/aac/aacdec.c --- ffmpeg-7.1.4/libavcodec/aac/aacdec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/aac/aacdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -2381,6 +2381,12 @@ ac->oc[1].status = OC_LOCKED; } + if (samples && avctx->sample_rate <= 0) { + av_log(avctx, AV_LOG_ERROR, + "Cannot output a frame without a valid sample rate\n"); + return AVERROR_INVALIDDATA; + } + if (!ac->frame->data[0] && samples) { av_log(avctx, AV_LOG_ERROR, "no frame data found\n"); return AVERROR_INVALIDDATA; diff -Nru ffmpeg-7.1.4/libavcodec/aac/aacdec_usac.c ffmpeg-7.1.5/libavcodec/aac/aacdec_usac.c --- ffmpeg-7.1.4/libavcodec/aac/aacdec_usac.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/aac/aacdec_usac.c 2026-06-20 02:25:39.000000000 +0000 @@ -373,6 +373,8 @@ freq_idx = get_bits(gb, 5); /* usacSamplingFrequencyIndex */ if (freq_idx == 0x1f) { samplerate = get_bits(gb, 24); /* usacSamplingFrequency */ + if (samplerate == 0) + return AVERROR(EINVAL); } else { samplerate = ff_aac_usac_samplerate[freq_idx]; if (samplerate < 0) diff -Nru ffmpeg-7.1.4/libavcodec/adpcm.c ffmpeg-7.1.5/libavcodec/adpcm.c --- ffmpeg-7.1.4/libavcodec/adpcm.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/adpcm.c 2026-06-20 02:25:39.000000000 +0000 @@ -857,7 +857,7 @@ if(ch <= 0) return 0; - if (buf_size > INT_MAX / 2) + if (buf_size > INT_MAX / 14) return 0; switch (avctx->codec->id) { diff -Nru ffmpeg-7.1.4/libavcodec/agm.c ffmpeg-7.1.5/libavcodec/agm.c --- ffmpeg-7.1.4/libavcodec/agm.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/agm.c 2026-06-20 02:25:39.000000000 +0000 @@ -408,12 +408,14 @@ int map = s->map[x]; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->wblocks + x * 64); @@ -445,12 +447,14 @@ return ret; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->block); diff -Nru ffmpeg-7.1.4/libavcodec/av1dec.c ffmpeg-7.1.5/libavcodec/av1dec.c --- ffmpeg-7.1.4/libavcodec/av1dec.c 2026-05-05 01:56:29.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/av1dec.c 2026-06-20 02:25:39.000000000 +0000 @@ -282,6 +282,8 @@ forward_idx = -1; backward_idx = -1; for (i = 0; i < AV1_REFS_PER_FRAME; i++) { + if (!s->ref[header->ref_frame_idx[i]].raw_frame_header) + return; ref_hint = s->ref[header->ref_frame_idx[i]].raw_frame_header->order_hint; dist = get_relative_dist(seq, ref_hint, header->order_hint); if (dist < 0) { diff -Nru ffmpeg-7.1.4/libavcodec/cbs_av1_syntax_template.c ffmpeg-7.1.5/libavcodec/cbs_av1_syntax_template.c --- ffmpeg-7.1.4/libavcodec/cbs_av1_syntax_template.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/cbs_av1_syntax_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -186,10 +186,13 @@ static int FUNC(sequence_header_obu)(CodedBitstreamContext *ctx, RWContext *rw, AV1RawSequenceHeader *current) { + CodedBitstreamAV1Context *priv = ctx->priv_data; int i, err; HEADER("Sequence Header"); + priv->seen_frame_header = 0; + fc(3, seq_profile, AV_PROFILE_AV1_MAIN, AV_PROFILE_AV1_PROFESSIONAL); flag(still_picture); diff -Nru ffmpeg-7.1.4/libavcodec/cbs_h266_syntax_template.c ffmpeg-7.1.5/libavcodec/cbs_h266_syntax_template.c --- ffmpeg-7.1.4/libavcodec/cbs_h266_syntax_template.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/cbs_h266_syntax_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -1057,7 +1057,7 @@ H266RawSPS *current) { CodedBitstreamH266Context *h266 = ctx->priv_data; - int err, i, j; + int err, i, j, max_width_minus1, max_height_minus1; unsigned int ctb_log2_size_y, min_cb_log2_size_y, min_qt_log2_size_intra_y, min_qt_log2_size_inter_y, ctb_size_y, max_num_merge_cand, tmp_width_val, tmp_height_val; @@ -1130,8 +1130,10 @@ ctb_log2_size_y); tmp_height_val = AV_CEIL_RSHIFT(current->sps_pic_height_max_in_luma_samples, ctb_log2_size_y); + max_width_minus1 = tmp_width_val - 1; + max_height_minus1 = tmp_height_val - 1; - flag(sps_subpic_info_present_flag); + u(1, sps_subpic_info_present_flag, 0, !current->sps_res_change_in_clvs_allowed_flag); if (current->sps_subpic_info_present_flag) { ue(sps_num_subpics_minus1, 0, VVC_MAX_SLICES - 1); if (current->sps_num_subpics_minus1 > 0) { @@ -1145,13 +1147,13 @@ infer(sps_subpic_ctu_top_left_x[0], 0); infer(sps_subpic_ctu_top_left_y[0], 0); if (current->sps_pic_width_max_in_luma_samples > ctb_size_y) - ubs(wlen, sps_subpic_width_minus1[0], 1, 0); + us(wlen, sps_subpic_width_minus1[0], 0, max_width_minus1, 1, 0); else - infer(sps_subpic_width_minus1[0], tmp_width_val - 1); + infer(sps_subpic_width_minus1[0], max_width_minus1); if (current->sps_pic_height_max_in_luma_samples > ctb_size_y) - ubs(hlen, sps_subpic_height_minus1[0], 1, 0); + us(hlen, sps_subpic_height_minus1[0], 0, max_height_minus1, 1, 0); else - infer(sps_subpic_height_minus1[0], tmp_height_val - 1); + infer(sps_subpic_height_minus1[0], max_height_minus1); if (!current->sps_independent_subpics_flag) { flags(sps_subpic_treated_as_pic_flag[0], 1, 0); flags(sps_loop_filter_across_subpic_enabled_flag[0], 1, 0); @@ -1161,58 +1163,54 @@ } for (i = 1; i <= current->sps_num_subpics_minus1; i++) { if (!current->sps_subpic_same_size_flag) { - if (current->sps_pic_width_max_in_luma_samples > ctb_size_y) { - const int win_right_edge = - current->sps_pic_width_max_in_luma_samples - - current->sps_conf_win_right_offset * sub_width_c; - us(wlen, sps_subpic_ctu_top_left_x[i], 0, - AV_CEIL_RSHIFT(win_right_edge, ctb_log2_size_y) - 1, - 1, i); - } else + const int win_right_edge = + current->sps_pic_width_max_in_luma_samples - + current->sps_conf_win_right_offset * sub_width_c; + const int win_bottom_edge = + current->sps_pic_height_max_in_luma_samples - + current->sps_conf_win_bottom_offset * sub_height_c; + const int win_left_edge = + current->sps_conf_win_left_offset * sub_width_c; + const int win_top_edge = + current->sps_conf_win_top_offset * sub_height_c; + const int win_left_edge_ctus = + AV_CEIL_RSHIFT(win_left_edge, ctb_log2_size_y); + const int win_right_edge_ctus = + AV_CEIL_RSHIFT(win_right_edge, ctb_log2_size_y); + const int win_top_edge_ctus = + AV_CEIL_RSHIFT(win_top_edge, ctb_log2_size_y); + const int win_bottom_edge_ctus = + AV_CEIL_RSHIFT(win_bottom_edge, ctb_log2_size_y); + const int min_width = + FFMAX(win_left_edge_ctus - current->sps_subpic_ctu_top_left_x[i], 0); + const int min_height = + FFMAX(win_top_edge_ctus - current->sps_subpic_ctu_top_left_y[i], 0); + + if (current->sps_pic_width_max_in_luma_samples > ctb_size_y) + us(wlen, sps_subpic_ctu_top_left_x[i], 0, win_right_edge_ctus - 1, 1, i); + else infer(sps_subpic_ctu_top_left_x[i], 0); - if (current->sps_pic_height_max_in_luma_samples > - ctb_size_y) { - const int win_bottom_edge = - current->sps_pic_height_max_in_luma_samples - - current->sps_conf_win_bottom_offset * sub_height_c; - us(hlen, sps_subpic_ctu_top_left_y[i], 0, - AV_CEIL_RSHIFT(win_bottom_edge, ctb_log2_size_y) - 1, - 1, i); - } else + + if (current->sps_pic_height_max_in_luma_samples > ctb_size_y) + us(hlen, sps_subpic_ctu_top_left_y[i], 0, win_bottom_edge_ctus - 1, 1, i); + else infer(sps_subpic_ctu_top_left_y[i], 0); + + max_width_minus1 = tmp_width_val - current->sps_subpic_ctu_top_left_x[i] - 1; + max_height_minus1 = tmp_height_val - current->sps_subpic_ctu_top_left_y[i] - 1; + if (i < current->sps_num_subpics_minus1 && - current->sps_pic_width_max_in_luma_samples > - ctb_size_y) { - const int win_left_edge = - current->sps_conf_win_left_offset * sub_width_c; - const int win_left_edge_ctus = - AV_CEIL_RSHIFT(win_left_edge, ctb_log2_size_y); - us(wlen, sps_subpic_width_minus1[i], - win_left_edge_ctus > current->sps_subpic_ctu_top_left_x[i] - ? win_left_edge_ctus - current->sps_subpic_ctu_top_left_x[i] - : 0, - MAX_UINT_BITS(wlen), 1, i); + current->sps_pic_width_max_in_luma_samples > ctb_size_y) { + us(wlen, sps_subpic_width_minus1[i], min_width, max_width_minus1, 1, i); } else { - infer(sps_subpic_width_minus1[i], - tmp_width_val - - current->sps_subpic_ctu_top_left_x[i] - 1); + infer(sps_subpic_width_minus1[i], max_width_minus1); } + if (i < current->sps_num_subpics_minus1 && - current->sps_pic_height_max_in_luma_samples > - ctb_size_y) { - const int win_top_edge = - current->sps_conf_win_top_offset * sub_height_c; - const int win_top_edge_ctus = - AV_CEIL_RSHIFT(win_top_edge, ctb_log2_size_y); - us(hlen, sps_subpic_height_minus1[i], - win_top_edge_ctus > current->sps_subpic_ctu_top_left_y[i] - ? win_top_edge_ctus - current->sps_subpic_ctu_top_left_y[i] - : 0, - MAX_UINT_BITS(hlen), 1, i); + current->sps_pic_height_max_in_luma_samples > ctb_size_y) { + us(hlen, sps_subpic_height_minus1[i], min_height, max_height_minus1, 1, i); } else { - infer(sps_subpic_height_minus1[i], - tmp_height_val - - current->sps_subpic_ctu_top_left_y[i] - 1); + infer(sps_subpic_height_minus1[i], max_height_minus1); } } else { int num_subpic_cols = tmp_width_val / @@ -1245,8 +1243,8 @@ } else { infer(sps_subpic_ctu_top_left_x[0], 0); infer(sps_subpic_ctu_top_left_y[0], 0); - infer(sps_subpic_width_minus1[0], tmp_width_val - 1); - infer(sps_subpic_height_minus1[0], tmp_height_val - 1); + infer(sps_subpic_width_minus1[0], max_width_minus1); + infer(sps_subpic_height_minus1[0], max_height_minus1); } ue(sps_subpic_id_len_minus1, 0, 15); if ((1 << (current->sps_subpic_id_len_minus1 + 1)) < @@ -1273,8 +1271,8 @@ infer(sps_subpic_id_mapping_explicitly_signalled_flag, 0); infer(sps_subpic_ctu_top_left_x[0], 0); infer(sps_subpic_ctu_top_left_y[0], 0); - infer(sps_subpic_width_minus1[0], tmp_width_val - 1); - infer(sps_subpic_height_minus1[0], tmp_height_val - 1); + infer(sps_subpic_width_minus1[0], max_width_minus1); + infer(sps_subpic_height_minus1[0], max_height_minus1); } @@ -2024,7 +2022,7 @@ for (j = 0; j < current->pps_num_exp_slices_in_tile[i]; j++) { ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0, - current->row_height_val[tile_y] - 1, 2, + remaining_height_in_ctbs_y - (current->pps_num_exp_slices_in_tile[i] - j), 2, i, j); slice_height_in_ctus = current-> @@ -2810,9 +2808,9 @@ 0, FFMIN(6, ctb_log2_size_y) - min_cb_log2_size_y); ue(ph_max_mtt_hierarchy_depth_intra_slice_chroma, 0, 2 * (ctb_log2_size_y - min_cb_log2_size_y)); - if (sps->sps_max_mtt_hierarchy_depth_intra_slice_chroma != 0) { + if (current->ph_max_mtt_hierarchy_depth_intra_slice_chroma != 0) { unsigned int min_qt_log2_size_intra_c = - sps->sps_log2_diff_min_qt_min_cb_intra_slice_chroma + + current->ph_log2_diff_min_qt_min_cb_intra_slice_chroma + min_cb_log2_size_y; ue(ph_log2_diff_max_bt_min_qt_intra_slice_chroma, 0, FFMIN(6, ctb_log2_size_y) - min_qt_log2_size_intra_c); @@ -3136,7 +3134,7 @@ if (!pps->pps_rect_slice_flag && pps->num_tiles_in_pic - current->sh_slice_address > 1) - ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1); + ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1 - current->sh_slice_address); else infer(sh_num_tiles_in_slice_minus1, 0); @@ -3254,6 +3252,12 @@ FFMIN(ref_pic_lists->rpl_ref_list[i].num_ref_entries, pps->pps_num_ref_idx_default_active_minus1[i] + 1); } + + if (current->num_ref_idx_active[i] <= 0) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "Inter slice but no reference pictures available for RPL%d.\n", i); + return AVERROR_INVALIDDATA; + } } else { current->num_ref_idx_active[i] = 0; } diff -Nru ffmpeg-7.1.4/libavcodec/cook.c ffmpeg-7.1.5/libavcodec/cook.c --- ffmpeg-7.1.4/libavcodec/cook.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/cook.c 2026-06-20 02:25:39.000000000 +0000 @@ -1080,6 +1080,7 @@ int s = 0; unsigned int channel_mask = 0; int samples_per_frame = 0; + int total_channels = 0; int ret; int channels = avctx->ch_layout.nb_channels; @@ -1237,10 +1238,12 @@ q->subpacket[s].gains2.now = q->subpacket[s].gain_3; q->subpacket[s].gains2.previous = q->subpacket[s].gain_4; - if (q->num_subpackets + q->subpacket[s].num_channels > channels) { - av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, channels); + if (total_channels + q->subpacket[s].num_channels > channels) { + av_log(avctx, AV_LOG_ERROR, "Too many subpacket channels %d for channels %d\n", + total_channels + q->subpacket[s].num_channels, channels); return AVERROR_INVALIDDATA; } + total_channels += q->subpacket[s].num_channels; q->num_subpackets++; s++; diff -Nru ffmpeg-7.1.4/libavcodec/cri.c ffmpeg-7.1.5/libavcodec/cri.c --- ffmpeg-7.1.4/libavcodec/cri.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/cri.c 2026-06-20 02:25:39.000000000 +0000 @@ -71,6 +71,7 @@ s->jpeg_avctx->flags = avctx->flags; s->jpeg_avctx->flags2 = avctx->flags2; s->jpeg_avctx->idct_algo = avctx->idct_algo; + s->jpeg_avctx->max_pixels = avctx->max_pixels; ret = avcodec_open2(s->jpeg_avctx, codec, NULL); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.4/libavcodec/diracdec.c ffmpeg-7.1.5/libavcodec/diracdec.c --- ffmpeg-7.1.4/libavcodec/diracdec.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/diracdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -339,9 +339,9 @@ av_freep(&s->mctmp); av_freep(&s->mcscratch); - s->edge_emu_buffer_base = av_malloc_array(stride, MAX_BLOCKSIZE); + s->edge_emu_buffer_base = av_malloc_array(stride, 4 * MAX_BLOCKSIZE); - s->mctmp = av_malloc_array((stride+MAX_BLOCKSIZE), (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp)); + s->mctmp = av_malloc_array((stride+MAX_BLOCKSIZE), (h + 5*MAX_BLOCKSIZE) * sizeof(*s->mctmp)); s->mcscratch = av_malloc_array(stride, MAX_BLOCKSIZE); if (!s->edge_emu_buffer_base || !s->mctmp || !s->mcscratch) @@ -1895,7 +1895,7 @@ /* FIXME: small resolutions */ for (i = 0; i < 4; i++) - s->edge_emu_buffer[i] = s->edge_emu_buffer_base + i*FFALIGN(p->width, 16); + s->edge_emu_buffer[i] = s->edge_emu_buffer_base + i*s->buffer_stride*MAX_BLOCKSIZE; if (!s->zero_res && !s->low_delay) { @@ -1944,7 +1944,7 @@ h = p->height - start; else h = p->ybsep - (start - dsty); - if (h < 0) + if (h <= 0) break; memset(mctmp+2*p->yoffset*p->stride, 0, 2*rowheight); diff -Nru ffmpeg-7.1.4/libavcodec/fastaudio.c ffmpeg-7.1.5/libavcodec/fastaudio.c --- ffmpeg-7.1.4/libavcodec/fastaudio.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/fastaudio.c 2026-06-20 02:25:39.000000000 +0000 @@ -112,6 +112,8 @@ int ret; subframes = pkt->size / (40 * avctx->ch_layout.nb_channels); + if (subframes <= 0 || subframes > INT_MAX / 256) + return AVERROR_INVALIDDATA; frame->nb_samples = subframes * 256; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; diff -Nru ffmpeg-7.1.4/libavcodec/g2meet.c ffmpeg-7.1.5/libavcodec/g2meet.c --- ffmpeg-7.1.4/libavcodec/g2meet.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/g2meet.c 2026-06-20 02:25:39.000000000 +0000 @@ -481,12 +481,13 @@ static inline int is_pixel_on_stack(const ePICContext *dc, uint32_t pix) { int i; + int n = FFMIN(dc->stack_pos, EPIC_PIX_STACK_SIZE); - for (i = 0; i < dc->stack_pos; i++) + for (i = 0; i < n; i++) if (dc->stack[i] == pix) break; - return i != dc->stack_pos; + return i != n; } #define TOSIGNED(val) (((val) >> 1) ^ -((val) & 1)) diff -Nru ffmpeg-7.1.4/libavcodec/h2645_sei.c ffmpeg-7.1.5/libavcodec/h2645_sei.c --- ffmpeg-7.1.4/libavcodec/h2645_sei.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/h2645_sei.c 2026-06-20 02:25:39.000000000 +0000 @@ -606,15 +606,15 @@ return AVERROR(ENOMEM); } + dst_env->ambient_illuminance = av_make_q(env->ambient_illuminance, 10000); + dst_env->ambient_light_x = av_make_q(env->ambient_light_x, 50000); + dst_env->ambient_light_y = av_make_q(env->ambient_light_y, 50000); + ret = ff_frame_new_side_data_from_buf_ext(avctx, sd, nb_sd, AV_FRAME_DATA_AMBIENT_VIEWING_ENVIRONMENT, &buf); if (ret < 0) return ret; - - dst_env->ambient_illuminance = av_make_q(env->ambient_illuminance, 10000); - dst_env->ambient_light_x = av_make_q(env->ambient_light_x, 50000); - dst_env->ambient_light_y = av_make_q(env->ambient_light_y, 50000); } if (sei->mastering_display.present) { diff -Nru ffmpeg-7.1.4/libavcodec/h264_slice.c ffmpeg-7.1.5/libavcodec/h264_slice.c --- ffmpeg-7.1.4/libavcodec/h264_slice.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/h264_slice.c 2026-06-20 02:25:39.000000000 +0000 @@ -316,8 +316,10 @@ int bytes = is_chroma ? AV_CEIL_RSHIFT(frame->width, desc->log2_chroma_w) : frame->width; int height = is_chroma ? AV_CEIL_RSHIFT(frame->height, desc->log2_chroma_h) : frame->height; if (desc->comp[0].depth >= 9) { - ((uint16_t*)dst)[0] = c[p]; - av_memcpy_backptr(dst + 2, 2, bytes - 2); + if (bytes >= 1) + ((uint16_t*)dst)[0] = c[p]; + if (bytes >= 2) + av_memcpy_backptr(dst + 2, 2, 2 * (bytes - 1)); dst += frame->linesize[p]; for (int y = 1; y < height; y++) { memcpy(dst, frame->data[p], 2*bytes); diff -Nru ffmpeg-7.1.4/libavcodec/hdrdec.c ffmpeg-7.1.5/libavcodec/hdrdec.c --- ffmpeg-7.1.4/libavcodec/hdrdec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/hdrdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -72,7 +72,7 @@ for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) { memcpy(scanline, scanline - 4, 4); scanline += 4; - w -= 4; + w--; } rshift += 8; if (rshift > 16) diff -Nru ffmpeg-7.1.4/libavcodec/hevc/ps.c ffmpeg-7.1.5/libavcodec/hevc/ps.c --- ffmpeg-7.1.4/libavcodec/hevc/ps.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/hevc/ps.c 2026-06-20 02:25:39.000000000 +0000 @@ -62,6 +62,29 @@ 1, 2, 1, 1 }; +static int read_window(HEVCWindow *window, GetBitContext *gb, int chroma_format_idc, int w, int h) +{ + int64_t vert_mult = hevc_sub_height_c[chroma_format_idc]; + int64_t horiz_mult = hevc_sub_width_c [chroma_format_idc]; + int64_t left = get_ue_golomb_long(gb) * horiz_mult; + int64_t right = get_ue_golomb_long(gb) * horiz_mult; + int64_t top = get_ue_golomb_long(gb) * vert_mult; + int64_t bottom = get_ue_golomb_long(gb) * vert_mult; + + if (left < 0 || right < 0 || top < 0 || bottom < 0 || + w <= left + right || + h <= top + bottom) { + memset(window, 0, sizeof(*window)); + return AVERROR_INVALIDDATA; + } + + window->left_offset = left; + window->right_offset = right; + window->top_offset = top; + window->bottom_offset = bottom; + return 0; +} + static void remove_sps(HEVCParamSets *s, int id) { int i; @@ -656,12 +679,9 @@ } if (get_bits1(gb) /* conformance_window_vps_flag */) { - int vert_mult = hevc_sub_height_c[vps->rep_format.chroma_format_idc]; - int horiz_mult = hevc_sub_width_c[vps->rep_format.chroma_format_idc]; - vps->rep_format.conf_win_left_offset = get_ue_golomb(gb) * horiz_mult; - vps->rep_format.conf_win_right_offset = get_ue_golomb(gb) * horiz_mult; - vps->rep_format.conf_win_top_offset = get_ue_golomb(gb) * vert_mult; - vps->rep_format.conf_win_bottom_offset = get_ue_golomb(gb) * vert_mult; + int ret = read_window(&vps->rep_format.conf_win, gb, vps->rep_format.chroma_format_idc, vps->rep_format.pic_width_in_luma_samples, vps->rep_format.pic_height_in_luma_samples); + if (ret < 0) + return ret; } vps->max_one_active_ref_layer = get_bits1(gb); @@ -907,12 +927,7 @@ vui->default_display_window_flag = get_bits1(gb); if (vui->default_display_window_flag) { - int vert_mult = hevc_sub_height_c[sps->chroma_format_idc]; - int horiz_mult = hevc_sub_width_c[sps->chroma_format_idc]; - vui->def_disp_win.left_offset = get_ue_golomb_long(gb) * horiz_mult; - vui->def_disp_win.right_offset = get_ue_golomb_long(gb) * horiz_mult; - vui->def_disp_win.top_offset = get_ue_golomb_long(gb) * vert_mult; - vui->def_disp_win.bottom_offset = get_ue_golomb_long(gb) * vert_mult; + read_window(&vui->def_disp_win, gb, sps->chroma_format_idc, sps->width, sps->height); if (apply_defdispwin && avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) { @@ -1219,10 +1234,10 @@ sps->height, 0, avctx)) < 0) return ret; - sps->pic_conf_win.left_offset = rf->conf_win_left_offset; - sps->pic_conf_win.right_offset = rf->conf_win_right_offset; - sps->pic_conf_win.top_offset = rf->conf_win_top_offset; - sps->pic_conf_win.bottom_offset = rf->conf_win_bottom_offset; + sps->pic_conf_win.left_offset = rf->conf_win.left_offset; + sps->pic_conf_win.right_offset = rf->conf_win.right_offset; + sps->pic_conf_win.top_offset = rf->conf_win.top_offset; + sps->pic_conf_win.bottom_offset = rf->conf_win.bottom_offset; } else { sps->chroma_format_idc = get_ue_golomb_long(gb); @@ -1245,12 +1260,9 @@ sps->conformance_window = get_bits1(gb); if (sps->conformance_window) { - int vert_mult = hevc_sub_height_c[sps->chroma_format_idc]; - int horiz_mult = hevc_sub_width_c[sps->chroma_format_idc]; - sps->pic_conf_win.left_offset = get_ue_golomb_long(gb) * horiz_mult; - sps->pic_conf_win.right_offset = get_ue_golomb_long(gb) * horiz_mult; - sps->pic_conf_win.top_offset = get_ue_golomb_long(gb) * vert_mult; - sps->pic_conf_win.bottom_offset = get_ue_golomb_long(gb) * vert_mult; + ret = read_window(&sps->pic_conf_win, gb, sps->chroma_format_idc, sps->width, sps->height); + if (ret < 0) + return ret; if (avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) { av_log(avctx, AV_LOG_DEBUG, diff -Nru ffmpeg-7.1.4/libavcodec/hevc/ps.h ffmpeg-7.1.5/libavcodec/hevc/ps.h --- ffmpeg-7.1.4/libavcodec/hevc/ps.h 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/hevc/ps.h 2026-06-20 02:25:39.000000000 +0000 @@ -162,10 +162,7 @@ uint8_t separate_colour_plane_flag; uint8_t bit_depth_luma; ///< bit_depth_vps_luma_minus8 + 8 uint8_t bit_depth_chroma; ///< bit_depth_vps_chroma_minus8 + 8 - uint16_t conf_win_left_offset; - uint16_t conf_win_right_offset; - uint16_t conf_win_top_offset; - uint16_t conf_win_bottom_offset; + HEVCWindow conf_win; } RepFormat; typedef struct HEVCVPS { diff -Nru ffmpeg-7.1.4/libavcodec/hevc/refs.c ffmpeg-7.1.5/libavcodec/hevc/refs.c --- ffmpeg-7.1.4/libavcodec/hevc/refs.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/hevc/refs.c 2026-06-20 02:25:39.000000000 +0000 @@ -432,12 +432,13 @@ return NULL; if (!s->avctx->hwaccel) { + int nb_planes = l->sps->chroma_format_idc ? 3 : 1; if (!l->sps->pixel_shift) { - for (i = 0; frame->f->data[i]; i++) + for (i = 0; i < nb_planes; i++) memset(frame->f->data[i], 1 << (l->sps->bit_depth - 1), frame->f->linesize[i] * AV_CEIL_RSHIFT(l->sps->height, l->sps->vshift[i])); } else { - for (i = 0; frame->f->data[i]; i++) + for (i = 0; i < nb_planes; i++) for (y = 0; y < (l->sps->height >> l->sps->vshift[i]); y++) { uint8_t *dst = frame->f->data[i] + y * frame->f->linesize[i]; AV_WN16(dst, 1 << (l->sps->bit_depth - 1)); diff -Nru ffmpeg-7.1.4/libavcodec/imm5.c ffmpeg-7.1.5/libavcodec/imm5.c --- ffmpeg-7.1.4/libavcodec/imm5.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/imm5.c 2026-06-20 02:25:39.000000000 +0000 @@ -63,6 +63,7 @@ ctx->h264_avctx->thread_count = 1; ctx->h264_avctx->flags = avctx->flags; ctx->h264_avctx->flags2 = avctx->flags2; + ctx->h264_avctx->max_pixels = avctx->max_pixels; ret = avcodec_open2(ctx->h264_avctx, codec, NULL); if (ret < 0) return ret; @@ -76,6 +77,7 @@ ctx->hevc_avctx->thread_count = 1; ctx->hevc_avctx->flags = avctx->flags; ctx->hevc_avctx->flags2 = avctx->flags2; + ctx->hevc_avctx->max_pixels = avctx->max_pixels; ret = avcodec_open2(ctx->hevc_avctx, codec, NULL); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.4/libavcodec/jpeg2000dec.c ffmpeg-7.1.5/libavcodec/jpeg2000dec.c --- ffmpeg-7.1.4/libavcodec/jpeg2000dec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/jpeg2000dec.c 2026-06-20 02:25:39.000000000 +0000 @@ -1539,6 +1539,7 @@ } } av_freep(&cblk->lengthinc); + cblk->nb_lengthinc = 0; } } // Save state of stream @@ -1949,7 +1950,7 @@ int width, int height, int bpno, int bandno, int seg_symbols, int vert_causal_ctx_csty_symbol) { - int mask = 3 << (bpno - 1), y0, x, y, runlen, dec; + int mask = (3u << bpno)>>1, y0, x, y, runlen, dec; for (y0 = 0; y0 < height; y0 += 4) { for (x = 0; x < width; x++) { @@ -2417,8 +2418,14 @@ memset(s->qntsty, 0, sizeof(s->qntsty)); memset(s->properties, 0, sizeof(s->properties)); memset(&s->poc , 0, sizeof(s->poc)); + memset(s->roi_shift, 0, sizeof(s->roi_shift)); s->numXtiles = s->numYtiles = 0; s->ncomponents = 0; + s->has_ppm = 0; + s->isHT = 0; + s->precision = 0; + s->colour_space = 0; + s->pal8 = 0; } static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s) diff -Nru ffmpeg-7.1.4/libavcodec/jpeglsdec.c ffmpeg-7.1.5/libavcodec/jpeglsdec.c --- ffmpeg-7.1.4/libavcodec/jpeglsdec.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/jpeglsdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -495,7 +495,7 @@ if (s->bits <= 8) { uint8_t *src = s->picture_ptr->data[0]; - for (i = 0; i < s->height; i++) { + for (i = 0; i < decoded_height; i++) { switch(s->xfrm) { case 1: for (x = off; x + 2 < w; x += 3) { diff -Nru ffmpeg-7.1.4/libavcodec/magicyuv.c ffmpeg-7.1.5/libavcodec/magicyuv.c --- ffmpeg-7.1.4/libavcodec/magicyuv.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/magicyuv.c 2026-06-20 02:25:39.000000000 +0000 @@ -225,7 +225,8 @@ s->llviddsp.add_left_pred_int16(dst, dst, max, width, 0); dst += stride; } - lefttop = left = dst[0]; + if (1 + interlaced < height) + lefttop = left = dst[0]; for (k = 1 + interlaced; k < height; k++) { magicyuv_median_pred16(dst, dst - fake_stride, dst, width, &left, &lefttop, max); lefttop = left = dst[0]; @@ -584,6 +585,13 @@ "invalid slice height: %d\n", s->slice_height); return AVERROR_INVALIDDATA; } + if (s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1))) { + av_log(avctx, AV_LOG_ERROR, + "slice_height %d is not aligned to chroma vertical " + "subsampling (must be a multiple of %d)\n", + s->slice_height, 1 << s->vshift[1]); + return AVERROR_INVALIDDATA; + } bytestream2_skipu(&gb, 4); @@ -594,11 +602,11 @@ return AVERROR_INVALIDDATA; } + if ((s->slice_height >> s->vshift[1]) <= s->interlaced) { + av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); + return AVERROR_INVALIDDATA; + } if (s->interlaced) { - if ((s->slice_height >> s->vshift[1]) < 2) { - av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); - return AVERROR_INVALIDDATA; - } if ((avctx->coded_height % s->slice_height) && ((avctx->coded_height % s->slice_height) >> s->vshift[1]) < 2) { av_log(avctx, AV_LOG_ERROR, "impossible height\n"); return AVERROR_INVALIDDATA; diff -Nru ffmpeg-7.1.4/libavcodec/misc4.c ffmpeg-7.1.5/libavcodec/misc4.c --- ffmpeg-7.1.4/libavcodec/misc4.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/misc4.c 2026-06-20 02:25:39.000000000 +0000 @@ -57,6 +57,12 @@ { MISC4Context *s = avctx->priv_data; + if (avctx->sample_rate <= 0) + return AVERROR_INVALIDDATA; + + if (avctx->ch_layout.nb_channels != 1 && avctx->ch_layout.nb_channels != 2) + return AVERROR_INVALIDDATA; + avctx->sample_fmt = AV_SAMPLE_FMT_S16; switch (avctx->sample_rate) { case 8000: diff -Nru ffmpeg-7.1.4/libavcodec/mwsc.c ffmpeg-7.1.5/libavcodec/mwsc.c --- ffmpeg-7.1.4/libavcodec/mwsc.c 2026-03-16 18:13:04.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/mwsc.c 2026-06-20 02:25:39.000000000 +0000 @@ -65,6 +65,9 @@ } else if (run == 255) { int pos = bytestream2_tell_p(pb); + if (!gbp) + return AVERROR_INVALIDDATA; + bytestream2_seek(gbp, pos, SEEK_SET); if (pos + width - w < fill) @@ -128,11 +131,16 @@ return ret; bytestream2_init(&gb, s->decomp_buf, zstream->total_out); - bytestream2_init(&gbp, s->prev_frame->data[0], avctx->height * s->prev_frame->linesize[0]); + if (s->prev_frame->data[0]) + bytestream2_init(&gbp, s->prev_frame->data[0], avctx->height * s->prev_frame->linesize[0]); bytestream2_init_writer(&pb, frame->data[0], avctx->height * frame->linesize[0]); - if (rle_uncompress(&gb, &pb, &gbp, avctx->width, avctx->height, avctx->width * 3, - frame->linesize[0], s->prev_frame->linesize[0])) + ret = rle_uncompress(&gb, &pb, s->prev_frame->data[0] ? &gbp : NULL, + avctx->width, avctx->height, avctx->width * 3, + frame->linesize[0], s->prev_frame->linesize[0]); + if (ret < 0) + return ret; + if (ret) frame->flags |= AV_FRAME_FLAG_KEY; else frame->flags &= ~AV_FRAME_FLAG_KEY; diff -Nru ffmpeg-7.1.4/libavcodec/on2avc.c ffmpeg-7.1.5/libavcodec/on2avc.c --- ffmpeg-7.1.4/libavcodec/on2avc.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/on2avc.c 2026-06-20 02:25:39.000000000 +0000 @@ -866,6 +866,12 @@ av_log(avctx, AV_LOG_ERROR, "No subframes present\n"); return AVERROR_INVALIDDATA; } + if (num_frames > INT_MAX / ON2AVC_SUBFRAME_SIZE) { + av_log(avctx, AV_LOG_ERROR, + "Too many subframes (%d); per-frame sample count overflows\n", + num_frames); + return AVERROR_INVALIDDATA; + } /* get output buffer */ frame->nb_samples = ON2AVC_SUBFRAME_SIZE * num_frames; diff -Nru ffmpeg-7.1.4/libavcodec/options_table.h ffmpeg-7.1.5/libavcodec/options_table.h --- ffmpeg-7.1.4/libavcodec/options_table.h 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/options_table.h 2026-06-20 02:25:39.000000000 +0000 @@ -295,7 +295,9 @@ {"bt709", "BT.709", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_BT709 }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"unknown", "Unspecified", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_UNSPECIFIED }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"gamma22", "BT.470 M", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA22 }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, +{"bt470m", "BT.470 M", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA22 }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"gamma28", "BT.470 BG", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA28 }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, +{"bt470bg", "BT.470 BG", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA28 }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"smpte170m", "SMPTE 170 M", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTE170M }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"smpte240m", "SMPTE 240 M", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTE240M }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, {"linear", "Linear", 0, AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_LINEAR }, INT_MIN, INT_MAX, V|E|D, .unit = "color_trc_type"}, diff -Nru ffmpeg-7.1.4/libavcodec/rv10.c ffmpeg-7.1.5/libavcodec/rv10.c --- ffmpeg-7.1.4/libavcodec/rv10.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/rv10.c 2026-06-20 02:25:39.000000000 +0000 @@ -412,8 +412,9 @@ MpegEncContext *s = &rv->m; int mb_count, mb_pos, left, start_mb_x, active_bits_size, ret; + if ((ret = init_get_bits8(&s->gb, buf, FFMAX(buf_size, buf_size2))) < 0) + return ret; active_bits_size = buf_size * 8; - init_get_bits(&s->gb, buf, FFMAX(buf_size, buf_size2) * 8); if (s->codec_id == AV_CODEC_ID_RV10) mb_count = rv10_decode_picture_header(s); else diff -Nru ffmpeg-7.1.4/libavcodec/rv34.c ffmpeg-7.1.5/libavcodec/rv34.c --- ffmpeg-7.1.4/libavcodec/rv34.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/rv34.c 2026-06-20 02:25:39.000000000 +0000 @@ -1428,7 +1428,9 @@ int mb_pos, slice_type; int res; - init_get_bits(&r->s.gb, buf, buf_size*8); + res = init_get_bits8(&r->s.gb, buf, buf_size); + if (res < 0) + return res; res = r->parse_slice_header(r, gb, &r->si); if(res < 0){ av_log(s->avctx, AV_LOG_ERROR, "Incorrect or unknown slice header\n"); @@ -1652,8 +1654,9 @@ av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); return AVERROR_INVALIDDATA; } - init_get_bits(&s->gb, buf+offset, (buf_size-offset)*8); - if(r->parse_slice_header(r, &r->s.gb, &si) < 0 || si.start){ + if ((ret = init_get_bits8(&s->gb, buf+offset, buf_size-offset)) < 0) + return ret; + if (r->parse_slice_header(r, &r->s.gb, &si) < 0 || si.start) { av_log(avctx, AV_LOG_ERROR, "First slice header is incorrect\n"); return AVERROR_INVALIDDATA; } @@ -1782,8 +1785,10 @@ av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); break; } - init_get_bits(&s->gb, buf+offset1, (buf_size-offset1)*8); - if(r->parse_slice_header(r, &r->s.gb, &si) < 0){ + ret = init_get_bits8(&s->gb, buf+offset1, buf_size-offset1); + if (ret < 0) + return ret; + if (r->parse_slice_header(r, &r->s.gb, &si) < 0) { size = offset2 - offset; }else r->si.end = si.start; diff -Nru ffmpeg-7.1.4/libavcodec/snowenc.c ffmpeg-7.1.5/libavcodec/snowenc.c --- ffmpeg-7.1.4/libavcodec/snowenc.