Packman Build Service PMBS

ffmpeg-8.changes Changed

@@ -1,4 +1,27 @@
 -------------------------------------------------------------------
+Wed Oct  7 07:59:26 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 8.1.3
+  * More robust parsing of formats
+- Delete ffmpeg-8-CVE-2026-58049.patch,
+  ffmpeg-8-CVE-2026-64833.patch, ffmpeg-8-CVE-2026-64834.patch,
+  ffmpeg-8-CVE-2026-65703.patch, ffmpeg-8-CVE-2026-65704.patch,
+  ffmpeg-8-CVE-2026-65705.patch, ffmpeg-8-CVE-2026-65706.patch,
+  ffmpeg-8-CVE-2026-66037.patch, ffmpeg-8-CVE-2026-70628.patch,
+  ffmpeg-8-CVE-2026-70629.patch, ffmpeg-8-CVE-2026-70630.patch,
+  ffmpeg-8-CVE-2026-70631.patch, ffmpeg-8-CVE-2026-70632.patch,
+  ffmpeg-8-CVE-2026-75141.patch, ffmpeg-8-CVE-2026-75142.patch,
+  ffmpeg-8-CVE-2026-75143.patch, ffmpeg-8-CVE-2026-75144.patch,
+  ffmpeg-8-CVE-2026-75145.patch, ffmpeg-8-CVE-2026-75146.patch,
+  ffmpeg-8-CVE-2026-75147.patch,
+  ffmpeg-8-CVE-2026-66036-shim01.patch (merged)
+- Delete ffmpeg-8-CVE-2026-66036.patch (feature patch not accepted
+  upstream for 8.x)
+- Enable apv encoder support, add pkgconfig(oapv) BuildRequires and
+  pass enable-liboapv to configure.
+- Add 0001-avcodec-liboapvenc-fix-build-with-openapv-1.1.patch
+
+-------------------------------------------------------------------
 Sat Oct  3 08:30:10 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
 
 - Add aptx/aptx_hd to enable_decoders/encoders.
@@ -12,8 +35,6 @@
 -------------------------------------------------------------------
 Tue Sep 29 21:26:57 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
 
-- Enable apv encoder support, add pkgconfig(oapv) BuildRequires and
-  pass enable-liboapv to configure.
 - Correct version in "mini" part of spec.
 
 -------------------------------------------------------------------

ffmpeg-8.spec Changed

@@ -19,6 +19,7 @@
 %define flavor @BUILD_FLAVOR@%nil
 #
 # preamble is present twice, watch out
+# buildtest with BUILD_ORIG=1 too.
 #
 %if "%flavor" != "mini"
 
@@ -108,7 +109,7 @@
 %define _major_expected 9
 
 Name:           ffmpeg-8
-Version:        8.1.2
+Version:        8.1.3
 Release:        0
 Summary:        Set of libraries for working with various multimedia formats
 License:        GPL-3.0-or-later
@@ -131,28 +132,10 @@
 Patch5:         work-around-abi-break.patch
 Patch10:        ffmpeg-chromium.patch
 Patch15:        11013-avcodec-decode-clean-up-if-get_hw_frames_parameters-.patch
-Patch16:        ffmpeg-8-CVE-2026-58049.patch
-Patch17:        ffmpeg-8-CVE-2026-64833.patch
-Patch18:        ffmpeg-8-CVE-2026-64834.patch
-Patch19:        ffmpeg-8-CVE-2026-65703.patch
-Patch20:        ffmpeg-8-CVE-2026-65704.patch
-Patch21:        ffmpeg-8-CVE-2026-65705.patch
-Patch22:        ffmpeg-8-CVE-2026-65706.patch
-Patch23:        ffmpeg-8-CVE-2026-66036-shim01.patch
-Patch24:        ffmpeg-8-CVE-2026-66036.patch
-Patch25:        ffmpeg-8-CVE-2026-66037.patch
-Patch26:        ffmpeg-8-CVE-2026-70628.patch
-Patch27:        ffmpeg-8-CVE-2026-70629.patch
-Patch28:        ffmpeg-8-CVE-2026-70630.patch
-Patch29:        ffmpeg-8-CVE-2026-70631.patch
-Patch30:        ffmpeg-8-CVE-2026-70632.patch
-Patch31:        ffmpeg-8-CVE-2026-75141.patch
-Patch32:        ffmpeg-8-CVE-2026-75142.patch
-Patch33:        ffmpeg-8-CVE-2026-75143.patch
-Patch34:        ffmpeg-8-CVE-2026-75144.patch
-Patch35:        ffmpeg-8-CVE-2026-75145.patch
-Patch36:        ffmpeg-8-CVE-2026-75146.patch
-Patch37:        ffmpeg-8-CVE-2026-75147.patch
+Patch16:        0001-avcodec-liboapvenc-fix-build-with-openapv-1.1.patch
+#
+# preamble is present twice, watch out
+#
 BuildRequires:  c++_compiler
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
@@ -165,7 +148,6 @@
 BuildRequires:  pkgconfig(fontconfig) >= 2.4.2
 BuildRequires:  pkgconfig(freetype2)
 BuildRequires:  pkgconfig(fribidi) >= 0.19.0
-BuildRequires:  pkgconfig(openssl)
 BuildRequires:  pkgconfig(harfbuzz)
 BuildRequires:  pkgconfig(jack)
 BuildRequires:  pkgconfig(libass) >= 0.11.0
@@ -197,6 +179,7 @@
 BuildRequires:  pkgconfig(oapv)
 BuildRequires:  pkgconfig(ogg)
 BuildRequires:  pkgconfig(openh264)
+BuildRequires:  pkgconfig(openssl)
 BuildRequires:  pkgconfig(opus)
 BuildRequires:  pkgconfig(sdl2) >= 2.0.1
 BuildRequires:  pkgconfig(soxr)
@@ -277,9 +260,9 @@
 %else
 BuildRequires:  (pkgconfig(libplacebo) >= 4.192.0 with pkgconfig(libplacebo) < 6.292.0)
 %endif
+BuildRequires:  glslang-devel
 BuildRequires:  pkgconfig(shaderc) >= 2019.1
 BuildRequires:  pkgconfig(vulkan) >= 1.3.255
-BuildRequires:  glslang-devel
 %endif
 
 %if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150500
@@ -835,7 +818,7 @@
 #
 #!BcntSyncTag:  ffmpeg-8
 Name:           ffmpeg-8-mini
-Version:        8.1.2
+Version:        8.1.3
 Release:        0
 Summary:        Set of libraries for working with various multimedia formats
 License:        GPL-3.0-or-later
@@ -851,6 +834,7 @@
 Patch5:         work-around-abi-break.patch
 Patch10:        ffmpeg-chromium.patch
 Patch15:        11013-avcodec-decode-clean-up-if-get_hw_frames_parameters-.patch
+Patch16:        0001-avcodec-liboapvenc-fix-build-with-openapv-1.1.patch
 BuildRequires:  c_compiler
 Requires:       this-is-only-for-build-envs

0001-avcodec-liboapvenc-fix-build-with-openapv-1.1.patch Added

@@ -0,0 +1,43 @@
+From 0880196367273612c3113279438b4b999045d123 Mon Sep 17 00:00:00 2001
+From: Werner Robitza <werner.robitza@gmail.com>
+Date: Thu, 24 Sep 2026 15:02:42 +0200
+Subject: PATCH avcodec/liboapvenc: fix build with openapv >= 1.1
+
+openapv 1.1 changed oapvm_create() to take a descriptor argument.
+This was first raised here:
+https://github.com/homebrew-ffmpeg/homebrew-ffmpeg/issues/235
+
+(cherry picked from commit c54710db21c1827dbc3e47658a562525af0fe528)
+---
+ libavcodec/liboapvenc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libavcodec/liboapvenc.c b/libavcodec/liboapvenc.c
+index 2b4da37b7d..7159955c1f 100644
+--- a/libavcodec/liboapvenc.c
++++ b/libavcodec/liboapvenc.c
+@@ -405,6 +405,9 @@ static av_cold int liboapve_init(AVCodecContext *avctx)
+ {
+     ApvEncContext *apv = avctx->priv_data;
+     oapve_cdesc_t *cdsc = &apv->cdsc;
++#if OAPV_VER_APISET >= 1
++    oapvm_cdesc_t mcdsc = { 0 };
++#endif
+     unsigned char *bs_buf;
+     int ret;
+ 
+@@ -434,7 +437,11 @@ static av_cold int liboapve_init(AVCodecContext *avctx)
+     }
+ 
+     /* create metadata handler */
++#if OAPV_VER_APISET >= 1
++    apv->mid = oapvm_create(&mcdsc, &ret);
++#else
+     apv->mid = oapvm_create(&ret);
++#endif
+     if (apv->mid == NULL || OAPV_FAILED(ret)) {
+         av_log(avctx, AV_LOG_ERROR, "cannot create OAPV metadata handler\n");
+         return AVERROR_EXTERNAL;
+-- 
+2.55.0
+

ffmpeg-8-CVE-2026-58049.patch Deleted

@@ -1,71 +0,0 @@
-From f8d7795dcca36a4dd412e89cbd83e3dfec1e0d81 Mon Sep 17 00:00:00 2001
-From: Umar Pathan <hello@umar.ac>
-Date: Sun, 28 Jun 2026 23:02:52 +0200
-Subject: PATCH avcodec/rasc: Check that 32-bit DLTA accesses stay within the
- row
-
-Found-by: bikini (github.com/bikini/exploitarium)
-Fixes: out of array access
-Fixes: rowspill_128x1.avi / gen_rowspill_avi.py
-Fixes: xGV79bIb7uAJ
-(cherry picked from commit 11ff18a6c80187405fc492f9bb07ba9f2f663f76)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/rasc.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c
-index 5f956a9b2c..d784a44063 100644
---- a/libavcodec/rasc.c
-+++ b/libavcodec/rasc.c
-@@ -320,6 +320,11 @@ static int decode_move(AVCodecContext *avctx,
-     return 0;
- }
- 
-+static inline int dlta_room(unsigned cx, unsigned w, unsigned bpp, unsigned need)
-+{
-+    return cx + need <= w * bpp;
-+}
-+
- #define NEXT_LINE                        \
-     if (cx >= w * s->bpp) {              \
-         cx = 0;                          \
-@@ -418,6 +423,8 @@ static int decode_dlta(AVCodecContext *avctx,
-         case 4:
-             fill = bytestream2_get_byte(&dc);
-             while (len > 0 && cy > 0) {
-+                if (!dlta_room(cx, w, s->bpp, 4))
-+                    return AVERROR_INVALIDDATA;
-                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
-                 AV_WL32(b2 + cx, fill);
-                 cx++;
-@@ -427,6 +434,8 @@ static int decode_dlta(AVCodecContext *avctx,
-         case 7:
-             fill = bytestream2_get_le32(&dc);
-             while (len > 0 && cy > 0) {
-+                if (!dlta_room(cx, w, s->bpp, 4))
-+                    return AVERROR_INVALIDDATA;
-                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
-                 AV_WL32(b2 + cx, fill);
-                 cx += 4;
-@@ -443,6 +452,8 @@ static int decode_dlta(AVCodecContext *avctx,
-             while (len > 0 && cy > 0) {
-                 unsigned v0, v1;
- 
-+                if (!dlta_room(cx, w, s->bpp, 4))
-+                    return AVERROR_INVALIDDATA;
-                 v0 = AV_RL32(b2 + cx);
-                 v1 = AV_RL32(b1 + cx);
-                 AV_WL32(b2 + cx, v1);
-@@ -454,6 +465,8 @@ static int decode_dlta(AVCodecContext *avctx,
-         case 13:
-             while (len > 0 && cy > 0) {
-                 fill = bytestream2_get_le32(&dc);
-+                if (!dlta_room(cx, w, s->bpp, 4))
-+                    return AVERROR_INVALIDDATA;
-                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
-                 AV_WL32(b2 + cx, fill);
-                 cx += 4;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-64833.patch Deleted