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/snowenc.c 2026-06-20 02:25:39.000000000 +0000 @@ -699,13 +699,15 @@ for(y2= FFMAX(y, 0); y2h) obmc_v += obmc[index - block_h*obmc_stride]; - if(x+block_w>w) obmc_v += obmc[index - block_w]; + if(y<0) obmc_v += obmc[index + block_h*obmc_stride]; + if(x<0) obmc_v += obmc[index + block_w]; + if(y+block_h>h && row-block_h >= 0) obmc_v += obmc[index - block_h*obmc_stride]; + if(x+block_w>w && col-block_w >= 0) obmc_v += obmc[index - block_w]; //FIXME precalculate this or simplify it somehow else d = -dst[index] + (1<<(FRAC_BITS-1)); @@ -717,6 +719,9 @@ } *b= backup; + if (!aa) + return 0; + return av_clip_uint8( ROUNDED_DIV((int64_t)ab<jpeg_avctx->flags = avctx->flags; ctx->jpeg_avctx->flags2 = avctx->flags2; ctx->jpeg_avctx->idct_algo = avctx->idct_algo; + ctx->jpeg_avctx->max_pixels = avctx->max_pixels; ret = avcodec_open2(ctx->jpeg_avctx, codec, NULL); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.4/libavcodec/truespeech.c ffmpeg-7.1.5/libavcodec/truespeech.c --- ffmpeg-7.1.4/libavcodec/truespeech.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/truespeech.c 2026-06-20 02:25:39.000000000 +0000 @@ -323,6 +323,11 @@ "Too small input buffer (%d bytes), need at least 32 bytes\n", buf_size); return -1; } + if (iterations > INT_MAX / 240) { + av_log(avctx, AV_LOG_ERROR, + "Too large input buffer (%d bytes); per-block sample count overflows\n", buf_size); + return AVERROR_INVALIDDATA; + } /* get output buffer */ frame->nb_samples = iterations * 240; diff -Nru ffmpeg-7.1.4/libavcodec/vc2enc_dwt.c ffmpeg-7.1.5/libavcodec/vc2enc_dwt.c --- ffmpeg-7.1.4/libavcodec/vc2enc_dwt.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vc2enc_dwt.c 2026-06-20 02:25:39.000000000 +0000 @@ -56,7 +56,7 @@ ptrdiff_t stride, int width, int height) { int x, y; - dwtcoef *datal = data, *synth = t->buffer, *synthl = synth; + uint32_t *datal = (uint32_t *)data, *synth = (uint32_t *)t->buffer, *synthl = synth; const ptrdiff_t synth_width = width << 1; const ptrdiff_t synth_height = height << 1; @@ -75,21 +75,21 @@ synthl = synth; for (y = 0; y < synth_height; y++) { /* Lifting stage 2. */ - synthl[1] -= (8*synthl[0] + 9*synthl[2] - synthl[4] + 8) >> 4; + synthl[1] -= (dwtcoef)(8*synthl[0] + 9*synthl[2] - synthl[4] + 8) >> 4; for (x = 1; x < width - 2; x++) - synthl[2*x + 1] -= (9*synthl[2*x] + 9*synthl[2*x + 2] - synthl[2*x + 4] - + synthl[2*x + 1] -= (dwtcoef)(9*synthl[2*x] + 9*synthl[2*x + 2] - synthl[2*x + 4] - synthl[2 * x - 2] + 8) >> 4; - synthl[synth_width - 1] -= (17*synthl[synth_width - 2] - + synthl[synth_width - 1] -= (dwtcoef)(17*synthl[synth_width - 2] - synthl[synth_width - 4] + 8) >> 4; - synthl[synth_width - 3] -= (8*synthl[synth_width - 2] + + synthl[synth_width - 3] -= (dwtcoef)(8*synthl[synth_width - 2] + 9*synthl[synth_width - 4] - synthl[synth_width - 6] + 8) >> 4; /* Lifting stage 1. */ - synthl[0] += (synthl[1] + synthl[1] + 2) >> 2; + synthl[0] += (dwtcoef)(synthl[1] + synthl[1] + 2) >> 2; for (x = 1; x < width - 1; x++) - synthl[2*x] += (synthl[2*x - 1] + synthl[2*x + 1] + 2) >> 2; + synthl[2*x] += (dwtcoef)(synthl[2*x - 1] + synthl[2*x + 1] + 2) >> 2; - synthl[synth_width - 2] += (synthl[synth_width - 3] + + synthl[synth_width - 2] += (dwtcoef)(synthl[synth_width - 3] + synthl[synth_width - 1] + 2) >> 2; synthl += synth_width; } @@ -97,13 +97,13 @@ /* Vertical synthesis: Lifting stage 2. */ synthl = synth + synth_width; for (x = 0; x < synth_width; x++) - synthl[x] -= (8*synthl[x - synth_width] + 9*synthl[x + synth_width] - + synthl[x] -= (dwtcoef)(8*synthl[x - synth_width] + 9*synthl[x + synth_width] - synthl[x + 3 * synth_width] + 8) >> 4; synthl = synth + (synth_width << 1); for (y = 1; y < height - 2; y++) { for (x = 0; x < synth_width; x++) - synthl[x + synth_width] -= (9*synthl[x] + + synthl[x + synth_width] -= (dwtcoef)(9*synthl[x] + 9*synthl[x + 2 * synth_width] - synthl[x - 2 * synth_width] - synthl[x + 4 * synth_width] + 8) >> 4; @@ -112,36 +112,36 @@ synthl = synth + (synth_height - 1) * synth_width; for (x = 0; x < synth_width; x++) { - synthl[x] -= (17*synthl[x - synth_width] - + synthl[x] -= (dwtcoef)(17*synthl[x - synth_width] - synthl[x - 3*synth_width] + 8) >> 4; - synthl[x - 2*synth_width] -= (9*synthl[x - 3*synth_width] + + synthl[x - 2*synth_width] -= (dwtcoef)(9*synthl[x - 3*synth_width] + 8*synthl[x - 1*synth_width] - synthl[x - 5*synth_width] + 8) >> 4; } /* Vertical synthesis: Lifting stage 1. */ synthl = synth; for (x = 0; x < synth_width; x++) - synthl[x] += (synthl[x + synth_width] + synthl[x + synth_width] + 2) >> 2; + synthl[x] += (dwtcoef)(synthl[x + synth_width] + synthl[x + synth_width] + 2) >> 2; synthl = synth + (synth_width << 1); for (y = 1; y < height - 1; y++) { for (x = 0; x < synth_width; x++) - synthl[x] += (synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; + synthl[x] += (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; synthl += synth_width << 1; } synthl = synth + (synth_height - 2) * synth_width; for (x = 0; x < synth_width; x++) - synthl[x] += (synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; + synthl[x] += (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; - deinterleave(data, stride, width, height, synth); + deinterleave(data, stride, width, height, (dwtcoef *)synth); } static void vc2_subband_dwt_53(VC2TransformContext *t, dwtcoef *data, ptrdiff_t stride, int width, int height) { int x, y; - dwtcoef *synth = t->buffer, *synthl = synth, *datal = data; + uint32_t *synth = (uint32_t *)t->buffer, *synthl = synth, *datal = (uint32_t *)data; const ptrdiff_t synth_width = width << 1; const ptrdiff_t synth_height = height << 1; @@ -161,16 +161,16 @@ for (y = 0; y < synth_height; y++) { /* Lifting stage 2. */ for (x = 0; x < width - 1; x++) - synthl[2 * x + 1] -= (synthl[2 * x] + synthl[2 * x + 2] + 1) >> 1; + synthl[2 * x + 1] -= (dwtcoef)(synthl[2 * x] + synthl[2 * x + 2] + 1) >> 1; - synthl[synth_width - 1] -= (2*synthl[synth_width - 2] + 1) >> 1; + synthl[synth_width - 1] -= (dwtcoef)(2*synthl[synth_width - 2] + 1) >> 1; /* Lifting stage 1. */ - synthl[0] += (2*synthl[1] + 2) >> 2; + synthl[0] += (dwtcoef)(2*synthl[1] + 2) >> 2; for (x = 1; x < width - 1; x++) - synthl[2 * x] += (synthl[2 * x - 1] + synthl[2 * x + 1] + 2) >> 2; + synthl[2 * x] += (dwtcoef)(synthl[2 * x - 1] + synthl[2 * x + 1] + 2) >> 2; - synthl[synth_width - 2] += (synthl[synth_width - 3] + synthl[synth_width - 1] + 2) >> 2; + synthl[synth_width - 2] += (dwtcoef)(synthl[synth_width - 3] + synthl[synth_width - 1] + 2) >> 2; synthl += synth_width; } @@ -178,37 +178,37 @@ /* Vertical synthesis: Lifting stage 2. */ synthl = synth + synth_width; for (x = 0; x < synth_width; x++) - synthl[x] -= (synthl[x - synth_width] + synthl[x + synth_width] + 1) >> 1; + synthl[x] -= (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 1) >> 1; synthl = synth + (synth_width << 1); for (y = 1; y < height - 1; y++) { for (x = 0; x < synth_width; x++) - synthl[x + synth_width] -= (synthl[x] + synthl[x + synth_width * 2] + 1) >> 1; + synthl[x + synth_width] -= (dwtcoef)(synthl[x] + synthl[x + synth_width * 2] + 1) >> 1; synthl += (synth_width << 1); } synthl = synth + (synth_height - 1) * synth_width; for (x = 0; x < synth_width; x++) - synthl[x] -= (2*synthl[x - synth_width] + 1) >> 1; + synthl[x] -= (dwtcoef)(2*synthl[x - synth_width] + 1) >> 1; /* Vertical synthesis: Lifting stage 1. */ synthl = synth; for (x = 0; x < synth_width; x++) - synthl[x] += (2*synthl[synth_width + x] + 2) >> 2; + synthl[x] += (dwtcoef)(2*synthl[synth_width + x] + 2) >> 2; synthl = synth + (synth_width << 1); for (y = 1; y < height - 1; y++) { for (x = 0; x < synth_width; x++) - synthl[x] += (synthl[x + synth_width] + synthl[x - synth_width] + 2) >> 2; + synthl[x] += (dwtcoef)(synthl[x + synth_width] + synthl[x - synth_width] + 2) >> 2; synthl += (synth_width << 1); } synthl = synth + (synth_height - 2)*synth_width; for (x = 0; x < synth_width; x++) - synthl[x] += (synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; + synthl[x] += (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2; - deinterleave(data, stride, width, height, synth); + deinterleave(data, stride, width, height, (dwtcoef *)synth); } static av_always_inline void dwt_haar(VC2TransformContext *t, dwtcoef *data, @@ -216,7 +216,7 @@ const int s) { int x, y; - dwtcoef *synth = t->buffer, *synthl = synth, *datal = data; + uint32_t *synth = (uint32_t *)t->buffer, *synthl = synth, *datal = (uint32_t *)data; const ptrdiff_t synth_width = width << 1; const ptrdiff_t synth_height = height << 1; @@ -225,7 +225,7 @@ for (x = 0; x < synth_width; x += 2) { synthl[y*synth_width + x + 1] = (datal[y*stride + x + 1] - datal[y*stride + x]) * (1 << s); synthl[y*synth_width + x] = datal[y*stride + x + 0] * (1 << s) + - ((synthl[y*synth_width + x + 1] + 1) >> 1); + ((dwtcoef)(synthl[y*synth_width + x + 1] + 1) >> 1); } } @@ -235,11 +235,11 @@ synthl[(y + 1)*synth_width + x] = synthl[(y + 1)*synth_width + x] - synthl[y*synth_width + x]; synthl[y*synth_width + x] = synthl[y*synth_width + x] + - ((synthl[(y + 1)*synth_width + x] + 1) >> 1); + ((dwtcoef)(synthl[(y + 1)*synth_width + x] + 1) >> 1); } } - deinterleave(data, stride, width, height, synth); + deinterleave(data, stride, width, height, (dwtcoef *)synth); } static void vc2_subband_dwt_haar(VC2TransformContext *t, dwtcoef *data, diff -Nru ffmpeg-7.1.4/libavcodec/vp8.c ffmpeg-7.1.5/libavcodec/vp8.c --- ffmpeg-7.1.4/libavcodec/vp8.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vp8.c 2026-06-20 02:25:39.000000000 +0000 @@ -541,9 +541,12 @@ /* preserve the golden frame, write a new previous frame */ if (s->framep[VP8_FRAME_GOLDEN] == s->framep[VP8_FRAME_PREVIOUS]) { - s->framep[VP8_FRAME_PREVIOUS] = vp8_find_free_buffer(s); - if ((ret = vp8_alloc_frame(s, s->framep[VP8_FRAME_PREVIOUS], 1)) < 0) + VP8Frame *prev_frame = vp8_find_free_buffer(s); + + ret = vp8_alloc_frame(s, prev_frame, 1); + if (ret < 0) return ret; + s->framep[VP8_FRAME_PREVIOUS] = prev_frame; dst = s->framep[VP8_FRAME_PREVIOUS]->tf.f; @@ -2699,8 +2702,6 @@ &s->frames[i] != s->framep[VP8_FRAME_ALTREF]) vp8_release_frame(&s->frames[i]); - curframe = s->framep[VP8_FRAME_CURRENT] = vp8_find_free_buffer(s); - if (!s->colorspace) avctx->colorspace = AVCOL_SPC_BT470BG; if (s->fullrange) @@ -2721,8 +2722,10 @@ goto err; } + curframe = vp8_find_free_buffer(s); if ((ret = vp8_alloc_frame(s, curframe, referenced)) < 0) goto err; + s->framep[VP8_FRAME_CURRENT] = curframe; if (s->keyframe) curframe->tf.f->flags |= AV_FRAME_FLAG_KEY; else diff -Nru ffmpeg-7.1.4/libavcodec/vvc/ctu.c ffmpeg-7.1.5/libavcodec/vvc/ctu.c --- ffmpeg-7.1.4/libavcodec/vvc/ctu.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/ctu.c 2026-06-20 02:25:39.000000000 +0000 @@ -1136,8 +1136,11 @@ const CodingUnit *cu = lc->cu; int ret; - if (cu->tree_type != DUAL_TREE_CHROMA) - set_qp_y(lc, cu->x0, cu->y0, 0); + if (cu->tree_type != DUAL_TREE_CHROMA) { + ret = set_qp_y(lc, cu->x0, cu->y0, 0); + if (ret < 0) + return ret; + } if (rsps->sps_chroma_format_idc && cu->tree_type != DUAL_TREE_LUMA) set_qp_c(lc); ret = skipped_transform_tree(lc, cu->x0, cu->y0, cu->cb_width, cu->cb_height); @@ -1778,13 +1781,16 @@ pu->general_merge_flag = ff_vvc_general_merge_flag(lc); if (pu->general_merge_flag) { - hls_merge_data(lc); + ret = hls_merge_data(lc); } else if (cu->pred_mode == MODE_IBC){ ret = mvp_data_ibc(lc); } else { ret = mvp_data(lc); } + if (ret) + return ret; + if (cu->pred_mode == MODE_IBC) { ff_vvc_update_hmvp(lc, mi); @@ -2286,6 +2292,7 @@ ALFParams *alf = &CTB(fc->tab.alf, rx, ry); alf->ctb_flag[LUMA] = alf->ctb_flag[CB] = alf->ctb_flag[CR] = 0; + alf->ctb_cc_idc[0] = alf->ctb_cc_idc[1] = 0; if (sh->sh_alf_enabled_flag) { alf->ctb_flag[LUMA] = ff_vvc_alf_ctb_flag(lc, rx, ry, LUMA); if (alf->ctb_flag[LUMA]) { @@ -2316,7 +2323,6 @@ const uint8_t cc_enabled[] = { sh->sh_alf_cc_cb_enabled_flag, sh->sh_alf_cc_cr_enabled_flag }; const uint8_t cc_aps_id[] = { sh->sh_alf_cc_cb_aps_id, sh->sh_alf_cc_cr_aps_id }; for (int i = 0; i < 2; i++) { - alf->ctb_cc_idc[i] = 0; if (cc_enabled[i]) { const VVCALF *aps = fc->ps.alf_list[cc_aps_id[i]]; alf->ctb_cc_idc[i] = ff_vvc_alf_ctb_cc_idc(lc, rx, ry, i, aps->num_cc_filters[i]); diff -Nru ffmpeg-7.1.4/libavcodec/vvc/dec.c ffmpeg-7.1.5/libavcodec/vvc/dec.c --- ffmpeg-7.1.4/libavcodec/vvc/dec.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/dec.c 2026-06-20 02:25:39.000000000 +0000 @@ -672,8 +672,6 @@ { int ret; - fc->ref = NULL; - // copy refs from the last frame if (s->nb_frames && s->nb_fcs > 1) { VVCFrameContext *prev = get_frame_context(s, fc, -1); @@ -877,6 +875,7 @@ int ret = 0; s->last_eos = s->eos; s->eos = 0; + fc->ref = NULL; ff_cbs_fragment_reset(frame); ret = ff_cbs_read_packet(s->cbc, frame, avpkt); @@ -1000,7 +999,7 @@ if (ret < 0) return ret; - if (!fc->ft) + if (!fc->ft || !fc->ref) return avpkt->size; ret = submit_frame(s, fc, output, got_output); diff -Nru ffmpeg-7.1.4/libavcodec/vvc/inter_template.c ffmpeg-7.1.5/libavcodec/vvc/inter_template.c --- ffmpeg-7.1.4/libavcodec/vvc/inter_template.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/inter_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -472,6 +472,9 @@ (filter[0] * src[x] + \ filter[1] * src[x + stride]) +#define DMVR_FILTER2(filter, src0, src1) \ + (filter[0] * src0 + filter[1] * src1) + //8.5.3.2.2 Luma sample bilinear interpolation process static void FUNC(dmvr)(int16_t *dst, const uint8_t *_src, const ptrdiff_t _src_stride, const int height, const intptr_t mx, const intptr_t my, const int width) @@ -541,31 +544,31 @@ static void FUNC(dmvr_hv)(int16_t *dst, const uint8_t *_src, const ptrdiff_t _src_stride, const int height, const intptr_t mx, const intptr_t my, const int width) { - int16_t tmp_array[(MAX_PB_SIZE + BILINEAR_EXTRA) * MAX_PB_SIZE]; - int16_t *tmp = tmp_array; + int16_t tmp_array[MAX_PB_SIZE * 2]; + int16_t *tmp0 = tmp_array; + int16_t *tmp1 = tmp_array + MAX_PB_SIZE; const pixel *src = (const pixel*)_src; const ptrdiff_t src_stride = _src_stride / sizeof(pixel); - const int8_t *filter = ff_vvc_inter_luma_dmvr_filters[mx]; + const int8_t *filter_x = ff_vvc_inter_luma_dmvr_filters[mx]; + const int8_t *filter_y = ff_vvc_inter_luma_dmvr_filters[my]; const int shift1 = BIT_DEPTH - 6; const int offset1 = 1 << (shift1 - 1); const int shift2 = 4; const int offset2 = 1 << (shift2 - 1); src -= BILINEAR_EXTRA_BEFORE * src_stride; - for (int y = 0; y < height + BILINEAR_EXTRA; y++) { - for (int x = 0; x < width; x++) - tmp[x] = (DMVR_FILTER(src, 1) + offset1) >> shift1; + for (int x = 0; x < width; x++) + tmp0[x] = (DMVR_FILTER2(filter_x, src[x], src[x + 1]) + offset1) >> shift1; + src += src_stride; + + for (int y = 1; y < height + BILINEAR_EXTRA; y++) { + for (int x = 0; x < width; x++) { + tmp1[x] = (DMVR_FILTER2(filter_x, src[x], src[x + 1]) + offset1) >> shift1; + dst[x] = (DMVR_FILTER2(filter_y, tmp0[x], tmp1[x]) + offset2) >> shift2; + } src += src_stride; - tmp += MAX_PB_SIZE; - } - - tmp = tmp_array + BILINEAR_EXTRA_BEFORE * MAX_PB_SIZE; - filter = ff_vvc_inter_luma_dmvr_filters[my]; - for (int y = 0; y < height; y++) { - for (int x = 0; x < width; x++) - dst[x] = (DMVR_FILTER(tmp, MAX_PB_SIZE) + offset2) >> shift2; - tmp += MAX_PB_SIZE; dst += MAX_PB_SIZE; + FFSWAP(int16_t *, tmp0, tmp1); } } diff -Nru ffmpeg-7.1.4/libavcodec/vvc/intra.c ffmpeg-7.1.5/libavcodec/vvc/intra.c --- ffmpeg-7.1.4/libavcodec/vvc/intra.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/intra.c 2026-06-20 02:25:39.000000000 +0000 @@ -243,21 +243,23 @@ } //8.4.5.1 General decoding process for intra blocks -static void predict_intra(VVCLocalContext *lc, const TransformUnit *tu, const int idx, const int target_ch_type) +static int predict_intra(VVCLocalContext *lc, const TransformUnit *tu, const int idx, const int target_ch_type) { const VVCFrameContext *fc = lc->fc; const CodingUnit *cu = lc->cu; const VVCTreeType tree_type = cu->tree_type; - int x0, y0, w, h; + int x0, y0, w, h, ret; if (cu->pred_mode != MODE_INTRA) { - add_reconstructed_area(lc, target_ch_type, tu->x0, tu->y0, tu->width, tu->height); - return; + ret = add_reconstructed_area(lc, target_ch_type, tu->x0, tu->y0, tu->width, tu->height); + return ret; } if (!target_ch_type && tree_type != DUAL_TREE_CHROMA) { if (get_luma_predict_unit(cu, tu, idx, &x0, &y0, &w, &h)) { ff_vvc_set_neighbour_available(lc, x0, y0, w, h); fc->vvcdsp.intra.intra_pred(lc, x0, y0, w, h, 0); - add_reconstructed_area(lc, 0, x0, y0, w, h); + ret = add_reconstructed_area(lc, 0, x0, y0, w, h); + if (ret < 0) + return ret; } } if (target_ch_type && tree_type != DUAL_TREE_LUMA) { @@ -269,9 +271,12 @@ fc->vvcdsp.intra.intra_pred(lc, x0, y0, w, h, 1); fc->vvcdsp.intra.intra_pred(lc, x0, y0, w, h, 2); } - add_reconstructed_area(lc, 1, x0, y0, w, h); + ret = add_reconstructed_area(lc, 1, x0, y0, w, h); + if (ret < 0) + return ret; } } + return 0; } static void scale_clip(int *coeff, const int nzw, const int w, const int h, @@ -571,11 +576,14 @@ CodingUnit *cu = lc->cu; const int start = cu->tree_type == DUAL_TREE_CHROMA; const int end = fc->ps.sps->r->sps_chroma_format_idc && (cu->tree_type != DUAL_TREE_LUMA); + int ret; for (int ch_type = start; ch_type <= end; ch_type++) { TransformUnit *tu = cu->tus.head; for (int i = 0; tu; i++) { - predict_intra(lc, tu, i, ch_type); + ret = predict_intra(lc, tu, i, ch_type); + if (ret < 0) + return ret; itransform(lc, tu, i, ch_type); tu = tu->next; } @@ -681,10 +689,16 @@ if (cu->coded_flag) { ret = reconstruct(lc); } else { - if (cu->tree_type != DUAL_TREE_CHROMA) - add_reconstructed_area(lc, LUMA, cu->x0, cu->y0, cu->cb_width, cu->cb_height); - if (sps->r->sps_chroma_format_idc && cu->tree_type != DUAL_TREE_LUMA) - add_reconstructed_area(lc, CHROMA, cu->x0, cu->y0, cu->cb_width, cu->cb_height); + if (cu->tree_type != DUAL_TREE_CHROMA) { + ret = add_reconstructed_area(lc, LUMA, cu->x0, cu->y0, cu->cb_width, cu->cb_height); + if (ret < 0) + return ret; + } + if (sps->r->sps_chroma_format_idc && cu->tree_type != DUAL_TREE_LUMA) { + ret = add_reconstructed_area(lc, CHROMA, cu->x0, cu->y0, cu->cb_width, cu->cb_height); + if (ret < 0) + return ret; + } } if (sps->r->sps_ibc_enabled_flag) ibc_fill_vir_buf(lc, cu); diff -Nru ffmpeg-7.1.4/libavcodec/vvc/ps.c ffmpeg-7.1.5/libavcodec/vvc/ps.c --- ffmpeg-7.1.4/libavcodec/vvc/ps.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/ps.c 2026-06-20 02:25:39.000000000 +0000 @@ -20,6 +20,7 @@ * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +#include #include "libavcodec/cbs_h266.h" #include "libavutil/mem.h" @@ -238,9 +239,10 @@ } if (old_sps) { - if (old_sps->r == rsps || !memcmp(old_sps->r, rsps, sizeof(*old_sps->r))) + if (old_sps->r == rsps || !memcmp(old_sps->r, rsps, sizeof(*old_sps->r))) { + ps->sps_id_used |= (1 << sps_id); return 0; - else if (ps->sps_id_used & (1 << sps_id)) + } else if (ps->sps_id_used & (1 << sps_id)) return AVERROR_INVALIDDATA; } @@ -358,6 +360,8 @@ int start = *off; for (int y = 0; y < h; y++) { for (int x = 0; x < w; x++) { + if (*off >= pps->ctb_count) + return AVERROR_INVALIDDATA; pps->ctb_addr_in_slice[*off] = ctu_rs(rx + x, ry + y, pps); (*off)++; } @@ -365,15 +369,21 @@ return *off - start; } -static void pps_single_slice_picture(VVCPPS *pps, int *off) +static int pps_single_slice_picture(VVCPPS *pps, int *off) { + pps->num_ctus_in_slice[0] = 0; for (int j = 0; j < pps->r->num_tile_rows; j++) { for (int i = 0; i < pps->r->num_tile_columns; i++) { - pps->num_ctus_in_slice[0] = pps_add_ctus(pps, off, + const int ret = pps_add_ctus(pps, off, pps->col_bd[i], pps->row_bd[j], pps->r->col_width_val[i], pps->r->row_height_val[j]); + if (ret < 0) + return ret; + pps->num_ctus_in_slice[0] += ret; } } + + return 0; } static void subpic_tiles(int *tile_x, int *tile_y, int *tile_x_end, int *tile_y_end, @@ -400,25 +410,36 @@ (*tile_y_end)++; } -static void pps_subpic_less_than_one_tile_slice(VVCPPS *pps, const VVCSPS *sps, const int i, const int tx, const int ty, int *off) +static int pps_subpic_less_than_one_tile_slice(VVCPPS *pps, const VVCSPS *sps, const int i, const int tx, const int ty, int *off) { - pps->num_ctus_in_slice[i] = pps_add_ctus(pps, off, - pps->col_bd[tx], pps->row_bd[ty], - pps->r->col_width_val[tx], sps->r->sps_subpic_height_minus1[i] + 1); + const int ret = pps_add_ctus(pps, off, + sps->r->sps_subpic_ctu_top_left_x[i], sps->r->sps_subpic_ctu_top_left_y[i], + sps->r->sps_subpic_width_minus1[i] + 1, sps->r->sps_subpic_height_minus1[i] + 1); + if (ret < 0) + return ret; + + pps->num_ctus_in_slice[i] = ret; + return 0; } -static void pps_subpic_one_or_more_tiles_slice(VVCPPS *pps, const int tile_x, const int tile_y, const int x_end, const int y_end, const int i, int *off) +static int pps_subpic_one_or_more_tiles_slice(VVCPPS *pps, const int tile_x, const int tile_y, const int x_end, const int y_end, + const int i, int *off) { for (int ty = tile_y; ty < y_end; ty++) { for (int tx = tile_x; tx < x_end; tx++) { - pps->num_ctus_in_slice[i] += pps_add_ctus(pps, off, + const int ret = pps_add_ctus(pps, off, pps->col_bd[tx], pps->row_bd[ty], pps->r->col_width_val[tx], pps->r->row_height_val[ty]); + if (ret < 0) + return ret; + + pps->num_ctus_in_slice[i] += ret; } } + return 0; } -static void pps_subpic_slice(VVCPPS *pps, const VVCSPS *sps, const int i, int *off) +static int pps_subpic_slice(VVCPPS *pps, const VVCSPS *sps, const int i, int *off) { int tx, ty, x_end, y_end; @@ -427,19 +448,27 @@ subpic_tiles(&tx, &ty, &x_end, &y_end, sps, pps, i); if (ty + 1 == y_end && sps->r->sps_subpic_height_minus1[i] + 1 < pps->r->row_height_val[ty]) - pps_subpic_less_than_one_tile_slice(pps, sps, i, tx, ty, off); + return pps_subpic_less_than_one_tile_slice(pps, sps, i, tx, ty, off); else - pps_subpic_one_or_more_tiles_slice(pps, tx, ty, x_end, y_end, i, off); + return pps_subpic_one_or_more_tiles_slice(pps, tx, ty, x_end, y_end, i, off); } -static void pps_single_slice_per_subpic(VVCPPS *pps, const VVCSPS *sps, int *off) +static int pps_single_slice_per_subpic(VVCPPS *pps, const VVCSPS *sps, int *off) { + int ret; + if (!sps->r->sps_subpic_info_present_flag) { - pps_single_slice_picture(pps, off); + ret = pps_single_slice_picture(pps, off); + if (ret < 0) + return ret; } else { - for (int i = 0; i < pps->r->pps_num_slices_in_pic_minus1 + 1; i++) - pps_subpic_slice(pps, sps, i, off); + for (int i = 0; i < pps->r->pps_num_slices_in_pic_minus1 + 1; i++) { + const int ret = pps_subpic_slice(pps, sps, i, off); + if (ret < 0) + return ret; + } } + return 0; } static int pps_one_tile_slices(VVCPPS *pps, const int tile_idx, int i, int *off) @@ -451,16 +480,20 @@ ctu_xy(&rx, &ry, tile_x, tile_y, pps); ctu_y_end = ry + r->row_height_val[tile_y]; while (ry < ctu_y_end) { + int ret; pps->slice_start_offset[i] = *off; - pps->num_ctus_in_slice[i] = pps_add_ctus(pps, off, rx, ry, + ret = pps_add_ctus(pps, off, rx, ry, r->col_width_val[tile_x], r->slice_height_in_ctus[i]); + if (ret < 0) + return ret; + pps->num_ctus_in_slice[i] = ret; ry += r->slice_height_in_ctus[i++]; } i--; return i; } -static void pps_multi_tiles_slice(VVCPPS *pps, const int tile_idx, const int i, int *off) +static int pps_multi_tiles_slice(VVCPPS *pps, const int tile_idx, const int i, int *off, bool *tile_in_slice) { const H266RawPPS *r = pps->r; int rx, ry, tile_x, tile_y; @@ -470,57 +503,91 @@ pps->num_ctus_in_slice[i] = 0; for (int ty = tile_y; ty <= tile_y + r->pps_slice_height_in_tiles_minus1[i]; ty++) { for (int tx = tile_x; tx <= tile_x + r->pps_slice_width_in_tiles_minus1[i]; tx++) { + int ret; + const int idx = ty * r->num_tile_columns + tx; + if (tile_in_slice[idx]) + return AVERROR_INVALIDDATA; + tile_in_slice[idx] = true; ctu_xy(&rx, &ry, tx, ty, pps); - pps->num_ctus_in_slice[i] += pps_add_ctus(pps, off, rx, ry, + ret = pps_add_ctus(pps, off, rx, ry, r->col_width_val[tx], r->row_height_val[ty]); + if (ret < 0) + return ret; + pps->num_ctus_in_slice[i] += ret; } } + + return 0; } -static void pps_rect_slice(VVCPPS *pps, const VVCSPS *sps) +static int pps_rect_slice(VVCPPS *pps, const VVCSPS *sps) { const H266RawPPS *r = pps->r; - int tile_idx = 0, off = 0; + bool tile_in_slice[VVC_MAX_TILES_PER_AU] = {false}; + int tile_idx = 0, off = 0, ret; if (r->pps_single_slice_per_subpic_flag) { - pps_single_slice_per_subpic(pps, sps, &off); - return; + return pps_single_slice_per_subpic(pps, sps, &off); } for (int i = 0; i < r->pps_num_slices_in_pic_minus1 + 1; i++) { if (!r->pps_slice_width_in_tiles_minus1[i] && !r->pps_slice_height_in_tiles_minus1[i]) { - i = pps_one_tile_slices(pps, tile_idx, i, &off); + if (tile_in_slice[tile_idx]) + return AVERROR_INVALIDDATA; + tile_in_slice[tile_idx] = true; + ret = pps_one_tile_slices(pps, tile_idx, i, &off); + if (ret < 0) + return ret; + i = ret; } else { - pps_multi_tiles_slice(pps, tile_idx, i, &off); + ret = pps_multi_tiles_slice(pps, tile_idx, i, &off, tile_in_slice); + if (ret < 0) + return ret; } tile_idx = next_tile_idx(tile_idx, i, r); } + + for (int i = 0; i < r->num_tiles_in_pic; i++) { + if (!tile_in_slice[i]) + return AVERROR_INVALIDDATA; + } + + return 0; } -static void pps_no_rect_slice(VVCPPS* pps) +static int pps_no_rect_slice(VVCPPS* pps) { const H266RawPPS* r = pps->r; int rx, ry, off = 0; for (int tile_y = 0; tile_y < r->num_tile_rows; tile_y++) { for (int tile_x = 0; tile_x < r->num_tile_columns; tile_x++) { + int ret; ctu_xy(&rx, &ry, tile_x, tile_y, pps); - pps_add_ctus(pps, &off, rx, ry, r->col_width_val[tile_x], r->row_height_val[tile_y]); + ret = pps_add_ctus(pps, &off, rx, ry, r->col_width_val[tile_x], r->row_height_val[tile_y]); + if (ret < 0) + return ret; } } + + return 0; } static int pps_slice_map(VVCPPS *pps, const VVCSPS *sps) { + int ret; + pps->ctb_addr_in_slice = av_calloc(pps->ctb_count, sizeof(*pps->ctb_addr_in_slice)); if (!pps->ctb_addr_in_slice) return AVERROR(ENOMEM); if (pps->r->pps_rect_slice_flag) - pps_rect_slice(pps, sps); - else - pps_no_rect_slice(pps); + return pps_rect_slice(pps, sps); + + ret = pps_no_rect_slice(pps); + if (ret < 0) + return ret; return 0; } @@ -649,6 +716,12 @@ if (ret < 0) return ret; + if (rsps->sps_log2_ctu_size_minus5 > 2) { + // CTU > 128 are reserved in vvc spec v3 + av_log(log_ctx, AV_LOG_ERROR, "CTU size > 128. \n"); + return AVERROR_PATCHWELCOME; + } + ret = decode_pps(ps, rpps); if (ret < 0) return ret; @@ -728,7 +801,7 @@ uint16_t input_pivot[LMCS_MAX_BIN_SIZE]; uint16_t scale_coeff[LMCS_MAX_BIN_SIZE]; uint16_t inv_scale_coeff[LMCS_MAX_BIN_SIZE]; - int i, delta_crs; + int i, delta_crs, sum_cw = 0; if (bit_depth > LMCS_MAX_BIT_DEPTH) return AVERROR_PATCHWELCOME; @@ -739,8 +812,12 @@ lmcs->max_bin_idx = LMCS_MAX_BIN_SIZE - 1 - rlmcs->lmcs_min_bin_idx; memset(cw, 0, sizeof(cw)); - for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++) + for (int i = lmcs->min_bin_idx; i <= lmcs->max_bin_idx; i++) { cw[i] = org_cw + (1 - 2 * rlmcs->lmcs_delta_sign_cw_flag[i]) * rlmcs->lmcs_delta_abs_cw[i]; + sum_cw += cw[i]; + } + if (sum_cw > (1 << bit_depth) - 1) + return AVERROR_INVALIDDATA; delta_crs = (1 - 2 * rlmcs->lmcs_delta_sign_crs_flag) * rlmcs->lmcs_delta_abs_crs; @@ -748,19 +825,26 @@ for (i = 0; i < LMCS_MAX_BIN_SIZE; i++) { input_pivot[i] = i * org_cw; lmcs->pivot[i + 1] = lmcs->pivot[i] + cw[i]; + if (i >= lmcs->min_bin_idx && i <= lmcs->max_bin_idx && + lmcs->pivot[i] % (1 << (bit_depth - 5)) != 0 && + lmcs->pivot[i] >> (bit_depth - 5) == lmcs->pivot[i + 1] >> (bit_depth - 5)) + return AVERROR_INVALIDDATA; scale_coeff[i] = (cw[i] * (1 << 11) + off) >> shift; if (cw[i] == 0) { inv_scale_coeff[i] = 0; lmcs->chroma_scale_coeff[i] = (1 << 11); } else { + const int cw_plus_d = cw[i] + delta_crs; + if (cw_plus_d < (org_cw >> 3) || cw_plus_d > ((org_cw << 3) - 1)) + return AVERROR_INVALIDDATA; inv_scale_coeff[i] = org_cw * (1 << 11) / cw[i]; - lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / (cw[i] + delta_crs); + lmcs->chroma_scale_coeff[i] = org_cw * (1 << 11) / cw_plus_d; } } //derive lmcs_fwd_lut for (uint16_t sample = 0; sample < max; sample++) { - const int idx_y = sample / org_cw; + const int idx_y = sample >> shift; const uint16_t fwd_sample = lmcs_derive_lut_sample(sample, lmcs->pivot, input_pivot, scale_coeff, idx_y, max); if (bit_depth > 8) @@ -776,6 +860,7 @@ uint16_t inv_sample; while (i <= lmcs->max_bin_idx && sample >= lmcs->pivot[i + 1]) i++; + i = FFMIN(i, LMCS_MAX_BIN_SIZE - 1); inv_sample = lmcs_derive_lut_sample(sample, input_pivot, lmcs->pivot, inv_scale_coeff, i, max); @@ -1198,7 +1283,7 @@ return 0; } -static void sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps) +static int sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps) { const int slice_address = sh->r->sh_slice_address; @@ -1222,6 +1307,11 @@ sh->num_ctus_in_curr_slice += pps->r->row_height_val[tile_y] * pps->r->col_width_val[tile_x]; } } + + if (!sh->num_ctus_in_curr_slice) + return AVERROR_INVALIDDATA; + + return 0; } static void sh_qp_y(VVCSH *sh, const H266RawPPS *pps, const H266RawPictureHeader *ph) @@ -1318,7 +1408,9 @@ const H266RawPictureHeader *ph = fps->ph.r; int ret; - sh_slice_address(sh, sps, fps->pps); + ret = sh_slice_address(sh, sps, fps->pps); + if (ret < 0) + return ret; ret = sh_alf_aps(sh, fps); if (ret < 0) return ret; diff -Nru ffmpeg-7.1.4/libavcodec/vvc/refs.c ffmpeg-7.1.5/libavcodec/vvc/refs.c --- ffmpeg-7.1.4/libavcodec/vvc/refs.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/refs.c 2026-06-20 02:25:39.000000000 +0000 @@ -21,6 +21,7 @@ */ #include +#include #include "libavutil/mem.h" #include "libavutil/thread.h" @@ -29,10 +30,6 @@ #include "refs.h" -#define VVC_FRAME_FLAG_OUTPUT (1 << 0) -#define VVC_FRAME_FLAG_SHORT_REF (1 << 1) -#define VVC_FRAME_FLAG_LONG_REF (1 << 2) -#define VVC_FRAME_FLAG_BUMPING (1 << 3) typedef struct FrameProgress { atomic_int progress[VVC_PROGRESS_LAST]; @@ -50,6 +47,8 @@ return; frame->flags &= ~flags; + if (!(frame->flags & ~VVC_FRAME_FLAG_CORRUPT)) + frame->flags = 0; if (!frame->flags) { av_frame_unref(frame->frame); ff_refstruct_unref(&frame->sps); @@ -246,6 +245,9 @@ if (nb_output) { VVCFrame *frame = &fc->DPB[min_idx]; + if (frame->flags & VVC_FRAME_FLAG_CORRUPT) + frame->frame->flags |= AV_FRAME_FLAG_CORRUPT; + ret = av_frame_ref(out, frame->frame); if (frame->flags & VVC_FRAME_FLAG_BUMPING) ff_vvc_unref_frame(fc, frame, VVC_FRAME_FLAG_OUTPUT | VVC_FRAME_FLAG_BUMPING); @@ -355,7 +357,7 @@ frame->poc = poc; frame->sequence = s->seq_decode; - frame->flags = 0; + frame->flags = VVC_FRAME_FLAG_CORRUPT; ff_vvc_report_frame_finished(frame); @@ -390,6 +392,19 @@ if (ref == fc->ref || list->nb_refs >= VVC_MAX_REF_ENTRIES) return AVERROR_INVALIDDATA; + if (!IS_CVSS(s)) { + const bool ref_corrupt = !ref || (ref->flags & VVC_FRAME_FLAG_CORRUPT); + const bool recovering = s->no_output_before_recovery_flag && !GDR_IS_RECOVERED(s); + + if (ref_corrupt && !recovering) { + if (!(s->avctx->flags & AV_CODEC_FLAG_OUTPUT_CORRUPT) && + !(s->avctx->flags2 & AV_CODEC_FLAG2_SHOW_ALL)) + return AVERROR_INVALIDDATA; + + fc->ref->flags |= VVC_FRAME_FLAG_CORRUPT; + } + } + if (!ref) { ref = generate_missing_ref(s, fc, poc); if (!ref) diff -Nru ffmpeg-7.1.4/libavcodec/vvc/refs.h ffmpeg-7.1.5/libavcodec/vvc/refs.h --- ffmpeg-7.1.4/libavcodec/vvc/refs.h 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/refs.h 2026-06-20 02:25:39.000000000 +0000 @@ -25,6 +25,12 @@ #include "dec.h" +#define VVC_FRAME_FLAG_OUTPUT (1 << 0) +#define VVC_FRAME_FLAG_SHORT_REF (1 << 1) +#define VVC_FRAME_FLAG_LONG_REF (1 << 2) +#define VVC_FRAME_FLAG_BUMPING (1 << 3) +#define VVC_FRAME_FLAG_CORRUPT (1 << 4) + int ff_vvc_output_frame(VVCContext *s, VVCFrameContext *fc, struct AVFrame *out, int no_output_of_prior_pics_flag, int flush); void ff_vvc_bump_frame(VVCContext *s, VVCFrameContext *fc); int ff_vvc_set_new_ref(VVCContext *s, VVCFrameContext *fc, struct AVFrame **frame); diff -Nru ffmpeg-7.1.4/libavcodec/vvc/thread.c ffmpeg-7.1.5/libavcodec/vvc/thread.c --- ffmpeg-7.1.4/libavcodec/vvc/thread.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/vvc/thread.c 2026-06-20 02:25:39.000000000 +0000 @@ -655,9 +655,9 @@ "frame %5d, %s(%3d, %3d) failed with %d\r\n", (int)fc->decode_order, task_name[stage], t->rx, t->ry, ret); } + if (!ret) + task_stage_done(t, s); } - - task_stage_done(t, s); return; } @@ -822,6 +822,13 @@ } } } + for (int rs = 0; rs < ft->ctu_count; rs++) { + const VVCTask *t = ft->tasks + rs; + if (!t->sc) { + av_log(s->avctx, AV_LOG_ERROR, "frame %5d, CTU(%d, %d) not belong to any slice\r\n", (int)fc->decode_order, t->rx, t->ry); + return AVERROR_INVALIDDATA; + } + } frame_thread_add_score(s, ft, 0, 0, VVC_TASK_STAGE_INIT); return 0; diff -Nru ffmpeg-7.1.4/libavcodec/x86/vorbisdsp.asm ffmpeg-7.1.5/libavcodec/x86/vorbisdsp.asm --- ffmpeg-7.1.4/libavcodec/x86/vorbisdsp.asm 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.5/libavcodec/x86/vorbisdsp.asm 2026-06-20 02:25:39.000000000 +0000 @@ -41,8 +41,8 @@ mova m1, [angq+block_sizeq] xorps m2, m2 xorps m3, m3 - cmpleps m2, m0 ; m <= 0.0 - cmpleps m3, m1 ; a <= 0.0 + cmpltps m2, m0 ; m < 0.0 + cmpltps m3, m1 ; a < 0.0 andps m2, m5 ; keep only the sign bit xorps m1, m2 mova m4, m3 diff -Nru ffmpeg-7.1.4/libavfilter/aap_template.c ffmpeg-7.1.5/libavfilter/aap_template.c --- ffmpeg-7.1.4/libavfilter/aap_template.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/aap_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -196,8 +196,8 @@ { AudioAPContext *s = ctx->priv; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int c = start; c < end; c++) { const ftype *input = (const ftype *)s->frame[0]->extended_data[c]; diff -Nru ffmpeg-7.1.4/libavfilter/adynamicequalizer_template.c ffmpeg-7.1.5/libavfilter/adynamicequalizer_template.c --- ffmpeg-7.1.4/libavfilter/adynamicequalizer_template.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/adynamicequalizer_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -269,8 +269,8 @@ const ftype tqfactor = s->tqfactor; const ftype itqfactor = ONE / tqfactor; const ftype fg = TAN(M_PI * tfrequency / sample_rate); - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); const int is_disabled = ctx->is_disabled; const int detection = s->detection; const int tftype = s->tftype; diff -Nru ffmpeg-7.1.4/libavfilter/af_acrossover.c ffmpeg-7.1.5/libavfilter/af_acrossover.c --- ffmpeg-7.1.4/libavfilter/af_acrossover.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_acrossover.c 2026-06-20 02:25:39.000000000 +0000 @@ -397,8 +397,8 @@ AudioCrossoverContext *s = ctx->priv; \ AVFrame *in = arg; \ AVFrame **frames = s->frames; \ - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; \ - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); \ const int nb_samples = in->nb_samples; \ const int nb_outs = ctx->nb_outputs; \ const int first_order = s->first_order; \ diff -Nru ffmpeg-7.1.4/libavfilter/af_adecorrelate.c ffmpeg-7.1.5/libavfilter/af_adecorrelate.c --- ffmpeg-7.1.4/libavfilter/af_adecorrelate.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_adecorrelate.c 2026-06-20 02:25:39.000000000 +0000 @@ -161,8 +161,8 @@ ThreadData *td = arg; AVFrame *out = td->out; AVFrame *in = td->in; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) s->filter_channel(ctx, ch, in, out); diff -Nru ffmpeg-7.1.4/libavfilter/af_adenorm.c ffmpeg-7.1.5/libavfilter/af_adenorm.c --- ffmpeg-7.1.4/libavfilter/af_adenorm.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_adenorm.c 2026-06-20 02:25:39.000000000 +0000 @@ -188,8 +188,8 @@ ThreadData *td = arg; AVFrame *out = td->out; AVFrame *in = td->in; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) { s->filter[s->type](ctx, out->extended_data[ch], diff -Nru ffmpeg-7.1.4/libavfilter/af_adrc.c ffmpeg-7.1.5/libavfilter/af_adrc.c --- ffmpeg-7.1.4/libavfilter/af_adrc.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_adrc.c 2026-06-20 02:25:39.000000000 +0000 @@ -349,8 +349,8 @@ AudioDRCContext *s = ctx->priv; AVFrame *in = s->in; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) drc_channel(ctx, in, out, ch); diff -Nru ffmpeg-7.1.4/libavfilter/af_aemphasis.c ffmpeg-7.1.5/libavfilter/af_aemphasis.c --- ffmpeg-7.1.4/libavfilter/af_aemphasis.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_aemphasis.c 2026-06-20 02:25:39.000000000 +0000 @@ -105,8 +105,8 @@ ThreadData *td = arg; AVFrame *out = td->out; AVFrame *in = td->in; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) { const double *src = (const double *)in->extended_data[ch]; diff -Nru ffmpeg-7.1.4/libavfilter/af_afftdn.c ffmpeg-7.1.5/libavfilter/af_afftdn.c --- ffmpeg-7.1.4/libavfilter/af_afftdn.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_afftdn.c 2026-06-20 02:25:39.000000000 +0000 @@ -1050,8 +1050,8 @@ { AudioFFTDeNoiseContext *s = ctx->priv; AVFrame *in = arg; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); const int window_length = s->window_length; const double *window = s->window; diff -Nru ffmpeg-7.1.4/libavfilter/af_afftfilt.c ffmpeg-7.1.5/libavfilter/af_afftfilt.c --- ffmpeg-7.1.4/libavfilter/af_afftfilt.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_afftfilt.c 2026-06-20 02:25:39.000000000 +0000 @@ -233,8 +233,8 @@ { AFFTFiltContext *s = ctx->priv; const int channels = s->channels; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) { AVComplexFloat *fft_in = s->fft_in[ch]; @@ -253,8 +253,8 @@ const float *window_lut = s->window_func_lut; const float f = sqrtf(1.f - s->overlap); const int channels = s->channels; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); double values[VAR_VARS_NB]; memcpy(values, arg, sizeof(values)); diff -Nru ffmpeg-7.1.4/libavfilter/af_afir.c ffmpeg-7.1.5/libavfilter/af_afir.c --- ffmpeg-7.1.4/libavfilter/af_afir.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_afir.c 2026-06-20 02:25:39.000000000 +0000 @@ -156,8 +156,8 @@ static int fir_channels(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) { AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) fir_channel(ctx, out, ch); diff -Nru ffmpeg-7.1.4/libavfilter/af_afreqshift.c ffmpeg-7.1.5/libavfilter/af_afreqshift.c --- ffmpeg-7.1.4/libavfilter/af_afreqshift.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_afreqshift.c 2026-06-20 02:25:39.000000000 +0000 @@ -292,8 +292,8 @@ ThreadData *td = arg; AVFrame *out = td->out; AVFrame *in = td->in; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) s->filter_channel(ctx, ch, in, out); diff -Nru ffmpeg-7.1.4/libavfilter/af_anequalizer.c ffmpeg-7.1.5/libavfilter/af_anequalizer.c --- ffmpeg-7.1.4/libavfilter/af_anequalizer.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_anequalizer.c 2026-06-20 02:25:39.000000000 +0000 @@ -687,8 +687,8 @@ { AudioNEqualizerContext *s = ctx->priv; AVFrame *buf = arg; - const int start = (buf->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (buf->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(buf->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(buf->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int i = 0; i < s->nb_filters; i++) { EqualizatorFilter *f = &s->filters[i]; diff -Nru ffmpeg-7.1.4/libavfilter/af_apsyclip.c ffmpeg-7.1.5/libavfilter/af_apsyclip.c --- ffmpeg-7.1.4/libavfilter/af_apsyclip.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_apsyclip.c 2026-06-20 02:25:39.000000000 +0000 @@ -532,8 +532,8 @@ { AudioPsyClipContext *s = ctx->priv; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) psy_channel(ctx, s->in, out, ch); diff -Nru ffmpeg-7.1.4/libavfilter/af_arnndn.c ffmpeg-7.1.5/libavfilter/af_arnndn.c --- ffmpeg-7.1.4/libavfilter/af_arnndn.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_arnndn.c 2026-06-20 02:25:39.000000000 +0000 @@ -1411,8 +1411,8 @@ ThreadData *td = arg; AVFrame *in = td->in; AVFrame *out = td->out; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) { rnnoise_channel(s, &s->st[ch], diff -Nru ffmpeg-7.1.4/libavfilter/af_asdr.c ffmpeg-7.1.5/libavfilter/af_asdr.c --- ffmpeg-7.1.4/libavfilter/af_asdr.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_asdr.c 2026-06-20 02:25:39.000000000 +0000 @@ -52,8 +52,8 @@ AVFrame *u = s->cache[0]; \ AVFrame *v = s->cache[1]; \ const int channels = u->ch_layout.nb_channels; \ - const int start = (channels * jobnr) / nb_jobs; \ - const int end = (channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); \ const int nb_samples = u->nb_samples; \ \ for (int ch = start; ch < end; ch++) { \ @@ -85,8 +85,8 @@ AVFrame *u = s->cache[0]; \ AVFrame *v = s->cache[1]; \ const int channels = u->ch_layout.nb_channels; \ - const int start = (channels * jobnr) / nb_jobs; \ - const int end = (channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); \ const int nb_samples = u->nb_samples; \ \ for (int ch = start; ch < end; ch++) { \ @@ -121,8 +121,8 @@ AVFrame *u = s->cache[0]; \ AVFrame *v = s->cache[1]; \ const int channels = u->ch_layout.nb_channels; \ - const int start = (channels * jobnr) / nb_jobs; \ - const int end = (channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); \ const int nb_samples = u->nb_samples; \ \ for (int ch = start; ch < end; ch++) { \ diff -Nru ffmpeg-7.1.4/libavfilter/af_asoftclip.c ffmpeg-7.1.5/libavfilter/af_asoftclip.c --- ffmpeg-7.1.4/libavfilter/af_asoftclip.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_asoftclip.c 2026-06-20 02:25:39.000000000 +0000 @@ -410,8 +410,8 @@ AVFrame *in = td->in; const int channels = td->channels; const int nb_samples = td->nb_samples; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); s->filter(s, (void **)out->extended_data, (const void **)in->extended_data, nb_samples, channels, start, end); diff -Nru ffmpeg-7.1.4/libavfilter/af_aspectralstats.c ffmpeg-7.1.5/libavfilter/af_aspectralstats.c --- ffmpeg-7.1.4/libavfilter/af_aspectralstats.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_aspectralstats.c 2026-06-20 02:25:39.000000000 +0000 @@ -438,8 +438,8 @@ const float *window_func_lut = s->window_func_lut; AVFrame *in = arg; const int channels = s->nb_channels; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); const int offset = s->win_size - s->hop_size; for (int ch = start; ch < end; ch++) { diff -Nru ffmpeg-7.1.4/libavfilter/af_astats.c ffmpeg-7.1.5/libavfilter/af_astats.c --- ffmpeg-7.1.4/libavfilter/af_astats.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_astats.c 2026-06-20 02:25:39.000000000 +0000 @@ -684,8 +684,8 @@ const uint8_t * const * const data = (const uint8_t * const *)buf->extended_data; const int channels = s->nb_channels; const int samples = buf->nb_samples; - const int start = (buf->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (buf->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(buf->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(buf->ch_layout.nb_channels, jobnr + 1, nb_jobs); switch (inlink->format) { case AV_SAMPLE_FMT_DBLP: diff -Nru ffmpeg-7.1.4/libavfilter/af_asubboost.c ffmpeg-7.1.5/libavfilter/af_asubboost.c --- ffmpeg-7.1.4/libavfilter/af_asubboost.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_asubboost.c 2026-06-20 02:25:39.000000000 +0000 @@ -108,8 +108,8 @@ const double b2 = s->b2; const double a1 = -s->a1; const double a2 = -s->a2; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); const int buffer_samples = s->buffer_samples; for (int ch = start; ch < end; ch++) { diff -Nru ffmpeg-7.1.4/libavfilter/af_asupercut.c ffmpeg-7.1.5/libavfilter/af_asupercut.c --- ffmpeg-7.1.4/libavfilter/af_asupercut.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_asupercut.c 2026-06-20 02:25:39.000000000 +0000 @@ -210,8 +210,8 @@ ThreadData *td = arg; \ AVFrame *out = td->out; \ AVFrame *in = td->in; \ - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; \ - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); \ const double level = s->level; \ \ for (int ch = start; ch < end; ch++) { \ diff -Nru ffmpeg-7.1.4/libavfilter/af_atilt.c ffmpeg-7.1.5/libavfilter/af_atilt.c --- ffmpeg-7.1.4/libavfilter/af_atilt.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_atilt.c 2026-06-20 02:25:39.000000000 +0000 @@ -125,8 +125,8 @@ ThreadData *td = arg; \ AVFrame *out = td->out; \ AVFrame *in = td->in; \ - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; \ - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); \ const type level = s->level; \ \ for (int ch = start; ch < end; ch++) { \ diff -Nru ffmpeg-7.1.4/libavfilter/af_biquads.c ffmpeg-7.1.5/libavfilter/af_biquads.c --- ffmpeg-7.1.4/libavfilter/af_biquads.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_biquads.c 2026-06-20 02:25:39.000000000 +0000 @@ -1242,8 +1242,8 @@ AVFrame *buf = td->in; AVFrame *out_buf = td->out; BiquadsContext *s = ctx->priv; - const int start = (buf->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (buf->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(buf->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(buf->ch_layout.nb_channels, jobnr + 1, nb_jobs); int ch; for (ch = start; ch < end; ch++) { diff -Nru ffmpeg-7.1.4/libavfilter/af_crystalizer.c ffmpeg-7.1.5/libavfilter/af_crystalizer.c --- ffmpeg-7.1.4/libavfilter/af_crystalizer.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_crystalizer.c 2026-06-20 02:25:39.000000000 +0000 @@ -65,8 +65,8 @@ const int channels = td->channels; \ const type mult = td->mult; \ const type scale = one / (-mult + one); \ - const int start = (channels * jobnr) / nb_jobs; \ - const int end = (channels * (jobnr+1)) / nb_jobs; \ + const int start = ff_slice_pos(channels, jobnr, nb_jobs); \ + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); \ \ if (packed) { \ type *prv = p[0]; \ diff -Nru ffmpeg-7.1.4/libavfilter/af_dynaudnorm.c ffmpeg-7.1.5/libavfilter/af_dynaudnorm.c --- ffmpeg-7.1.4/libavfilter/af_dynaudnorm.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_dynaudnorm.c 2026-06-20 02:25:39.000000000 +0000 @@ -579,8 +579,8 @@ DynamicAudioNormalizerContext *s = ctx->priv; AVFrame *analyze_frame = arg; const int channels = s->channels; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); for (int c = start; c < end; c++) update_gain_history(s, c, get_max_local_gain(s, analyze_frame, c)); @@ -824,8 +824,8 @@ AVFrame *in = td->in; const int enabled = td->enabled; const int channels = s->channels; - const int start = (channels * jobnr) / nb_jobs; - const int end = (channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(channels, jobnr, nb_jobs); + const int end = ff_slice_pos(channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) amplify_channel(s, in, out, enabled, ch); diff -Nru ffmpeg-7.1.4/libavfilter/af_join.c ffmpeg-7.1.5/libavfilter/af_join.c --- ffmpeg-7.1.4/libavfilter/af_join.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_join.c 2026-06-20 02:25:39.000000000 +0000 @@ -469,7 +469,7 @@ for (j = 0; j < nb_buffers; j++) if (s->buffers[j]->buffer == buf->buffer) break; - if (j == i) + if (j == nb_buffers) s->buffers[nb_buffers++] = buf; } diff -Nru ffmpeg-7.1.4/libavfilter/af_surround.c ffmpeg-7.1.5/libavfilter/af_surround.c --- ffmpeg-7.1.4/libavfilter/af_surround.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/af_surround.c 2026-06-20 02:25:39.000000000 +0000 @@ -1261,8 +1261,8 @@ static int fft_channels(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) { AVFrame *in = arg; - const int start = (in->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (in->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(in->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(in->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) fft_channel(ctx, in, ch); @@ -1302,8 +1302,8 @@ { AudioSurroundContext *s = ctx->priv; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) { if (s->upmix) diff -Nru ffmpeg-7.1.4/libavfilter/anlms_template.c ffmpeg-7.1.5/libavfilter/anlms_template.c --- ffmpeg-7.1.4/libavfilter/anlms_template.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/anlms_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -106,8 +106,8 @@ { AudioNLMSContext *s = ctx->priv; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int c = start; c < end; c++) { const ftype *input = (const ftype *)s->frame[0]->extended_data[c]; diff -Nru ffmpeg-7.1.4/libavfilter/arls_template.c ffmpeg-7.1.5/libavfilter/arls_template.c --- ffmpeg-7.1.4/libavfilter/arls_template.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/arls_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -133,8 +133,8 @@ { AudioRLSContext *s = ctx->priv; AVFrame *out = arg; - const int start = (out->ch_layout.nb_channels * jobnr) / nb_jobs; - const int end = (out->ch_layout.nb_channels * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(out->ch_layout.nb_channels, jobnr, nb_jobs); + const int end = ff_slice_pos(out->ch_layout.nb_channels, jobnr + 1, nb_jobs); for (int c = start; c < end; c++) { const ftype *input = (const ftype *)s->frame[0]->extended_data[c]; diff -Nru ffmpeg-7.1.4/libavfilter/avf_avectorscope.c ffmpeg-7.1.5/libavfilter/avf_avectorscope.c --- ffmpeg-7.1.4/libavfilter/avf_avectorscope.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/avf_avectorscope.c 2026-06-20 02:25:39.000000000 +0000 @@ -201,8 +201,8 @@ AudioVectorScopeContext *s = ctx->priv; const int linesize = s->outpicref->linesize[0]; const int height = s->outpicref->height; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); if (s->fade[0] == 255 && s->fade[1] == 255 && s->fade[2] == 255) { for (int i = slice_start; i < slice_end; i++) diff -Nru ffmpeg-7.1.4/libavfilter/avf_showcwt.c ffmpeg-7.1.5/libavfilter/avf_showcwt.c --- ffmpeg-7.1.4/libavfilter/avf_showcwt.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/avf_showcwt.c 2026-06-20 02:25:39.000000000 +0000 @@ -455,8 +455,8 @@ const ptrdiff_t alinesize = s->outpicref->linesize[3]; const float log_factor = 1.f/logf(s->logarithmic_basis); const int count = s->frequency_band_count; - const int start = (count * jobnr) / nb_jobs; - const int end = (count * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(count, jobnr, nb_jobs); + const int end = ff_slice_pos(count, jobnr + 1, nb_jobs); const int nb_channels = s->nb_channels; const int iscale = s->intensity_scale; const int ihop_index = s->ihop_index; @@ -659,8 +659,8 @@ const float scale = 1.f / input_padding_size; const int ihop_size = s->ihop_size; const int count = s->frequency_band_count; - const int start = (count * jobnr) / nb_jobs; - const int end = (count * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(count, jobnr, nb_jobs); + const int end = ff_slice_pos(count, jobnr + 1, nb_jobs); for (int y = start; y < end; y++) { AVComplexFloat *chout = ((AVComplexFloat *)s->ch_out->extended_data[y]) + ch * ihop_size; @@ -762,7 +762,7 @@ } } - for (int n = b; n >= a; n--) { + for (int n = b - 1; n >= a; n--) { if (tkernel[n+range] != 0.f) { if (tkernel[n+range] > FLT_MIN) av_log(ctx, AV_LOG_DEBUG, "out of range kernel %g\n", tkernel[n+range]); @@ -817,6 +817,7 @@ float maximum_frequency = fminf(s->maximum_frequency, limit_frequency); float minimum_frequency = s->minimum_frequency; float scale = 1.f, factor; + double nb_samples; int ret; if (minimum_frequency >= maximum_frequency) { @@ -886,11 +887,11 @@ if (!s->frequency_band) return AVERROR(ENOMEM); - s->nb_consumed_samples = inlink->sample_rate * - frequency_band(s->frequency_band, - s->frequency_band_count, maximum_frequency - minimum_frequency, - minimum_frequency, s->frequency_scale, s->deviation); - s->nb_consumed_samples = FFMIN(s->nb_consumed_samples, 65536); + nb_samples = inlink->sample_rate * + frequency_band(s->frequency_band, + s->frequency_band_count, maximum_frequency - minimum_frequency, + minimum_frequency, s->frequency_scale, s->deviation); + s->nb_consumed_samples = av_clip(av_clipd(nb_samples, 1, 65536), 1, 65536); s->nb_threads = FFMIN(s->frequency_band_count, ff_filter_get_nb_threads(ctx)); s->nb_channels = inlink->ch_layout.nb_channels; @@ -1069,7 +1070,7 @@ for (int p = 0; p < nb_planes; p++) { ptrdiff_t linesize = s->outpicref->linesize[p]; - for (int y = 0; y < s->sono_size; y++) { + for (int y = 0; y < s->sono_size - 1; y++) { uint8_t *dst = s->outpicref->data[p] + y * linesize; memmove(dst, dst + linesize, s->w); @@ -1149,7 +1150,7 @@ case DIRECTION_RL: for (int p = 0; p < nb_planes; p++) { ptrdiff_t linesize = s->outpicref->linesize[p]; - const int size = s->w - s->pos; + const int size = FFMIN(s->pos + 1, s->sono_size); const int fill = p > 0 && p < 3 ? 128 : 0; for (int y = 0; y < s->h; y++) { @@ -1176,7 +1177,7 @@ ptrdiff_t linesize = s->outpicref->linesize[p]; const int fill = p > 0 && p < 3 ? 128 : 0; - for (int y = s->h - s->pos; y >= 0; y--) { + for (int y = FFMIN(s->pos, s->sono_size - 1); y >= 0; y--) { uint8_t *dst = s->outpicref->data[p] + y * linesize; memset(dst, fill, s->w); @@ -1231,8 +1232,8 @@ { ShowCWTContext *s = ctx->priv; const int count = s->nb_channels; - const int start = (count * jobnr) / nb_jobs; - const int end = (count * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(count, jobnr, nb_jobs); + const int end = ff_slice_pos(count, jobnr + 1, nb_jobs); for (int ch = start; ch < end; ch++) run_channel_cwt_prepare(ctx, arg, jobnr, ch); diff -Nru ffmpeg-7.1.4/libavfilter/avf_showspectrum.c ffmpeg-7.1.5/libavfilter/avf_showspectrum.c --- ffmpeg-7.1.4/libavfilter/avf_showspectrum.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/avf_showspectrum.c 2026-06-20 02:25:39.000000000 +0000 @@ -1152,6 +1152,11 @@ float scale = 1.f; ret = av_tx_init(&s->fft[i], &s->tx_fn, AV_TX_FLOAT_FFT, 0, fft_size << (!!s->stop), &scale, 0); + if (ret < 0) { + av_log(ctx, AV_LOG_ERROR, "Unable to create FFT context. " + "The window size might be too high.\n"); + return ret; + } if (s->stop) { ret = av_tx_init(&s->ifft[i], &s->itx_fn, AV_TX_FLOAT_FFT, 1, fft_size << (!!s->stop), &scale, 0); if (ret < 0) { @@ -1160,11 +1165,6 @@ return ret; } } - if (ret < 0) { - av_log(ctx, AV_LOG_ERROR, "Unable to create FFT context. " - "The window size might be too high.\n"); - return ret; - } } s->magnitudes = av_calloc(s->nb_display_channels, sizeof(*s->magnitudes)); diff -Nru ffmpeg-7.1.4/libavfilter/boxblur.c ffmpeg-7.1.5/libavfilter/boxblur.c --- ffmpeg-7.1.4/libavfilter/boxblur.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/boxblur.c 2026-06-20 02:25:39.000000000 +0000 @@ -114,9 +114,9 @@ #define CHECK_RADIUS_VAL(w_, h_, comp) \ if (comp->radius < 0 || \ - 2*comp->radius > FFMIN(w_, h_)) { \ + 2*comp->radius >= FFMIN(w_, h_)) { \ av_log(ctx, AV_LOG_ERROR, \ - "Invalid " #comp " radius value %d, must be >= 0 and <= %d\n", \ + "Invalid " #comp " radius value %d, must be >= 0 and < %d\n", \ comp->radius, FFMIN(w_, h_)/2); \ return AVERROR(EINVAL); \ } diff -Nru ffmpeg-7.1.4/libavfilter/colorchannelmixer_template.c ffmpeg-7.1.5/libavfilter/colorchannelmixer_template.c --- ffmpeg-7.1.4/libavfilter/colorchannelmixer_template.c 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/colorchannelmixer_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -54,8 +54,8 @@ AVFrame *out = td->out; const float pa = s->preserve_amount; const float max = (1 << depth) - 1; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const pixel *srcg = (const pixel *)(in->data[0] + slice_start * in->linesize[0]); const pixel *srcb = (const pixel *)(in->data[1] + slice_start * in->linesize[1]); const pixel *srcr = (const pixel *)(in->data[2] + slice_start * in->linesize[2]); @@ -172,8 +172,8 @@ AVFrame *out = td->out; const float pa = s->preserve_amount; const float max = (1 << depth) - 1; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; const uint8_t boffset = s->rgba_map[B]; diff -Nru ffmpeg-7.1.4/libavfilter/f_zmq.c ffmpeg-7.1.5/libavfilter/f_zmq.c --- ffmpeg-7.1.4/libavfilter/f_zmq.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/f_zmq.c 2026-06-20 02:25:39.000000000 +0000 @@ -156,7 +156,7 @@ while (1) { char cmd_buf[1024]; - char *recv_buf, *send_buf; + char *recv_buf = NULL, *send_buf = NULL; int recv_buf_size; Command cmd = {0}; int ret; diff -Nru ffmpeg-7.1.4/libavfilter/filters.h ffmpeg-7.1.5/libavfilter/filters.h --- ffmpeg-7.1.4/libavfilter/filters.h 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/filters.h 2026-06-20 02:25:39.000000000 +0000 @@ -533,6 +533,21 @@ int ff_filter_get_nb_threads(AVFilterContext *ctx) av_pure; /** + * Compute the boundary index for a slice when work of size total is split + * into nb_jobs slices. Returns the first index of slice jobnr, so the slice + * jobnr covers [ff_slice_pos(total, jobnr, nb_jobs), + * ff_slice_pos(total, jobnr + 1, nb_jobs)). + * + * The multiplication is performed in 64bit to avoid signed overflow of the + * total * jobnr intermediate that would occur for large dimensions and many + * slice threads. + */ +static inline int ff_slice_pos(int total, int jobnr, int nb_jobs) +{ + return (int)((int64_t)total * jobnr / nb_jobs); +} + +/** * Send a frame of data to the next filter. * * @param link the output link over which the data is being sent diff -Nru ffmpeg-7.1.4/libavfilter/vf_amplify.c ffmpeg-7.1.5/libavfilter/vf_amplify.c --- ffmpeg-7.1.4/libavfilter/vf_amplify.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_amplify.c 2026-06-20 02:25:39.000000000 +0000 @@ -98,8 +98,8 @@ const stype limit[2] = { s->llimit, s->hlimit }; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->height[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->height[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->height[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->height[p], jobnr + 1, nb_jobs); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ ptrdiff_t dst_linesize = out->linesize[p] / sizeof(type); \ \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_atadenoise.c ffmpeg-7.1.5/libavfilter/vf_atadenoise.c --- ffmpeg-7.1.4/libavfilter/vf_atadenoise.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_atadenoise.c 2026-06-20 02:25:39.000000000 +0000 @@ -345,8 +345,8 @@ const float *weights = s->weights[p]; const int h = s->planeheight[p]; const int w = s->planewidth[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *src = in->data[p] + slice_start * in->linesize[p]; uint8_t *dst = out->data[p] + slice_start * out->linesize[p]; const int thra = s->thra[p]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_backgroundkey.c ffmpeg-7.1.5/libavfilter/vf_backgroundkey.c --- ffmpeg-7.1.4/libavfilter/vf_backgroundkey.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_backgroundkey.c 2026-06-20 02:25:39.000000000 +0000 @@ -48,8 +48,8 @@ { BackgroundkeyContext *s = avctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); const int min_diff = (255 + 255 + 255) * s->similarity; const float blend = s->blend; const int hsub = s->hsub_log2; @@ -91,8 +91,8 @@ { BackgroundkeyContext *s = avctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); const int hsub = s->hsub_log2; const int vsub = s->vsub_log2; const int max = s->max; diff -Nru ffmpeg-7.1.4/libavfilter/vf_bilateral.c ffmpeg-7.1.5/libavfilter/vf_bilateral.c --- ffmpeg-7.1.4/libavfilter/vf_bilateral.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_bilateral.c 2026-06-20 02:25:39.000000000 +0000 @@ -157,8 +157,8 @@ { \ const int width = s->planewidth[plane]; \ const int height = s->planeheight[plane]; \ - const int slice_start = (height * jobnr) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ const int src_linesize = in->linesize[plane] / sizeof(type); \ const type *src = (const type *)in->data[plane]; \ float *img_temp = s->img_temp[plane]; \ @@ -229,8 +229,8 @@ { \ const int width = s->planewidth[plane]; \ const int height = s->planeheight[plane]; \ - const int slice_start = (width * jobnr) / nb_jobs; \ - const int slice_end = (width * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(width, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(width, jobnr + 1, nb_jobs); \ const int src_linesize = in->linesize[plane] / sizeof(type); \ const type *src = (const type *)in->data[plane] + slice_start; \ float *img_out_f = s->img_out_f[plane] + slice_start; \ @@ -332,8 +332,8 @@ { \ const int width = s->planewidth[plane]; \ const int height = s->planeheight[plane]; \ - const int slice_start = (height * jobnr) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ const int dst_linesize = out->linesize[plane] / sizeof(type); \ \ for (int i = slice_start; i < slice_end; i++) { \ @@ -401,8 +401,8 @@ if (!(s->planes & (1 << plane))) { if (out != in) { const int height = s->planeheight[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int width = s->planewidth[plane]; const int linesize = in->linesize[plane]; const int dst_linesize = out->linesize[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_blackdetect.c ffmpeg-7.1.5/libavfilter/vf_blackdetect.c --- ffmpeg-7.1.4/libavfilter/vf_blackdetect.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_blackdetect.c 2026-06-20 02:25:39.000000000 +0000 @@ -143,8 +143,8 @@ const int linesize = in->linesize[0]; const int w = in->width; const int h = in->height; - const int start = (h * jobnr) / nb_jobs; - const int end = (h * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(h, jobnr, nb_jobs); + const int end = ff_slice_pos(h, jobnr + 1, nb_jobs); const int size = end - start; unsigned int counter = 0; diff -Nru ffmpeg-7.1.4/libavfilter/vf_blend.c ffmpeg-7.1.5/libavfilter/vf_blend.c --- ffmpeg-7.1.4/libavfilter/vf_blend.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_blend.c 2026-06-20 02:25:39.000000000 +0000 @@ -167,8 +167,8 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) { ThreadData *td = arg; - int slice_start = (td->h * jobnr ) / nb_jobs; - int slice_end = (td->h * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(td->h, jobnr, nb_jobs); + int slice_end = ff_slice_pos(td->h, jobnr + 1, nb_jobs); int height = slice_end - slice_start; const uint8_t *top = td->top->data[td->plane]; const uint8_t *bottom = td->bottom->data[td->plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_bm3d.c ffmpeg-7.1.5/libavfilter/vf_bm3d.c --- ffmpeg-7.1.4/libavfilter/vf_bm3d.