@@ -1,33 +0,0 @@
-From 385ac2fadcb4394ec4f65e5c4d3d24003e090f36 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Tue, 30 Jun 2026 00:11:50 +0200
-Subject: PATCH avformat/spdifenc: bound DTS core_size against the packet
- size in the HD path
-
-Fixes: out of array read
-Fixes: yBSax492UIB9
-Fixes: 482d98f69b2 (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI)
-Found-by: Pavel Kohout (Aisle Research)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-(cherry picked from commit 6f80e2765492700622596af720534cef33dd31b4)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavformat/spdifenc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavformat/spdifenc.c b/libavformat/spdifenc.c
-index ab3f73da0d..16eebda01c 100644
---- a/libavformat/spdifenc.c
-+++ b/libavformat/spdifenc.c
-@@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket *pkt, int core_size,
-              * (dtshd_fallback == 0) */
-             ctx->dtshd_skip = 1;
-     }
--    if (ctx->dtshd_skip && core_size) {
-+    if (ctx->dtshd_skip && core_size && core_size <= pkt->size) {
-         pkt_size = core_size;
-         if (ctx->dtshd_fallback >= 0)
-             --ctx->dtshd_skip;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-64834.patch Deleted

@@ -1,33 +0,0 @@
-From 3c441711a343ccf50196c70a3f0b554b52f8d9de Mon Sep 17 00:00:00 2001
-From: Pavel Kohout <disclosure@aisle.com>
-Date: Tue, 30 Jun 2026 21:55:16 +0200
-Subject: PATCH avformat/rtpdec_asf: reject ASF objects smaller than their
- header
-
-Fixes: infinite loop
-Fixes: MzWwJdpZF2Ls
-Fixes: c2f3eec445389d67afc8c699ba23915a20cae51c (Implement RTSP-MS/ASF packet parsing.)
-Found-by: Pavel Kohout (Aisle Research)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-(cherry picked from commit 11d5f475be95d22d5f0692220cc772b116abc632)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavformat/rtpdec_asf.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
-index b3b346f3cc..f7fa69e27f 100644
---- a/libavformat/rtpdec_asf.c
-+++ b/libavformat/rtpdec_asf.c
-@@ -56,6 +56,8 @@ static int rtp_asf_fix_header(uint8_t *buf, int len)
-         uint64_t chunksize = AV_RL64(p + sizeof(ff_asf_guid));
-         int skip = 6 * 8 + 3 * 4 + sizeof(ff_asf_guid) * 2;
-         if (memcmp(p, ff_asf_file_header, sizeof(ff_asf_guid))) {
-+            if (chunksize < sizeof(ff_asf_guid) + 8)
-+                return -1;
-             if (chunksize > end - p)
-                 return -1;
-             p += chunksize;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-65703.patch Deleted

@@ -1,44 +0,0 @@
-From 3b85fbe89025ea696988488358dfde41a09c53c5 Mon Sep 17 00:00:00 2001
-From: Cloud-LHY <security@clouditera.com>
-Date: Fri, 10 Jul 2026 04:07:04 +0200
-Subject: PATCH avcodec/tdsc: unref the reference frame before reallocating
- on size change
-
-Fixes: out of array access
-Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py
-Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py
-Fixes: p9xG4xGf9P7H
-Fixes: HQL7a1WgTdHZ
-Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit fd3ee52fab34d98a95b787d0b5ff45685766200c)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/tdsc.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c
-index ca9dd0f0a6..102b4ae966 100644
---- a/libavcodec/tdsc.c
-+++ b/libavcodec/tdsc.c
-@@ -485,11 +485,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles)
-             return ret;
-         init_refframe = 1;
-     }
--    ctx->refframe->width  = ctx->width  = w;
--    ctx->refframe->height = ctx->height = h;
-+    ctx->width  = w;
-+    ctx->height = h;
- 
-     /* Allocate the reference frame if not already done or on size change */
-     if (init_refframe) {
-+        av_frame_unref(ctx->refframe);
-+        ctx->refframe->format = avctx->pix_fmt;
-+        ctx->refframe->width  = w;
-+        ctx->refframe->height = h;
-         ret = av_frame_get_buffer(ctx->refframe, 0);
-         if (ret < 0)
-             return ret;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-65704.patch Deleted

@@ -1,32 +0,0 @@
-From 52f7983f15678c8a6065327760d7b6eb1c9c84ed Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Fri, 10 Jul 2026 04:07:35 +0200
-Subject: PATCH avformat/ty: don't let the Series2 AC3 trim underflow the
- packet size
-
-Fixes: negative-size-param
-Fixes: ty-s2-ac3-negative-size-single-file.ffconcat / create_poc.py
-Fixes: g0qeE6KvrjZi
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit de771bd52774a52d45b0e2c82e56995a1ef40df7)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavformat/ty.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavformat/ty.c b/libavformat/ty.c
-index 9be027fcca..842d97038c 100644
---- a/libavformat/ty.c
-+++ b/libavformat/ty.c
-@@ -578,7 +578,7 @@ static int demux_audio(AVFormatContext *s, TyRecHdr *rec_hdr, AVPacket *pkt)
-         if (ty->audio_type == TIVO_AUDIO_AC3 &&
-                 ty->tivo_series == TIVO_SERIES2) {
-             if (ty->ac3_pkt_size + pkt->size > AC3_PKT_LENGTH) {
--                pkt->size -= 2;
-+                pkt->size -= FFMIN(pkt->size, 2);
-                 ty->ac3_pkt_size = 0;
-             } else {
-                 ty->ac3_pkt_size += pkt->size;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-65705.patch Deleted

@@ -1,99 +0,0 @@
-From 30a52276f9dff60fe732d8bb8d463e587ff69c94 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sun, 12 Jul 2026 03:27:47 +0200
-Subject: PATCH avfilter/vf_floodfill: remove unneeded variables
-
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-(cherry picked from commit f186c50cf53aec20e9a29059cb22ca3f2d59201c)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavfilter/vf_floodfill.c | 35 ++++++++++++++++-------------------
- 1 file changed, 16 insertions(+), 19 deletions(-)
-
-diff a/libavfilter/vf_floodfill.c b/libavfilter/vf_floodfill.c
---- a/libavfilter/vf_floodfill.c
-+++ b/libavfilter/vf_floodfill.c
-@@ -39,7 +39,6 @@
-     int d4;
- 
-     int nb_planes;
--    int back, front;
-     Points *points;
- 
-     int (*is_same)(const AVFrame *frame, int x, int y,
-@@ -270,7 +269,6 @@
-        }
-     }
- 
--    s->front = s->back = 0;
-     s->points = av_calloc(inlink->w * inlink->h, 4 * sizeof(Points));
-     if (!s->points)
-         return AVERROR(ENOMEM);
-@@ -293,6 +291,7 @@
-     const int w = frame->width;
-     const int h = frame->height;
-     int i, ret;
-+    int front = 0;
- 
-     if (is_inside(s->x, s->y, w, h)) {
-         s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3);
-@@ -310,9 +309,9 @@
-             goto end;
- 
-         if (s->is_same(frame, s->x, s->y, s0, s1, s2, s3)) {
--            s->pointss->front.x = s->x;
--            s->pointss->front.y = s->y;
--            s->front++;
-+            s->pointsfront.x = s->x;
-+            s->pointsfront.y = s->y;
-+            front++;
-         }
- 
-         if (ret = ff_inlink_make_frame_writable(link, &frame)) {
-@@ -320,34 +319,34 @@
-             return ret;
-         }
- 
--        while (s->front > s->back) {
-+        while (front > 0) {
-             int x, y;
- 
--            s->front--;
--            x = s->pointss->front.x;
--            y = s->pointss->front.y;
-+            front--;
-+            x = s->pointsfront.x;
-+            y = s->pointsfront.y;
- 
-             if (s->is_same(frame, x, y, s0, s1, s2, s3)) {
-                 s->set_pixel(frame, x, y, d0, d1, d2, d3);
- 
-                 if (is_inside(x + 1, y, w, h)) {
--                    s->pointss->front  .x = x + 1;
--                    s->pointss->front++.y = y;
-+                    s->pointsfront  .x = x + 1;
-+                    s->pointsfront++.y = y;
-                 }
- 
-                 if (is_inside(x - 1, y, w, h)) {
--                    s->pointss->front  .x = x - 1;
--                    s->pointss->front++.y = y;
-+                    s->pointsfront  .x = x - 1;
-+                    s->pointsfront++.y = y;
-                 }
- 
-                 if (is_inside(x, y + 1, w, h)) {
--                    s->pointss->front  .x = x;
--                    s->pointss->front++.y = y + 1;
-+                    s->pointsfront  .x = x;
-+                    s->pointsfront++.y = y + 1;
-                 }
- 
-                 if (is_inside(x, y - 1, w, h)) {
--                    s->pointss->front  .x = x;
--                    s->pointss->front++.y = y - 1;
-+                    s->pointsfront  .x = x;
-+                    s->pointsfront++.y = y - 1;
-                 }
-             }
-         }