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_bm3d.c 2026-06-20 02:25:39.000000000 +0000 @@ -695,9 +695,9 @@ const int height = s->planeheight[plane]; const int block_pos_bottom = FFMAX(0, height - s->block_size); const int block_pos_right = FFMAX(0, width - s->block_size); - const int slice_start = (((height + block_step - 1) / block_step) * jobnr / nb_jobs) * block_step; + const int slice_start = ff_slice_pos((height + block_step - 1) / block_step, jobnr, nb_jobs) * block_step; const int slice_end = (jobnr == nb_jobs - 1) ? block_pos_bottom + block_step : - (((height + block_step - 1) / block_step) * (jobnr + 1) / nb_jobs) * block_step; + ff_slice_pos((height + block_step - 1) / block_step, jobnr + 1, nb_jobs) * block_step; memset(sc->num, 0, width * height * sizeof(float)); memset(sc->den, 0, width * height * sizeof(float)); diff -Nru ffmpeg-7.1.4/libavfilter/vf_bwdif.c ffmpeg-7.1.5/libavfilter/vf_bwdif.c --- ffmpeg-7.1.4/libavfilter/vf_bwdif.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_bwdif.c 2026-06-20 02:25:39.000000000 +0000 @@ -54,7 +54,7 @@ // and the frame is a multiple of 4 high then filter_line will never be called static inline int job_start(const int jobnr, const int nb_jobs, const int h) { - return jobnr >= nb_jobs ? h : ((h * jobnr) / nb_jobs) & ~3; + return jobnr >= nb_jobs ? h : (ff_slice_pos(h, jobnr, nb_jobs)) & ~3; } static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) diff -Nru ffmpeg-7.1.4/libavfilter/vf_cas.c ffmpeg-7.1.5/libavfilter/vf_cas.c --- ffmpeg-7.1.4/libavfilter/vf_cas.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_cas.c 2026-06-20 02:25:39.000000000 +0000 @@ -52,8 +52,8 @@ AVFrame *in = s->in; for (int p = 0; p < s->nb_planes; p++) { - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); const int linesize = out->linesize[p]; const int in_linesize = in->linesize[p]; const int w = s->planewidth[p]; @@ -119,8 +119,8 @@ AVFrame *in = s->in; for (int p = 0; p < s->nb_planes; p++) { - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); const int linesize = out->linesize[p] / 2; const int in_linesize = in->linesize[p] / 2; const int w = s->planewidth[p]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_chromakey.c ffmpeg-7.1.5/libavfilter/vf_chromakey.c --- ffmpeg-7.1.4/libavfilter/vf_chromakey.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_chromakey.c 2026-06-20 02:25:39.000000000 +0000 @@ -116,8 +116,8 @@ { AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); ChromakeyContext *ctx = avctx->priv; @@ -146,8 +146,8 @@ { AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); ChromakeyContext *ctx = avctx->priv; @@ -180,8 +180,8 @@ { ChromakeyContext *ctx = avctx->priv; AVFrame *frame = arg; - const int slice_start = ((frame->height >> ctx->vsub_log2) * jobnr) / nb_jobs; - const int slice_end = ((frame->height >> ctx->vsub_log2) * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height >> ctx->vsub_log2, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height >> ctx->vsub_log2, jobnr + 1, nb_jobs); int x, y, alpha; @@ -217,8 +217,8 @@ { ChromakeyContext *ctx = avctx->priv; AVFrame *frame = arg; - const int slice_start = ((frame->height >> ctx->vsub_log2) * jobnr) / nb_jobs; - const int slice_end = ((frame->height >> ctx->vsub_log2) * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height >> ctx->vsub_log2, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height >> ctx->vsub_log2, jobnr + 1, nb_jobs); const int mid = ctx->mid; double max = ctx->max; diff -Nru ffmpeg-7.1.4/libavfilter/vf_chromanr.c ffmpeg-7.1.5/libavfilter/vf_chromanr.c --- ffmpeg-7.1.4/libavfilter/vf_chromanr.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_chromanr.c 2026-06-20 02:25:39.000000000 +0000 @@ -97,8 +97,8 @@ const int thres_v = s->thres_v; \ const int h = s->planeheight[1]; \ const int w = s->planewidth[1]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ type *out_uptr = (type *)(out->data[1] + slice_start * out_ulinesize); \ type *out_vptr = (type *)(out->data[2] + slice_start * out_vlinesize); \ \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_chromashift.c ffmpeg-7.1.5/libavfilter/vf_chromashift.c --- ffmpeg-7.1.4/libavfilter/vf_chromashift.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_chromashift.c 2026-06-20 02:25:39.000000000 +0000 @@ -64,8 +64,8 @@ const int crv = s->crv; \ const int h = s->height[1]; \ const int w = s->width[1]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *su = (const type *)in->data[1]; \ const type *sv = (const type *)in->data[2]; \ type *du = (type *)out->data[1] + slice_start * ulinesize; \ @@ -106,8 +106,8 @@ const int crv = s->crv; \ const int h = s->height[1]; \ const int w = s->width[1]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *su = (const type *)in->data[1]; \ const type *sv = (const type *)in->data[2]; \ type *du = (type *)out->data[1] + slice_start * ulinesize; \ @@ -169,8 +169,8 @@ const int av = s->av; \ const int h = s->height[1]; \ const int w = s->width[1]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *sr = (const type *)in->data[2]; \ const type *sg = (const type *)in->data[0]; \ const type *sb = (const type *)in->data[1]; \ @@ -236,8 +236,8 @@ const int av = s->av; \ const int h = s->height[1]; \ const int w = s->width[1]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *sr = (const type *)in->data[2]; \ const type *sg = (const type *)in->data[0]; \ const type *sb = (const type *)in->data[1]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorbalance.c ffmpeg-7.1.5/libavfilter/vf_colorbalance.c --- ffmpeg-7.1.4/libavfilter/vf_colorbalance.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorbalance.c 2026-06-20 02:25:39.000000000 +0000 @@ -153,8 +153,8 @@ ThreadData *td = arg; AVFrame *in = td->in; AVFrame *out = td->out; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const uint8_t *srcg = in->data[0] + slice_start * in->linesize[0]; const uint8_t *srcb = in->data[1] + slice_start * in->linesize[1]; const uint8_t *srcr = in->data[2] + slice_start * in->linesize[2]; @@ -206,8 +206,8 @@ ThreadData *td = arg; AVFrame *in = td->in; AVFrame *out = td->out; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const uint16_t *srcg = (const uint16_t *)in->data[0] + slice_start * in->linesize[0] / 2; const uint16_t *srcb = (const uint16_t *)in->data[1] + slice_start * in->linesize[1] / 2; const uint16_t *srcr = (const uint16_t *)in->data[2] + slice_start * in->linesize[2] / 2; @@ -261,8 +261,8 @@ AVFrame *in = td->in; AVFrame *out = td->out; AVFilterLink *outlink = ctx->outputs[0]; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const uint8_t *srcrow = in->data[0] + slice_start * in->linesize[0]; const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; @@ -312,8 +312,8 @@ AVFrame *in = td->in; AVFrame *out = td->out; AVFilterLink *outlink = ctx->outputs[0]; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); const uint16_t *srcrow = (const uint16_t *)in->data[0] + slice_start * in->linesize[0] / 2; const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorconstancy.c ffmpeg-7.1.5/libavfilter/vf_colorconstancy.c --- ffmpeg-7.1.4/libavfilter/vf_colorconstancy.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorconstancy.c 2026-06-20 02:25:39.000000000 +0000 @@ -270,8 +270,8 @@ if (dir == DIR_X) { /** Applying gauss horizontally along each row */ const uint8_t *src = in->data[plane]; - slice_start = (height * jobnr ) / nb_jobs; - slice_end = (height * (jobnr + 1)) / nb_jobs; + slice_start = ff_slice_pos(height, jobnr, nb_jobs); + slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); for (r = slice_start; r < slice_end; ++r) { for (c = 0; c < width; ++c) { @@ -285,8 +285,8 @@ } else { /** Applying gauss vertically along each column */ const double *src = td->data[src_index][plane]; - slice_start = (width * jobnr ) / nb_jobs; - slice_end = (width * (jobnr + 1)) / nb_jobs; + slice_start = ff_slice_pos(width, jobnr, nb_jobs); + slice_end = ff_slice_pos(width, jobnr + 1, nb_jobs); for (c = slice_start; c < slice_end; ++c) { for (r = 0; r < height; ++r) { @@ -448,8 +448,8 @@ const int height = s->planeheight[plane]; const int width = s->planewidth[plane]; const int in_linesize = in->linesize[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const uint8_t *img_data = in->data[plane]; const double *src = td->data[INDEX_NORM][plane]; double *dst = td->data[INDEX_DST][plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorcontrast.c ffmpeg-7.1.5/libavfilter/vf_colorcontrast.c --- ffmpeg-7.1.4/libavfilter/vf_colorcontrast.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorcontrast.c 2026-06-20 02:25:39.000000000 +0000 @@ -94,8 +94,8 @@ AVFrame *frame = arg; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0]; const ptrdiff_t blinesize = frame->linesize[1]; const ptrdiff_t rlinesize = frame->linesize[2]; @@ -148,8 +148,8 @@ const float max = (1 << depth) - 1; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0] / 2; const ptrdiff_t blinesize = frame->linesize[1] / 2; const ptrdiff_t rlinesize = frame->linesize[2] / 2; @@ -201,8 +201,8 @@ const int step = s->step; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0]; const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; @@ -253,8 +253,8 @@ const float max = (1 << depth) - 1; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0] / 2; const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorcorrect.c ffmpeg-7.1.5/libavfilter/vf_colorcorrect.c --- ffmpeg-7.1.4/libavfilter/vf_colorcorrect.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorcorrect.c 2026-06-20 02:25:39.000000000 +0000 @@ -68,8 +68,8 @@ const float imax = s->imax; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; const uint8_t *uptr = (const uint8_t *)frame->data[1] + slice_start * ulinesize; @@ -99,8 +99,8 @@ const float imax = s->imax; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; const uint16_t *uptr = (const uint16_t *)frame->data[1] + slice_start * ulinesize; @@ -130,8 +130,8 @@ const float imax = s->imax; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; const uint8_t *uptr = (const uint8_t *)frame->data[1] + slice_start * ulinesize; @@ -166,8 +166,8 @@ const float imax = s->imax; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; const uint16_t *uptr = (const uint16_t *)frame->data[1] + slice_start * ulinesize; @@ -322,8 +322,8 @@ const int chroma_h = s->chroma_h; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0]; const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; @@ -363,8 +363,8 @@ const int chroma_h = s->chroma_h; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0] / 2; const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorize.c ffmpeg-7.1.5/libavfilter/vf_colorize.c --- ffmpeg-7.1.4/libavfilter/vf_colorize.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorize.c 2026-06-20 02:25:39.000000000 +0000 @@ -50,8 +50,8 @@ AVFrame *frame = arg; const int width = s->planewidth[0]; const int height = s->planeheight[0]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0]; uint8_t *yptr = frame->data[0] + slice_start * ylinesize; const int yv = s->c[0]; @@ -73,8 +73,8 @@ AVFrame *frame = arg; const int width = s->planewidth[0]; const int height = s->planeheight[0]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0] / 2; uint16_t *yptr = (uint16_t *)frame->data[0] + slice_start * ylinesize; const int yv = s->c[0]; @@ -96,8 +96,8 @@ AVFrame *frame = arg; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; uint8_t *uptr = frame->data[1] + slice_start * ulinesize; @@ -124,8 +124,8 @@ AVFrame *frame = arg; const int width = s->planewidth[1]; const int height = s->planeheight[1]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; uint16_t *uptr = (uint16_t *)frame->data[1] + slice_start * ulinesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorkey.c ffmpeg-7.1.5/libavfilter/vf_colorkey.c --- ffmpeg-7.1.4/libavfilter/vf_colorkey.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorkey.c 2026-06-20 02:25:39.000000000 +0000 @@ -67,8 +67,8 @@ int jobnr, int nb_jobs) \ { \ AVFrame *frame = arg; \ - const int slice_start = (frame->height * jobnr) / nb_jobs; \ - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); \ ColorkeyContext *ctx = avctx->priv; \ const float similarity = ctx->similarity; \ const float iblend = 1.f / ctx->blend; \ @@ -102,8 +102,8 @@ int jobnr, int nb_jobs) \ { \ AVFrame *frame = arg; \ - const int slice_start = (frame->height * jobnr) / nb_jobs; \ - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); \ ColorkeyContext *ctx = avctx->priv; \ const int depth = ctx->depth; \ const int max = ctx->max; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_colorlevels.c ffmpeg-7.1.5/libavfilter/vf_colorlevels.c --- ffmpeg-7.1.4/libavfilter/vf_colorlevels.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colorlevels.c 2026-06-20 02:25:39.000000000 +0000 @@ -106,8 +106,8 @@ const int linesize = s->linesize; \ const int step = s->step; \ const int process_h = td->h; \ - const int slice_start = (process_h * jobnr ) / nb_jobs; \ - const int slice_end = (process_h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(process_h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(process_h, jobnr + 1, nb_jobs); \ const int src_linesize = td->src_linesize / sizeof(type); \ const int dst_linesize = td->dst_linesize / sizeof(type); \ const type *src_r = (const type *)(td->srcrow[R]) + src_linesize * slice_start; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_colormap.c ffmpeg-7.1.5/libavfilter/vf_colormap.c --- ffmpeg-7.1.4/libavfilter/vf_colormap.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colormap.c 2026-06-20 02:25:39.000000000 +0000 @@ -309,8 +309,8 @@ const int maps = s->nb_maps; const int width = out->width; const int height = out->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int sr_linesize = in->linesize[2] / 4; const int dr_linesize = out->linesize[2] / 4; const int sg_linesize = in->linesize[0] / 4; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colormatrix.c ffmpeg-7.1.5/libavfilter/vf_colormatrix.c --- ffmpeg-7.1.4/libavfilter/vf_colormatrix.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colormatrix.c 2026-06-20 02:25:39.000000000 +0000 @@ -209,8 +209,8 @@ const int width = src->width*2; const int src_pitch = src->linesize[0]; const int dst_pitch = dst->linesize[0]; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const unsigned char *srcp = src->data[0] + slice_start * src_pitch; unsigned char *dstp = dst->data[0] + slice_start * dst_pitch; const int c2 = td->c2; @@ -245,8 +245,8 @@ AVFrame *dst = td->dst; const int height = src->height; const int width = src->width; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int src_pitchY = src->linesize[0]; const int src_pitchUV = src->linesize[1]; const unsigned char *srcpU = src->data[1] + slice_start * src_pitchUV; @@ -292,8 +292,8 @@ AVFrame *dst = td->dst; const int height = src->height; const int width = src->width; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int src_pitchY = src->linesize[0]; const int src_pitchUV = src->linesize[1]; const unsigned char *srcpU = src->data[1] + slice_start * src_pitchUV; @@ -340,8 +340,8 @@ AVFrame *dst = td->dst; const int height = FFALIGN(src->height, 2) >> 1; const int width = src->width; - const int slice_start = ((height * jobnr ) / nb_jobs) << 1; - const int slice_end = ((height * (jobnr+1)) / nb_jobs) << 1; + const int slice_start = (ff_slice_pos(height, jobnr, nb_jobs)) << 1; + const int slice_end = (ff_slice_pos(height, jobnr + 1, nb_jobs)) << 1; const int src_pitchY = src->linesize[0]; const int src_pitchUV = src->linesize[1]; const int dst_pitchY = dst->linesize[0]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_colortemperature.c ffmpeg-7.1.5/libavfilter/vf_colortemperature.c --- ffmpeg-7.1.4/libavfilter/vf_colortemperature.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_colortemperature.c 2026-06-20 02:25:39.000000000 +0000 @@ -109,8 +109,8 @@ const float mix = s->mix; const float preserve = s->preserve; const float *color = s->color; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0]; const ptrdiff_t blinesize = frame->linesize[1]; const ptrdiff_t rlinesize = frame->linesize[2]; @@ -151,8 +151,8 @@ const float preserve = s->preserve; const float mix = s->mix; const float *color = s->color; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0] / sizeof(uint16_t); const ptrdiff_t blinesize = frame->linesize[1] / sizeof(uint16_t); const ptrdiff_t rlinesize = frame->linesize[2] / sizeof(uint16_t); @@ -192,8 +192,8 @@ const float preserve = s->preserve; const float mix = s->mix; const float *color = s->color; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0] / sizeof(float); const ptrdiff_t blinesize = frame->linesize[1] / sizeof(float); const ptrdiff_t rlinesize = frame->linesize[2] / sizeof(float); @@ -237,8 +237,8 @@ const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; const uint8_t boffset = s->rgba_map[B]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0]; uint8_t *ptr = frame->data[0] + slice_start * linesize; @@ -277,8 +277,8 @@ const uint8_t roffset = s->rgba_map[R]; const uint8_t goffset = s->rgba_map[G]; const uint8_t boffset = s->rgba_map[B]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0] / sizeof(uint16_t); uint16_t *ptr = (uint16_t *)frame->data[0] + slice_start * linesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_convolution.c ffmpeg-7.1.5/libavfilter/vf_convolution.c --- ffmpeg-7.1.4/libavfilter/vf_convolution.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_convolution.c 2026-06-20 02:25:39.000000000 +0000 @@ -322,17 +322,16 @@ int x; for (x = 0; x < width; x++) { - int sum = AV_RN16A(&c[0][2 * x]) * matrix[0] + - AV_RN16A(&c[1][2 * x]) * matrix[1] + - AV_RN16A(&c[2][2 * x]) * matrix[2] + - AV_RN16A(&c[3][2 * x]) * matrix[3] + - AV_RN16A(&c[4][2 * x]) * matrix[4] + - AV_RN16A(&c[5][2 * x]) * matrix[5] + - AV_RN16A(&c[6][2 * x]) * matrix[6] + - AV_RN16A(&c[7][2 * x]) * matrix[7] + - AV_RN16A(&c[8][2 * x]) * matrix[8]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip(sum, 0, peak); + unsigned sum = (unsigned)AV_RN16A(&c[0][2 * x]) * matrix[0] + + (unsigned)AV_RN16A(&c[1][2 * x]) * matrix[1] + + (unsigned)AV_RN16A(&c[2][2 * x]) * matrix[2] + + (unsigned)AV_RN16A(&c[3][2 * x]) * matrix[3] + + (unsigned)AV_RN16A(&c[4][2 * x]) * matrix[4] + + (unsigned)AV_RN16A(&c[5][2 * x]) * matrix[5] + + (unsigned)AV_RN16A(&c[6][2 * x]) * matrix[6] + + (unsigned)AV_RN16A(&c[7][2 * x]) * matrix[7] + + (unsigned)AV_RN16A(&c[8][2 * x]) * matrix[8]; + dst[x] = av_clip((int)sum * rdiv + bias + 0.5f, 0, peak); } } @@ -345,13 +344,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 25; i++) - sum += AV_RN16A(&c[i][2 * x]) * matrix[i]; + sum += (unsigned)AV_RN16A(&c[i][2 * x]) * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip(sum, 0, peak); + dst[x] = av_clip((int)sum * rdiv + bias + 0.5f, 0, peak); } } @@ -364,13 +363,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 49; i++) - sum += AV_RN16A(&c[i][2 * x]) * matrix[i]; + sum += (unsigned)AV_RN16A(&c[i][2 * x]) * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip(sum, 0, peak); + dst[x] = av_clip((int)sum * rdiv + bias + 0.5f, 0, peak); } } @@ -383,13 +382,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 2 * radius + 1; i++) - sum += AV_RN16A(&c[i][2 * x]) * matrix[i]; + sum += (unsigned)AV_RN16A(&c[i][2 * x]) * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip(sum, 0, peak); + dst[x] = av_clip((int)sum * rdiv + bias + 0.5f, 0, peak); } } @@ -398,7 +397,7 @@ const uint8_t *c[], int peak, int radius, int dstride, int stride, int size) { - DECLARE_ALIGNED(64, int, sum)[16]; + DECLARE_ALIGNED(64, unsigned, sum)[16]; uint16_t *dst = (uint16_t *)dstp; const int width = FFMIN(16, size); @@ -407,12 +406,11 @@ memset(sum, 0, sizeof(sum)); for (int i = 0; i < 2 * radius + 1; i++) { for (int off16 = 0; off16 < width; off16++) - sum[off16] += AV_RN16A(&c[i][0 + y * stride + off16 * 2]) * matrix[i]; + sum[off16] += (unsigned)AV_RN16A(&c[i][0 + y * stride + off16 * 2]) * matrix[i]; } for (int off16 = 0; off16 < width; off16++) { - sum[off16] = (int)(sum[off16] * rdiv + bias + 0.5f); - dst[off16] = av_clip(sum[off16], 0, peak); + dst[off16] = av_clip((int)sum[off16] * rdiv + bias + 0.5f, 0, peak); } dst += dstride / 2; } @@ -426,13 +424,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 49; i++) - sum += c[i][x] * matrix[i]; + sum += (unsigned)c[i][x] * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip_uint8(sum); + dst[x] = av_clip_uint8((int)sum * rdiv + bias + 0.5f); } } @@ -444,13 +442,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 25; i++) - sum += c[i][x] * matrix[i]; + sum += (unsigned)c[i][x] * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip_uint8(sum); + dst[x] = av_clip_uint8((int)sum * rdiv + bias + 0.5f); } } @@ -465,11 +463,10 @@ int x; for (x = 0; x < width; x++) { - int sum = c0[x] * matrix[0] + c1[x] * matrix[1] + c2[x] * matrix[2] + - c3[x] * matrix[3] + c4[x] * matrix[4] + c5[x] * matrix[5] + - c6[x] * matrix[6] + c7[x] * matrix[7] + c8[x] * matrix[8]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip_uint8(sum); + unsigned sum = (unsigned)c0[x] * matrix[0] + (unsigned)c1[x] * matrix[1] + (unsigned)c2[x] * matrix[2] + + (unsigned)c3[x] * matrix[3] + (unsigned)c4[x] * matrix[4] + (unsigned)c5[x] * matrix[5] + + (unsigned)c6[x] * matrix[6] + (unsigned)c7[x] * matrix[7] + (unsigned)c8[x] * matrix[8]; + dst[x] = av_clip_uint8((int)sum * rdiv + bias + 0.5f); } } @@ -481,13 +478,13 @@ int x; for (x = 0; x < width; x++) { - int i, sum = 0; + int i; + unsigned sum = 0; for (i = 0; i < 2 * radius + 1; i++) - sum += c[i][x] * matrix[i]; + sum += (unsigned)c[i][x] * matrix[i]; - sum = (int)(sum * rdiv + bias + 0.5f); - dst[x] = av_clip_uint8(sum); + dst[x] = av_clip_uint8((int)sum * rdiv + bias + 0.5f); } } @@ -496,19 +493,18 @@ const uint8_t *c[], int peak, int radius, int dstride, int stride, int size) { - DECLARE_ALIGNED(64, int, sum)[16]; + DECLARE_ALIGNED(64, unsigned, sum)[16]; for (int y = 0; y < height; y++) { memset(sum, 0, sizeof(sum)); for (int i = 0; i < 2 * radius + 1; i++) { for (int off16 = 0; off16 < 16; off16++) - sum[off16] += c[i][0 + y * stride + off16] * matrix[i]; + sum[off16] += (unsigned)c[i][0 + y * stride + off16] * matrix[i]; } for (int off16 = 0; off16 < 16; off16++) { - sum[off16] = (int)(sum[off16] * rdiv + bias + 0.5f); - dst[off16] = av_clip_uint8(sum[off16]); + dst[off16] = av_clip_uint8((int)sum[off16] * rdiv + bias + 0.5f); } dst += dstride; } @@ -582,8 +578,8 @@ const int dstride = out->linesize[plane]; const int sizeh = mode == MATRIX_COLUMN ? width : height; const int sizew = mode == MATRIX_COLUMN ? height : width; - const int slice_start = (sizeh * jobnr) / nb_jobs; - const int slice_end = (sizeh * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(sizeh, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(sizeh, jobnr + 1, nb_jobs); const float rdiv = s->rdiv[plane]; const float bias = s->bias[plane]; const uint8_t *src = in->data[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_convolve.c ffmpeg-7.1.5/libavfilter/vf_convolve.c --- ffmpeg-7.1.4/libavfilter/vf_convolve.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_convolve.c 2026-06-20 02:25:39.000000000 +0000 @@ -189,8 +189,8 @@ AVComplexFloat *hdata_out = td->hdata_out; const int plane = td->plane; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y; for (y = start; y < end; y++) { @@ -376,8 +376,8 @@ AVComplexFloat *vdata_out = td->vdata_out; const int plane = td->plane; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y, x; for (y = start; y < end; y++) { @@ -401,8 +401,8 @@ AVComplexFloat *vdata_in = td->vdata_in; const int plane = td->plane; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y, x; for (y = start; y < end; y++) { @@ -425,8 +425,8 @@ AVComplexFloat *hdata_in = td->hdata_in; const int plane = td->plane; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y; for (y = start; y < end; y++) { @@ -518,8 +518,8 @@ AVComplexFloat *filter = td->vdata_in; const float noise = s->noise; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y, x; for (y = start; y < end; y++) { @@ -548,8 +548,8 @@ AVComplexFloat *filter = td->vdata_in; const int n = td->n; const float scale = 1.f / (n * n); - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); for (int y = start; y < end; y++) { int yn = y * n; @@ -578,8 +578,8 @@ AVComplexFloat *filter = td->vdata_in; const float noise = s->noise; const int n = td->n; - int start = (n * jobnr) / nb_jobs; - int end = (n * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(n, jobnr, nb_jobs); + int end = ff_slice_pos(n, jobnr + 1, nb_jobs); int y, x; for (y = start; y < end; y++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_corr.c ffmpeg-7.1.5/libavfilter/vf_corr.c --- ffmpeg-7.1.4/libavfilter/vf_corr.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_corr.c 2026-06-20 02:25:39.000000000 +0000 @@ -101,8 +101,8 @@ sizeof(type); \ const int h = s->planeheight[c]; \ const int w = s->planewidth[c]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *src1 = (const type *)master->data[c] + \ linesize1 * slice_start; \ const type *src2 = (const type *)ref->data[c] + \ @@ -147,8 +147,8 @@ const type *src2 = (const type *)ref->data[c]; \ const int h = s->planeheight[c]; \ const int w = s->planewidth[c]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const float scale = 1.f / s->max[c]; \ const float mean1 = s->mean[c][0]; \ const float mean2 = s->mean[c][1]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_curves.c ffmpeg-7.1.5/libavfilter/vf_curves.c --- ffmpeg-7.1.4/libavfilter/vf_curves.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_curves.c 2026-06-20 02:25:39.000000000 +0000 @@ -757,8 +757,8 @@ const uint8_t g = curves->rgba_map[G]; const uint8_t b = curves->rgba_map[B]; const uint8_t a = curves->rgba_map[A]; - const int slice_start = (in->height * jobnr ) / nb_jobs; - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); if (curves->is_16bit) { for (y = slice_start; y < slice_end; y++) { @@ -805,8 +805,8 @@ const uint8_t g = curves->rgba_map[G]; const uint8_t b = curves->rgba_map[B]; const uint8_t a = curves->rgba_map[A]; - const int slice_start = (in->height * jobnr ) / nb_jobs; - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); if (curves->is_16bit) { for (y = slice_start; y < slice_end; y++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_datascope.c ffmpeg-7.1.5/libavfilter/vf_datascope.c --- ffmpeg-7.1.4/libavfilter/vf_datascope.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_datascope.c 2026-06-20 02:25:39.000000000 +0000 @@ -190,8 +190,8 @@ const int W = (outlink->w - xoff) / (C * 10); const int H = (outlink->h - yoff) / (PP * 12); const char *format[4] = {"%02X\n", "%04X\n", "%03d\n", "%05d\n"}; - const int slice_start = (W * jobnr) / nb_jobs; - const int slice_end = (W * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(W, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(W, jobnr + 1, nb_jobs); int x, y, p; for (y = 0; y < H && (y + s->y < inlink->h); y++) { @@ -237,8 +237,8 @@ const int W = (outlink->w - xoff) / (C * 10); const int H = (outlink->h - yoff) / (PP * 12); const char *format[4] = {"%02X\n", "%04X\n", "%03d\n", "%05d\n"}; - const int slice_start = (W * jobnr) / nb_jobs; - const int slice_end = (W * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(W, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(W, jobnr + 1, nb_jobs); int x, y, p; for (y = 0; y < H && (y + s->y < inlink->h); y++) { @@ -280,8 +280,8 @@ const int W = (outlink->w - xoff) / (C * 10); const int H = (outlink->h - yoff) / (PP * 12); const char *format[4] = {"%02X\n", "%04X\n", "%03d\n", "%05d\n"}; - const int slice_start = (W * jobnr) / nb_jobs; - const int slice_end = (W * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(W, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(W, jobnr + 1, nb_jobs); int x, y, p; for (y = 0; y < H && (y + s->y < inlink->h); y++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_dctdnoiz.c ffmpeg-7.1.5/libavfilter/vf_dctdnoiz.c --- ffmpeg-7.1.4/libavfilter/vf_dctdnoiz.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_dctdnoiz.c 2026-06-20 02:25:39.000000000 +0000 @@ -675,8 +675,8 @@ const ThreadData *td = arg; const int w = s->pr_width; const int h = s->pr_height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const int slice_start_ctx = FFMAX(slice_start - s->bsize + 1, 0); const int slice_end_ctx = FFMIN(slice_end, h - s->bsize + 1); const int slice_h = slice_end_ctx - slice_start_ctx; diff -Nru ffmpeg-7.1.4/libavfilter/vf_deband.c ffmpeg-7.1.5/libavfilter/vf_deband.c --- ffmpeg-7.1.4/libavfilter/vf_deband.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_deband.c 2026-06-20 02:25:39.000000000 +0000 @@ -143,8 +143,8 @@ const int dst_linesize = out->linesize[p]; const int src_linesize = in->linesize[p]; const int thr = s->thr[p]; - const int start = (s->planeheight[p] * jobnr ) / nb_jobs; - const int end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); + const int end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); const int w = s->planewidth[p] - 1; const int h = s->planeheight[p] - 1; @@ -184,8 +184,8 @@ ThreadData *td = arg; AVFrame *in = td->in; AVFrame *out = td->out; - const int start = (s->planeheight[0] * jobnr ) / nb_jobs; - const int end = (s->planeheight[0] * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(s->planeheight[0], jobnr, nb_jobs); + const int end = ff_slice_pos(s->planeheight[0], jobnr + 1, nb_jobs); int x, y, p; for (y = start; y < end; y++) { @@ -249,8 +249,8 @@ ThreadData *td = arg; AVFrame *in = td->in; AVFrame *out = td->out; - const int start = (s->planeheight[0] * jobnr ) / nb_jobs; - const int end = (s->planeheight[0] * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(s->planeheight[0], jobnr, nb_jobs); + const int end = ff_slice_pos(s->planeheight[0], jobnr + 1, nb_jobs); int x, y, p, z; for (y = start; y < end; y++) { @@ -324,8 +324,8 @@ const int dst_linesize = out->linesize[p] / 2; const int src_linesize = in->linesize[p] / 2; const int thr = s->thr[p]; - const int start = (s->planeheight[p] * jobnr ) / nb_jobs; - const int end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); + const int end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); const int w = s->planewidth[p] - 1; const int h = s->planeheight[p] - 1; diff -Nru ffmpeg-7.1.4/libavfilter/vf_dedot.c ffmpeg-7.1.5/libavfilter/vf_dedot.c --- ffmpeg-7.1.4/libavfilter/vf_dedot.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_dedot.c 2026-06-20 02:25:39.000000000 +0000 @@ -84,8 +84,8 @@ int p3_linesize = s->frames[3]->linesize[0] / div; \ int p4_linesize = s->frames[4]->linesize[0] / div; \ const int h = s->planeheight[0]; \ - int slice_start = (h * jobnr) / nb_jobs; \ - int slice_end = (h * (jobnr+1)) / nb_jobs; \ + int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ type *p0 = (type *)s->frames[0]->data[0]; \ type *p1 = (type *)s->frames[1]->data[0]; \ type *p3 = (type *)s->frames[3]->data[0]; \ @@ -159,8 +159,8 @@ AVFrame *out = td->out; \ const int plane = td->plane; \ const int h = s->planeheight[plane]; \ - int slice_start = (h * jobnr) / nb_jobs; \ - int slice_end = (h * (jobnr+1)) / nb_jobs; \ + int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ int src_linesize = s->frames[2]->linesize[plane] / div; \ int dst_linesize = out->linesize[plane] / div; \ int p0_linesize = s->frames[0]->linesize[plane] / div; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_despill.c ffmpeg-7.1.5/libavfilter/vf_despill.c --- ffmpeg-7.1.4/libavfilter/vf_despill.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_despill.c 2026-06-20 02:25:39.000000000 +0000 @@ -43,8 +43,8 @@ DespillContext *s = ctx->priv; AVFrame *frame = arg; const int ro = s->co[0], go = s->co[1], bo = s->co[2], ao = s->co[3]; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); const float brightness = s->brightness; const float redscale = s->redscale; const float greenscale = s->greenscale; diff -Nru ffmpeg-7.1.4/libavfilter/vf_displace.c ffmpeg-7.1.5/libavfilter/vf_displace.c --- ffmpeg-7.1.4/libavfilter/vf_displace.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_displace.c 2026-06-20 02:25:39.000000000 +0000 @@ -89,8 +89,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int h = s->height[plane]; const int w = s->width[plane]; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const int dlinesize = out->linesize[plane]; const int slinesize = in->linesize[plane]; const int xlinesize = xin->linesize[plane]; @@ -170,8 +170,8 @@ const int step = s->step; const int h = s->height[0]; const int w = s->width[0]; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const int dlinesize = out->linesize[0]; const int slinesize = in->linesize[0]; const int xlinesize = xin->linesize[0]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_drawtext.c ffmpeg-7.1.5/libavfilter/vf_drawtext.c --- ffmpeg-7.1.4/libavfilter/vf_drawtext.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_drawtext.c 2026-06-20 02:25:39.000000000 +0000 @@ -741,11 +741,13 @@ FT_Vector shift; struct AVTreeNode *node = NULL; int ret = 0; + int cached = 0; /* get glyph */ dummy.code = code; dummy.fontsize = s->fontsize; glyph = av_tree_find(s->glyphs, &dummy, glyph_cmp, NULL); + cached = !!glyph; if (!glyph) { if (FT_Load_Glyph(s->face, code, s->ft_load_flags)) { return AVERROR(EINVAL); @@ -762,11 +764,12 @@ goto error; } if (s->borderw) { - glyph->border_glyph = glyph->glyph; - if (FT_Glyph_StrokeBorder(&glyph->border_glyph, s->stroker, 0, 0)) { + FT_Glyph tmp = glyph->glyph; + if (FT_Glyph_StrokeBorder(&tmp, s->stroker, 0, 0)) { ret = AVERROR_EXTERNAL; goto error; } + glyph->border_glyph = tmp; } /* measure text height to calculate text_height (or the maximum text height) */ FT_Glyph_Get_CBox(glyph->glyph, FT_GLYPH_BBOX_SUBPIXELS, &glyph->bbox); @@ -777,13 +780,15 @@ goto error; } av_tree_insert(&s->glyphs, glyph, glyph_cmp, &node); + cached = 1; } else { if (s->borderw && !glyph->border_glyph) { - glyph->border_glyph = glyph->glyph; - if (FT_Glyph_StrokeBorder(&glyph->border_glyph, s->stroker, 0, 0)) { + FT_Glyph tmp = glyph->glyph; + if (FT_Glyph_StrokeBorder(&tmp, s->stroker, 0, 0)) { ret = AVERROR_EXTERNAL; goto error; } + glyph->border_glyph = tmp; } } @@ -801,11 +806,11 @@ goto error; } glyph->bglyph[idx] = (FT_BitmapGlyph)tmp_glyph; - if (glyph->bglyph[idx]->bitmap.pixel_mode == FT_PIXEL_MODE_MONO) { - av_log(ctx, AV_LOG_ERROR, "Monocromatic (1bpp) fonts are not supported.\n"); - ret = AVERROR(EINVAL); - goto error; - } + } + if (glyph->bglyph[idx]->bitmap.pixel_mode == FT_PIXEL_MODE_MONO) { + av_log(ctx, AV_LOG_ERROR, "Monocromatic (1bpp) fonts are not supported.\n"); + ret = AVERROR(EINVAL); + goto error; } if (s->borderw && !glyph->border_bglyph[idx]) { FT_Glyph tmp_glyph = glyph->border_glyph; @@ -822,10 +827,13 @@ return 0; error: - if (glyph && glyph->glyph) - FT_Done_Glyph(glyph->glyph); - - av_freep(&glyph); + if (glyph && !cached) { + if (glyph->border_glyph && glyph->border_glyph != glyph->glyph) + FT_Done_Glyph(glyph->border_glyph); + if (glyph->glyph) + FT_Done_Glyph(glyph->glyph); + av_freep(&glyph); + } av_freep(&node); return ret; } @@ -1088,10 +1096,10 @@ if (glyph->border_glyph != NULL) { for (int t = 0; t < 16; ++t) { - if (glyph->border_bglyph[t] != NULL) { - FT_Done_Glyph((FT_Glyph)glyph->border_bglyph[t]); - glyph->border_bglyph[t] = NULL; - } + FT_Glyph bbg = (FT_Glyph)glyph->border_bglyph[t]; + if (bbg && bbg != glyph->border_glyph) + FT_Done_Glyph(bbg); + glyph->border_bglyph[t] = NULL; } FT_Done_Glyph(glyph->border_glyph); glyph->border_glyph = NULL; @@ -1103,16 +1111,17 @@ { Glyph *glyph = elem; - FT_Done_Glyph(glyph->glyph); - FT_Done_Glyph(glyph->border_glyph); for (int t = 0; t < 16; ++t) { - if (glyph->bglyph[t] != NULL) { - FT_Done_Glyph((FT_Glyph)glyph->bglyph[t]); - } - if (glyph->border_bglyph[t] != NULL) { - FT_Done_Glyph((FT_Glyph)glyph->border_bglyph[t]); - } + FT_Glyph bg = (FT_Glyph)glyph->bglyph[t]; + FT_Glyph bbg = (FT_Glyph)glyph->border_bglyph[t]; + if (bg && bg != glyph->glyph && bg != glyph->border_glyph) + FT_Done_Glyph(bg); + if (bbg && bbg != glyph->glyph && bbg != glyph->border_glyph) + FT_Done_Glyph(bbg); } + if (glyph->border_glyph && glyph->border_glyph != glyph->glyph) + FT_Done_Glyph(glyph->border_glyph); + FT_Done_Glyph(glyph->glyph); av_free(elem); return 0; } @@ -1550,6 +1559,15 @@ done: av_free(textdup); + if (ret < 0) { + if (s->lines) { + for (int l = 0; l < s->line_count; ++l) + hb_destroy(&s->lines[l].hb_data); + } + av_freep(&s->lines); + av_freep(&s->tab_clusters); + s->line_count = 0; + } return ret; } @@ -1740,7 +1758,7 @@ ret = load_glyph(ctx, &glyph, hb->glyph_info[t].codepoint, shift_x64, shift_y64); if (ret != 0) { - return ret; + goto fail; } g_info->code = hb->glyph_info[t].codepoint; g_info->x = (x64 + true_x) >> 6; @@ -1802,23 +1820,25 @@ if (s->shadowx || s->shadowy) { if ((ret = draw_glyphs(s, frame, &shadowcolor, &metrics, s->shadowx, s->shadowy, s->borderw)) < 0) { - return ret; + goto fail; } } if (s->borderw) { if ((ret = draw_glyphs(s, frame, &bordercolor, &metrics, 0, 0, s->borderw)) < 0) { - return ret; + goto fail; } } if ((ret = draw_glyphs(s, frame, &fontcolor, &metrics, 0, 0, 0)) < 0) { - return ret; + goto fail; } } + ret = 0; +fail: // FREE data structures for (int l = 0; l < s->line_count; ++l) { TextLine *line = &s->lines[l]; @@ -1827,8 +1847,9 @@ } av_freep(&s->lines); av_freep(&s->tab_clusters); + s->line_count = 0; - return 0; + return ret; } static int filter_frame(AVFilterLink *inlink, AVFrame *frame) diff -Nru ffmpeg-7.1.4/libavfilter/vf_epx.c ffmpeg-7.1.5/libavfilter/vf_epx.c --- ffmpeg-7.1.4/libavfilter/vf_epx.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_epx.c 2026-06-20 02:25:39.000000000 +0000 @@ -48,8 +48,8 @@ ThreadData *td = arg; const AVFrame *in = td->in; AVFrame *out = td->out; - const int slice_start = (in->height * jobnr ) / nb_jobs; - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); for (int p = 0; p < 1; p++) { const int width = in->width; @@ -115,8 +115,8 @@ ThreadData *td = arg; const AVFrame *in = td->in; AVFrame *out = td->out; - const int slice_start = (in->height * jobnr ) / nb_jobs; - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); for (int p = 0; p < 1; p++) { const int width = in->width; diff -Nru ffmpeg-7.1.4/libavfilter/vf_estdif.c ffmpeg-7.1.5/libavfilter/vf_estdif.c --- ffmpeg-7.1.4/libavfilter/vf_estdif.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_estdif.c 2026-06-20 02:25:39.000000000 +0000 @@ -354,8 +354,8 @@ const int height = s->planeheight[plane]; const int src_linesize = in->linesize[plane]; const int dst_linesize = out->linesize[plane]; - const int start = (height * jobnr) / nb_jobs; - const int end = (height * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(height, jobnr, nb_jobs); + const int end = ff_slice_pos(height, jobnr + 1, nb_jobs); const uint8_t *prev_line, *prev2_line, *next_line, *next2_line, *in_line; const uint8_t *prev3_line, *next3_line; uint8_t *out_line; diff -Nru ffmpeg-7.1.4/libavfilter/vf_exposure.c ffmpeg-7.1.5/libavfilter/vf_exposure.c --- ffmpeg-7.1.4/libavfilter/vf_exposure.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_exposure.c 2026-06-20 02:25:39.000000000 +0000 @@ -46,8 +46,8 @@ ThreadData *td = arg; const int width = td->out->width; const int height = td->out->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const float black = s->black; const float scale = s->scale; diff -Nru ffmpeg-7.1.4/libavfilter/vf_fade.c ffmpeg-7.1.5/libavfilter/vf_fade.c --- ffmpeg-7.1.4/libavfilter/vf_fade.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_fade.c 2026-06-20 02:25:39.000000000 +0000 @@ -234,8 +234,8 @@ { FadeContext *s = ctx->priv; AVFrame *frame = arg; - int slice_start = (frame->height * jobnr ) / nb_jobs; - int slice_end = (frame->height * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); if (s->is_planar && s->alpha) filter_rgb_planar(s, frame, slice_start, slice_end, 1); @@ -254,8 +254,8 @@ { FadeContext *s = ctx->priv; AVFrame *frame = arg; - int slice_start = (frame->height * jobnr ) / nb_jobs; - int slice_end = (frame->height * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); int i, j; for (int k = 0; k < 1 + 2 * (s->is_planar && s->is_rgb); k++) { @@ -279,8 +279,8 @@ { FadeContext *s = ctx->priv; AVFrame *frame = arg; - int slice_start = (frame->height * jobnr ) / nb_jobs; - int slice_end = (frame->height * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); int i, j; for (int k = 0; k < 1 + 2 * (s->is_planar && s->is_rgb); k++) { @@ -307,8 +307,8 @@ int i, j, plane; const int width = AV_CEIL_RSHIFT(frame->width, s->hsub); const int height= AV_CEIL_RSHIFT(frame->height, s->vsub); - int slice_start = (height * jobnr ) / nb_jobs; - int slice_end = FFMIN(((height * (jobnr+1)) / nb_jobs), frame->height); + int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + int slice_end = FFMIN((ff_slice_pos(height, jobnr + 1, nb_jobs)), frame->height); for (plane = 1; plane < 3; plane++) { for (i = slice_start; i < slice_end; i++) { @@ -336,8 +336,8 @@ const int height= AV_CEIL_RSHIFT(frame->height, s->vsub); const int mid = 1 << (s->depth - 1); const int add = ((mid << 1) + 1) << 15; - int slice_start = (height * jobnr ) / nb_jobs; - int slice_end = FFMIN(((height * (jobnr+1)) / nb_jobs), frame->height); + int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + int slice_end = FFMIN((ff_slice_pos(height, jobnr + 1, nb_jobs)), frame->height); for (plane = 1; plane < 3; plane++) { for (i = slice_start; i < slice_end; i++) { @@ -358,8 +358,8 @@ FadeContext *s = ctx->priv; AVFrame *frame = arg; int plane = s->is_packed_rgb ? 0 : A; - int slice_start = (frame->height * jobnr ) / nb_jobs; - int slice_end = (frame->height * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); int i, j; for (i = slice_start; i < slice_end; i++) { @@ -383,8 +383,8 @@ FadeContext *s = ctx->priv; AVFrame *frame = arg; int plane = s->is_packed_rgb ? 0 : A; - int slice_start = (frame->height * jobnr ) / nb_jobs; - int slice_end = (frame->height * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); int i, j; for (i = slice_start; i < slice_end; i++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_fftdnoiz.c ffmpeg-7.1.5/libavfilter/vf_fftdnoiz.c --- ffmpeg-7.1.4/libavfilter/vf_fftdnoiz.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_fftdnoiz.c 2026-06-20 02:25:39.000000000 +0000 @@ -549,8 +549,8 @@ PlaneContext *p = &s->planes[plane]; const int nox = p->nox; const int noy = p->noy; - const int slice_start = (noy * jobnr) / nb_jobs; - const int slice_end = (noy * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(noy, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(noy, jobnr + 1, nb_jobs); if (!((1 << plane) & s->planesf) || ctx->is_disabled) continue; diff -Nru ffmpeg-7.1.4/libavfilter/vf_fftfilt.c ffmpeg-7.1.5/libavfilter/vf_fftfilt.c --- ffmpeg-7.1.4/libavfilter/vf_fftfilt.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_fftfilt.c 2026-06-20 02:25:39.000000000 +0000 @@ -133,8 +133,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int w = s->planewidth[plane]; const int h = s->planeheight[plane]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) { const uint8_t *src = in->data[plane] + i * in->linesize[plane]; @@ -164,8 +164,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int w = s->planewidth[plane]; const int h = s->planeheight[plane]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) { const uint16_t *src = (const uint16_t *)(in->data[plane] + i * in->linesize[plane]); @@ -195,8 +195,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int w = s->planewidth[plane]; const int h = s->planeheight[plane]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) s->ihtx_fn(s->ihrdft[jobnr][plane], @@ -226,8 +226,8 @@ int max = (1 << s->depth) - 1; const int w = s->planewidth[plane]; const int h = s->planeheight[plane]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) s->ihtx_fn(s->ihrdft[jobnr][plane], @@ -396,8 +396,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int height = s->rdft_hlen[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); /*Change user defined parameters*/ for (int i = slice_start; i < slice_end; i++) { const double *weight = s->weight[plane] + i * s->rdft_vlen[plane]; @@ -420,8 +420,8 @@ const int vlen = s->rdft_vlen[plane]; const int hstride = s->rdft_hstride[plane]; const int vstride = s->rdft_vstride[plane]; - const int slice_start = (hlen * jobnr) / nb_jobs; - const int slice_end = (hlen * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(hlen, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(hlen, jobnr + 1, nb_jobs); const int h = s->planeheight[plane]; float *hdata = s->rdft_hdata_out[plane]; float *vdata = s->rdft_vdata_in[plane]; @@ -442,8 +442,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int height = s->rdft_hlen[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) s->vtx_fn(s->vrdft[jobnr][plane], @@ -461,8 +461,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int height = s->rdft_hlen[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) s->ivtx_fn(s->ivrdft[jobnr][plane], @@ -482,8 +482,8 @@ const int hlen = s->rdft_hlen[plane]; const int hstride = s->rdft_hstride[plane]; const int vstride = s->rdft_vstride[plane]; - const int slice_start = (hlen * jobnr) / nb_jobs; - const int slice_end = (hlen * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(hlen, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(hlen, jobnr + 1, nb_jobs); const int h = s->planeheight[plane]; float *hdata = s->rdft_hdata_in[plane]; float *vdata = s->rdft_vdata_in[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_gblur.c ffmpeg-7.1.5/libavfilter/vf_gblur.c --- ffmpeg-7.1.4/libavfilter/vf_gblur.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_gblur.c 2026-06-20 02:25:39.000000000 +0000 @@ -61,8 +61,8 @@ ThreadData *td = arg; const int height = td->height; const int width = td->width; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const float boundaryscale = s->boundaryscale; const int steps = s->steps; const float nu = s->nu; @@ -83,8 +83,8 @@ ThreadData *td = arg; const int height = td->height; const int width = td->width; - const int slice_start = (width * jobnr ) / nb_jobs; - const int slice_end = (width * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(width, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(width, jobnr + 1, nb_jobs); const float boundaryscale = s->boundaryscaleV; const int steps = s->steps; const float nu = s->nuV; @@ -105,8 +105,8 @@ const int height = td->height; const int width = td->width; const int awidth = FFALIGN(width, 64); - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const float postscale = s->postscale * s->postscaleV; const int slice_size = slice_end - slice_start; diff -Nru ffmpeg-7.1.4/libavfilter/vf_geq.c ffmpeg-7.1.5/libavfilter/vf_geq.c --- ffmpeg-7.1.4/libavfilter/vf_geq.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_geq.c 2026-06-20 02:25:39.000000000 +0000 @@ -403,8 +403,8 @@ const int width = td->width; const int plane = td->plane; const int linesize = td->linesize; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); int x, y; double values[VAR_VARS_NB]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_grayworld.c ffmpeg-7.1.5/libavfilter/vf_grayworld.c --- ffmpeg-7.1.4/libavfilter/vf_grayworld.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_grayworld.c 2026-06-20 02:25:39.000000000 +0000 @@ -126,8 +126,8 @@ AVFrame *in = td->in; AVFrame *out = td->out; AVFilterLink *outlink = ctx->outputs[0]; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); float rgb[3], lab[3]; for (int i = slice_start; i < slice_end; i++) { @@ -193,8 +193,8 @@ ThreadData *td = arg; AVFrame *out = td->out; AVFilterLink *outlink = ctx->outputs[0]; - const int slice_start = (out->height * jobnr) / nb_jobs; - const int slice_end = (out->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); float rgb[3], lab[3]; for (int i = slice_start; i < slice_end; i++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_guided.c ffmpeg-7.1.5/libavfilter/vf_guided.c --- ffmpeg-7.1.4/libavfilter/vf_guided.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_guided.c 2026-06-20 02:25:39.000000000 +0000 @@ -113,8 +113,8 @@ const int height = t->height; const int src_stride = t->srcStride; const int dst_stride = t->dstStride; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int radius = s->radius; const float *src = t->src; float *dst = t->dst; diff -Nru ffmpeg-7.1.4/libavfilter/vf_hqx.c ffmpeg-7.1.5/libavfilter/vf_hqx.c --- ffmpeg-7.1.4/libavfilter/vf_hqx.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_hqx.c 2026-06-20 02:25:39.000000000 +0000 @@ -388,8 +388,8 @@ const uint32_t *r2y = td->rgbtoyuv; const int height = in->height; const int width = in->width; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int dst_linesize = out->linesize[0]; const int src_linesize = in->linesize[0]; uint8_t *dst = out->data[0] + slice_start * dst_linesize * n; diff -Nru ffmpeg-7.1.4/libavfilter/vf_hsvkey.c ffmpeg-7.1.5/libavfilter/vf_hsvkey.c --- ffmpeg-7.1.4/libavfilter/vf_hsvkey.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_hsvkey.c 2026-06-20 02:25:39.000000000 +0000 @@ -88,8 +88,8 @@ { HSVKeyContext *s = avctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); const int hsub_log2 = s->hsub_log2; const int vsub_log2 = s->vsub_log2; const float hue = s->hue; @@ -113,8 +113,8 @@ { HSVKeyContext *s = avctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); const int hsub_log2 = s->hsub_log2; const int vsub_log2 = s->vsub_log2; const float hue = s->hue; @@ -143,8 +143,8 @@ const int vsub_log2 = s->vsub_log2; const int width = frame->width >> hsub_log2; const int height = frame->height >> vsub_log2; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const float scale = s->scale; const float hue = s->hue; const float sat = s->sat; @@ -179,8 +179,8 @@ const int vsub_log2 = s->vsub_log2; const int width = frame->width >> hsub_log2; const int height = frame->height >> vsub_log2; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const float scale = s->scale; const float half = s->half; const float hue = s->hue; diff -Nru ffmpeg-7.1.4/libavfilter/vf_huesaturation.c ffmpeg-7.1.5/libavfilter/vf_huesaturation.c --- ffmpeg-7.1.4/libavfilter/vf_huesaturation.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_huesaturation.c 2026-06-20 02:25:39.000000000 +0000 @@ -103,8 +103,8 @@ const int step = s->step; \ const int width = frame->width; \ const int process_h = frame->height; \ - const int slice_start = (process_h * jobnr ) / nb_jobs; \ - const int slice_end = (process_h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(process_h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(process_h, jobnr + 1, nb_jobs); \ const ptrdiff_t linesize = frame->linesize[0] / sizeof(type); \ type *row = (type *)frame->data[0] + linesize * slice_start; \ const uint8_t offset_r = s->rgba_map[R]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_identity.c ffmpeg-7.1.5/libavfilter/vf_identity.c --- ffmpeg-7.1.4/libavfilter/vf_identity.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_identity.c 2026-06-20 02:25:39.000000000 +0000 @@ -103,8 +103,8 @@ for (int c = 0; c < td->nb_components; c++) { const int outw = td->planewidth[c]; const int outh = td->planeheight[c]; - const int slice_start = (outh * jobnr) / nb_jobs; - const int slice_end = (outh * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(outh, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(outh, jobnr + 1, nb_jobs); const int ref_linesize = td->ref_linesize[c]; const int main_linesize = td->main_linesize[c]; const uint8_t *main_line = td->main_data[c] + main_linesize * slice_start; @@ -131,8 +131,8 @@ for (int c = 0; c < td->nb_components; c++) { const int outw = td->planewidth[c]; const int outh = td->planeheight[c]; - const int slice_start = (outh * jobnr) / nb_jobs; - const int slice_end = (outh * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(outh, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(outh, jobnr + 1, nb_jobs); const int ref_linesize = td->ref_linesize[c]; const int main_linesize = td->main_linesize[c]; const uint8_t *main_line = td->main_data[c] + main_linesize * slice_start; diff -Nru ffmpeg-7.1.4/libavfilter/vf_lagfun.c ffmpeg-7.1.5/libavfilter/vf_lagfun.c --- ffmpeg-7.1.4/libavfilter/vf_lagfun.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lagfun.c 2026-06-20 02:25:39.000000000 +0000 @@ -81,8 +81,8 @@ AVFrame *out = td->out; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); \ const int width = s->planewidth[p]; \ const type *src = (const type *)in->data[p] + \ slice_start * in->linesize[p] / sizeof(type); \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_lensfun.c ffmpeg-7.1.5/libavfilter/vf_lensfun.c --- ffmpeg-7.1.4/libavfilter/vf_lensfun.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lensfun.c 2026-06-20 02:25:39.000000000 +0000 @@ -284,8 +284,8 @@ static int vignetting_filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) { const VignettingThreadData *thread_data = arg; - const int slice_start = thread_data->height * jobnr / nb_jobs; - const int slice_end = thread_data->height * (jobnr + 1) / nb_jobs; + const int slice_start = ff_slice_pos(thread_data->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(thread_data->height, jobnr + 1, nb_jobs); lf_modifier_apply_color_modification(thread_data->modifier, thread_data->data_in + slice_start * thread_data->linesize_in, @@ -307,8 +307,8 @@ static int distortion_correction_filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) { const DistortionCorrectionThreadData *thread_data = arg; - const int slice_start = thread_data->height * jobnr / nb_jobs; - const int slice_end = thread_data->height * (jobnr + 1) / nb_jobs; + const int slice_start = ff_slice_pos(thread_data->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(thread_data->height, jobnr + 1, nb_jobs); int x, y, i, j, rgb_index; float interpolated, new_x, new_y, d, norm; diff -Nru ffmpeg-7.1.4/libavfilter/vf_limitdiff.c ffmpeg-7.1.5/libavfilter/vf_limitdiff.c --- ffmpeg-7.1.4/libavfilter/vf_limitdiff.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_limitdiff.c 2026-06-20 02:25:39.000000000 +0000 @@ -170,8 +170,8 @@ const int thr2 = s->thr2; const int w = s->planewidth[p]; const int h = s->planeheight[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *filtered = td->filtered->data[p] + slice_start * filtered_linesize; const uint8_t *source = td->source->data[p] + slice_start * source_linesize; const uint8_t *reference = td->reference->data[p] + slice_start * reference_linesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_limiter.c ffmpeg-7.1.5/libavfilter/vf_limiter.c --- ffmpeg-7.1.4/libavfilter/vf_limiter.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_limiter.c 2026-06-20 02:25:39.000000000 +0000 @@ -157,8 +157,8 @@ for (p = 0; p < s->nb_planes; p++) { const int h = s->height[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); if (!((1 << p) & s->planes)) { if (out != in) diff -Nru ffmpeg-7.1.4/libavfilter/vf_lumakey.c ffmpeg-7.1.5/libavfilter/vf_lumakey.c --- ffmpeg-7.1.4/libavfilter/vf_lumakey.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lumakey.c 2026-06-20 02:25:39.000000000 +0000 @@ -43,8 +43,8 @@ { LumakeyContext *s = ctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); uint8_t *alpha = frame->data[3] + slice_start * frame->linesize[3]; const uint8_t *luma = frame->data[0] + slice_start * frame->linesize[0]; const int so = s->so; @@ -75,8 +75,8 @@ { LumakeyContext *s = ctx->priv; AVFrame *frame = arg; - const int slice_start = (frame->height * jobnr) / nb_jobs; - const int slice_end = (frame->height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(frame->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(frame->height, jobnr + 1, nb_jobs); uint16_t *alpha = (uint16_t *)(frame->data[3] + slice_start * frame->linesize[3]); const uint16_t *luma = (const uint16_t *)(frame->data[0] + slice_start * frame->linesize[0]); const int so = s->so; diff -Nru ffmpeg-7.1.4/libavfilter/vf_lut.c ffmpeg-7.1.5/libavfilter/vf_lut.c --- ffmpeg-7.1.4/libavfilter/vf_lut.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lut.c 2026-06-20 02:25:39.000000000 +0000 @@ -356,8 +356,8 @@ const uint16_t (*tab)[256*256] = (const uint16_t (*)[256*256])s->lut;\ const int step = s->step;\ \ - const int slice_start = (h * jobnr ) / nb_jobs;\ - const int slice_end = (h * (jobnr+1)) / nb_jobs;\ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ /* packed, 16-bit */ static int lut_packed_16bits(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) @@ -439,8 +439,8 @@ int w = AV_CEIL_RSHIFT(td->w, hsub);\ const uint16_t *tab = s->lut[plane];\ \ - const int slice_start = (h * jobnr ) / nb_jobs;\ - const int slice_end = (h * (jobnr+1)) / nb_jobs;\ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ /* planar >8 bit depth */ static int lut_planar_16bits(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) diff -Nru ffmpeg-7.1.4/libavfilter/vf_lut2.c ffmpeg-7.1.5/libavfilter/vf_lut2.c --- ffmpeg-7.1.4/libavfilter/vf_lut2.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lut2.c 2026-06-20 02:25:39.000000000 +0000 @@ -258,8 +258,8 @@ int p, y, x; \ \ for (p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->heightx[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->heightx[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->heightx[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->heightx[p], jobnr + 1, nb_jobs); \ const uint16_t *lut = s->lut[p]; \ const xtype *srcxx; \ const ytype *srcyy; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_lut3d.c ffmpeg-7.1.5/libavfilter/vf_lut3d.c --- ffmpeg-7.1.4/libavfilter/vf_lut3d.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_lut3d.c 2026-06-20 02:25:39.000000000 +0000 @@ -328,8 +328,8 @@ const AVFrame *in = td->in; \ const AVFrame *out = td->out; \ const int direct = out == in; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *grow = out->data[0] + slice_start * out->linesize[0]; \ uint8_t *brow = out->data[1] + slice_start * out->linesize[1]; \ uint8_t *rrow = out->data[2] + slice_start * out->linesize[2]; \ @@ -426,8 +426,8 @@ const AVFrame *in = td->in; \ const AVFrame *out = td->out; \ const int direct = out == in; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *grow = out->data[0] + slice_start * out->linesize[0]; \ uint8_t *brow = out->data[1] + slice_start * out->linesize[1]; \ uint8_t *rrow = out->data[2] + slice_start * out->linesize[2]; \ @@ -498,8 +498,8 @@ const uint8_t g = lut3d->rgba_map[G]; \ const uint8_t b = lut3d->rgba_map[B]; \ const uint8_t a = lut3d->rgba_map[A]; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *dstrow = out->data[0] + slice_start * out->linesize[0]; \ const uint8_t *srcrow = in ->data[0] + slice_start * in ->linesize[0]; \ const float lut_max = lut3d->lutsize - 1; \ @@ -1865,8 +1865,8 @@ const AVFrame *in = td->in; \ const AVFrame *out = td->out; \ const int direct = out == in; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *grow = out->data[0] + slice_start * out->linesize[0]; \ uint8_t *brow = out->data[1] + slice_start * out->linesize[1]; \ uint8_t *rrow = out->data[2] + slice_start * out->linesize[2]; \ @@ -1961,8 +1961,8 @@ const AVFrame *in = td->in; \ const AVFrame *out = td->out; \ const int direct = out == in; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *grow = out->data[0] + slice_start * out->linesize[0]; \ uint8_t *brow = out->data[1] + slice_start * out->linesize[1]; \ uint8_t *rrow = out->data[2] + slice_start * out->linesize[2]; \ @@ -2031,8 +2031,8 @@ const uint8_t g = lut1d->rgba_map[G]; \ const uint8_t b = lut1d->rgba_map[B]; \ const uint8_t a = lut1d->rgba_map[A]; \ - const int slice_start = (in->height * jobnr ) / nb_jobs; \ - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ uint8_t *dstrow = out->data[0] + slice_start * out->linesize[0]; \ const uint8_t *srcrow = in ->data[0] + slice_start * in ->linesize[0]; \ const float factor = (1 << nbits) - 1; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_maskedclamp.c ffmpeg-7.1.5/libavfilter/vf_maskedclamp.c --- ffmpeg-7.1.4/libavfilter/vf_maskedclamp.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_maskedclamp.c 2026-06-20 02:25:39.000000000 +0000 @@ -94,8 +94,8 @@ const ptrdiff_t dlinesize = td->d->linesize[p]; const int w = s->width[p]; const int h = s->height[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *bsrc = td->b->data[p] + slice_start * blinesize; const uint8_t *darksrc = td->o->data[p] + slice_start * darklinesize; const uint8_t *brightsrc = td->m->data[p] + slice_start * brightlinesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_maskedmerge.c ffmpeg-7.1.5/libavfilter/vf_maskedmerge.c --- ffmpeg-7.1.4/libavfilter/vf_maskedmerge.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_maskedmerge.c 2026-06-20 02:25:39.000000000 +0000 @@ -76,8 +76,8 @@ for (p = 0; p < s->nb_planes; p++) { const int h = s->height[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); if (!((1 << p) & s->planes)) { av_image_copy_plane(out->data[p] + slice_start * out->linesize[p], diff -Nru ffmpeg-7.1.4/libavfilter/vf_maskedminmax.c ffmpeg-7.1.5/libavfilter/vf_maskedminmax.c --- ffmpeg-7.1.4/libavfilter/vf_maskedminmax.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_maskedminmax.c 2026-06-20 02:25:39.000000000 +0000 @@ -149,8 +149,8 @@ const ptrdiff_t dst_linesize = td->dst->linesize[p]; const int w = s->planewidth[p]; const int h = s->planeheight[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *src = td->src->data[p] + slice_start * src_linesize; const uint8_t *f1 = td->f1->data[p] + slice_start * f1_linesize; const uint8_t *f2 = td->f2->data[p] + slice_start * f2_linesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_maskedthreshold.c ffmpeg-7.1.5/libavfilter/vf_maskedthreshold.c --- ffmpeg-7.1.4/libavfilter/vf_maskedthreshold.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_maskedthreshold.c 2026-06-20 02:25:39.000000000 +0000 @@ -154,8 +154,8 @@ const ptrdiff_t dst_linesize = td->dst->linesize[p]; const int w = s->planewidth[p]; const int h = s->planeheight[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *src = td->src->data[p] + slice_start * src_linesize; const uint8_t *ref = td->ref->data[p] + slice_start * ref_linesize; uint8_t *dst = td->dst->data[p] + slice_start * dst_linesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_maskfun.c ffmpeg-7.1.5/libavfilter/vf_maskfun.c --- ffmpeg-7.1.4/libavfilter/vf_maskfun.