ffmpeg-8-CVE-2026-65706.patch Deleted

@@ -1,49 +0,0 @@
-From b3c7ebc1edc401fd9881277fdfae93f3f24ceb81 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sat, 11 Jul 2026 16:46:39 +0200
-Subject: PATCH avfilter/vf_swaprect: size the temp row buffer for the widest
- plane
-
-Fixes: out of array access
-Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py
-Fixes: VRAXYvKtmKa8
-Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
-(cherry picked from commit a7e38b617b32f996beaa371bbf04b39907d7a527)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavfilter/vf_swaprect.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c
-index 5d93f51c30..fe007ee5e7 100644
---- a/libavfilter/vf_swaprect.c
-+++ b/libavfilter/vf_swaprect.c
-@@ -200,6 +200,7 @@ static int config_input(AVFilterLink *inlink)
- {
-     AVFilterContext *ctx = inlink->dst;
-     SwapRectContext *s = ctx->priv;
-+    int size = 0;
- 
-     if (!s->w  || !s->h  ||
-         !s->x1 || !s->y1 ||
-@@ -210,7 +211,16 @@ static int config_input(AVFilterLink *inlink)
-     av_image_fill_max_pixsteps(s->pixsteps, NULL, s->desc);
-     s->nb_planes = av_pix_fmt_count_planes(inlink->format);
- 
--    s->temp = av_malloc_array(inlink->w, s->pixsteps0);
-+    for (int p = 0; p < s->nb_planes; p++) {
-+        int shift = p == 1 || p == 2 ? s->desc->log2_chroma_w : 0;
-+        int width = AV_CEIL_RSHIFT(inlink->w, shift);
-+
-+        if (width > INT_MAX / s->pixstepsp)
-+            return AVERROR(EINVAL);
-+        size = FFMAX(size, width * s->pixstepsp);
-+    }
-+
-+    s->temp = av_malloc(size);
-     if (!s->temp)
-         return AVERROR(ENOMEM);
- 
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-66036-shim01.patch Deleted

@@ -1,117 +0,0 @@
-From e3d0c719fddd259709c8e275942ab56af3afc35d Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sun, 12 Jul 2026 13:05:07 +0200
-Subject: PATCH avfilter/vf_hqdn3d: reject unsupported frame parameter
- changes
-
-Fixes: out of array access
-Fixes: 9aj_hqdn3d_dynamic_res.mjpg / 9aj_generate_hqdn3d_dynamic_res_mjpg.py
-Fixes: wWDsy2oDvMuR
-Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
-(cherry picked from commit f0f634b6585fdc7bbb43ab3ae461499bfca9ad2e)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavfilter/vf_hqdn3d.c | 34 +++++++++++++++++++++++++---------
- libavfilter/vf_hqdn3d.h |  2 ++
- 2 files changed, 27 insertions(+), 9 deletions(-)
-
-diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c
-index d880c2bdda..70a2ec4628 100644
---- a/libavfilter/vf_hqdn3d.c
-+++ b/libavfilter/vf_hqdn3d.c
-@@ -163,12 +163,8 @@ static int denoise_depth(HQDN3DContext *s,
-             case 14: ret = denoise_depth(__VA_ARGS__, 14); break;             \
-             case 16: ret = denoise_depth(__VA_ARGS__, 16); break;             \
-         }                                                                     \
--        if (ret < 0) {                                                        \
--            av_frame_free(&out);                                              \
--            if (!direct)                                                      \
--                av_frame_free(&in);                                           \
-+        if (ret < 0)                                                          \
-             return ret;                                                       \
--        }                                                                     \
-     } while (0)
- 
- static void precalc_coefs(double dist25, int depth, int16_t *ct)
-@@ -281,12 +277,15 @@ static int config_input(AVFilterLink *inlink)
-     ff_hqdn3d_init_x86(s);
- #endif
- 
-+    s->format = inlink->format;
-+    s->width  = inlink->w;
-+    s->height = inlink->h;
-+
-     return 0;
- }
- 
- typedef struct ThreadData {
-     AVFrame *in, *out;
--    int direct;
- } ThreadData;
- 
- static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs)
-@@ -295,7 +294,6 @@ static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs)
-     const ThreadData *td = data;
-     AVFrame *out = td->out;
-     AVFrame *in = td->in;
--    int direct = td->direct;
- 
-     denoise(s, in->datajob_nr, out->datajob_nr,
-                 s->linejob_nr, &s->frame_prevjob_nr,
-@@ -312,10 +310,21 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
- {
-     AVFilterContext *ctx  = inlink->dst;
-     AVFilterLink *outlink = ctx->outputs0;
-+    HQDN3DContext *s = ctx->priv;
- 
-     AVFrame *out;
-     int direct = av_frame_is_writable(in) && !ctx->is_disabled;
-     ThreadData td;
-+    int ret3;
-+
-+    if (in->format != s->format ||
-+        in->width  != s->width  ||
-+        in->height != s->height) {
-+        av_log(ctx, AV_LOG_ERROR,
-+               "Frame size or format changed without filter graph reinitialization\n");
-+        av_frame_free(&in);
-+        return AVERROR(EINVAL);
-+    }
- 
-     if (direct) {
-         out = in;
-@@ -331,9 +340,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
- 
-     td.in = in;
-     td.out = out;
--    td.direct = direct;
-     /* one thread per plane */
--    ff_filter_execute(ctx, do_denoise, &td, NULL, 3);
-+    ff_filter_execute(ctx, do_denoise, &td, ret, 3);
-+    for (int i = 0; i < FF_ARRAY_ELEMS(ret); i++) {
-+        if (reti < 0) {
-+            av_frame_free(&out);
-+            if (!direct)
-+                av_frame_free(&in);
-+            return reti;
-+        }
-+    }
- 
-     if (ctx->is_disabled) {
-         av_frame_free(&out);
-diff --git a/libavfilter/vf_hqdn3d.h b/libavfilter/vf_hqdn3d.h
-index 3279bbcc77..3467f27145 100644
---- a/libavfilter/vf_hqdn3d.h
-+++ b/libavfilter/vf_hqdn3d.h
-@@ -36,6 +36,8 @@ typedef struct HQDN3DContext {
-     double strength4;
-     int hsub, vsub;
-     int depth;
-+    int width, height;
-+    enum AVPixelFormat format;
-     void (*denoise_row17)(uint8_t *src, uint8_t *dst, uint16_t *line_ant, uint16_t *frame_ant, ptrdiff_t w, int16_t *spatial, int16_t *temporal);
- } HQDN3DContext;
- 
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-66036.patch Deleted

@@ -1,68 +0,0 @@
-From 62294b6a8ad2370e1435bb9985ebe6b53be14c2b Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sun, 12 Jul 2026 13:05:33 +0200
-Subject: PATCH avfilter/vf_hqdn3d: support dynamic frame sizes
-
-(cherry picked from commit 5d7112c60e6f0f0742ce47d448e6da0718a70f4c)
----
- libavfilter/avfilter.c  |  3 ++-
- libavfilter/vf_hqdn3d.c | 21 ++++++++++++++-------
- 2 files changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c
-index b15f0b08b4..2715f658b3 100644
---- a/libavfilter/avfilter.c
-+++ b/libavfilter/avfilter.c
-@@ -1078,7 +1078,8 @@ int ff_filter_frame(AVFilterLink *link, AVFrame *frame)
-             strcmp(link->dst->filter->name, "idet") &&
-             strcmp(link->dst->filter->name, "null") &&
-             strcmp(link->dst->filter->name, "scale") &&
--            strcmp(link->dst->filter->name, "libplacebo")) {
-+            strcmp(link->dst->filter->name, "libplacebo") &&
-+            strcmp(link->dst->filter->name, "hqdn3d")) {
-             av_assert1(frame->format        == link->format);
-             av_assert1(frame->width         == link->w);
-             av_assert1(frame->height        == link->h);
-diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c
-index 70a2ec4628..98c05e886c 100644
---- a/libavfilter/vf_hqdn3d.c
-+++ b/libavfilter/vf_hqdn3d.c
-@@ -315,21 +315,28 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
-     AVFrame *out;
-     int direct = av_frame_is_writable(in) && !ctx->is_disabled;
-     ThreadData td;
--    int ret3;
-+    int err, ret3;
- 
--    if (in->format != s->format ||
--        in->width  != s->width  ||
--        in->height != s->height) {
--        av_log(ctx, AV_LOG_ERROR,
--               "Frame size or format changed without filter graph reinitialization\n");
-+    if (in->format != s->format) {
-         av_frame_free(&in);
-         return AVERROR(EINVAL);
-     }
- 
-+    if (in->width != s->width || in->height != s->height) {
-+        inlink->w = in->width;
-+        inlink->h = in->height;
-+        if ((err = config_input(inlink)) < 0) {
-+            av_frame_free(&in);
-+            return err;
-+        }
-+        outlink->w = in->width;
-+        outlink->h = in->height;
-+    }
-+
-     if (direct) {
-         out = in;
-     } else {
--        out = ff_get_video_buffer(outlink, outlink->w, outlink->h);
-+        out = ff_get_video_buffer(outlink, in->width, in->height);
-         if (!out) {
-             av_frame_free(&in);
-             return AVERROR(ENOMEM);
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-66037.patch Deleted

@@ -1,36 +0,0 @@
-From f15e730cd225763bbae68614af777560aeb449dd Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sun, 28 Jun 2026 22:05:28 +0200
-Subject: PATCH avformat/iamf_parse: check count_label against the available
- bytes
-
-Fixes: unbounded allocation / denial of service
-Fixes: tP59h4cpaFyg
-Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer)
-Found-by: Adrian Junge (vurlo)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-(cherry picked from commit 86708357d126af84c16f80d9c57335d1e8c845c5)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavformat/iamf_parse.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
-index d74a8677d6..4c2df2c9e6 100644
---- a/libavformat/iamf_parse.c
-+++ b/libavformat/iamf_parse.c
-@@ -1009,6 +1009,11 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
-     mix_presentation->cmix = mix;
- 
-     mix_presentation->count_label = ffio_read_leb(pbc);
-+    if (mix_presentation->count_label > len - avio_tell(pbc)) {
-+        mix_presentation->count_label = 0;
-+        ret = AVERROR_INVALIDDATA;
-+        goto fail;
-+    }
-     mix_presentation->language_label = av_calloc(mix_presentation->count_label,
-                                                  sizeof(*mix_presentation->language_label));
-     if (!mix_presentation->language_label) {
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-70628.patch Deleted