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_maskfun.c 2026-06-20 02:25:39.000000000 +0000 @@ -168,8 +168,8 @@ const int linesize = out->linesize[p] / div; \ const int w = s->planewidth[p]; \ const int h = s->planeheight[p]; \ - const int slice_start = (h * jobnr) / nb_jobs; \ - const int slice_end = (h * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); \ const type *src = (type *)in->data[p] + \ slice_start * src_linesize; \ type *dst = (type *)out->data[p] + \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_median.c ffmpeg-7.1.5/libavfilter/vf_median.c --- ffmpeg-7.1.4/libavfilter/vf_median.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_median.c 2026-06-20 02:25:39.000000000 +0000 @@ -186,8 +186,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int h = s->planeheight[plane]; const int w = s->planewidth[plane]; - const int slice_h_start = (h * jobnr) / nb_jobs; - const int slice_h_end = (h * (jobnr+1)) / nb_jobs; + const int slice_h_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_h_end = ff_slice_pos(h, jobnr + 1, nb_jobs); if (!(s->planes & (1 << plane))) { av_image_copy_plane(out->data[plane] + slice_h_start * out->linesize[plane], diff -Nru ffmpeg-7.1.4/libavfilter/vf_mix.c ffmpeg-7.1.5/libavfilter/vf_mix.c --- ffmpeg-7.1.4/libavfilter/vf_mix.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_mix.c 2026-06-20 02:25:39.000000000 +0000 @@ -156,8 +156,8 @@ #define FAST_TMIX_SLICE(type, stype, round) \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->height[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->height[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->height[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->height[p], jobnr + 1, nb_jobs); \ const int width = s->linesizes[p] / sizeof(type); \ stype *sum = (stype *)(s->sum[p] + slice_start * s->linesizes[p] * 2); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ @@ -195,8 +195,8 @@ #define MIX_SLICE(type, fun, clip) \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->height[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->height[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->height[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->height[p], jobnr + 1, nb_jobs); \ const int width = s->linesizes[p] / sizeof(type); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ const ptrdiff_t dst_linesize = out->linesize[p] / sizeof(type); \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_monochrome.c ffmpeg-7.1.5/libavfilter/vf_monochrome.c --- ffmpeg-7.1.4/libavfilter/vf_monochrome.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_monochrome.c 2026-06-20 02:25:39.000000000 +0000 @@ -87,8 +87,8 @@ const float imax = 1.f / max; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0]; const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; @@ -126,8 +126,8 @@ const float imax = 1.f / max; const int width = frame->width; const int height = frame->height; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ylinesize = frame->linesize[0] / 2; const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; @@ -164,8 +164,8 @@ const int subh = s->subh; const int width = AV_CEIL_RSHIFT(frame->width, subw); const int height = AV_CEIL_RSHIFT(frame->height, subh); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1]; const ptrdiff_t vlinesize = frame->linesize[2]; @@ -190,8 +190,8 @@ const int subh = s->subh; const int width = AV_CEIL_RSHIFT(frame->width, subw); const int height = AV_CEIL_RSHIFT(frame->height, subh); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t ulinesize = frame->linesize[1] / 2; const ptrdiff_t vlinesize = frame->linesize[2] / 2; diff -Nru ffmpeg-7.1.4/libavfilter/vf_morpho.c ffmpeg-7.1.5/libavfilter/vf_morpho.c --- ffmpeg-7.1.4/libavfilter/vf_morpho.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_morpho.c 2026-06-20 02:25:39.000000000 +0000 @@ -802,8 +802,8 @@ for (int p = 0; p < s->nb_planes; p++) { const int width = s->planewidth[p]; const int height = s->planeheight[p]; - const int y0 = (height * jobnr ) / nb_jobs; - const int y1 = (height * (jobnr+1)) / nb_jobs; + const int y0 = ff_slice_pos(height, jobnr, nb_jobs); + const int y1 = ff_slice_pos(height, jobnr + 1, nb_jobs); const int depth = s->depth; if (ctx->is_disabled || !(s->planes & (1 << p))) { @@ -857,8 +857,8 @@ for (int p = 0; p < s->nb_planes; p++) { const int height = s->planeheight[p]; - const int y0 = (height * jobnr ) / nb_jobs; - const int y1 = (height * (jobnr+1)) / nb_jobs; + const int y0 = ff_slice_pos(height, jobnr, nb_jobs); + const int y1 = ff_slice_pos(height, jobnr + 1, nb_jobs); if (ctx->is_disabled || !(s->planes & (1 << p))) { copy: diff -Nru ffmpeg-7.1.4/libavfilter/vf_multiply.c ffmpeg-7.1.5/libavfilter/vf_multiply.c --- ffmpeg-7.1.4/libavfilter/vf_multiply.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_multiply.c 2026-06-20 02:25:39.000000000 +0000 @@ -98,8 +98,8 @@ const ptrdiff_t dst_linesize = td->dst->linesize[p]; const int w = td->src->width; const int h = td->src->height; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *src = td->src->data[p] + slice_start * src_linesize; const uint8_t *ref = td->ref->data[p] + slice_start * ref_linesize; uint8_t *dst = td->dst->data[p] + slice_start * dst_linesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_negate.c ffmpeg-7.1.5/libavfilter/vf_negate.c --- ffmpeg-7.1.4/libavfilter/vf_negate.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_negate.c 2026-06-20 02:25:39.000000000 +0000 @@ -277,8 +277,8 @@ for (int p = 0; p < s->nb_planes; p++) { const int h = s->height[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); if (!((1 << p) & s->planes)) { if (out != in) diff -Nru ffmpeg-7.1.4/libavfilter/vf_neighbor.c ffmpeg-7.1.5/libavfilter/vf_neighbor.c --- ffmpeg-7.1.4/libavfilter/vf_neighbor.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_neighbor.c 2026-06-20 02:25:39.000000000 +0000 @@ -268,8 +268,8 @@ const int dstride = out->linesize[plane]; const int height = s->planeheight[plane]; const int width = s->planewidth[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const uint8_t *src = (const uint8_t *)in->data[plane] + slice_start * stride; uint8_t *dst = out->data[plane] + slice_start * dstride; diff -Nru ffmpeg-7.1.4/libavfilter/vf_nlmeans.c ffmpeg-7.1.5/libavfilter/vf_nlmeans.c --- ffmpeg-7.1.4/libavfilter/vf_nlmeans.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_nlmeans.c 2026-06-20 02:25:39.000000000 +0000 @@ -292,8 +292,8 @@ const struct thread_data *td = arg; const ptrdiff_t src_linesize = td->src_linesize; const int process_h = td->endy - td->starty; - const int slice_start = (process_h * jobnr ) / nb_jobs; - const int slice_end = (process_h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(process_h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(process_h, jobnr + 1, nb_jobs); const int starty = td->starty + slice_start; const int endy = td->starty + slice_end; const int p = td->p; diff -Nru ffmpeg-7.1.4/libavfilter/vf_nnedi.c ffmpeg-7.1.5/libavfilter/vf_nnedi.c --- ffmpeg-7.1.4/libavfilter/vf_nnedi.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_nnedi.c 2026-06-20 02:25:39.000000000 +0000 @@ -551,8 +551,8 @@ for (int p = 0; p < s->nb_planes; p++) { const int height = s->planeheight[p]; const int width = s->planewidth[p]; - const int slice_start = 2 * ((height / 2 * jobnr) / nb_jobs); - const int slice_end = 2 * ((height / 2 * (jobnr+1)) / nb_jobs); + const int slice_start = 2 * (ff_slice_pos(height / 2, jobnr, nb_jobs)); + const int slice_end = 2 * (ff_slice_pos(height / 2, jobnr + 1, nb_jobs)); const uint8_t *src_data = in->data[p]; uint8_t *dst_data = out->data[p]; uint8_t *dst = out->data[p] + slice_start * out->linesize[p]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_noise.c ffmpeg-7.1.5/libavfilter/vf_noise.c --- ffmpeg-7.1.4/libavfilter/vf_noise.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_noise.c 2026-06-20 02:25:39.000000000 +0000 @@ -230,8 +230,8 @@ for (plane = 0; plane < s->nb_planes; plane++) { const int height = s->height[plane]; - const int start = (height * jobnr ) / nb_jobs; - const int end = (height * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(height, jobnr, nb_jobs); + const int end = ff_slice_pos(height, jobnr + 1, nb_jobs); noise(td->out->data[plane] + start * td->out->linesize[plane], td->in->data[plane] + start * td->in->linesize[plane], td->out->linesize[plane], td->in->linesize[plane], diff -Nru ffmpeg-7.1.4/libavfilter/vf_overlay.c ffmpeg-7.1.5/libavfilter/vf_overlay.c --- ffmpeg-7.1.4/libavfilter/vf_overlay.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_overlay.c 2026-06-20 02:25:39.000000000 +0000 @@ -389,8 +389,8 @@ i = FFMAX(-y, 0); imax = FFMIN3(-y + dst_h, FFMIN(src_h, dst_h), y + src_h); - slice_start = i + (imax * jobnr) / nb_jobs; - slice_end = i + (imax * (jobnr+1)) / nb_jobs; + slice_start = i + ff_slice_pos(imax, jobnr, nb_jobs); + slice_end = i + ff_slice_pos(imax, jobnr + 1, nb_jobs); sp = src->data[0] + (slice_start) * src->linesize[0]; dp = dst->data[0] + (y + slice_start) * dst->linesize[0]; @@ -482,8 +482,8 @@ j = FFMAX(-yp, 0); \ jmax = FFMIN3(-yp + dst_hp, FFMIN(src_hp, dst_hp), yp + src_hp); \ \ - slice_start = j + (jmax * jobnr) / nb_jobs; \ - slice_end = j + (jmax * (jobnr+1)) / nb_jobs; \ + slice_start = j + ff_slice_pos(jmax, jobnr, nb_jobs); \ + slice_end = j + ff_slice_pos(jmax, jobnr + 1, nb_jobs); \ \ sp = (uint##depth##_t *)(src->data[i] + (slice_start) * src->linesize[i]); \ dp = (uint##depth##_t *)(dst->data[dst_plane] \ @@ -592,9 +592,8 @@ \ imax = FFMIN3(-y + dst_h, FFMIN(src_h, dst_h), y + src_h); \ i = FFMAX(-y, 0); \ - \ - slice_start = i + (imax * jobnr) / nb_jobs; \ - slice_end = i + ((imax * (jobnr+1)) / nb_jobs); \ + slice_start = i + ff_slice_pos(imax, jobnr, nb_jobs); \ + slice_end = i + (ff_slice_pos(imax, jobnr + 1, nb_jobs)); \ \ sa = (uint##depth##_t *)(src->data[3] + (slice_start) * src->linesize[3]); \ da = (uint##depth##_t *)(dst->data[3] + (y + slice_start) * dst->linesize[3]); \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_photosensitivity.c ffmpeg-7.1.5/libavfilter/vf_photosensitivity.c --- ffmpeg-7.1.4/libavfilter/vf_photosensitivity.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_photosensitivity.c 2026-06-20 02:25:39.000000000 +0000 @@ -84,8 +84,8 @@ ThreadData_convert_frame *td = arg; - const int slice_start = (NUM_CELLS * jobnr) / nb_jobs; - const int slice_end = (NUM_CELLS * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(NUM_CELLS, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(NUM_CELLS, jobnr + 1, nb_jobs); int width = td->in->width, height = td->in->height, linesize = td->in->linesize[0], skip = td->skip; const uint8_t *data = td->in->data[0]; @@ -149,8 +149,8 @@ ThreadData_blend_frame *td = arg; const uint16_t s_mul = td->s_mul; const uint16_t t_mul = 0x100 - s_mul; - const int slice_start = (td->target->height * jobnr) / nb_jobs; - const int slice_end = (td->target->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(td->target->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(td->target->height, jobnr + 1, nb_jobs); const int linesize = td->target->linesize[0]; for (y = slice_start; y < slice_end; y++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_pixelize.c ffmpeg-7.1.5/libavfilter/vf_pixelize.c --- ffmpeg-7.1.4/libavfilter/vf_pixelize.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_pixelize.c 2026-06-20 02:25:39.000000000 +0000 @@ -189,10 +189,10 @@ const int wh = s->planeheight[p]; const int h = (s->planeheight[p] + s->block_h[p] - 1) / s->block_h[p]; const int w = (s->planewidth[p] + s->block_w[p] - 1) / s->block_w[p]; - const int wslice_start = (wh * jobnr) / nb_jobs; - const int wslice_end = (wh * (jobnr+1)) / nb_jobs; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int wslice_start = ff_slice_pos(wh, jobnr, nb_jobs); + const int wslice_end = ff_slice_pos(wh, jobnr + 1, nb_jobs); + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const ptrdiff_t out_linesize = out->linesize[p]; const ptrdiff_t in_linesize = in->linesize[p]; const uint8_t *src = in->data[p]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_premultiply.c ffmpeg-7.1.5/libavfilter/vf_premultiply.c --- ffmpeg-7.1.4/libavfilter/vf_premultiply.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_premultiply.c 2026-06-20 02:25:39.000000000 +0000 @@ -479,8 +479,8 @@ int p; for (p = 0; p < s->nb_planes; p++) { - const int slice_start = (s->height[p] * jobnr) / nb_jobs; - const int slice_end = (s->height[p] * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->height[p], jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->height[p], jobnr + 1, nb_jobs); if (!((1 << p) & s->planes) || p == 3) { av_image_copy_plane(out->data[p] + slice_start * out->linesize[p], diff -Nru ffmpeg-7.1.4/libavfilter/vf_pseudocolor.c ffmpeg-7.1.5/libavfilter/vf_pseudocolor.c --- ffmpeg-7.1.4/libavfilter/vf_pseudocolor.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_pseudocolor.c 2026-06-20 02:25:39.000000000 +0000 @@ -981,9 +981,9 @@ AVFrame *out = td->out; for (int plane = 0; plane < s->nb_planes; plane++) { - const int slice_start = (s->height[plane] * jobnr) / nb_jobs; - const int slice_end = (s->height[plane] * (jobnr+1)) / nb_jobs; - const int islice_start = (s->height[s->index] * jobnr) / nb_jobs; + const int slice_start = ff_slice_pos(s->height[plane], jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->height[plane], jobnr + 1, nb_jobs); + const int islice_start = ff_slice_pos(s->height[s->index], jobnr, nb_jobs); ptrdiff_t ilinesize = in->linesize[s->index]; ptrdiff_t slinesize = in->linesize[plane]; ptrdiff_t dlinesize = out->linesize[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_psnr.c ffmpeg-7.1.5/libavfilter/vf_psnr.c --- ffmpeg-7.1.4/libavfilter/vf_psnr.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_psnr.c 2026-06-20 02:25:39.000000000 +0000 @@ -128,8 +128,8 @@ for (int c = 0; c < td->nb_components; c++) { const int outw = td->planewidth[c]; const int outh = td->planeheight[c]; - const int slice_start = (outh * jobnr) / nb_jobs; - const int slice_end = (outh * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(outh, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(outh, jobnr + 1, nb_jobs); const int ref_linesize = td->ref_linesize[c]; const int main_linesize = td->main_linesize[c]; const uint8_t *main_line = td->main_data[c] + main_linesize * slice_start; diff -Nru ffmpeg-7.1.4/libavfilter/vf_remap.c ffmpeg-7.1.5/libavfilter/vf_remap.c --- ffmpeg-7.1.4/libavfilter/vf_remap.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_remap.c 2026-06-20 02:25:39.000000000 +0000 @@ -141,8 +141,8 @@ const AVFrame *xin = td->xin; \ const AVFrame *yin = td->yin; \ const AVFrame *out = td->out; \ - const int slice_start = (out->height * jobnr ) / nb_jobs; \ - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); \ const int xlinesize = xin->linesize[0] / 2; \ const int ylinesize = yin->linesize[0] / 2; \ int x , y, plane; \ @@ -192,8 +192,8 @@ const AVFrame *xin = td->xin; \ const AVFrame *yin = td->yin; \ const AVFrame *out = td->out; \ - const int slice_start = (out->height * jobnr ) / nb_jobs; \ - const int slice_end = (out->height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(out->height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(out->height, jobnr + 1, nb_jobs); \ const int dlinesize = out->linesize[0] / div; \ const int slinesize = in->linesize[0] / div; \ const int xlinesize = xin->linesize[0] / 2; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_removegrain.c ffmpeg-7.1.5/libavfilter/vf_removegrain.c --- ffmpeg-7.1.4/libavfilter/vf_removegrain.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_removegrain.c 2026-06-20 02:25:39.000000000 +0000 @@ -523,8 +523,8 @@ const int om = in->linesize[i] - 1; const int o0 = in->linesize[i] ; const int op = in->linesize[i] + 1; - int start = (height * jobnr ) / nb_jobs; - int end = (height * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(height, jobnr, nb_jobs); + int end = ff_slice_pos(height, jobnr + 1, nb_jobs); int x, y; start = FFMAX(1, start); diff -Nru ffmpeg-7.1.4/libavfilter/vf_scroll.c ffmpeg-7.1.5/libavfilter/vf_scroll.c --- ffmpeg-7.1.4/libavfilter/vf_scroll.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_scroll.c 2026-06-20 02:25:39.000000000 +0000 @@ -80,8 +80,8 @@ const uint8_t *src = in->data[p]; const int h = s->planeheight[p]; const int w = s->planewidth[p] * s->bytes; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); uint8_t *dst = out->data[p] + slice_start * out->linesize[p]; for (int y = slice_start; y < slice_end; y++) { diff -Nru ffmpeg-7.1.4/libavfilter/vf_selectivecolor.c ffmpeg-7.1.5/libavfilter/vf_selectivecolor.c --- ffmpeg-7.1.4/libavfilter/vf_selectivecolor.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_selectivecolor.c 2026-06-20 02:25:39.000000000 +0000 @@ -315,8 +315,8 @@ const SelectiveColorContext *s = ctx->priv; \ const int height = in->height; \ const int width = in->width; \ - const int slice_start = (height * jobnr ) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ const int dst_linesize = out->linesize[0] / ((nbits + 7) / 8); \ const int src_linesize = in->linesize[0] / ((nbits + 7) / 8); \ const uint8_t roffset = s->rgba_map[R]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_shear.c ffmpeg-7.1.5/libavfilter/vf_shear.c --- ffmpeg-7.1.4/libavfilter/vf_shear.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_shear.c 2026-06-20 02:25:39.000000000 +0000 @@ -130,8 +130,8 @@ const int height = s->planeheight[p]; \ const int wx = vsub * shx * height * 0.5f / hsub; \ const int wy = hsub * shy * width * 0.5f / vsub; \ - const int slice_start = (height * jobnr) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ const int src_linesize = in->linesize[p] / sizeof(type); \ const int dst_linesize = out->linesize[p] / sizeof(type); \ const type *src = (const type *)in->data[p]; \ @@ -177,8 +177,8 @@ const int height = s->planeheight[p]; \ const float wx = vsub * shx * height * 0.5f / hsub; \ const float wy = hsub * shy * width * 0.5f / vsub; \ - const int slice_start = (height * jobnr) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ const int src_linesize = in->linesize[p] / sizeof(type); \ const int dst_linesize = out->linesize[p] / sizeof(type); \ const type *src = (const type *)in->data[p]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_shufflepixels.c ffmpeg-7.1.5/libavfilter/vf_shufflepixels.c --- ffmpeg-7.1.4/libavfilter/vf_shufflepixels.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_shufflepixels.c 2026-06-20 02:25:39.000000000 +0000 @@ -204,8 +204,8 @@ AVFrame *out = td->out; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ const type *src = (const type *)(in->data[p] + \ slice_start * in->linesize[p]); \ @@ -237,8 +237,8 @@ AVFrame *out = td->out; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ const int32_t *map = s->map; \ \ @@ -267,8 +267,8 @@ AVFrame *out = td->out; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->planeheight[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->planeheight[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->planeheight[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->planeheight[p], jobnr + 1, nb_jobs); \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ const type *src = (const type *)in->data[p]; \ const int32_t *map = s->map + slice_start * s->planewidth[p]; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_signalstats.c ffmpeg-7.1.5/libavfilter/vf_signalstats.c --- ffmpeg-7.1.4/libavfilter/vf_signalstats.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_signalstats.c 2026-06-20 02:25:39.000000000 +0000 @@ -218,8 +218,8 @@ AVFrame *out = td->out; const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); int x, y, score = 0; for (y = slice_start; y < slice_end; y++) { @@ -253,8 +253,8 @@ const int mult = 1 << (s->depth - 8); const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); int x, y, score = 0; for (y = slice_start; y < slice_end; y++) { @@ -292,8 +292,8 @@ AVFrame *out = td->out; const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *p = in->data[0]; int lw = in->linesize[0]; int x, y, score = 0, filt; @@ -340,8 +340,8 @@ AVFrame *out = td->out; const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint16_t *p = (uint16_t *)in->data[0]; int lw = in->linesize[0] / 2; int x, y, score = 0, filt; @@ -383,8 +383,8 @@ AVFrame *out = td->out; const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *p = in->data[0]; const int lw = in->linesize[0]; int x, y, score = 0; @@ -417,8 +417,8 @@ AVFrame *out = td->out; const int w = in->width; const int h = in->height; - const int slice_start = (h * jobnr ) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint16_t *p = (uint16_t *)in->data[0]; const int lw = in->linesize[0] / 2; int x, y, score = 0; @@ -464,8 +464,8 @@ AVFrame *dst_sat = td->dst_sat; AVFrame *dst_hue = td->dst_hue; - const int slice_start = (s->chromah * jobnr ) / nb_jobs; - const int slice_end = (s->chromah * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->chromah, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->chromah, jobnr + 1, nb_jobs); const int lsz_u = src->linesize[1]; const int lsz_v = src->linesize[2]; @@ -503,8 +503,8 @@ AVFrame *dst_hue = td->dst_hue; const int mid = 1 << (s->depth - 1); - const int slice_start = (s->chromah * jobnr ) / nb_jobs; - const int slice_end = (s->chromah * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->chromah, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->chromah, jobnr + 1, nb_jobs); const int lsz_u = src->linesize[1] / 2; const int lsz_v = src->linesize[2] / 2; diff -Nru ffmpeg-7.1.4/libavfilter/vf_ssim.c ffmpeg-7.1.5/libavfilter/vf_ssim.c --- ffmpeg-7.1.4/libavfilter/vf_ssim.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_ssim.c 2026-06-20 02:25:39.000000000 +0000 @@ -247,8 +247,8 @@ const int ref_stride = td->ref_linesize[c]; int width = td->planewidth[c]; int height = td->planeheight[c]; - const int slice_start = ((height >> 2) * jobnr) / nb_jobs; - const int slice_end = ((height >> 2) * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height >> 2, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height >> 2, jobnr + 1, nb_jobs); const int ystart = FFMAX(1, slice_start); int z = ystart - 1; double ssim = 0.0; @@ -290,8 +290,8 @@ const int ref_stride = td->ref_linesize[c]; int width = td->planewidth[c]; int height = td->planeheight[c]; - const int slice_start = ((height >> 2) * jobnr) / nb_jobs; - const int slice_end = ((height >> 2) * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height >> 2, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height >> 2, jobnr + 1, nb_jobs); const int ystart = FFMAX(1, slice_start); int z = ystart - 1; double ssim = 0.0; diff -Nru ffmpeg-7.1.4/libavfilter/vf_stereo3d.c ffmpeg-7.1.5/libavfilter/vf_stereo3d.c --- ffmpeg-7.1.4/libavfilter/vf_stereo3d.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_stereo3d.c 2026-06-20 02:25:39.000000000 +0000 @@ -613,8 +613,8 @@ AVFrame *iright = td->iright; AVFrame *out = td->out; int height = s->out.height; - int start = (height * jobnr ) / nb_jobs; - int end = (height * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(height, jobnr, nb_jobs); + int end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int **ana_matrix = s->ana_matrix; s->dsp.anaglyph(out->data[0] + out->linesize[0] * start, diff -Nru ffmpeg-7.1.4/libavfilter/vf_super2xsai.c ffmpeg-7.1.5/libavfilter/vf_super2xsai.c --- ffmpeg-7.1.4/libavfilter/vf_super2xsai.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_super2xsai.c 2026-06-20 02:25:39.000000000 +0000 @@ -76,8 +76,8 @@ const uint32_t lo_pixel_mask = s->lo_pixel_mask; const uint32_t q_hi_pixel_mask = s->q_hi_pixel_mask; const uint32_t q_lo_pixel_mask = s->q_lo_pixel_mask; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); /* Point to the first 4 lines, first line is duplicated */ src_line[0] = src + src_linesize*FFMAX(slice_start - 1, 0); diff -Nru ffmpeg-7.1.4/libavfilter/vf_threshold.c ffmpeg-7.1.5/libavfilter/vf_threshold.c --- ffmpeg-7.1.4/libavfilter/vf_threshold.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_threshold.c 2026-06-20 02:25:39.000000000 +0000 @@ -86,8 +86,8 @@ for (int p = 0; p < s->nb_planes; p++) { const int h = s->height[p]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); if (!(s->planes & (1 << p))) { av_image_copy_plane(out->data[p] + slice_start * out->linesize[p], diff -Nru ffmpeg-7.1.4/libavfilter/vf_thumbnail.c ffmpeg-7.1.5/libavfilter/vf_thumbnail.c --- ffmpeg-7.1.4/libavfilter/vf_thumbnail.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_thumbnail.c 2026-06-20 02:25:39.000000000 +0000 @@ -149,8 +149,8 @@ int *hist = s->thread_histogram + HIST_SIZE * jobnr; const int h = frame->height; const int w = frame->width; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); const uint8_t *p = frame->data[0] + slice_start * frame->linesize[0]; memset(hist, 0, sizeof(*hist) * HIST_SIZE); @@ -195,8 +195,8 @@ break; default: for (int plane = 0; plane < 3; plane++) { - const int slice_start = (s->planeheight[plane] * jobnr) / nb_jobs; - const int slice_end = (s->planeheight[plane] * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(s->planeheight[plane], jobnr, nb_jobs); + const int slice_end = ff_slice_pos(s->planeheight[plane], jobnr + 1, nb_jobs); const uint8_t *p = frame->data[plane] + slice_start * frame->linesize[plane]; const ptrdiff_t linesize = frame->linesize[plane]; const int planewidth = s->planewidth[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_tonemap.c ffmpeg-7.1.5/libavfilter/vf_tonemap.c --- ffmpeg-7.1.4/libavfilter/vf_tonemap.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_tonemap.c 2026-06-20 02:25:39.000000000 +0000 @@ -183,8 +183,8 @@ AVFrame *in = td->in; AVFrame *out = td->out; const AVPixFmtDescriptor *desc = td->desc; - const int slice_start = (in->height * jobnr) / nb_jobs; - const int slice_end = (in->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); double peak = td->peak; for (int y = slice_start; y < slice_end; y++) diff -Nru ffmpeg-7.1.4/libavfilter/vf_transpose.c ffmpeg-7.1.5/libavfilter/vf_transpose.c --- ffmpeg-7.1.4/libavfilter/vf_transpose.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_transpose.c 2026-06-20 02:25:39.000000000 +0000 @@ -280,8 +280,8 @@ int inh = AV_CEIL_RSHIFT(in->height, vsub); int outw = AV_CEIL_RSHIFT(out->width, hsub); int outh = AV_CEIL_RSHIFT(out->height, vsub); - int start = (outh * jobnr ) / nb_jobs; - int end = (outh * (jobnr+1)) / nb_jobs; + int start = ff_slice_pos(outh, jobnr, nb_jobs); + int end = ff_slice_pos(outh, jobnr + 1, nb_jobs); uint8_t *dst, *src; int dstlinesize, srclinesize; int x, y; diff -Nru ffmpeg-7.1.4/libavfilter/vf_unsharp.c ffmpeg-7.1.5/libavfilter/vf_unsharp.c --- ffmpeg-7.1.4/libavfilter/vf_unsharp.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_unsharp.c 2026-06-20 02:25:39.000000000 +0000 @@ -110,8 +110,8 @@ const int height = td->height; \ const int sc_offset = jobnr * 2 * steps_y; \ const int sr_offset = jobnr * (MAX_MATRIX_SIZE - 1); \ - const int slice_start = (height * jobnr) / nb_jobs; \ - const int slice_end = (height * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ \ int32_t res; \ int x, y, z; \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_v360.c ffmpeg-7.1.5/libavfilter/vf_v360.c --- ffmpeg-7.1.4/libavfilter/vf_v360.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_v360.c 2026-06-20 02:25:39.000000000 +0000 @@ -305,13 +305,13 @@ const int width = s->pr_width[plane]; \ const int height = s->pr_height[plane]; \ \ - const int slice_start = (height * jobnr ) / nb_jobs; \ - const int slice_end = (height * (jobnr + 1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); \ \ for (int y = slice_start; y < slice_end && !mask; y++) { \ - const int16_t *const u = r->u[map] + (y - slice_start) * uv_linesize * ws * ws; \ - const int16_t *const v = r->v[map] + (y - slice_start) * uv_linesize * ws * ws; \ - const int16_t *const ker = r->ker[map] + (y - slice_start) * uv_linesize * ws * ws; \ + const int16_t *const u = r->u[map] + (y - slice_start) * (int64_t)uv_linesize * ws * ws; \ + const int16_t *const v = r->v[map] + (y - slice_start) * (int64_t)uv_linesize * ws * ws; \ + const int16_t *const ker = r->ker[map] + (y - slice_start) * (int64_t)uv_linesize * ws * ws;\ \ s->remap_line(dst + y * out_linesize, width, src, in_linesize, u, v, ker); \ } \ @@ -4243,8 +4243,8 @@ const int height = s->pr_height[p]; const int in_width = s->inplanewidth[p]; const int in_height = s->inplaneheight[p]; - const int slice_start = (height * jobnr ) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int elements = s->elements; float du, dv; float vec[3]; @@ -4252,9 +4252,9 @@ for (int j = slice_start; j < slice_end; j++) { for (int i = 0; i < width; i++) { - int16_t *u = r->u[p] + ((j - slice_start) * uv_linesize + i) * elements; - int16_t *v = r->v[p] + ((j - slice_start) * uv_linesize + i) * elements; - int16_t *ker = r->ker[p] + ((j - slice_start) * uv_linesize + i) * elements; + int16_t *u = r->u[p] + ((j - slice_start) * (int64_t)uv_linesize + i) * elements; + int16_t *v = r->v[p] + ((j - slice_start) * (int64_t)uv_linesize + i) * elements; + int16_t *ker = r->ker[p] + ((j - slice_start) * (int64_t)uv_linesize + i) * elements; uint8_t *mask8 = (p || !r->mask) ? NULL : r->mask + ((j - slice_start) * s->pr_width[0] + i); uint16_t *mask16 = (p || !r->mask) ? NULL : (uint16_t *)r->mask + ((j - slice_start) * s->pr_width[0] + i); int in_mask, out_mask; @@ -4292,6 +4292,20 @@ return 0; } +static int get_output_dimension(AVFilterContext *ctx, const char *name, + float val, int *dim) +{ + if (!isfinite(val) || val < 1.f || val > INT16_MAX) { + av_log(ctx, AV_LOG_ERROR, + "Output %s %g is outside the allowed range [1, %d].\n", + name, val, INT16_MAX); + return AVERROR(EINVAL); + } + + *dim = lrintf(val); + return 0; +} + static int config_output(AVFilterLink *outlink) { AVFilterContext *ctx = outlink->src; @@ -4462,6 +4476,15 @@ if (s->in_transpose) FFSWAP(int, s->in_width, s->in_height); + // The remap code stores input coordinates in int16_t + if (s->in_width < 1 || s->in_width > INT16_MAX || + s->in_height < 1 || s->in_height > INT16_MAX) { + av_log(ctx, AV_LOG_ERROR, + "Input dimensions %dx%d are outside the allowed range [1, %d].\n", + s->in_width, s->in_height, INT16_MAX); + return AVERROR(EINVAL); + } + switch (s->in) { case EQUIRECTANGULAR: s->in_transform = xyz_to_equirect; @@ -4779,11 +4802,17 @@ if (s->width > 0 && s->height <= 0 && s->h_fov > 0.f && s->v_fov > 0.f && s->out == FLAT && s->d_fov == 0.f) { w = s->width; - h = w / tanf(s->h_fov * M_PI / 360.f) * tanf(s->v_fov * M_PI / 360.f); + err = get_output_dimension(ctx, "height", + w / tanf(s->h_fov * M_PI / 360.f) * tanf(s->v_fov * M_PI / 360.f), &h); + if (err < 0) + return err; } else if (s->width <= 0 && s->height > 0 && s->h_fov > 0.f && s->v_fov > 0.f && s->out == FLAT && s->d_fov == 0.f) { h = s->height; - w = h / tanf(s->v_fov * M_PI / 360.f) * tanf(s->h_fov * M_PI / 360.f); + err = get_output_dimension(ctx, "width", + h / tanf(s->v_fov * M_PI / 360.f) * tanf(s->h_fov * M_PI / 360.f), &w); + if (err < 0) + return err; } else if (s->width > 0 && s->height > 0) { w = s->width; h = s->height; @@ -4798,6 +4827,13 @@ FFSWAP(int, w, h); } + if (w < 1 || w > INT16_MAX || h < 1 || h > INT16_MAX) { + av_log(ctx, AV_LOG_ERROR, + "Output dimensions %dx%d are outside the allowed range [1, %d].