@@ -1,33 +0,0 @@
-From 02fc47e13f903768b75f7985a2706a6223ab4506 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Wed, 22 Jul 2026 05:49:11 +0200
-Subject: PATCH avcodec/dvbsub_parser: avoid signed overflow in the capacity
- check
-
-Fixes: signed integer overflow
-Fixes: out of array access
-Fixes: poc.wtv
-Fixes: fJeEU9JwKwsR
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit 93f2a525ec6c7b467bae68322720d10188fc6e30)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/dvbsub_parser.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c
-index 4527e4dd75..a93f39bfe0 100644
---- a/libavcodec/dvbsub_parser.c
-+++ b/libavcodec/dvbsub_parser.c
-@@ -104,7 +104,7 @@ static int dvbsub_parse(AVCodecParserContext *s,
-         }
-     }
- 
--    if (buf_size - buf_pos + pc->packet_index > PARSE_BUF_SIZE)
-+    if (buf_size - buf_pos > PARSE_BUF_SIZE - pc->packet_index)
-         return buf_size;
- 
- /* if not currently in a packet, pass data */
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-70629.patch Deleted

@@ -1,36 +0,0 @@
-From a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Wed, 22 Jul 2026 05:44:03 +0200
-Subject: PATCH avcodec/rscc: do not leave uninitilized data when the input
- is too short
-
-Fixes: use of uninitialized memory
-Fixes: rscc_short_deflate_heap_disclosure.avi
-Fixes: plB80py3i3Bu
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/rscc.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
-index 3715e1c6d4..5fde30ec35 100644
---- a/libavcodec/rscc.c
-+++ b/libavcodec/rscc.c
-@@ -311,6 +311,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, AVFrame *frame,
-             ret = AVERROR_UNKNOWN;
-             goto end;
-         }
-+        if (len < pixel_size) {
-+            av_log(avctx, AV_LOG_WARNING, "Deflated %lu bytes, but %d are needed\n",
-+                   len, pixel_size);
-+            memset(ctx->inflated_buf + len, 0, pixel_size - len);
-+            pixel_size = len;
-+        }
-         pixels = ctx->inflated_buf;
-     }
- 
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-70630.patch Deleted

@@ -1,53 +0,0 @@
-From c22667d0fd7916a33fd3e79685b7246fc48f1a62 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Wed, 22 Jul 2026 05:44:41 +0200
-Subject: PATCH avcodec/screenpresso: reject deflate output shorter than the
- frame
-
-Fixes: use of uninitialized memory
-Fixes: screenpresso_short_zlib_heap_disclosure.avi
-Fixes: ksUBwBOjJodq
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit 705890061467ad550ecc1dad5eea07f28ccfb43e)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/screenpresso.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/libavcodec/screenpresso.c b/libavcodec/screenpresso.c
-index b27154991c..5864253d41 100644
---- a/libavcodec/screenpresso.c
-+++ b/libavcodec/screenpresso.c
-@@ -137,6 +137,9 @@ static int screenpresso_decode_frame(AVCodecContext *avctx, AVFrame *frame,
-         return AVERROR_INVALIDDATA;
-     }
- 
-+    /* Codec has aligned strides */
-+    src_linesize = FFALIGN(avctx->width * component_size, 4);
-+
-     /* Inflate the frame after the 2 byte header */
-     ret = uncompress(ctx->inflated_buf, &length,
-                      avpkt->data + 2, avpkt->size - 2);
-@@ -144,14 +147,16 @@ static int screenpresso_decode_frame(AVCodecContext *avctx, AVFrame *frame,
-         av_log(avctx, AV_LOG_ERROR, "Deflate error %d.\n", ret);
-         return AVERROR_UNKNOWN;
-     }
-+    if (length < src_linesize * avctx->height) {
-+        av_log(avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %d are needed\n",
-+               length, src_linesize * avctx->height);
-+        return AVERROR_INVALIDDATA;
-+    }
- 
-     ret = ff_reget_buffer(avctx, ctx->current, 0);
-     if (ret < 0)
-         return ret;
- 
--    /* Codec has aligned strides */
--    src_linesize = FFALIGN(avctx->width * component_size, 4);
--
-     /* When a keyframe is found, copy it (flipped) */
-     if (keyframe)
-         av_image_copy_plane(ctx->current->data0 +
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-70631.patch Deleted

@@ -1,64 +0,0 @@
-From 3c287af3affe1286350faa69c02bcc5d49de18bb Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Wed, 22 Jul 2026 05:44:41 +0200
-Subject: PATCH avcodec/tiff: reject inflate output shorter than the strip
-
-Fixes: use of uninitialized memory
-Fixes: tiff_short_deflate_heap_disclosure.tiff
-Fixes: 1cRIkpUVMQtn
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit 2f234ea34c81288e3840fca632dd16481d8de39f)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/tiff.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
-index 8a179f0fd0..b8ce7b0b55 100644
---- a/libavcodec/tiff.c
-+++ b/libavcodec/tiff.c
-@@ -526,6 +526,7 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
-     uint8_t *zbuf;
-     unsigned long outlen;
-     int ret, line;
-+    int rows = is_yuv ? (lines + s->subsampling1 - 1) / s->subsampling1 : lines;
-     outlen = width * lines;
-     zbuf   = av_malloc(outlen);
-     if (!zbuf)
-@@ -545,6 +546,12 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
-         av_free(zbuf);
-         return AVERROR_UNKNOWN;
-     }
-+    if (outlen < (unsigned long)width * rows) {
-+        av_log(s->avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %lu are needed\n",
-+               outlen, (unsigned long)width * rows);
-+        av_free(zbuf);
-+        return AVERROR_INVALIDDATA;
-+    }
-     src = zbuf;
-     for (line = 0; line < lines; line++) {
-         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
-@@ -592,6 +599,7 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
- {
-     uint64_t outlen = width * (uint64_t)lines;
-     int ret, line;
-+    int rows = is_yuv ? (lines + s->subsampling1 - 1) / s->subsampling1 : lines;
-     uint8_t *buf = av_malloc(outlen);
-     if (!buf)
-         return AVERROR(ENOMEM);
-@@ -610,6 +618,12 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
-         av_free(buf);
-         return AVERROR_UNKNOWN;
-     }
-+    if (outlen < (uint64_t)width * rows) {
-+        av_log(s->avctx, AV_LOG_ERROR, "Uncompressed %"PRIu64" bytes, but %"PRIu64" are needed\n",
-+               outlen, (uint64_t)width * rows);
-+        av_free(buf);
-+        return AVERROR_INVALIDDATA;
-+    }
-     src = buf;
-     for (line = 0; line < lines; line++) {
-         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-70632.patch Deleted

@@ -1,40 +0,0 @@
-From 16b2049d4d5222db6cd7c031409058571c94f6a9 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Wed, 22 Jul 2026 05:53:16 +0200
-Subject: PATCH avcodec/cfhd: reject transform-2 output wider than the plane
-
-Fixes: out of array access
-Fixes: cfhd_transform2_output_width_oob.avi
-Fixes: MimvoaEVpKow
-Found-by: Adrian Junge (vurlo)
-(cherry picked from commit db05df9d135fb56a4babb836d5e9f5c1d984e087)
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavcodec/cfhd.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
-index 4d430e32ef..128362ac62 100644
---- a/libavcodec/cfhd.c
-+++ b/libavcodec/cfhd.c
-@@ -1224,7 +1224,7 @@ finish:
- 
-             if (lowpass_height > s->planeplane.band41.a_height || lowpass_width > s->planeplane.band41.a_width ||
-                 !highpass_stride || s->planeplane.band41.width > s->planeplane.band41.a_width ||
--                lowpass_width < 3 || lowpass_height < 3) {
-+                lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->planeplane.width) {
-                 av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
-                 ret = AVERROR(EINVAL);
-                 goto end;
-@@ -1345,7 +1345,7 @@ finish:
- 
-             if (lowpass_height > s->planeplane.band41.a_height || lowpass_width > s->planeplane.band41.a_width ||
-                 s->planeplane.band41.width > s->planeplane.band41.a_width ||
--                lowpass_width < 3 || lowpass_height < 3) {
-+                lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->planeplane.width) {
-                 av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
-                 ret = AVERROR(EINVAL);
-                 goto end;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75141.patch Deleted

@@ -1,33 +0,0 @@
-From acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:56 +0000
-Subject: PATCH avformat/hevc: reject hvcC NAL arrays that overflow the
- 16-bit count
-
-numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one
-type wraps it to 0 and then writes nal-1. Reject before the count can
-wrap. Reachable by remuxing a crafted file with -c copy.
-
-Fixes: integer overflow
-Fixes: out of array access
----
- libavformat/hevc.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/libavformat/hevc.c b/libavformat/hevc.c
-index c9ee11f36c..678a9e2206 100644
---- a/libavformat/hevc.c
-+++ b/libavformat/hevc.c
-@@ -844,6 +844,9 @@ static int hvcc_array_add_nal_unit(const uint8_t *nal_buf, uint32_t nal_size,
-     int ret;
-     uint16_t numNalus = array->numNalus;
- 
-+    if (numNalus >= UINT16_MAX)
-+        return AVERROR_INVALIDDATA;
-+
-     ret = av_reallocp_array(&array->nal, numNalus + 1, sizeof(*array->nal));
-     if (ret < 0)
-         return ret;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75142.patch Deleted

@@ -1,41 +0,0 @@
-From 9d786e4b5e9b8482651928574de33772aeee7be1 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/mpegenc: reject stream counts that overflow the
- system header
-
-put_system_header() writes 12 + 3*N bytes after the pack header into a
-fixed 128-byte stack buffer, but is handed a PutBitContext sized past the
-real buffer, so its own bounds check never fires; ~35+ streams overflow the
-stack. Reject at mux init when the system header would not fit.
-
-Fixes: out of array access
-Fixes: many.mkv
----
- libavformat/mpegenc.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/libavformat/mpegenc.c b/libavformat/mpegenc.c
-index 128dfe2885..cea91d80da 100644
---- a/libavformat/mpegenc.c
-+++ b/libavformat/mpegenc.c
-@@ -473,6 +473,16 @@ static av_cold int mpeg_mux_init(AVFormatContext *ctx)
-         if (!stream->fifo)
-             return AVERROR(ENOMEM);
-     }
-+
-+    /* The system header is emitted, right after the pack header (which is at
-+     * most 14 bytes), into the fixed 128-byte buffer used by flush_packet().
-+     * Reject configurations whose system header would not fit. */
-+    if (get_system_header_size(ctx) > 128 - 14) {
-+        av_log(ctx, AV_LOG_ERROR,
-+               "Too many streams to fit the MPEG program stream system header\n");
-+        return AVERROR(EINVAL);
-+    }
-+
-     bitrate       = 0;
-     audio_bitrate = 0;
-     video_bitrate = 0;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75143.patch Deleted

@@ -1,31 +0,0 @@
-From 1c10bcc2e17255dacb717a25ab3db142ce390602 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/librist: honor the caller buffer size in
- librist_read
-
-librist_read() ignored its size argument and copied the full payload_len,
-overflowing a smaller destination (e.g. via the async: wrapper). Clamp the
-copy to the caller-provided buffer size.
-
-Fixes: out of array access
----
- libavformat/librist.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavformat/librist.c b/libavformat/librist.c
-index 9669d5b5df..3c4b5e3e5b 100644
---- a/libavformat/librist.c
-+++ b/libavformat/librist.c
-@@ -226,7 +226,7 @@ static int librist_read(URLContext *h, uint8_t *buf, int size)
-         }
-     }
- 
--    size = data_block->payload_len;
-+    size = FFMIN(data_block->payload_len, size);
-     memcpy(buf, data_block->payload, size);
- out_free:
-     rist_receiver_data_block_free2(&data_block);
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75144.patch Deleted

@@ -1,67 +0,0 @@
-From 1cdeb3c4e7f1f8566d846b9b451e01c376398818 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/rtpenc_vc2hq: reject data units larger than the RTP
- payload buffer
-
-send_packet() copied an input-derived unit/fragment size into the fixed
-rtp_ctx->buf with no bound, overflowing it for a crafted Dirac unit even at
-the default packet size. Reject units that do not fit in max_payload_size.
-
-Fixes: out of array access
----
- libavformat/rtpenc_vc2hq.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/libavformat/rtpenc_vc2hq.c b/libavformat/rtpenc_vc2hq.c
-index cf548191d2..3b7147dfe2 100644
---- a/libavformat/rtpenc_vc2hq.c
-+++ b/libavformat/rtpenc_vc2hq.c
-@@ -33,16 +33,23 @@
- #define DIRAC_PIC_NR_SIZE                    4
- #define DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT      0xEC
- 
--static void send_packet(AVFormatContext *ctx, uint8_t parse_code, int info_hdr_size, const uint8_t *buf, int size, int i, int f, int rtp_m)
-+static int send_packet(AVFormatContext *ctx, uint8_t parse_code, int info_hdr_size, const uint8_t *buf, int size, int i, int f, int rtp_m)
- {
-     RTPMuxContext *rtp_ctx = ctx->priv_data;
- 
-+    if (size < 0 ||
-+        size > rtp_ctx->max_payload_size - RTP_VC2HQ_PL_HEADER_SIZE - info_hdr_size) {
-+        av_log(ctx, AV_LOG_ERROR, "VC-2 data unit too large for RTP payload buffer\n");
-+        return AVERROR_INVALIDDATA;
-+    }
-+
-     AV_WB16(&rtp_ctx->buf0, 0); /* extended sequence number */
-     AV_WB8 (&rtp_ctx->buf2, i ? (f ? (0x03) : (0x02)) : 0x00); /* flags: interlaced, second field */
-     AV_WB8 (&rtp_ctx->buf3, parse_code);
-     if (size > 0)
-         memcpy(&rtp_ctx->buf4 + info_hdr_size, buf, size);
-     ff_rtp_send_data(ctx, rtp_ctx->buf, RTP_VC2HQ_PL_HEADER_SIZE + info_hdr_size + size, rtp_m);
-+    return 0;
- }
- 
- static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int interlaced)
-@@ -85,7 +92,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int
-     AV_WB16(&info_hdr 6, size_scaler);
-     AV_WB16(&info_hdr 8, frag_len);
-     AV_WB16(&info_hdr10, 0 /* nr. of slices */);
--    send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 12, buf, frag_len, interlaced, second_field, 0);
-+    if (send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 12, buf, frag_len, interlaced, second_field, 0) < 0)
-+        return AVERROR_INVALIDDATA;
-     buf += frag_len;
-     size -= frag_len;
- 
-@@ -97,7 +105,8 @@ static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int
-         AV_WB16(&info_hdr14, 0 /* slice y */);
- 
-         size -= frag_len;
--        send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 16, buf, frag_len, interlaced, second_field, size > 0 ? 0 : 1);
-+        if (send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 16, buf, frag_len, interlaced, second_field, size > 0 ? 0 : 1) < 0)
-+            return AVERROR_INVALIDDATA;
-         buf += frag_len;
-     }
-     return 0;
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75145.patch Deleted

@@ -1,30 +0,0 @@
-From b4c199c5906ff53368926c2a5839881f41957e7f Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/rtpenc_av1: do not narrow the OBU size to (long)
-
-(long)obu_size sign-flips values in 0x80000000..0xfffffffd on ILP32/LLP64
-targets (32-bit long, e.g. 64-bit Windows), bypassing the size check.
-Compare as uint32_t; frame_size is non-negative at this point.
-
-No PoC as the used setup was 64bit specific
----
- libavformat/rtpenc_av1.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c
-index 934cfb63a3..f7c6aad47a 100644
---- a/libavformat/rtpenc_av1.c
-+++ b/libavformat/rtpenc_av1.c
-@@ -177,7 +177,7 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t *frame_buf, int frame_s
-             return;
-         }
- 
--        if ((long) obu_size > frame_size) {
-+        if (obu_size > (unsigned) frame_size) {
-             av_log(ctx, AV_LOG_ERROR, "AV1 OBU size %d larger than remaining frame size %d\n", obu_size, frame_size);
-             return;
-         }
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75146.patch Deleted

@@ -1,44 +0,0 @@
-From 65b0dab903e5975e036b30ecc58f5935d4f151e0 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/dashdec: reject a negative fragment index
-
-A live manifest whose startNumber decreases across a refresh drives
-cur_seq_no negative in move_segments(); get_current_fragment() only checked
-the upper bound before indexing fragments. Add a lower-bound check and
-clamp the negative delta at its source.
-
-Fixes: out of array read
----
- libavformat/dashdec.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
-index d4a05ace7e..740ac6bc1c 100644
---- a/libavformat/dashdec.c
-+++ b/libavformat/dashdec.c
-@@ -1537,8 +1537,11 @@ static void move_segments(struct representation *rep_src, struct representation
-         free_fragment_list(rep_dest);
-         if (rep_src->start_number > (rep_dest->start_number + rep_dest->n_fragments))
-             rep_dest->cur_seq_no = 0;
--        else
-+        else {
-             rep_dest->cur_seq_no += rep_src->start_number - rep_dest->start_number;
-+            if (rep_dest->cur_seq_no < 0)
-+                rep_dest->cur_seq_no = 0;
-+        }
-         rep_dest->fragments    = rep_src->fragments;
-         rep_dest->n_fragments  = rep_src->n_fragments;
-         rep_dest->parent  = rep_src->parent;
-@@ -1658,7 +1661,7 @@ static struct fragment *get_current_fragment(struct representation *pls)
-     int reload_count = 0;
- 
-     while (( !ff_check_interrupt(c->interrupt_callback)&& pls->n_fragments > 0)) {
--        if (pls->cur_seq_no < pls->n_fragments) {
-+        if (pls->cur_seq_no >= 0 && pls->cur_seq_no < pls->n_fragments) {
-             seg_ptr = pls->fragmentspls->cur_seq_no;
-             seg = av_mallocz(sizeof(struct fragment));
-             if (!seg) {
--- 
-2.49.0
-

ffmpeg-8-CVE-2026-75147.patch Deleted

@@ -1,44 +0,0 @@
-From 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8 Mon Sep 17 00:00:00 2001
-From: Joshua Rogers <MegaManSec@users.noreply.github.com>
-Date: Tue, 4 Aug 2026 12:11:55 +0000
-Subject: PATCH avformat/rtpenc_av1: bound OBU size in the keyframe search
- loop
-
-The is_keyframe sequence-header search loop advanced buf_ptr/rem_size by
-num_lebs + obu_size without bounding obu_size against the remaining data
-(unlike the main packetization loop). A crafted obu_size (~0x80000010)
-wraps the signed rem_size back positive, so the next iteration
-dereferences a pointer past the packet. Consume the LEB bytes first, then
-reject an OBU larger than the remaining size. Out-of-bounds read reachable
-from a crafted AV1 packet muxed to RTP.
-
-Fixes: out of array read
----
- libavformat/rtpenc_av1.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/libavformat/rtpenc_av1.c b/libavformat/rtpenc_av1.c
-index fbf9212216..ae66fdb86f 100644
---- a/libavformat/rtpenc_av1.c
-+++ b/libavformat/rtpenc_av1.c
-@@ -116,8 +116,15 @@ void ff_rtp_send_av1(AVFormatContext *ctx, const uint8_t *frame_buf, int frame_s
-             if (!num_lebs) {
-                 break;
-             }
--            buf_ptr += num_lebs + obu_size;
--            rem_size -= num_lebs + obu_size;
-+            buf_ptr += num_lebs;
-+            rem_size -= num_lebs;
-+            // bound OBU payload against remaining data to avoid pointer/size
-+            // wraparound (mirrors the check in the packetization loop below)
-+            if (obu_size > (uint32_t) rem_size) {
-+                break;
-+            }
-+            buf_ptr += obu_size;
-+            rem_size -= obu_size;
-         }
- #else // RTPENC_AV1_SEARCH_SEQ_HEADER
-         av_log(ctx, AV_LOG_DEBUG, "Marking FIRST packet\n");
--- 
-2.49.0
-