\n", + w, h, INT16_MAX); + return AVERROR(EINVAL); + } + s->width = w; s->height = h; diff -Nru ffmpeg-7.1.4/libavfilter/vf_varblur.c ffmpeg-7.1.5/libavfilter/vf_varblur.c --- ffmpeg-7.1.4/libavfilter/vf_varblur.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_varblur.c 2026-06-20 02:25:39.000000000 +0000 @@ -215,8 +215,8 @@ for (int plane = 0; plane < s->nb_planes; plane++) { const int height = s->planeheight[plane]; - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int width = s->planewidth[plane]; const int linesize = in->linesize[plane]; const int dst_linesize = out->linesize[plane]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_vibrance.c ffmpeg-7.1.5/libavfilter/vf_vibrance.c --- ffmpeg-7.1.4/libavfilter/vf_vibrance.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_vibrance.c 2026-06-20 02:25:39.000000000 +0000 @@ -75,8 +75,8 @@ const float sgintensity = alternate * FFSIGN(gintensity); const float sbintensity = alternate * FFSIGN(bintensity); const float srintensity = alternate * FFSIGN(rintensity); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t glinesize = frame->linesize[0]; const ptrdiff_t blinesize = frame->linesize[1]; const ptrdiff_t rlinesize = frame->linesize[2]; @@ -152,8 +152,8 @@ const float sgintensity = alternate * FFSIGN(gintensity); const float sbintensity = alternate * FFSIGN(bintensity); const float srintensity = alternate * FFSIGN(rintensity); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t gslinesize = in->linesize[0] / 2; const ptrdiff_t bslinesize = in->linesize[1] / 2; const ptrdiff_t rslinesize = in->linesize[2] / 2; @@ -232,8 +232,8 @@ const float sgintensity = alternate * FFSIGN(gintensity); const float sbintensity = alternate * FFSIGN(bintensity); const float srintensity = alternate * FFSIGN(rintensity); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0]; const ptrdiff_t slinesize = in->linesize[0]; const uint8_t *src = in->data[0] + slice_start * slinesize; @@ -298,8 +298,8 @@ const float sgintensity = alternate * FFSIGN(gintensity); const float sbintensity = alternate * FFSIGN(bintensity); const float srintensity = alternate * FFSIGN(rintensity); - const int slice_start = (height * jobnr) / nb_jobs; - const int slice_end = (height * (jobnr + 1)) / nb_jobs; + const int slice_start = ff_slice_pos(height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(height, jobnr + 1, nb_jobs); const ptrdiff_t linesize = frame->linesize[0] / 2; const ptrdiff_t slinesize = in->linesize[0] / 2; const uint16_t *src = (const uint16_t *)in->data[0] + slice_start * slinesize; diff -Nru ffmpeg-7.1.4/libavfilter/vf_vif.c ffmpeg-7.1.5/libavfilter/vf_vif.c --- ffmpeg-7.1.4/libavfilter/vf_vif.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_vif.c 2026-06-20 02:25:39.000000000 +0000 @@ -215,8 +215,8 @@ int dst_stride = td->dst_stride; int filt_w = td->filter_width; float *temp = td->temp[jobnr]; - const int slice_start = (h * jobnr) / nb_jobs; - const int slice_end = (h * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(h, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(h, jobnr + 1, nb_jobs); for (int i = slice_start; i < slice_end; i++) { /** Vertical pass. */ diff -Nru ffmpeg-7.1.4/libavfilter/vf_w3fdif.c ffmpeg-7.1.5/libavfilter/vf_w3fdif.c --- ffmpeg-7.1.4/libavfilter/vf_w3fdif.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_w3fdif.c 2026-06-20 02:25:39.000000000 +0000 @@ -378,8 +378,8 @@ const int cur_line_stride = cur->linesize[plane]; const int adj_line_stride = adj->linesize[plane]; const int dst_line_stride = out->linesize[plane]; - const int start = (height * jobnr) / nb_jobs; - const int end = (height * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(height, jobnr, nb_jobs); + const int end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int max = s->max; const int interlaced = !!(cur->flags & AV_FRAME_FLAG_INTERLACED); const int tff = s->field == (s->parity == -1 ? interlaced ? !!(cur->flags & AV_FRAME_FLAG_TOP_FIELD_FIRST) : 1 : diff -Nru ffmpeg-7.1.4/libavfilter/vf_waveform.c ffmpeg-7.1.5/libavfilter/vf_waveform.c --- ffmpeg-7.1.4/libavfilter/vf_waveform.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_waveform.c 2026-06-20 02:25:39.000000000 +0000 @@ -705,10 +705,10 @@ const int max = limit - intensity; const int src_h = AV_CEIL_RSHIFT(in->height, shift_h); const int src_w = AV_CEIL_RSHIFT(in->width, shift_w); - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int step = column ? 1 << shift_w : 1 << shift_h; const uint16_t *src_data = (const uint16_t *)in->data[plane] + sliceh_start * src_linesize; uint16_t *dst_data = (uint16_t *)out->data[dplane] + (offset_y + sliceh_start * step) * dst_linesize + offset_x; @@ -842,10 +842,10 @@ const int max = 255 - intensity; const int src_h = AV_CEIL_RSHIFT(in->height, shift_h); const int src_w = AV_CEIL_RSHIFT(in->width, shift_w); - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int step = column ? 1 << shift_w : 1 << shift_h; const uint8_t *src_data = in->data[plane] + sliceh_start * src_linesize; uint8_t *dst_data = out->data[dplane] + (offset_y + sliceh_start * step) * dst_linesize + offset_x; @@ -986,10 +986,10 @@ const int mid = s->max / 2; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; int x, y; if (column) { @@ -1123,10 +1123,10 @@ const int max = 255 - intensity; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; int x, y; if (column) { @@ -1269,10 +1269,10 @@ const int mid = s->max / 2; \ const int src_h = in->height; \ const int src_w = in->width; \ - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; \ - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; \ - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; \ - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; \ + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; \ + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; \ + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; \ + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; \ int x, y; \ \ if (column) { \ @@ -1386,10 +1386,10 @@ int offset_x = td->offset_x; \ const int src_h = in->height; \ const int src_w = in->width; \ - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; \ - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; \ - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; \ - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; \ + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; \ + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; \ + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; \ + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; \ const int intensity = s->intensity; \ const int plane = s->desc->comp[component].plane; \ const int c0_linesize = in->linesize[ plane + 0 ]; \ @@ -1550,10 +1550,10 @@ const int c1_shift_h = s->shift_h[(component + 2) % s->ncomp]; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; int x, y; if (column) { @@ -1646,10 +1646,10 @@ const int plane = s->desc->comp[component].plane; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int c0_linesize = in->linesize[(plane + 1) % s->ncomp]; const int c1_linesize = in->linesize[(plane + 2) % s->ncomp]; const int dst_linesize = out->linesize[plane]; @@ -1751,10 +1751,10 @@ const int limit = s->max - 1; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int c0_linesize = in->linesize[ plane + 0 ] / 2; const int c1_linesize = in->linesize[(plane + 1) % s->ncomp] / 2; const int c2_linesize = in->linesize[(plane + 2) % s->ncomp] / 2; @@ -1883,10 +1883,10 @@ const int plane = s->desc->comp[component].plane; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int c0_linesize = in->linesize[ plane + 0 ]; const int c1_linesize = in->linesize[(plane + 1) % s->ncomp]; const int c2_linesize = in->linesize[(plane + 2) % s->ncomp]; @@ -2017,10 +2017,10 @@ const int max = limit - intensity; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int c0_shift_h = s->shift_h[ component + 0 ]; const int c1_shift_h = s->shift_h[(component + 1) % s->ncomp]; const int c2_shift_h = s->shift_h[(component + 2) % s->ncomp]; @@ -2149,10 +2149,10 @@ const int plane = s->desc->comp[component].plane; const int src_h = in->height; const int src_w = in->width; - const int sliceh_start = !column ? (src_h * jobnr) / nb_jobs : 0; - const int sliceh_end = !column ? (src_h * (jobnr+1)) / nb_jobs : src_h; - const int slicew_start = column ? (src_w * jobnr) / nb_jobs : 0; - const int slicew_end = column ? (src_w * (jobnr+1)) / nb_jobs : src_w; + const int sliceh_start = !column ? ff_slice_pos(src_h, jobnr, nb_jobs) : 0; + const int sliceh_end = !column ? ff_slice_pos(src_h, jobnr + 1, nb_jobs) : src_h; + const int slicew_start = column ? ff_slice_pos(src_w, jobnr, nb_jobs) : 0; + const int slicew_end = column ? ff_slice_pos(src_w, jobnr + 1, nb_jobs) : src_w; const int c0_shift_w = s->shift_w[ component + 0 ]; const int c1_shift_w = s->shift_w[(component + 1) % s->ncomp]; const int c2_shift_w = s->shift_w[(component + 2) % s->ncomp]; diff -Nru ffmpeg-7.1.4/libavfilter/vf_weave.c ffmpeg-7.1.5/libavfilter/vf_weave.c --- ffmpeg-7.1.4/libavfilter/vf_weave.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_weave.c 2026-06-20 02:25:39.000000000 +0000 @@ -111,8 +111,8 @@ for (int i = 0; i < s->nb_planes; i++) { const int height = s->planeheight[i]; - const int start = (height * jobnr) / nb_jobs; - const int end = (height * (jobnr+1)) / nb_jobs; + const int start = ff_slice_pos(height, jobnr, nb_jobs); + const int end = ff_slice_pos(height, jobnr + 1, nb_jobs); const int compensation = 2*end > s->outheight[i]; av_image_copy_plane(out->data[i] + out->linesize[i] * field1 + diff -Nru ffmpeg-7.1.4/libavfilter/vf_xbr.c ffmpeg-7.1.5/libavfilter/vf_xbr.c --- ffmpeg-7.1.4/libavfilter/vf_xbr.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_xbr.c 2026-06-20 02:25:39.000000000 +0000 @@ -219,8 +219,8 @@ const AVFrame *input = td->in; AVFrame *output = td->out; const uint32_t *r2y = td->rgbtoyuv; - const int slice_start = (input->height * jobnr ) / nb_jobs; - const int slice_end = (input->height * (jobnr+1)) / nb_jobs; + const int slice_start = ff_slice_pos(input->height, jobnr, nb_jobs); + const int slice_end = ff_slice_pos(input->height, jobnr + 1, nb_jobs); const int nl = output->linesize[0] >> 2; const int nl1 = nl + nl; const int nl2 = nl1 + nl; diff -Nru ffmpeg-7.1.4/libavfilter/vf_xfade.c ffmpeg-7.1.5/libavfilter/vf_xfade.c --- ffmpeg-7.1.4/libavfilter/vf_xfade.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_xfade.c 2026-06-20 02:25:39.000000000 +0000 @@ -2193,8 +2193,8 @@ XFadeContext *s = ctx->priv; AVFilterLink *outlink = ctx->outputs[0]; ThreadData *td = arg; - int slice_start = (outlink->h * jobnr ) / nb_jobs; - int slice_end = (outlink->h * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(outlink->h, jobnr, nb_jobs); + int slice_end = ff_slice_pos(outlink->h, jobnr + 1, nb_jobs); s->transitionf(ctx, td->xf[0], td->xf[1], td->out, td->progress, slice_start, slice_end, jobnr); diff -Nru ffmpeg-7.1.4/libavfilter/vf_xmedian.c ffmpeg-7.1.5/libavfilter/vf_xmedian.c --- ffmpeg-7.1.4/libavfilter/vf_xmedian.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_xmedian.c 2026-06-20 02:25:39.000000000 +0000 @@ -145,8 +145,8 @@ type values[256]; \ \ for (int p = 0; p < s->nb_planes; p++) { \ - const int slice_start = (s->height[p] * jobnr) / nb_jobs; \ - const int slice_end = (s->height[p] * (jobnr+1)) / nb_jobs; \ + const int slice_start = ff_slice_pos(s->height[p], jobnr, nb_jobs); \ + const int slice_end = ff_slice_pos(s->height[p], jobnr + 1, nb_jobs); \ const int width = s->width[p]; \ type *dst = (type *)(out->data[p] + slice_start * out->linesize[p]); \ ptrdiff_t dst_linesize = out->linesize[p] / sizeof(type); \ diff -Nru ffmpeg-7.1.4/libavfilter/vf_yadif.c ffmpeg-7.1.5/libavfilter/vf_yadif.c --- ffmpeg-7.1.4/libavfilter/vf_yadif.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_yadif.c 2026-06-20 02:25:39.000000000 +0000 @@ -193,8 +193,8 @@ int refs = s->cur->linesize[td->plane]; int df = (s->csp->comp[td->plane].depth + 7) / 8; int pix_3 = 3 * df; - int slice_start = (td->h * jobnr ) / nb_jobs; - int slice_end = (td->h * (jobnr+1)) / nb_jobs; + int slice_start = ff_slice_pos(td->h, jobnr, nb_jobs); + int slice_end = ff_slice_pos(td->h, jobnr + 1, nb_jobs); int y; int edge = 3 + MAX_ALIGN / df - 1; diff -Nru ffmpeg-7.1.4/libavfilter/vf_yaepblur.c ffmpeg-7.1.5/libavfilter/vf_yaepblur.c --- ffmpeg-7.1.4/libavfilter/vf_yaepblur.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/vf_yaepblur.c 2026-06-20 02:25:39.000000000 +0000 @@ -104,8 +104,8 @@ const int linesize = td->src_linesize / sizeof(type); \ const int sat_linesize = s->sat_linesize; \ \ - const int starty = height * jobnr / nb_jobs; \ - const int endy = height * (jobnr+1) / nb_jobs; \ + const int starty = ff_slice_pos(height, jobnr, nb_jobs); \ + const int endy = ff_slice_pos(height, jobnr + 1, nb_jobs); \ \ uint64_t *sat = s->sat + (starty + 1) * sat_linesize; \ uint64_t *square_sat = s->square_sat + (starty + 1) * sat_linesize; \ @@ -139,8 +139,8 @@ const int height = td->height; const int sat_linesize = s->sat_linesize; - const int startx = width * jobnr / nb_jobs; - const int endx = width * (jobnr + 1) / nb_jobs; + const int startx = ff_slice_pos(width, jobnr, nb_jobs); + const int endx = ff_slice_pos(width, jobnr + 1, nb_jobs); uint64_t *sat, *square_sat; int x, y; @@ -178,8 +178,8 @@ const type *src = (const type *)td->src; \ type *dst = (type *)td->dst; \ \ - const int starty = height * jobnr / nb_jobs; \ - const int endy = height * (jobnr + 1) / nb_jobs; \ + const int starty = ff_slice_pos(height, jobnr, nb_jobs); \ + const int endy = ff_slice_pos(height, jobnr + 1, nb_jobs); \ \ int x, y; \ int lower_x, higher_x; \ diff -Nru ffmpeg-7.1.4/libavfilter/x86/vf_lut3d_init.c ffmpeg-7.1.5/libavfilter/x86/vf_lut3d_init.c --- ffmpeg-7.1.4/libavfilter/x86/vf_lut3d_init.c 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.5/libavfilter/x86/vf_lut3d_init.c 2026-06-20 02:25:39.000000000 +0000 @@ -21,6 +21,7 @@ #include "libavutil/attributes.h" #include "libavutil/cpu.h" #include "libavutil/x86/cpu.h" +#include "libavfilter/filters.h" #include "libavfilter/lut3d.h" #define DEFINE_INTERP_FUNC(name, format, opt) \ @@ -33,8 +34,8 @@ AVFrame *in = td->in; \ AVFrame *out = td->out; \ int has_alpha = in->linesize[3] && out != in; \ - int slice_start = (in->height * jobnr ) / nb_jobs; \ - int slice_end = (in->height * (jobnr+1)) / nb_jobs; \ + int slice_start = ff_slice_pos(in->height, jobnr, nb_jobs); \ + int slice_end = ff_slice_pos(in->height, jobnr + 1, nb_jobs); \ ff_interp_##name##_##format##_##opt(lut3d, prelut, in, out, slice_start, slice_end, has_alpha); \ return 0; \ } diff -Nru ffmpeg-7.1.4/libavformat/assenc.c ffmpeg-7.1.5/libavformat/assenc.c --- ffmpeg-7.1.4/libavformat/assenc.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/assenc.c 2026-06-20 02:25:39.000000000 +0000 @@ -186,7 +186,7 @@ if (hh2 > 9) hh2 = 9, mm2 = 59, ss2 = 59, ms2 = 99; text_len = strlen(p); - while (text_len > 0 && p[text_len - 1] == '\r' || p[text_len - 1] == '\n') + while (text_len > 0 && (p[text_len - 1] == '\r' || p[text_len - 1] == '\n')) text_len--; dialogue->line = av_asprintf("%s%ld,%d:%02d:%02d.%02d,%d:%02d:%02d.%02d,%.*s", diff -Nru ffmpeg-7.1.4/libavformat/avc.c ffmpeg-7.1.5/libavformat/avc.c --- ffmpeg-7.1.4/libavformat/avc.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/avc.c 2026-06-20 02:25:39.000000000 +0000 @@ -23,6 +23,7 @@ #include "libavutil/mem.h" #include "libavcodec/h264.h" #include "libavcodec/get_bits.h" +#include "libavcodec/golomb.h" #include "avio.h" #include "avc.h" #include "avio_internal.h" @@ -192,19 +193,6 @@ { 2, 1 }, }; -static inline int get_ue_golomb(GetBitContext *gb) { - int i; - for (i = 0; i < 32 && !get_bits1(gb); i++) - ; - return get_bitsz(gb, i) + (1 << i) - 1; -} - -static inline int get_se_golomb(GetBitContext *gb) { - int v = get_ue_golomb(gb) + 1; - int sign = -(v & 1); - return ((v >> 1) ^ sign) - sign; -} - int ff_avc_decode_sps(H264SPS *sps, const uint8_t *buf, int buf_size) { int i, j, ret, rbsp_size, aspect_ratio_idc, pic_order_cnt_type; @@ -233,19 +221,19 @@ sps->constraint_set_flags |= get_bits1(&gb) << 5; // constraint_set5_flag skip_bits(&gb, 2); // reserved_zero_2bits sps->level_idc = get_bits(&gb, 8); - sps->id = get_ue_golomb(&gb); + sps->id = get_ue_golomb_long(&gb); if (sps->profile_idc == 100 || sps->profile_idc == 110 || sps->profile_idc == 122 || sps->profile_idc == 244 || sps->profile_idc == 44 || sps->profile_idc == 83 || sps->profile_idc == 86 || sps->profile_idc == 118 || sps->profile_idc == 128 || sps->profile_idc == 138 || sps->profile_idc == 139 || sps->profile_idc == 134) { - sps->chroma_format_idc = get_ue_golomb(&gb); // chroma_format_idc + sps->chroma_format_idc = get_ue_golomb_long(&gb); // chroma_format_idc if (sps->chroma_format_idc == 3) { skip_bits1(&gb); // separate_colour_plane_flag } - sps->bit_depth_luma = get_ue_golomb(&gb) + 8; - sps->bit_depth_chroma = get_ue_golomb(&gb) + 8; + sps->bit_depth_luma = get_ue_golomb_long(&gb) + 8; + sps->bit_depth_chroma = get_ue_golomb_long(&gb) + 8; skip_bits1(&gb); // qpprime_y_zero_transform_bypass_flag if (get_bits1(&gb)) { // seq_scaling_matrix_present_flag for (i = 0; i < ((sps->chroma_format_idc != 3) ? 8 : 12); i++) { @@ -256,7 +244,7 @@ sizeOfScalingList = i < 6 ? 16 : 64; for (j = 0; j < sizeOfScalingList; j++) { if (nextScale != 0) { - delta_scale = get_se_golomb(&gb); + delta_scale = get_se_golomb_long(&gb); nextScale = (lastScale + delta_scale) & 0xff; } lastScale = nextScale == 0 ? lastScale : nextScale; @@ -269,24 +257,24 @@ sps->bit_depth_chroma = 8; } - get_ue_golomb(&gb); // log2_max_frame_num_minus4 - pic_order_cnt_type = get_ue_golomb(&gb); + get_ue_golomb_long(&gb); // log2_max_frame_num_minus4 + pic_order_cnt_type = get_ue_golomb_long(&gb); if (pic_order_cnt_type == 0) { - get_ue_golomb(&gb); // log2_max_pic_order_cnt_lsb_minus4 + get_ue_golomb_long(&gb); // log2_max_pic_order_cnt_lsb_minus4 } else if (pic_order_cnt_type == 1) { skip_bits1(&gb); // delta_pic_order_always_zero - get_se_golomb(&gb); // offset_for_non_ref_pic - get_se_golomb(&gb); // offset_for_top_to_bottom_field - num_ref_frames_in_pic_order_cnt_cycle = get_ue_golomb(&gb); + get_se_golomb_long(&gb); // offset_for_non_ref_pic + get_se_golomb_long(&gb); // offset_for_top_to_bottom_field + num_ref_frames_in_pic_order_cnt_cycle = get_ue_golomb_long(&gb); for (i = 0; i < num_ref_frames_in_pic_order_cnt_cycle; i++) - get_se_golomb(&gb); // offset_for_ref_frame + get_se_golomb_long(&gb); // offset_for_ref_frame } - get_ue_golomb(&gb); // max_num_ref_frames + get_ue_golomb_long(&gb); // max_num_ref_frames skip_bits1(&gb); // gaps_in_frame_num_value_allowed_flag - get_ue_golomb(&gb); // pic_width_in_mbs_minus1 - get_ue_golomb(&gb); // pic_height_in_map_units_minus1 + get_ue_golomb_long(&gb); // pic_width_in_mbs_minus1 + get_ue_golomb_long(&gb); // pic_height_in_map_units_minus1 sps->frame_mbs_only_flag = get_bits1(&gb); if (!sps->frame_mbs_only_flag) @@ -295,10 +283,10 @@ skip_bits1(&gb); // direct_8x8_inference_flag if (get_bits1(&gb)) { // frame_cropping_flag - get_ue_golomb(&gb); // frame_crop_left_offset - get_ue_golomb(&gb); // frame_crop_right_offset - get_ue_golomb(&gb); // frame_crop_top_offset - get_ue_golomb(&gb); // frame_crop_bottom_offset + get_ue_golomb_long(&gb); // frame_crop_left_offset + get_ue_golomb_long(&gb); // frame_crop_right_offset + get_ue_golomb_long(&gb); // frame_crop_top_offset + get_ue_golomb_long(&gb); // frame_crop_bottom_offset } if (get_bits1(&gb)) { // vui_parameters_present_flag diff -Nru ffmpeg-7.1.4/libavformat/dashdec.c ffmpeg-7.1.5/libavformat/dashdec.c --- ffmpeg-7.1.4/libavformat/dashdec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/dashdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -446,7 +446,7 @@ av_freep(pb); av_dict_copy(&tmp, *opts, 0); av_dict_copy(&tmp, opts2, 0); - ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp, s->protocol_whitelist, s->protocol_blacklist); + ret = s->io_open(s, pb, url, AVIO_FLAG_READ, &tmp); if (ret >= 0) { // update cookies on http response with setcookies. char *new_cookies = NULL; @@ -1242,7 +1242,7 @@ close_in = 1; av_dict_copy(&opts, c->avio_opts, 0); - ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist); + ret = s->io_open(s, &in, url, AVIO_FLAG_READ, &opts); av_dict_free(&opts); if (ret < 0) return ret; @@ -1385,7 +1385,7 @@ av_bprint_finalize(&buf, NULL); if (close_in) { - avio_close(in); + ff_format_io_close(s, &in); } return ret; } @@ -2069,6 +2069,8 @@ if (ret) return ret; + if (rep->ctx->nb_streams == 0) + return AVERROR_PATCHWELCOME; rep->stream_index = stream_index; ++stream_index; } @@ -2087,6 +2089,8 @@ if (ret) return ret; + if (rep->ctx->nb_streams == 0) + return AVERROR_PATCHWELCOME; rep->stream_index = stream_index; ++stream_index; } @@ -2105,6 +2109,8 @@ if (ret) return ret; + if (rep->ctx->nb_streams == 0) + return AVERROR_PATCHWELCOME; rep->stream_index = stream_index; ++stream_index; } diff -Nru ffmpeg-7.1.4/libavformat/dashenc.c ffmpeg-7.1.5/libavformat/dashenc.c --- ffmpeg-7.1.4/libavformat/dashenc.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/dashenc.c 2026-06-20 02:25:39.000000000 +0000 @@ -619,7 +619,7 @@ if (!c->single_file) ffio_free_dyn_buf(&os->ctx->pb); else - avio_close(os->ctx->pb); + ff_format_io_close(s, &os->ctx->pb); } ff_format_io_close(s, &os->out); avformat_free_context(os->ctx); @@ -1586,7 +1586,7 @@ ret = s->io_open(s, &os->out, filename, AVIO_FLAG_WRITE, &opts); } else { ctx->url = av_strdup(filename); - ret = avio_open2(&ctx->pb, filename, AVIO_FLAG_WRITE, NULL, &opts); + ret = s->io_open(s, &ctx->pb, filename, AVIO_FLAG_WRITE, &opts); } av_dict_free(&opts); if (ret < 0) diff -Nru ffmpeg-7.1.4/libavformat/demux.c ffmpeg-7.1.5/libavformat/demux.c --- ffmpeg-7.1.4/libavformat/demux.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/demux.c 2026-06-20 02:25:39.000000000 +0000 @@ -364,7 +364,7 @@ ff_id3v2_free_extra_meta(&id3v2_extra_meta); av_dict_free(&tmp); if (s->pb && !(s->flags & AVFMT_FLAG_CUSTOM_IO)) - avio_closep(&s->pb); + ff_format_io_close(s, &s->pb); avformat_free_context(s); *ps = NULL; return ret; diff -Nru ffmpeg-7.1.4/libavformat/ftp.c ffmpeg-7.1.5/libavformat/ftp.c --- ffmpeg-7.1.4/libavformat/ftp.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/ftp.c 2026-06-20 02:25:39.000000000 +0000 @@ -100,6 +100,16 @@ static int ftp_close(URLContext *h); +static int is_bad_string(const unsigned char *s) +{ + while(*s) { + if (*s < 0x20 || *s == 0x7F || *s == 0xFF) + return 1; + s++; + } + return 0; +} + static int ftp_getc(FTPContext *s) { int len; @@ -250,7 +260,7 @@ static const int user_codes[] = {331, 230, 0}; static const int pass_codes[] = {230, 0}; - if (strpbrk(s->user, "\r\n")) + if (is_bad_string(s->user)) return AVERROR(EINVAL); err = snprintf(buf, sizeof(buf), "USER %s\r\n", s->user); if (err >= sizeof(buf)) @@ -259,7 +269,7 @@ err = ftp_send_command(s, buf, user_codes, NULL); if (err == 331) { if (s->password) { - if (strpbrk(s->password, "\r\n")) + if (is_bad_string(s->password)) return AVERROR(EINVAL); err = snprintf(buf, sizeof(buf), "PASS %s\r\n", s->password); if (err >= sizeof(buf)) @@ -746,6 +756,11 @@ av_free(s->path); s->path = newpath; + if (is_bad_string(s->path)) { + av_log(h, AV_LOG_ERROR, "Path contains non-printable characters\n"); + return AVERROR(EINVAL); + } + return 0; } @@ -1156,6 +1171,10 @@ av_url_split(0, 0, 0, 0, 0, 0, 0, path, sizeof(path), h_dst->filename); + if (is_bad_string(path)) { + ret = AVERROR(EINVAL); + goto cleanup; + } ret = snprintf(command, sizeof(command), "RNTO %s\r\n", path); if (ret >= sizeof(command)) { ret = AVERROR(ENOSYS); diff -Nru ffmpeg-7.1.4/libavformat/gxfenc.c ffmpeg-7.1.5/libavformat/gxfenc.c --- ffmpeg-7.1.4/libavformat/gxfenc.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/gxfenc.c 2026-06-20 02:25:39.000000000 +0000 @@ -669,9 +669,12 @@ if (sscanf(tcstr, "%d:%d:%d%c%d", &tc->hh, &tc->mm, &tc->ss, &c, &tc->ff) != 5) { av_log(s, AV_LOG_ERROR, "unable to parse timecode, " "syntax: hh:mm:ss[:;.]ff\n"); - return -1; + return AVERROR(EINVAL); } + if (tc->hh > 31U || tc->mm > 255U || tc->ss > 255U || tc->ff > (255U >> (fields == 2))) + return AVERROR(EINVAL); + tc->color = 0; tc->drop = c != ':'; @@ -803,8 +806,11 @@ sc->order = s->nb_streams - st->index; } - if (tcr && vsc) - gxf_init_timecode(s, &gxf->tc, tcr->value, vsc->fields); + if (tcr && vsc) { + ret = gxf_init_timecode(s, &gxf->tc, tcr->value, vsc->fields); + if (ret < 0) + return ret; + } gxf_init_timecode_track(&gxf->timecode_track, vsc); gxf->flags |= 0x200000; // time code track is non-drop frame diff -Nru ffmpeg-7.1.4/libavformat/hls.c ffmpeg-7.1.5/libavformat/hls.c --- ffmpeg-7.1.4/libavformat/hls.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/hls.c 2026-06-20 02:25:39.000000000 +0000 @@ -451,6 +451,11 @@ ptr = strchr(info->byterange, '@'); if (ptr) sec->url_offset = strtoll(ptr+1, NULL, 10); + if (sec->size < 0 || sec->url_offset < 0 || sec->size > INT64_MAX - sec->url_offset) { + av_freep(&sec->url); + av_free(sec); + return NULL; + } } else { /* the entire file is the init section */ sec->size = -1; @@ -954,9 +959,14 @@ goto fail; } if (av_strstart(ptr, "TIME-OFFSET=", &time_offset_value)) { - float offset = strtof(time_offset_value, NULL); - pls->start_time_offset = offset * AV_TIME_BASE; - pls->time_offset_flag = 1; + double offset = strtod(time_offset_value, NULL) * AV_TIME_BASE; + if (offset >= -0x1p63 && offset < 0x1p63) { + pls->start_time_offset = offset; + pls->time_offset_flag = 1; + } else { + av_log(c->ctx, AV_LOG_WARNING, "TIME-OFFSET value is" + "invalid, it will be ignored"); + } } else { av_log(c->ctx, AV_LOG_WARNING, "#EXT-X-START value is" "invalid, it will be ignored"); diff -Nru ffmpeg-7.1.4/libavformat/hlsenc.c ffmpeg-7.1.5/libavformat/hlsenc.c --- ffmpeg-7.1.4/libavformat/hlsenc.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/hlsenc.c 2026-06-20 02:25:39.000000000 +0000 @@ -777,7 +777,7 @@ return ret; avio_seek(pb, 0, SEEK_CUR); avio_write(pb, key, KEYSIZE); - avio_close(pb); + ff_format_io_close(s, &pb); } return 0; } @@ -1215,9 +1215,7 @@ const char *end; double discont_program_date_time = 0; - if ((ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, - &s->interrupt_callback, NULL, - s->protocol_whitelist, s->protocol_blacklist)) < 0) + if ((ret = s->io_open(s, &in, url, AVIO_FLAG_READ, NULL)) < 0) return ret; ff_get_chomp_line(in, line, sizeof(line)); @@ -1313,7 +1311,7 @@ } fail: - avio_close(in); + ff_format_io_close(s, &in); return ret; } diff -Nru ffmpeg-7.1.4/libavformat/http.c ffmpeg-7.1.5/libavformat/http.c --- ffmpeg-7.1.4/libavformat/http.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/http.c 2026-06-20 02:25:39.000000000 +0000 @@ -1145,6 +1145,8 @@ method = p; while (*p && !av_isspace(*p)) p++; + if (!av_isspace(*p)) + return ff_http_averror(400, AVERROR(EIO)); *(p++) = '\0'; av_log(h, AV_LOG_TRACE, "Received method: %s\n", method); if (s->method) { @@ -1171,6 +1173,8 @@ resource = p; while (*p && !av_isspace(*p)) p++; + if (!av_isspace(*p)) + return ff_http_averror(400, AVERROR(EIO)); *(p++) = '\0'; av_log(h, AV_LOG_TRACE, "Requested resource: %s\n", resource); if (!(s->resource = av_strdup(resource))) diff -Nru ffmpeg-7.1.4/libavformat/iamf_parse.c ffmpeg-7.1.5/libavformat/iamf_parse.c --- ffmpeg-7.1.4/libavformat/iamf_parse.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/iamf_parse.c 2026-06-20 02:25:39.000000000 +0000 @@ -694,6 +694,13 @@ } nb_substreams = ffio_read_leb(pbc); + /* Each substream consumes at least one byte (its leb128 id) from the + * remaining OBU buffer, so a count larger than that cannot be valid and + * would only serve to force an oversized allocation. */ + if (nb_substreams > len - avio_tell(pbc) || !nb_substreams) { + ret = AVERROR_INVALIDDATA; + goto fail; + } audio_element->codec_config_id = codec_config_id; audio_element->audio_element_id = audio_element_id; audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); diff -Nru ffmpeg-7.1.4/libavformat/icecast.c ffmpeg-7.1.5/libavformat/icecast.c --- ffmpeg-7.1.4/libavformat/icecast.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/icecast.c 2026-06-20 02:25:39.000000000 +0000 @@ -70,8 +70,14 @@ static void cat_header(AVBPrint *bp, const char key[], const char value[]) { - if (NOT_EMPTY(value)) + if (NOT_EMPTY(value)) { + if (strpbrk(value, "\r\n")) { + av_log(NULL, AV_LOG_ERROR, + "Refusing to send '%s' header: value contains CR/LF\n", key); + return; + } av_bprintf(bp, "%s: %s\r\n", key, value); + } } static int icecast_close(URLContext *h) diff -Nru ffmpeg-7.1.4/libavformat/iff.c ffmpeg-7.1.5/libavformat/iff.c --- ffmpeg-7.1.4/libavformat/iff.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/iff.c 2026-06-20 02:25:39.000000000 +0000 @@ -888,6 +888,8 @@ } } ret = av_get_packet(pb, pkt, data_size); + if (ret < 0) + return ret; pkt->pos = orig_pos; pkt->duration = get_anim_duration(pkt->data, pkt->size); if (pos == 12) diff -Nru ffmpeg-7.1.4/libavformat/matroskadec.c ffmpeg-7.1.5/libavformat/matroskadec.c --- ffmpeg-7.1.4/libavformat/matroskadec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/matroskadec.c 2026-06-20 02:25:39.000000000 +0000 @@ -1339,6 +1339,13 @@ if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size) return AVERROR(ENOMEM); + if (syntax->id == MATROSKA_ID_TRACKENTRY && + list->nb_elem >= matroska->ctx->max_streams) { + av_log(matroska->ctx, AV_LOG_ERROR, + "Number of tracks exceeds max_streams (%d)\n", + matroska->ctx->max_streams); + return AVERROR(EINVAL); + } newelem = av_fast_realloc(list->elem, &list->alloc_elem_size, (list->nb_elem + 1) * syntax->list_elem_size); @@ -4453,7 +4460,8 @@ cue_desc.end_offset = cues_start - matroska->segment_start; } - if (cue_desc.end_time_ns < cue_desc.start_time_ns) + if (cue_desc.end_time_ns < cue_desc.start_time_ns || + cue_desc.end_time_ns - (uint64_t)cue_desc.start_time_ns > INT64_MAX) return (CueDesc) {-1, -1, -1, -1}; return cue_desc; @@ -4647,11 +4655,14 @@ bits_per_second = 0.0; do { int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; - int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8) return -1; + if (desc_end.end_time_ns <= desc_beg.start_time_ns || + desc_end.end_time_ns - (uint64_t)desc_beg.start_time_ns > INT64_MAX) + return -1; + int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; desc_sec = desc_ns / nano_seconds_per_second; calc_bits_per_second = (desc_bytes * 8) / desc_sec; diff -Nru ffmpeg-7.1.4/libavformat/mov.c ffmpeg-7.1.5/libavformat/mov.c --- ffmpeg-7.1.4/libavformat/mov.