_scmsync.obsinfo Deleted

build.specials.obscpio Deleted

ffmpeg-8.1.2.tar.xz.asc Deleted

ffmpeg-8.1.3.tar.xz.asc Added

ffmpeg-8.1.2.tar.xz/Changelog -> ffmpeg-8.1.3.tar.xz/Changelog Changed

@@ -1,6 +1,267 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 8.1.3:
+ Revert "lavfi/bwdif: fix heap-buffer-overflow with small height videos"
+ avfilter/vf_bwdif: fix line boundary checks for >8 bits content
+ avformat/hlsenc: fix compile error when mp4 is disabled
+ swscale/unscaled: fix rgbToRgbWrapper for non-native-endian formats
+ avformat/hls: avoid casting callback functions type
+ avcodec/vulkan/ffv1_dec_setup: act on the slice header rejection
+ avformat/hlsenc: reject out-of-range EXT-X-PROGRAM-DATE-TIME
+ avformat/http: only reuse old connection if valid
+ avformat/http: properly re-set s->range_end before requests
+ avutil/rational: avoid signed integer overflow
+ avformat/mpegts: Fix memleak of pes_filter.opaque
+ avcodec/leaddec: Check input data before allocating buffer
+ avcodec/jpeglsdec: bound cumulative decoded JPEG-LS height per packet
+ avcodec/cbs_h265: allocate VPS hrd_parameters dynamically
+ avcodec/atsc_a53: Avoid GetBits API to parse A53 CC data
+ avcodec/pngdec: bound decompressed zTXt/iCCP size (decompression-bomb guard)
+ avformat/av1: fix uvlc loop past end of bitstream
+ tools/zmqsend: close the input FILE
+ avcodec/ppc/vp8dsp: store the 16 pixel wide rows at any alignment
+ avformat/os_support: fix return value of win32_rename
+ vulkan_encode: fix leak and swallowed errors in init_base_units()
+ avfilter/dnn: fix async teardown race condition in all backends
+ avfilter/vf_decimate: reject blocks smaller than one chroma sample
+ avformat/genh: check for unsupported interleaved size 1 typ1 THP
+ lavc/vvc: Prevent OOB write in sh_entry_points
+ avcodec/vulkan_hevc: bound the per category reference counts in vk_hevc_start_frame
+ avcodec/vulkan_hevc: bound the reference count in vk_hevc_start_frame
+ avcodec/fflcms2: fix memory leak after cmsDeleteContext(NULL)
+ avcodec/cbs_h266_syntax_template: fix ph_recovery_poc_cnt range
+ avformat/http: free cookie parameters on parse failure
+ avutil/opt: fix av_opt_is_set_to_default() on default-NAN options
+ fftools: reject negative -t durations
+ avcodec/hevc: don't error out on remaining slices of a skipped picture
+ avcodec/vvc: Skip over the current picture in find_ref_idx
+ avcodec/mips/vc1dsp_msa: Fix mspel functions
+ avcodec/mips/hevcpred_msa: Fix compilation
+ avcodec/vc1_block: don't drop the last macroblock when 1 bit remains
+ avcodec/dovi_rpudec: strip zero padding
+ avformat/dashdec: check fragment_timescale before division in refresh_manifest
+ avutil/encryption_info: reject init info with zero-sized key IDs
+ avformat/genh: check thp extradata read and allocation
+ avformat/oggdec: check for integer overflow in buf_realloc
+ vulkan_av1: fix out-of-bounds write of tile_sizes
+ avcodec/cfhd: reject header tags after the frame buffer was allocated
+ avcodec/cfhd: check the channel number after every tag
+ avcodec/cfhd: reset the allocated band sizes when freeing the buffers
+ avcodec/cook: require the channel mask to cover every subpacket channel
+ avcodec/dvdsubenc: account for the byte alignment of each RLE line
+ avfilter/vf_colorconstancy: free only allocated buffers on setup failure
+ avcodec/hap: do not hide the failure of the chunk table allocation
+ avformat/mov: Allocate the array without clearing before read
+ avformat/mov: do not zero a key string before reading it
+ avformat/mov: bound the keys atom entry count by the atom size
+ avcodec/vvc/dec: compare the CTU area in ibc_tl_init()
+ avcodec/vvc/dec: free the tabs when pic_arrays_init() fails
+ avcodec/vvc/thread: clear fc->ft when the frame thread is freed
+ avfilter/vf_uspp: Fix qpcount
+ avcodec/codec_internal: clarify docs for FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM
+ avfilter/f_metadata: avoid overread on long formatted output
+ avformat/tls_mbedtls: set the expected hostname for numeric hosts
+ libswscale/ppc/yuv2rgb_altivec: Fix heap buffer overflow in yuv2packedX
+ avcodec/apac: reset bitstream_index unconditionally to avoid integer overflow
+ avcodec/vorbisenc: dont assert on non finite input
+ avcodec/rv34: do not copy an unused reference line in the edge emulation
+ avcodec/rv34: do not await a negative reference-frame row
+ avcodec/vp9: unref next_refs in vp9_decode_flush
+ avcodec/vp8: do not await a negative reference-frame row
+ avformat/vpk: Check the channel count before dividing in the last block
+ avformat: Restore the container channel layout after a failed decoder open
+ avformat/sierravmd: require a 6bit palette in the probe
+ libswscale: use unaligned read/write macros in planarCopyWrapper
+ avformat/binka: reject truncated packet reads
+ avfilter/acrossover: reject non-finite parameters
+ avfilter/aiir: reject non-finite parameters
+ avfilter/firequalizer: reject overflowing delays
+ avcodec/wavpackenc: handle INT32_MIN samples
+ avfilter/aecho: reject non-finite delays and decays
+ libswresample/aarch64: Fix sign extension in audio conversion
+ avcodec/audiotoolbox: use 64-bit channel masks
+ avfilter/aarch64/vf_bwdif_init: Fix stride bound check
+ avformat/dashenc: free http options on avio_open_dyn_buf failure
+ avcodec/bmp: fix misaligned read in 16-bit decoding
+ avcodec/huffyuv: seed the median predictor endian independently
+ avformat/wvdec: convert flags to defines
+ avcodec/lcldec: clear what the multithread chunks leave undecoded
+ avformat/mlv: end the LJ92 packet where its data ends
+ avformat/mpegts: reject a max_packet_size below one TS payload
+ avformat/mpegts: keep the PES payload within max_packet_size
+ avfilter/spectrumsynth: negotiate one pixel format for both inputs
+ avfilter/afir: bound the crossfades by the samples of the input frame
+ avformat/rtpenc_av1: do not narrow the OBU size to (long)
+ avformat/rtpenc_av1: Check num_lebs
+ avformat/rtpenc_av1: bound OBU size in the keyframe search loop
+ avformat/gopher: Fix CRLF injection
+ avformat/rtpenc_vc2hq: reject data units larger than the RTP payload buffer
+ avformat/dashdec: reject a negative fragment index
+ avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count
+ avformat/mpegenc: reject stream counts that overflow the system header
+ avformat/mpegenc: pass buffer size into put_system_header()
+ avformat/librist: honor the caller buffer size in librist_read
+ avformat/scd: reject zero-channel tracks
+ avcodec/dolby_e: Add error recovery when parse_mantissas run out of bits
+ avfilter/af_pan: check the id of named input channels before use
+ swscale: avoid overflow in fast bilinear edge handling
+ avformat/rawutils: reject raw RGB frames that do not fit an AVPacket
+ avcodec/nvenc: write AV1 timecode metadata in AV1 syntax
+ avcodec/utils: add ff_alloc_timecode_metadata_av1()
+ avcodec/utils: factor the timecode fields out of ff_alloc_timecode_sei
+ vulkan_encode_av1: set primary_ref_frame to a reference name, not a slot
+ avformat/mov: reject a trun sample count the input cannot hold
+ avcodec/tiff: reject inflate output shorter than the strip
+ avformat/dashdec: check NULL pointer before use str_end_offset
+ avformat/dashdec: check NULL pointer of av_strtok value before use it
+ fftools/opt_common: fix format string bug in print_program_info
+ avformat/dashdec: fix integer truncation in calc_max_seg_no()
+ avdevice/android_camera: fix OOB read in metadata parsing
+ avcodec/cbs_h266: size vps_direct_ref_layer_flag for the full layer range
+ avcodec/ffv1dec: reject a remap that produces zero entries
+ avcodec/ffv1dec: mark the slice damaged when its remap fails
+ avcodec/pgssubdec: always give an output rect a palette
+ scale_d3d11: Fix hw_frame_ctx reference leak
+ avcodec/cfhd: reject transform-2 output wider than the plane
+ avformat/rtsp: clear authentication on cross-origin redirects
+ avcodec/dovi_rpuenc: normalize vdr_dm_metadata_present to 0/1
+ avcodec/dovi_rpuenc: validate vdr_rpu_id from the input metadata
+ avcodec/bsf/dovi_rpu: handle update_rpu() returning no RPU
+ avcodec/dovi_rpudec: bound num_x/y_partitions
+ avcodec/dovi_rpuenc: validate the data mapping before generation
+ avfilter/af_arnndn: pad the DCT input buffers to the read length
+ doc/nut.texi: point at the latest spec in the git repository
+ avformat/mov: bound sgpd sync entry_count by the atom size
+ avcodec/rscc: do not leave uninitilized data when the input is too short
+ avcodec/dvbsub_parser: avoid signed overflow in the capacity check
+ avformat/tls_openssl: bind peer identity for numeric-IP verify
+ avformat/codec2: avoid integer overflow in packet size and duration
+ avfilter/vf_xpsnr: avoid a zero block size on small frames
+ avcodec/cbs_av1: pad the ITU-T T.35 payload buffer
+ avcodec/screenpresso: reject deflate output shorter than the frame
+ avformat/hls: Enforce protocol checks when opening child playlists
+ avformat/hlsenc: Fix heap buffer overflow in parse_playlist()
+ avformat/hlsenc: Handle extensionless URIs in extract_segment_number()
+ avfilter/vf_lut3d: do not compute size*size before the size is validated
+ avfilter/vf_hqdn3d: reject unsupported frame parameter changes
+ avformat/tls_mbedtls: check the certificate verification result in tls_handshake()
+ Guard against int overflow when discarding samples
+ avformat/concatdec: Check recursion depth
+ avcodec/hevc: Fix integer overflow in WPP entry point range check
+ avformat/ty: don't let the Series2 AC3 trim underflow the packet size
+ avfilter/vf_swaprect: size the temp row buffer for the widest plane
+ avfilter/vf_floodfill: remove unneeded variables
+ avfilter/vf_floodfill: size the point stack for the current frame
+ avfilter/vf_lut3d: compute size2 after the 3DLUTSIZE directive
+ doc/developer.texi: update reviews section
+ doc/infra.txt: add fairy
+ avcodec/tdsc: unref the reference frame before reallocating on size change
+ avcodec/cavsdec: reject invalid start-code bitreader sizes
+ avcodec/libcodec2: reject packet sample counts that overflow int
+ avcodec/ffv1dec: mask the fltmap index on the 8bit remap path
+ avcodec/vorbisdec: skip the MDCT for unused channels
+ avcodec/exr: bound total decoded pixels by max_pixels
+ avcodec/bsf/dts2pts: evict unconsumable nodes from the poc tree
+ avcodec/bsf/dts2pts: fix removal of 2nd field nodes
+ avcodec/bsf/dts2pts: chain same-gop nodes instead of collecting into a fixed array
+ lavc/hevc: Always generate missing refs for foll pictures
+ avcodec/mjpegdec: reject redundant scans of a sequential image
+ avcodec/mjpegdec: reject flipping of bayer images
+ avcodec/tdsc: reject out-of-frame cursor position
+ avformat/spdif: fix reading past the buffer when probing AAC in IEC 61937
+ avfilter/vf_v360: keep remap source coordinates in bounds
+ avfilter/vf_v360: reject dimensions too small for the projection
+ avcodec/lzf: pad the decompressed buffer
+ avcodec/jpeg2000dec: avoid signed overflow in ROI shift
+ avcodec/hevc/ps: avoid signed overflow reading act qp offsets
+ avcodec/vvc/dec: fix pixel buffer tab leak on chroma format change
+ avcodec/vvc/dec: merge the SAO and ALF pixel buffer tab loops
+ avformat/hls_sample_encryption: Validate ADTS frame length against packet
+ avformat/iff: reject invalid data_size in ANIM
+ avformat/hls: reject Master Playlist tags in a Media Playlist
+ avformat/mov: bound the iref thmb/cdsc entry count by the sub-box size
+ avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure
+ avfilter/vf_quirc: resize the quirc buffers when the input size changes
+ swscale/output: avoid signed overflow in yuv2rgb_write_full luma scaling
+ avformat/wavdec: fix integer overflow in W64 chunk size check
+ avformat/imfdec: check for a missing or empty Path in the asset map
+ avformat/imfdec: reject virtual tracks with no resources
+ avcodec/mace: reject sample counts that overflow int
+ avcodec/apac: Check bitstream_size to avoid integer overflow
+ avfilter/boxblur: reject pixel formats deeper than 16 bits
+ Guard lpc methods in flacdsp and add tests
+ Guard against loop underflow
+ avformat/movenc: free sgpd_entries on the roll-distance error path
+ avfilter/vf_removelogo: free the whole mask on allocation failure
+ avfilter/af_adeclick: free transform contexts and buffers on error
+ tests/checkasm/llviddsp: fix add_left_pred_int16 buffer compare size
+ avcodec/rasc: Check that 32-bit DLTA accesses stay within the row

ffmpeg-8.1.2.tar.xz/RELEASE -> ffmpeg-8.1.3.tar.xz/RELEASE Changed

ffmpeg-8.1.2.tar.xz/VERSION -> ffmpeg-8.1.3.tar.xz/VERSION Changed

ffmpeg-8.1.2.tar.xz/configure -> ffmpeg-8.1.3.tar.xz/configure Changed

@@ -2599,6 +2599,7 @@
     symver_asm_label
     symver_gnu_asm
     vfp_args
+    x86_32_7regs
     xform_asm
     xmm_clobbers
 "
@@ -6755,6 +6756,14 @@
     check_inline_asm ebx_available '""::"b"(0)' &&
         check_inline_asm ebx_available '"":::"%ebx"'
 
+    # check whether 7 registers are available on x86-32
+    # Since https://github.com/llvm/llvm-project/commit/0d471b3f64d3116bd57c79d872f7384fff80daa5,
+    # Clang can save/restore EBP around clobber-only asm, so the EBP
+    # crash probe alone can be a false positive for 7-register asm.
+    disable x86_32_7regs
+    enabled_all x86_32 ebx_available ebp_available &&
+        check_inline_asm x86_32_7regs '"" :: "r"(0), "r"(1), "r"(2), "r"(3), "g"(4), "r"(5) : "%eax", "%edx"'
+
     # check whether xmm clobbers are supported
     check_inline_asm xmm_clobbers '"":::"%xmm0"'
 
@@ -8396,6 +8405,9 @@
     echo "EBX available             ${ebx_available-no}"
     echo "EBP available             ${ebp_available-no}"
 fi
+if enabled x86_32; then
+    echo "7 registers available     ${x86_32_7regs-no}"
+fi
 if enabled aarch64; then
     echo "NEON enabled              ${neon-no}"
     echo "DOTPROD enabled           ${dotprod-no}"

ffmpeg-8.1.2.tar.xz/doc/Doxyfile -> ffmpeg-8.1.3.tar.xz/doc/Doxyfile Changed

ffmpeg-8.1.2.tar.xz/doc/demuxers.texi -> ffmpeg-8.1.3.tar.xz/doc/demuxers.texi Changed

ffmpeg-8.1.2.tar.xz/doc/developer.texi -> ffmpeg-8.1.3.tar.xz/doc/developer.texi Changed

ffmpeg-8.1.2.tar.xz/doc/filters.texi -> ffmpeg-8.1.3.tar.xz/doc/filters.texi Changed

ffmpeg-8.1.2.tar.xz/doc/infra.txt -> ffmpeg-8.1.3.tar.xz/doc/infra.txt Changed

ffmpeg-8.1.2.tar.xz/doc/nut.texi -> ffmpeg-8.1.3.tar.xz/doc/nut.texi Changed

ffmpeg-8.1.2.tar.xz/fftools/ffmpeg_demux.c -> ffmpeg-8.1.3.tar.xz/fftools/ffmpeg_demux.c Changed

@@ -96,12 +96,6 @@
     uint64_t                 nb_packets;
     // combined size of all the packets read
     uint64_t                 data_size;
-    // latest wallclock time at which packet reading resumed after a stall - used for readrate
-    int64_t                  resume_wc;
-    // timestamp of first packet sent after the latest stall - used for readrate
-    int64_t                  resume_pts;
-    // measure of how far behind packet reading is against spceified readrate
-    int64_t                  lag;
 } DemuxStream;
 
 typedef struct DemuxStreamGroup {
@@ -144,6 +138,13 @@
     double                readrate_initial_burst;
     float                 readrate_catchup;
 
+    // latest wallclock time at which packet reading resumed after a stall - used for readrate
+    int64_t               resume_wc;
+    // relative timestamp of first packet sent after the latest stall - used for readrate
+    int64_t               resume_progress;
+    // measure of how far behind packet reading is against spceified readrate
+    int64_t               lag;
+
     Scheduler            *sch;
 
     AVPacket             *pkt_heartbeat;
@@ -514,43 +515,55 @@
     int64_t initial_burst = AV_TIME_BASE * d->readrate_initial_burst;
     int resume_warn = 0;
 
+    DemuxStream *slowest = NULL;
+    int64_t progress = INT64_MAX;
+
     for (int i = 0; i < f->nb_streams; i++) {
         InputStream *ist = f->streamsi;
         DemuxStream  *ds = ds_from_ist(ist);
-        int64_t stream_ts_offset, pts, now, wc_elapsed, elapsed, lag, max_pts, limit_pts;
-
-        if (ds->discard) continue;
+        int64_t stream_ts_offset, pts, pts_diff;
+        if (ds->discard || ds->finished || ds->first_dts == AV_NOPTS_VALUE)
+            continue;
 
-        stream_ts_offset = FFMAX(ds->first_dts != AV_NOPTS_VALUE ? ds->first_dts : 0, file_start);
+        stream_ts_offset = FFMAX(ds->first_dts, file_start);
         pts = av_rescale(ds->dts, 1000000, AV_TIME_BASE);
-        now = av_gettime_relative();
-        wc_elapsed = now - d->wallclock_start;
-
-        if (pts <= stream_ts_offset + initial_burst) continue;
-
-        max_pts = stream_ts_offset + initial_burst + (int64_t)(wc_elapsed * d->readrate);
-        lag = FFMAX(max_pts - pts, 0);
-        if ( (!ds->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > ds->lag + 0.3 * AV_TIME_BASE) ) {
-            ds->lag = lag;
-            ds->resume_wc = now;
-            ds->resume_pts = pts;
-            av_log_once(ds, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn,
-                        "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n",
-                        (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE);
-        }
-        if (ds->lag && !lag)
-            ds->lag = ds->resume_wc = ds->resume_pts = 0;
-        if (ds->resume_wc) {
-            elapsed = now - ds->resume_wc;
-            limit_pts = ds->resume_pts + (int64_t)(elapsed * d->readrate_catchup);
-        } else {
-            elapsed = wc_elapsed;
-            limit_pts = max_pts;
+        pts_diff = pts - stream_ts_offset;
+        if (pts_diff < progress) {
+            progress = pts_diff;
+            slowest = ds;
         }
+    }
 
-        if (pts > limit_pts)
-            av_usleep(pts - limit_pts);
+    if (!slowest || progress <= initial_burst)
+        return;
+
+    int64_t now = av_gettime_relative();
+    int64_t wc_elapsed = now - d->wallclock_start;
+    int64_t max_prog = initial_burst + (int64_t)(wc_elapsed * d->readrate);
+    int64_t lag = FFMAX(max_prog - progress, 0);
+    int64_t limit;
+
+    if ( (!d->lag && lag > 0.3 * AV_TIME_BASE) || ( lag > d->lag + 0.3 * AV_TIME_BASE) ) {
+        d->lag = lag;
+        d->resume_wc = now;
+        d->resume_progress = progress;
+
+        int64_t pts = FFMAX(slowest->first_dts, file_start) + progress;
+        av_log_once(slowest, AV_LOG_WARNING, AV_LOG_DEBUG, &resume_warn,
+                    "Resumed reading at pts %0.3f with rate %0.3f after a lag of %0.3fs\n",
+                    (float)pts/AV_TIME_BASE, d->readrate_catchup, (float)lag/AV_TIME_BASE);
+    }
+    if (d->lag && !lag)
+        d->lag = d->resume_wc = d->resume_progress = 0;
+    if (d->resume_wc) {
+        int64_t elapsed = now - d->resume_wc;
+        limit = d->resume_progress + (int64_t)(elapsed * d->readrate_catchup);
+    } else {
+        limit = max_prog;
     }
+
+    if (progress > limit)
+        av_usleep(progress - limit);
 }
 
 static int do_send(Demuxer *d, DemuxStream *ds, AVPacket *pkt, unsigned flags,
@@ -1916,6 +1929,11 @@
         }
     }
 
+    if (recording_time != INT64_MAX && recording_time < 0) {
+        av_log(d, AV_LOG_ERROR, "-t value must be non-negative; aborting.\n");
+        return AVERROR(EINVAL);
+    }
+
     if (o->format) {
         if (!(file_iformat = av_find_input_format(o->format))) {
             av_log(d, AV_LOG_FATAL, "Unknown input format: '%s'\n", o->format);

ffmpeg-8.1.2.tar.xz/fftools/ffmpeg_mux_init.c -> ffmpeg-8.1.3.tar.xz/fftools/ffmpeg_mux_init.c Changed