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/mov.c 2026-06-20 02:25:39.000000000 +0000 @@ -1196,15 +1196,13 @@ version = avio_r8(pb); flags = avio_rb24(pb); if (version != 0 || flags != 0) { - av_log(c->fc, AV_LOG_ERROR, - "Unsupported 'chnl' box with version %d, flags: %#x", + av_log(c->fc, AV_LOG_WARNING, + "Unsupported 'chnl' box with version %d, flags: %#x\n", version, flags); - return AVERROR_INVALIDDATA; + return 0; } - ret = ff_mov_read_chnl(c->fc, pb, st); - if (ret < 0) - return ret; + ff_mov_read_chnl(c->fc, pb, st); if (avio_tell(pb) != end) { av_log(c->fc, AV_LOG_WARNING, "skip %" PRId64 " bytes of unknown data inside chnl\n", @@ -5035,7 +5033,8 @@ { if ((sc->chunk_count && (!sc->stts_count || !sc->stsc_count || (!sc->sample_size && !sc->sample_count))) || - (!sc->chunk_count && sc->sample_count)) { + (sc->sample_count && (!sc->chunk_count || + (!sc->sample_size && !sc->sample_sizes)))) { av_log(log_obj, AV_LOG_ERROR, "stream %d, missing mandatory atoms, broken header\n", index); return 1; @@ -9002,6 +9001,12 @@ av_log(c->fc, AV_LOG_TRACE, "ispe: item_id %d, width %u, height %u\n", c->cur_item_id, width, height); + if (!width || !height || width > INT_MAX || height > INT_MAX) { + av_log(c->fc, AV_LOG_ERROR, "Invalid ispe dimensions %"PRIu32"x%"PRIu32"\n", + width, height); + return AVERROR_INVALIDDATA; + } + item = heif_cur_item(c); if (item) { item->width = width; @@ -9915,8 +9920,10 @@ { MOVContext *c = s->priv_data; const HEIFItem *item = grid->item; + int64_t coded_width = 0, coded_height = 0; int64_t offset = 0, pos = avio_tell(s->pb); - int x = 0, y = 0, i = 0; + int64_t x = 0, y = 0; + int i = 0; int tile_rows, tile_cols; int flags, size; @@ -9955,9 +9962,15 @@ return AVERROR_INVALIDDATA; for (int i = 0; i < tile_cols; i++) - tile_grid->coded_width += grid->tile_item_list[i]->width; + coded_width += grid->tile_item_list[i]->width; for (int i = 0; i < size; i += tile_cols) - tile_grid->coded_height += grid->tile_item_list[i]->height; + coded_height += grid->tile_item_list[i]->height; + + if (coded_width > INT_MAX || coded_height > INT_MAX) + return AVERROR_INVALIDDATA; + + tile_grid->coded_width = coded_width; + tile_grid->coded_height = coded_height; tile_grid->offsets = av_calloc(tile_grid->nb_tiles, sizeof(*tile_grid->offsets)); if (!tile_grid->offsets) @@ -10916,6 +10929,7 @@ if (sample >= sc->sample_offsets_count) return 1; + av_assert0(sample >= 0); key_sample_dts = sti->index_entries[sample].timestamp; key_sample_pts = key_sample_dts + sc->sample_offsets[sample] + sc->dts_shift; @@ -10958,6 +10972,8 @@ next_ts = timestamp - FFMAX(sc->min_sample_duration, 1); requested_sample = av_index_search_timestamp(st, next_ts, flags); + if (requested_sample < 0) + return AVERROR_INVALIDDATA; // If we've reached a different sample trying to find a good pts to // seek to, give up searching because we'll end up seeking back to diff -Nru ffmpeg-7.1.4/libavformat/mov_chan.c ffmpeg-7.1.5/libavformat/mov_chan.c --- ffmpeg-7.1.4/libavformat/mov_chan.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/mov_chan.c 2026-06-20 02:25:39.000000000 +0000 @@ -375,6 +375,7 @@ /* find the channel layout for the specified layout tag */ layout_map = find_layout_map(tag, map); if (layout_map) { + AVChannelLayout tmp = { 0 }; int ret; int map_layout_nb_channels = tag & 0xFFFF; int nb_channels = ch_layout->nb_channels; @@ -383,19 +384,23 @@ if (omitted_channel_map >> map_layout_nb_channels) return AVERROR_INVALIDDATA; - av_channel_layout_uninit(ch_layout); - ret = av_channel_layout_custom_init(ch_layout, nb_channels); + ret = av_channel_layout_custom_init(&tmp, nb_channels); if (ret < 0) return ret; for (int i = 0, idx = 0; i < map_layout_nb_channels && idx < nb_channels; i++, omitted_channel_map >>= 1) { if (!(omitted_channel_map & 1)) { enum AVChannel id = layout_map[i].id; - ch_layout->u.map[idx++].id = (id != AV_CHAN_NONE ? id : AV_CHAN_UNKNOWN); + tmp.u.map[idx++].id = (id != AV_CHAN_NONE ? id : AV_CHAN_UNKNOWN); } } - return av_channel_layout_retype(ch_layout, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); + ret = av_channel_layout_retype(&tmp, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); + if (ret < 0) + return ret; + + av_channel_layout_uninit(ch_layout); + *ch_layout = tmp; } return 0; } @@ -543,6 +548,7 @@ return 0; if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) { + AVChannelLayout tmp = { 0 }; int nb_channels = ch_layout->nb_channels; if (!num_descr || num_descr < nb_channels) { @@ -562,8 +568,7 @@ num_descr = nb_channels; } - av_channel_layout_uninit(ch_layout); - ret = av_channel_layout_custom_init(ch_layout, nb_channels); + ret = av_channel_layout_custom_init(&tmp, nb_channels); if (ret < 0) goto out; @@ -580,12 +585,15 @@ avio_rl32(pb); // mCoordinates[1] avio_rl32(pb); // mCoordinates[2] size -= 20; - ch_layout->u.map[i].id = mov_get_channel_id(label); + tmp.u.map[i].id = mov_get_channel_id(label); } - ret = av_channel_layout_retype(ch_layout, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); + ret = av_channel_layout_retype(&tmp, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); if (ret < 0) goto out; + + av_channel_layout_uninit(ch_layout); + *ch_layout = tmp; } else if (layout_tag == MOV_CH_LAYOUT_USE_BITMAP) { if (!ch_layout->nb_channels || av_popcount(bitmap) == ch_layout->nb_channels) { if (bitmap < 0x40000) { @@ -737,11 +745,10 @@ av_log(s, AV_LOG_TRACE, "'chnl' layout %d\n", layout); if (!layout) { - AVChannelLayout *ch_layout = &st->codecpar->ch_layout; + AVChannelLayout tmp = { 0 }, *ch_layout = &st->codecpar->ch_layout; int nb_channels = ch_layout->nb_channels; - av_channel_layout_uninit(ch_layout); - ret = av_channel_layout_custom_init(ch_layout, nb_channels); + ret = av_channel_layout_custom_init(&tmp, nb_channels); if (ret < 0) return ret; @@ -762,12 +769,15 @@ channel = AV_CHAN_UNKNOWN; } - ch_layout->u.map[i].id = channel; + tmp.u.map[i].id = channel; } - ret = av_channel_layout_retype(ch_layout, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); + ret = av_channel_layout_retype(&tmp, 0, AV_CHANNEL_LAYOUT_RETYPE_FLAG_CANONICAL); if (ret < 0) return ret; + + av_channel_layout_uninit(ch_layout); + *ch_layout = tmp; } else { uint64_t omitted_channel_map = avio_rb64(pb); ret = ff_mov_get_channel_layout_from_config(layout, &st->codecpar->ch_layout, omitted_channel_map); diff -Nru ffmpeg-7.1.4/libavformat/mpegts.c ffmpeg-7.1.5/libavformat/mpegts.c --- ffmpeg-7.1.4/libavformat/mpegts.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/mpegts.c 2026-06-20 02:25:39.000000000 +0000 @@ -172,6 +172,7 @@ /* scan context */ /** structure to keep track of Program->pids mapping */ unsigned int nb_prg; + unsigned int prg_size; ///< allocated size of prg in bytes struct Program *prg; int8_t crc_validity[NB_PID_MAX]; @@ -315,17 +316,26 @@ { av_freep(&ts->prg); ts->nb_prg = 0; + ts->prg_size = 0; } static struct Program * add_program(MpegTSContext *ts, unsigned int programid) { struct Program *p = get_program(ts, programid); + struct Program *tmp = NULL; + size_t new_prg_size; if (p) return p; - if (av_reallocp_array(&ts->prg, ts->nb_prg + 1, sizeof(*ts->prg)) < 0) { - ts->nb_prg = 0; + + if (!av_size_mult(ts->nb_prg + 1, sizeof(*ts->prg), &new_prg_size)) + tmp = av_fast_realloc(ts->prg, &ts->prg_size,new_prg_size); + if (!tmp) { + av_freep(&ts->prg); + ts->nb_prg = 0; + ts->prg_size = 0; return NULL; } + ts->prg = tmp; p = &ts->prg[ts->nb_prg]; p->id = programid; clear_program(p); diff -Nru ffmpeg-7.1.4/libavformat/mxfdec.c ffmpeg-7.1.5/libavformat/mxfdec.c --- ffmpeg-7.1.4/libavformat/mxfdec.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/mxfdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -1409,7 +1409,7 @@ av_log(NULL, AV_LOG_WARNING, "Duplicate sony_mpeg4_extradata\n"); av_free(descriptor->extradata); descriptor->extradata_size = 0; - descriptor->extradata = av_malloc(size); + descriptor->extradata = av_mallocz(size + AV_INPUT_BUFFER_PADDING_SIZE); if (!descriptor->extradata) return AVERROR(ENOMEM); descriptor->extradata_size = size; diff -Nru ffmpeg-7.1.4/libavformat/oggparsecelt.c ffmpeg-7.1.5/libavformat/oggparsecelt.c --- ffmpeg-7.1.4/libavformat/oggparsecelt.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/oggparsecelt.c 2026-06-20 02:25:39.000000000 +0000 @@ -27,6 +27,9 @@ #include "internal.h" #include "oggdec.h" +/* CELT-over-Ogg streams use at most a couple of vorbiscomment "extra" headers. */ +#define CELT_MAX_EXTRA_HEADERS 16 + struct oggcelt_private { int extra_headers_left; }; @@ -62,6 +65,12 @@ overlap = AV_RL32(p + 48); /* unused bytes per packet field skipped */ extra_headers = AV_RL32(p + 56); + if (extra_headers > CELT_MAX_EXTRA_HEADERS) { + av_log(s, AV_LOG_ERROR, + "Too many CELT extra headers (%u)\n", extra_headers); + av_free(priv); + return AVERROR_INVALIDDATA; + } st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_CELT; st->codecpar->sample_rate = sample_rate; diff -Nru ffmpeg-7.1.4/libavformat/oggparsevorbis.c ffmpeg-7.1.5/libavformat/oggparsevorbis.c --- ffmpeg-7.1.4/libavformat/oggparsevorbis.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/oggparsevorbis.c 2026-06-20 02:25:39.000000000 +0000 @@ -224,8 +224,11 @@ int i, offset, len, err; int buf_len; unsigned char *ptr; + uint64_t total_len = (uint64_t)priv->len[0] + priv->len[1] + priv->len[2]; + if (total_len + total_len / 255 + 64 > INT_MAX) + return AVERROR_INVALIDDATA; - len = priv->len[0] + priv->len[1] + priv->len[2]; + len = total_len; buf_len = len + len / 255 + 64; if (*buf) diff -Nru ffmpeg-7.1.4/libavformat/rtmppkt.c ffmpeg-7.1.5/libavformat/rtmppkt.c --- ffmpeg-7.1.4/libavformat/rtmppkt.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/rtmppkt.c 2026-06-20 02:25:39.000000000 +0000 @@ -27,6 +27,8 @@ #include "flv.h" #include "url.h" +#define MAX_DEPTH 16 ///< arbitrary limit to prevent unbounded recursion + void ff_amf_write_bool(uint8_t **dst, int val) { bytestream_put_byte(dst, AMF_DATA_TYPE_BOOL); @@ -436,7 +438,7 @@ pkt->size = 0; } -static int amf_tag_skip(GetByteContext *gb) +static int amf_tag_skip(GetByteContext *gb, int depth) { AMFDataType type; unsigned nb = -1; @@ -444,6 +446,11 @@ if (bytestream2_get_bytes_left(gb) < 1) return -1; + if (depth > MAX_DEPTH) { + av_log(NULL, AV_LOG_ERROR, "amf_tag_skip: exceeded max depth\n"); + return AVERROR_PATCHWELCOME; + } + type = bytestream2_get_byte(gb); switch (type) { case AMF_DATA_TYPE_NUMBER: @@ -479,7 +486,7 @@ return -1; bytestream2_skip(gb, size); } - t = amf_tag_skip(gb); + t = amf_tag_skip(gb, depth + 1); if (t < 0 || bytestream2_get_bytes_left(gb) <= 0) return -1; } @@ -499,7 +506,7 @@ bytestream2_init(&gb, data, data_end - data); - ret = amf_tag_skip(&gb); + ret = amf_tag_skip(&gb, 0); if (ret < 0 || bytestream2_get_bytes_left(&gb) <= 0) return -1; av_assert0(bytestream2_tell(&gb) >= 0 && bytestream2_tell(&gb) <= data_end - data); @@ -513,7 +520,7 @@ int len; while (bytestream2_peek_byte(gb) != AMF_DATA_TYPE_OBJECT && bytestream2_get_bytes_left(gb) > 0) { - int ret = amf_tag_skip(gb); + int ret = amf_tag_skip(gb, 0); if (ret < 0) return -1; } @@ -550,7 +557,7 @@ } return 0; } - len = amf_tag_skip(gb); + len = amf_tag_skip(gb, 0); if (len < 0 || bytestream2_get_bytes_left(gb) <= 0) return -1; } @@ -593,13 +600,18 @@ } static void amf_tag_contents(void *ctx, const uint8_t *data, - const uint8_t *data_end) + const uint8_t *data_end, int depth) { unsigned int size, nb = -1; char buf[1024]; AMFDataType type; int parse_key = 1; + if (depth > MAX_DEPTH) { + av_log(NULL, AV_LOG_ERROR, "amf_tag_contents: exceeded max depth\n"); + return; + } + if (data >= data_end) return; switch ((type = *data++)) { @@ -647,7 +659,7 @@ data += size; av_log(ctx, AV_LOG_DEBUG, " %s: ", buf); } - amf_tag_contents(ctx, data, data_end); + amf_tag_contents(ctx, data, data_end, depth + 1); t = ff_amf_tag_size(data, data_end); if (t < 0 || t >= data_end - data) return; @@ -670,7 +682,7 @@ uint8_t *src = p->data, *src_end = p->data + p->size; while (src < src_end) { int sz; - amf_tag_contents(ctx, src, src_end); + amf_tag_contents(ctx, src, src_end, 0); sz = ff_amf_tag_size(src, src_end); if (sz < 0) break; diff -Nru ffmpeg-7.1.4/libavformat/rtpenc_aac.c ffmpeg-7.1.5/libavformat/rtpenc_aac.c --- ffmpeg-7.1.4/libavformat/rtpenc_aac.c 2023-11-09 23:38:51.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/rtpenc_aac.c 2026-06-20 02:25:39.000000000 +0000 @@ -34,6 +34,10 @@ /* skip ADTS header, if present */ if ((s1->streams[0]->codecpar->extradata_size) == 0) { + if (size < 7) { + av_log(s1, AV_LOG_ERROR, "AAC packet too small for ADTS header\n"); + return; + } size -= 7; buff += 7; } diff -Nru ffmpeg-7.1.4/libavformat/rtpenc_amr.c ffmpeg-7.1.5/libavformat/rtpenc_amr.c --- ffmpeg-7.1.4/libavformat/rtpenc_amr.c 2020-04-27 21:48:16.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/rtpenc_amr.c 2026-06-20 02:25:39.000000000 +0000 @@ -34,6 +34,10 @@ int max_header_toc_size = 1 + s->max_frames_per_packet; uint8_t *p; int len; + int max_size = st->codecpar->codec_id == AV_CODEC_ID_AMR_NB ? 32 : 61; + + if (size < 1 || size > max_size) + return; /* Test if the packet must be sent. */ len = s->buf_ptr - s->buf; diff -Nru ffmpeg-7.1.4/libavformat/rtpenc_xiph.c ffmpeg-7.1.5/libavformat/rtpenc_xiph.c --- ffmpeg-7.1.4/libavformat/rtpenc_xiph.c 2023-11-09 23:38:51.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/rtpenc_xiph.c 2026-06-20 02:25:39.000000000 +0000 @@ -38,6 +38,10 @@ uint8_t *q; max_pkt_size = s->max_payload_size - 6; // ident+frag+tdt/vdt+pkt_num+pkt_length + if (max_pkt_size <= 0) { + av_log(s1, AV_LOG_ERROR, "Max payload size too small for Xiph RTP\n"); + return; + } // set xiph data type switch (*buff) { diff -Nru ffmpeg-7.1.4/libavformat/rtspdec.c ffmpeg-7.1.5/libavformat/rtspdec.c --- ffmpeg-7.1.4/libavformat/rtspdec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/rtspdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -190,7 +190,7 @@ rtsp_send_reply(s, RTSP_STATUS_SERVICE, NULL, request.seq); return AVERROR_OPTION_NOT_FOUND; } - if (request.content_length > 0) { + if (request.content_length > 0 && request.content_length <= SDP_MAX_SIZE) { sdp = av_malloc(request.content_length + 1); if (!sdp) return AVERROR(ENOMEM); diff -Nru ffmpeg-7.1.4/libavformat/sctp.c ffmpeg-7.1.5/libavformat/sctp.c --- ffmpeg-7.1.4/libavformat/sctp.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/sctp.c 2026-06-20 02:25:39.000000000 +0000 @@ -311,6 +311,9 @@ } if (s->max_streams) { + if (size < 2) + return AVERROR(EINVAL); + /*StreamId is introduced as a 2byte code into the stream*/ struct sctp_sndrcvinfo info = { 0 }; ret = ff_sctp_recvmsg(s->fd, buf + 2, size - 2, NULL, 0, &info, 0); diff -Nru ffmpeg-7.1.4/libavformat/soxdec.c ffmpeg-7.1.5/libavformat/soxdec.c --- ffmpeg-7.1.4/libavformat/soxdec.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/soxdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -87,7 +87,7 @@ return AVERROR_INVALIDDATA; } - if (sample_rate <= 0 || sample_rate > INT_MAX) { + if (sample_rate <= 0 || sample_rate > INT_MAX || isnan(sample_rate)) { av_log(s, AV_LOG_ERROR, "invalid sample rate (%f)\n", sample_rate); return AVERROR_INVALIDDATA; } diff -Nru ffmpeg-7.1.4/libavformat/ty.c ffmpeg-7.1.5/libavformat/ty.c --- ffmpeg-7.1.4/libavformat/ty.c 2026-05-03 23:09:50.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/ty.c 2026-06-20 02:25:39.000000000 +0000 @@ -395,12 +395,16 @@ int got_packet = 0; if (subrec_type != 0x02 && subrec_type != 0x0c && - subrec_type != 0x08 && rec_size > 4) { + subrec_type != 0x08 && rec_size > 7) { + /* get the PTS from this packet if it has one. * on S1, only 0x06 has PES. On S2, however, most all do. * Do NOT Pass the PES Header to the MPEG2 codec */ es_offset1 = find_es_header(ty_VideoPacket, ty->chunk + ty->cur_chunk_pos, 5); if (es_offset1 != -1) { + if (rec_size < es_offset1 + VIDEO_PTS_OFFSET + 5) + return AVERROR_INVALIDDATA; + ty->last_video_pts = ff_parse_pes_pts( ty->chunk + ty->cur_chunk_pos + es_offset1 + VIDEO_PTS_OFFSET); if (subrec_type != 0x06) { diff -Nru ffmpeg-7.1.4/libavformat/version.h ffmpeg-7.1.5/libavformat/version.h --- ffmpeg-7.1.4/libavformat/version.h 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/version.h 2026-06-20 02:25:39.000000000 +0000 @@ -32,7 +32,7 @@ #include "version_major.h" #define LIBAVFORMAT_VERSION_MINOR 7 -#define LIBAVFORMAT_VERSION_MICRO 102 +#define LIBAVFORMAT_VERSION_MICRO 103 #define LIBAVFORMAT_VERSION_INT AV_VERSION_INT(LIBAVFORMAT_VERSION_MAJOR, \ LIBAVFORMAT_VERSION_MINOR, \ diff -Nru ffmpeg-7.1.4/libavformat/vividas.c ffmpeg-7.1.5/libavformat/vividas.c --- ffmpeg-7.1.4/libavformat/vividas.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/vividas.c 2026-06-20 02:25:39.000000000 +0000 @@ -131,7 +131,7 @@ size >>= 2; while (size > 0) { - *d2 = *d1 ^ (HAVE_BIGENDIAN ? av_bswap32(k) : k); + AV_WN32(d2, AV_RN32(d1) ^ (HAVE_BIGENDIAN ? av_bswap32(k) : k)); k += key; d1++; d2++; diff -Nru ffmpeg-7.1.4/libavformat/wavdec.c ffmpeg-7.1.5/libavformat/wavdec.c --- ffmpeg-7.1.4/libavformat/wavdec.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libavformat/wavdec.c 2026-06-20 02:25:39.000000000 +0000 @@ -131,11 +131,11 @@ } /* RIFF chunks are always at even offsets relative to where they start. */ -static int64_t wav_seek_tag(WAVDemuxContext * wav, AVIOContext *s, int64_t offset, int whence) +static int64_t wav_seek_tag(WAVDemuxContext * wav, AVIOContext *s, int64_t offset) { offset += offset < INT64_MAX && offset + wav->unaligned & 1; - return avio_seek(s, offset, whence); + return avio_seek(s, offset, SEEK_SET); } /* return the size of the found tag */ @@ -144,13 +144,16 @@ unsigned int tag; int64_t size; + if (avio_tell(pb) + wav->unaligned & 1) + avio_skip(pb, 1); + for (;;) { if (avio_feof(pb)) return AVERROR_EOF; size = next_tag(pb, &tag, wav->rifx); if (tag == tag1) break; - wav_seek_tag(wav, pb, size, SEEK_CUR); + avio_skip(pb, size + (size & 1)); } return size; } @@ -422,7 +425,7 @@ for (;;) { AVStream *vst; size = next_tag(pb, &tag, wav->rifx); - next_tag_ofs = avio_tell(pb) + size; + next_tag_ofs = avio_tell(pb) + size + (size & 1); if (avio_feof(pb)) break; @@ -454,10 +457,12 @@ } if (rf64 || bw64) { - next_tag_ofs = wav->data_end = av_sat_add64(avio_tell(pb), data_size); - } else if (size != 0xFFFFFFFF) { + wav->data_end = av_sat_add64(avio_tell(pb), data_size); + next_tag_ofs = wav->data_end + (data_size & 1); + } else if (size > 0 && size != 0xFFFFFFFF) { data_size = size; - next_tag_ofs = wav->data_end = size ? next_tag_ofs : INT64_MAX; + wav->data_end = avio_tell(pb) + size; + next_tag_ofs = wav->data_end + (size & 1); } else { av_log(s, AV_LOG_WARNING, "Ignoring maximum wav data size, " "file may be invalid\n"); @@ -599,7 +604,7 @@ /* seek to next tag unless we know that we'll run into EOF */ if ((avio_size(pb) > 0 && next_tag_ofs >= avio_size(pb)) || - wav_seek_tag(wav, pb, next_tag_ofs, SEEK_SET) < 0) { + wav_seek_tag(wav, pb, next_tag_ofs) < 0) { break; } } diff -Nru ffmpeg-7.1.4/libswresample/x86/resample.asm ffmpeg-7.1.5/libswresample/x86/resample.asm --- ffmpeg-7.1.4/libswresample/x86/resample.asm 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.5/libswresample/x86/resample.asm 2026-06-20 02:25:39.000000000 +0000 @@ -198,7 +198,8 @@ add fracd, dst_incr_modd packssdw m0, m0 add indexd, dst_incr_divd - movd [dstq], m0 + movd filterd, m0 + mov [dstq], filterw %else ; float/double ; horizontal sum & store %if mmsize == 32 @@ -478,7 +479,8 @@ paddd m0, m1 psrad m0, 15 packssdw m0, m0 - movd [dstq], m0 + movd eax, m0 + mov [dstq], ax ; note that for imul/idiv, I need to move filter to edx/eax for each: ; - 32bit: eax=r0[filter1], edx=r2[filter2] diff -Nru ffmpeg-7.1.4/libswscale/alphablend.c ffmpeg-7.1.5/libswscale/alphablend.c --- ffmpeg-7.1.4/libswscale/alphablend.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/alphablend.c 2026-06-20 02:25:39.000000000 +0000 @@ -25,6 +25,8 @@ uint8_t *dst[], int dstStride[]) { const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(c->srcFormat); + const int lum_w = c->srcW; + const int lum_h = c->srcH; int nb_components = desc->nb_components; int plane, x, ysrc; int plane_count = isGray(c->srcFormat) ? 1 : 3; @@ -52,7 +54,8 @@ int y_subsample = plane ? desc->log2_chroma_h: 0; for (ysrc = 0; ysrc < AV_CEIL_RSHIFT(srcSliceH, y_subsample); ysrc++) { int y = ysrc + (srcSliceY >> y_subsample); - if (x_subsample || y_subsample) { + int subsample_row = y_subsample && (y << y_subsample) + 1 < lum_h; + if (x_subsample || subsample_row) { int alpha; unsigned u; if (sixteen_bits) { @@ -62,21 +65,23 @@ uint16_t *d = ( uint16_t *)(dst[plane ] + dstStride[plane ] * y); if ((!isBE(c->srcFormat)) == !HAVE_BIGENDIAN) { for (x = 0; x < w; x++) { - if (y_subsample) { - alpha = (a[2*x] + a[2*x + 1] + 2 + - a[2*x + alpha_step] + a[2*x + alpha_step + 1]) >> 2; + const int xnext = FFMIN(2*x + 1, lum_w - 1); + if (subsample_row) { + alpha = (a[2*x] + a[xnext] + 2 + + a[2*x + alpha_step] + a[xnext + alpha_step]) >> 2; } else - alpha = (a[2*x] + a[2*x + 1]) >> 1; + alpha = (a[2*x] + a[xnext]) >> 1; u = s[x]*alpha + target_table[((x^y)>>5)&1][plane]*(max-alpha) + off; d[x] = av_clip((u + (u >> shift)) >> shift, 0, max); } } else { for (x = 0; x < w; x++) { - if (y_subsample) { - alpha = (av_bswap16(a[2*x]) + av_bswap16(a[2*x + 1]) + 2 + - av_bswap16(a[2*x + alpha_step]) + av_bswap16(a[2*x + alpha_step + 1])) >> 2; + const int xnext = FFMIN(2*x + 1, lum_w - 1); + if (subsample_row) { + alpha = (av_bswap16(a[2*x]) + av_bswap16(a[xnext]) + 2 + + av_bswap16(a[2*x + alpha_step]) + av_bswap16(a[xnext + alpha_step])) >> 2; } else - alpha = (av_bswap16(a[2*x]) + av_bswap16(a[2*x + 1])) >> 1; + alpha = (av_bswap16(a[2*x]) + av_bswap16(a[xnext])) >> 1; u = av_bswap16(s[x])*alpha + target_table[((x^y)>>5)&1][plane]*(max-alpha) + off; d[x] = av_clip((u + (u >> shift)) >> shift, 0, max); } @@ -87,11 +92,12 @@ const uint8_t *a = src[plane_count] + (srcStride[plane_count] * ysrc << y_subsample); uint8_t *d = dst[plane ] + dstStride[plane] * y; for (x = 0; x < w; x++) { - if (y_subsample) { - alpha = (a[2*x] + a[2*x + 1] + 2 + - a[2*x + alpha_step] + a[2*x + alpha_step + 1]) >> 2; + const int xnext = FFMIN(2*x + 1, lum_w - 1); + if (subsample_row) { + alpha = (a[2*x] + a[xnext] + 2 + + a[2*x + alpha_step] + a[xnext + alpha_step]) >> 2; } else - alpha = (a[2*x] + a[2*x + 1]) >> 1; + alpha = (a[2*x] + a[xnext]) >> 1; u = s[x]*alpha + target_table[((x^y)>>5)&1][plane]*(255-alpha) + 128; d[x] = (257*u) >> 16; } diff -Nru ffmpeg-7.1.4/libswscale/loongarch/yuv2rgb_lasx.c ffmpeg-7.1.5/libswscale/loongarch/yuv2rgb_lasx.c --- ffmpeg-7.1.4/libswscale/loongarch/yuv2rgb_lasx.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/loongarch/yuv2rgb_lasx.c 2026-06-20 02:25:39.000000000 +0000 @@ -173,7 +173,7 @@ __m256i shuf3 = {0x1E0F0E1C0D0C1A0B, 0x0101010101010101, \ 0x1E0F0E1C0D0C1A0B, 0x0101010101010101}; \ YUV2RGB_LOAD_COE \ - y = (c->dstW + 7) & ~7; \ + y = c->dstW; \ h_size = y >> 4; \ res = y & 15; \ \ @@ -199,7 +199,7 @@ __m256i a = __lasx_xvldi(0xFF); \ \ YUV2RGB_LOAD_COE \ - y = (c->dstW + 7) & ~7; \ + y = c->dstW; \ h_size = y >> 4; \ res = y & 15; \ \ @@ -215,7 +215,7 @@ const uint8_t *pv = src[2] + (y >> vshift) * srcStride[2]; \ for(x = 0; x < h_size; x++) { \ -#define DEALYUV2RGBREMAIN \ +#define DEALYUV2RGBLINE \ py_1 += 16; \ py_2 += 16; \ pu += 8; \ @@ -223,9 +223,40 @@ image1 += 48; \ image2 += 48; \ } \ - if (res) { \ + if (res & 8) { \ -#define DEALYUV2RGBREMAIN32 \ +#define DEALYUV2RGBLINERES \ + py_1 += 8; \ + py_2 += 8; \ + pu += 4; \ + pv += 4; \ + image1 += 24; \ + image2 += 24; \ + res -= 8 ; \ + } \ + if (res) { + +#define ENDYUV2RGBLINE(rgb_l, rgb_h, image_1, image_2) \ + if (res == 6) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_h(rgb_h, image_1, 16, 0); \ + __lasx_xvstelm_d(rgb_l, image_2, 0, 2); \ + __lasx_xvstelm_d(rgb_l, image_2, 8, 3); \ + __lasx_xvstelm_h(rgb_h, image_2, 16, 8); \ + } else if (res == 4) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_w(rgb_l, image_1, 8, 2); \ + __lasx_xvstelm_d(rgb_l, image_2, 0, 2); \ + __lasx_xvstelm_w(rgb_l, image_2, 8, 6); \ + } else if (res == 2) { \ + __lasx_xvstelm_w(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_h(rgb_l, image_1, 4, 2); \ + __lasx_xvstelm_w(rgb_l, image_2, 0, 4); \ + __lasx_xvstelm_h(rgb_l, image_2, 4, 10); \ + } + +#define DEALYUV2RGBLINE32 \ py_1 += 16; \ py_2 += 16; \ pu += 8; \ @@ -233,7 +264,36 @@ image1 += 16; \ image2 += 16; \ } \ - if (res) { \ + if (res & 8) { \ + +#define DEALYUV2RGBLINERES32 \ + py_1 += 8; \ + py_2 += 8; \ + pu += 4; \ + pv += 4; \ + image1 += 8; \ + image2 += 8; \ + res -= 8; \ + } \ + if (res) { + +#define ENDYUV2RGBLINE32(rgb_l, rgb_h, image_1, image_2) \ + if (res == 6) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_d(rgb_l, image_1, 16, 2); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 8, 1); \ + __lasx_xvstelm_d(rgb_h, image_2, 16, 2); \ + } else if (res == 4) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 8, 1); \ + } else if (res == 2) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + } #define END_FUNC() \ @@ -249,10 +309,14 @@ RGB_PACK(r2, g2, b2, rgb2_l, rgb2_h); RGB_STORE(rgb1_l, rgb1_h, image1); RGB_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN + DEALYUV2RGBLINE YUV2RGB_RES RGB_PACK(r1, g1, b1, rgb1_l, rgb1_h); RGB_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES + YUV2RGB_RES + RGB_PACK(r1, g1, b1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC(yuv420_bgr24_lasx, uint8_t, 0) @@ -262,10 +326,14 @@ RGB_PACK(b2, g2, r2, rgb2_l, rgb2_h); RGB_STORE(rgb1_l, rgb1_h, image1); RGB_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN + DEALYUV2RGBLINE YUV2RGB_RES RGB_PACK(b1, g1, r1, rgb1_l, rgb1_h); RGB_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES + YUV2RGB_RES + RGB_PACK(b1, g1, r1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_rgba32_lasx, uint32_t, 0) @@ -275,10 +343,14 @@ RGB32_PACK(r2, g2, b2, a, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(r1, g1, b1, a, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(r1, g1, b1, a, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_bgra32_lasx, uint32_t, 0) @@ -288,10 +360,14 @@ RGB32_PACK(b2, g2, r2, a, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(b1, g1, r1, a, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(b1, g1, r1, a, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_argb32_lasx, uint32_t, 0) @@ -301,10 +377,14 @@ RGB32_PACK(a, r2, g2, b2, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(a, r1, g1, b1, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(a, r1, g1, b1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_abgr32_lasx, uint32_t, 0) @@ -314,8 +394,12 @@ RGB32_PACK(a, b2, g2, r2, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(a, b1, g1, r1, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(a, b1, g1, r1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() diff -Nru ffmpeg-7.1.4/libswscale/ppc/swscale_ppc_template.c ffmpeg-7.1.5/libswscale/ppc/swscale_ppc_template.c --- ffmpeg-7.1.4/libswscale/ppc/swscale_ppc_template.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/ppc/swscale_ppc_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -90,7 +90,7 @@ yuv2planeX_u(filter, filterSize, src, dest, dst_u, dither, offset, 0); - for (i = dst_u; i < dstW - 15; i += 16) + for (i = dst_u; i < dstW - 23; i += 16) FUNC(yuv2planeX_8_16)(filter, filterSize, src, dest + i, dither, offset, i); diff -Nru ffmpeg-7.1.4/libswscale/ppc/swscale_vsx.c ffmpeg-7.1.5/libswscale/ppc/swscale_vsx.c --- ffmpeg-7.1.4/libswscale/ppc/swscale_vsx.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/ppc/swscale_vsx.c 2026-06-20 02:25:39.000000000 +0000 @@ -54,7 +54,7 @@ } while (0) #define LOAD_FILTER(vf,f) {\ - vf = vec_vsx_ld(joffset, f);\ + vf = vec_splats(f[j]);\ } #define LOAD_L1(ll1,s,p){\ ll1 = vec_vsx_ld(xoffset, s);\ diff -Nru ffmpeg-7.1.4/libswscale/rgb2rgb_template.c ffmpeg-7.1.5/libswscale/rgb2rgb_template.c --- ffmpeg-7.1.4/libswscale/rgb2rgb_template.c 2026-05-05 00:56:30.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/rgb2rgb_template.c 2026-06-20 02:25:39.000000000 +0000 @@ -402,11 +402,11 @@ for (i = 0; i < chromWidth; i++) { #if HAVE_BIGENDIAN - *idst++ = (yc[0] << 24) + (uc[0] << 16) + + *idst++ = ((unsigned)yc[0] << 24) + (uc[0] << 16) + (yc[1] << 8) + (vc[0] << 0); #else *idst++ = yc[0] + (uc[0] << 8) + - (yc[1] << 16) + (vc[0] << 24); + (yc[1] << 16) + ((unsigned)vc[0] << 24); #endif yc += 2; uc++; diff -Nru ffmpeg-7.1.4/libswscale/x86/rgb_2_rgb.asm ffmpeg-7.1.5/libswscale/x86/rgb_2_rgb.asm --- ffmpeg-7.1.4/libswscale/x86/rgb_2_rgb.asm 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/libswscale/x86/rgb_2_rgb.asm 2026-06-20 02:25:39.000000000 +0000 @@ -127,6 +127,7 @@ movsxdifnidn src_strideq, src_strided mov back_wq, wq + and wq, -2 ; process whole UYVY pairs; trailing odd column via epilogue mov whalfq, wq shr whalfq, 1 ; whalf = width / 2 @@ -146,7 +147,7 @@ ;calc scalar loop count and xq, mmsize * 2 - 1 - je .loop_simd + je .skip_tail .loop_scalar: mov tmpb, [srcq + wtwoq + 0] @@ -168,6 +169,7 @@ jg .loop_scalar ; check if simd loop is need +.skip_tail: cmp wq, 0 jge .end_line @@ -237,6 +239,15 @@ jl .loop_simd .end_line: + test back_wq, 1 + jz .skip_last + mov tmpb, [srcq + 1] + mov [ydstq], tmpb + mov tmpb, [srcq + 0] + mov [udstq], tmpb + mov tmpb, [srcq + 2] + mov [vdstq], tmpb + .skip_last: add srcq, src_strideq add ydstq, lum_strideq add udstq, chrom_strideq @@ -244,6 +255,7 @@ ;restore initial state of line variable mov wq, back_wq + and wq, -2 mov xq, wq mov whalfq, wq shr whalfq, 1 ; whalf = width / 2 diff -Nru ffmpeg-7.1.4/tests/checkasm/sw_rgb.c ffmpeg-7.1.5/tests/checkasm/sw_rgb.c --- ffmpeg-7.1.4/tests/checkasm/sw_rgb.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/tests/checkasm/sw_rgb.c 2026-06-20 02:25:39.000000000 +0000 @@ -287,7 +287,7 @@ int width, int height, int srcStride, int dst1Stride, int dst2Stride); - randomize_buffers(src, 2*MAX_STRIDE*MAX_HEIGHT+2); + randomize_buffers(src, 2*MAX_STRIDE*MAX_HEIGHT); if (check_func(deinterleaveBytes, "deinterleave_bytes")) { for (int i = 0; i <= 16; i++) { diff -Nru ffmpeg-7.1.4/tests/tiny_ssim.c ffmpeg-7.1.5/tests/tiny_ssim.c --- ffmpeg-7.1.4/tests/tiny_ssim.c 2025-08-05 00:22:34.000000000 +0000 +++ ffmpeg-7.1.5/tests/tiny_ssim.c 2026-06-20 02:25:39.000000000 +0000 @@ -79,11 +79,11 @@ * Maximum value for 9-bit is: ss*64 = (2^9-1)^2*16*4*64 = 1069551616, which will not overflow. */ #if BIT_DEPTH > 9 typedef float type; - static const float ssim_c1 = .01*.01*PIXEL_MAX*PIXEL_MAX*64; + static const float ssim_c1 = .01*.01*PIXEL_MAX*PIXEL_MAX*64*64; static const float ssim_c2 = .03*.03*PIXEL_MAX*PIXEL_MAX*64*63; #else typedef int type; - static const int ssim_c1 = (int)(.01*.01*PIXEL_MAX*PIXEL_MAX*64 + .5); + static const int ssim_c1 = (int)(.01*.01*PIXEL_MAX*PIXEL_MAX*64*64 + .5); static const int ssim_c2 = (int)(.03*.03*PIXEL_MAX*PIXEL_MAX*64*63 + .5); #endif type fs1 = s1; diff -Nru ffmpeg-7.1.4/tools/target_dem_fuzzer.c ffmpeg-7.1.5/tools/target_dem_fuzzer.c --- ffmpeg-7.1.4/tools/target_dem_fuzzer.c 2026-05-05 00:56:22.000000000 +0000 +++ ffmpeg-7.1.5/tools/target_dem_fuzzer.c 2026-06-20 02:25:39.000000000 +0000 @@ -185,8 +185,11 @@ error("Failed to allocate pkt"); io_buffer = av_malloc(io_buffer_size); - if (!io_buffer) - error("Failed to allocate io_buffer"); + if (!io_buffer) { + avformat_free_context(avfmt); + av_packet_free(&pkt); + return 0; + } opaque.filesize = filesize; opaque.pos = 0; diff -Nru ffmpeg-7.1.4/tools/zmqsend.c ffmpeg-7.1.5/tools/zmqsend.c --- ffmpeg-7.1.4/tools/zmqsend.c 2026-03-16 18:13:05.000000000 +0000 +++ ffmpeg-7.1.5/tools/zmqsend.c 2026-06-20 02:25:39.000000000 +0000 @@ -55,7 +55,7 @@ int main(int argc, char **argv) { AVBPrint src; - char *src_buf, *recv_buf; + char *src_buf = NULL, *recv_buf; int c; int recv_buf_size, ret = 0; void *zmq_ctx, *socket; @@ -165,6 +165,7 @@ av_free(recv_buf); end: + av_freep(&src_buf); zmq_close(socket); zmq_ctx_destroy(zmq_ctx); return ret;