@@ -1203,7 +1203,7 @@
     int threads_manual = 0;
     AVRational enc_tb = { 0, 0 };
     enum VideoSyncMethod vsync_method = VSYNC_AUTO;
-    const char *bsfs = NULL, *time_base = NULL, *codec_tag = NULL;
+    const char *bsfs = NULL, *time_base = NULL, *codec_tag = NULL, *manual_disp = NULL;
     char  *next;
     double qscale = -1;
 
@@ -1260,6 +1260,20 @@
     ms->par_in->codec_type   = type;
     st->codecpar->codec_type = type;
 
+    if (ost->type == AVMEDIA_TYPE_VIDEO) {
+        if (ost->ist)
+            ost->st->disposition = ost->ist->st->disposition;
+
+        opt_match_per_stream_str(ost, &o->disposition, oc, st, &manual_disp);
+        if (manual_disp) {
+            ret = av_opt_set(ost->st, "disposition", manual_disp, 0);
+            if (ret < 0)
+                return ret;
+        }
+
+        ost->st->disposition &= AV_DISPOSITION_ATTACHED_PIC;
+    }
+
     ret = choose_encoder(o, oc, ms, &enc);
     if (ret < 0) {
         av_log(ost, AV_LOG_FATAL, "Error selecting an encoder\n");
@@ -3104,6 +3118,11 @@
     if (!dispositions)
         return AVERROR(ENOMEM);
 
+    // reset any apic flag set for option stream-spec matching in ost_add
+    for (int i = 0; i < ctx->nb_streams; i++) {
+        of->streamsi->st->disposition = 0;
+    }
+
     // first, copy the input dispositions
     for (int i = 0; i < ctx->nb_streams; i++) {
         OutputStream *ost = of->streamsi;
@@ -3358,6 +3377,11 @@
         }
     }
 
+    if (recording_time != INT64_MAX && recording_time < 0) {
+        av_log(mux, AV_LOG_ERROR, "-t value must be non-negative; aborting.\n");
+        return AVERROR(EINVAL);
+    }
+
     of->recording_time = recording_time;
     of->start_time     = o->start_time;

ffmpeg-8.1.2.tar.xz/fftools/opt_common.c -> ffmpeg-8.1.3.tar.xz/fftools/opt_common.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/adxdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/adxdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/apac.c -> ffmpeg-8.1.3.tar.xz/libavcodec/apac.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/atsc_a53.c -> ffmpeg-8.1.3.tar.xz/libavcodec/atsc_a53.c Changed

@@ -19,9 +19,9 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "libavutil/intreadwrite.h"
 #include "libavutil/mem.h"
 #include "atsc_a53.h"
-#include "get_bits.h"
 
 int ff_alloc_a53_sei(const AVFrame *frame, size_t prefix_len,
                      void **data, size_t *sei_size)
@@ -69,33 +69,25 @@
 int ff_parse_a53_cc(AVBufferRef **pbuf, const uint8_t *data, int size)
 {
     AVBufferRef *buf = *pbuf;
-    GetBitContext gb;
     size_t new_size, old_size = buf ? buf->size : 0;
     int ret, cc_count;
 
     if (size < 3)
         return AVERROR_INVALIDDATA;
 
-    ret = init_get_bits8(&gb, data, size);
-    if (ret < 0)
-        return ret;
-
-    if (get_bits(&gb, 8) != 0x3) // user_data_type_code
+    if (data0 != 0x3) // user_data_type_code
         return 0;
 
-    skip_bits(&gb, 1); // reserved
-    if (!get_bits(&gb, 1)) // process_cc_data_flag
+    if (!(data1 & 0x40)) // process_cc_data_flag
         return 0;
 
-    skip_bits(&gb, 1); // zero bit
-    cc_count = get_bits(&gb, 5);
+    cc_count = data1 & 0x1F;
     if (!cc_count)
         return 0;
 
-    skip_bits(&gb, 8); // reserved
-
+    // content of data2 is reserved
     /* 3 bytes per CC plus one byte marker_bits at the end */
-    if (cc_count * 3 >= (get_bits_left(&gb) >> 3))
+    if (cc_count * 3 >= size - 3)
         return AVERROR_INVALIDDATA;
 
     new_size = (old_size + cc_count * 3);
@@ -110,11 +102,7 @@
 
     buf = *pbuf;
     /* Use of av_buffer_realloc assumes buffer is writeable */
-    for (int i = 0; i < cc_count; i++) {
-        buf->dataold_size++ = get_bits(&gb, 8);
-        buf->dataold_size++ = get_bits(&gb, 8);
-        buf->dataold_size++ = get_bits(&gb, 8);
-    }
+    memcpy(buf->data + old_size, data + 3, cc_count * 3);
 
     return cc_count;
 }

ffmpeg-8.1.2.tar.xz/libavcodec/audiotoolboxdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/audiotoolboxdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/audiotoolboxenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/audiotoolboxenc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/bmp.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bmp.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/bsf/dca_core.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bsf/dca_core.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/bsf/dovi_rpu.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bsf/dovi_rpu.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/bsf/dts2pts.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bsf/dts2pts.c Changed

@@ -40,11 +40,18 @@
 #include "hevc/ps.h"
 #include "libavutil/refstruct.h"
 
+// Damaged frames leave their up to 2 timestamp nodes behind unconsumed.
+// This many damaged frames are tolerated before the oldest leftovers are
+// evicted; no timestamp of a valid frame is lost below this.
+#define MAX_DAMAGED_FRAMES 32
+
 typedef struct DTS2PTSNode {
     int64_t      dts;
     int64_t duration;
     int          poc;
     int          gop;
+    int64_t   serial; // insertion order, evicting the stalest node first
+    struct DTS2PTSNode *next; // valid only during same-gop re-keying
 } DTS2PTSNode;
 
 typedef struct DTS2PTSFrame {
@@ -88,6 +95,9 @@
         DTS2PTSHEVCContext hevc;
     } u;
 
+    int nb_nodes;
+    int nb_pending;
+    int64_t serial;
     int nb_frame;
     int gop;
     int eof;
@@ -127,11 +137,21 @@
     return 0;
 }
 
+static int find_stalest(void *opaque, void *elem)
+{
+    DTS2PTSNode **stalest = opaque;
+    DTS2PTSNode *node = elem;
+    if (!*stalest || node->serial < (*stalest)->serial)
+        *stalest = node;
+    return 0;
+}
+
 // Shared functions
 static int alloc_and_insert_node(AVBSFContext *ctx, int64_t ts, int64_t duration,
                                  int poc, int poc_diff, int gop)
 {
     DTS2PTSContext *s = ctx->priv_data;
+
     for (int i = 0; i < poc_diff; i++) {
         struct AVTreeNode *node = av_tree_node_alloc();
         DTS2PTSNode *poc_node, *ret;
@@ -144,13 +164,14 @@
         }
         if (i && ts != AV_NOPTS_VALUE)
             ts += duration / poc_diff;
-        *poc_node = (DTS2PTSNode) { ts, duration, poc++, gop };
+        *poc_node = (DTS2PTSNode) { ts, duration, poc++, gop, s->serial++ };
         ret = av_tree_insert(&s->root, poc_node, cmp_insert, &node);
         if (ret && ret != poc_node) {
             *ret = *poc_node;
             av_refstruct_unref(&poc_node);
             av_free(node);
-        }
+        } else
+            s->nb_nodes++;
     }
     return 0;
 }
@@ -228,6 +249,7 @@
     frame = (DTS2PTSFrame) { pkt, poc, poc_diff, s->gop };
     ret = av_fifo_write(s->fifo, &frame, 1);
     av_assert2(ret >= 0);
+    s->nb_pending += poc_diff;
     *queued = 1;
 
     return 0;
@@ -414,9 +436,7 @@
 
 typedef struct DTS2PTSCollect {
     int gop;
-    DTS2PTSNode **out;
-    int count;
-    int max;
+    DTS2PTSNode *head, *tail;
 } DTS2PTSCollect;
 
 static int collect_same_gop(void *opaque, void *elem)
@@ -424,9 +444,12 @@
     DTS2PTSCollect *c = opaque;
     DTS2PTSNode *node = elem;
     if (node->gop == c->gop) {
-        if (c->count < c->max)
-            c->outc->count = node;
-        c->count++;
+        if (c->tail)
+            c->tail->next = node;
+        else
+            c->head = node;
+        c->tail = node;
+        node->next = NULL;
     }
     return 0;
 }
@@ -453,23 +476,28 @@
 
     if (poc < s->nb_frame && hevc->gop == s->gop) {
         int dec = s->nb_frame - poc;
-        DTS2PTSNode *nodesHEVC_MAX_DPB_SIZE * 2;
-        DTS2PTSCollect c = { s->gop, nodes, 0, FF_ARRAY_ELEMS(nodes) };
+        DTS2PTSCollect c = { s->gop, NULL, NULL };
 
         s->nb_frame -= dec;
 
+        // Crafted streams can exceed any DPB-based estimate of the node count,
+        // so chain the matching nodes through their next pointers instead of
+        // collecting them into a fixed size array. The chain is in ascending
+        // poc order; processing it in this order keeps the new keys collision
+        // free as any potential collision partner is re-keyed first.
         av_tree_enumerate(s->root, &c, NULL, collect_same_gop);
-        av_assert0(c.count <= c.max);
-        for (int i = 0; i < c.count; i++) {
+        while (c.head) {
             struct AVTreeNode *tnode = NULL;
-            DTS2PTSNode *r;
-            av_tree_insert(&s->root, nodesi, cmp_insert, &tnode);
-            nodesi->poc -= dec;
-            r = av_tree_insert(&s->root, nodesi, cmp_insert, &tnode);
-            if (r && r != nodesi) {
-                *r = *nodesi;
-                av_refstruct_unref(&nodesi);
+            DTS2PTSNode *node = c.head, *r;
+            c.head = node->next;
+            av_tree_insert(&s->root, node, cmp_insert, &tnode);
+            node->poc -= dec;
+            r = av_tree_insert(&s->root, node, cmp_insert, &tnode);
+            if (r && r != node) {
+                *r = *node;
+                av_refstruct_unref(&node);
                 av_free(tnode);
+                s->nb_nodes--;
             }
         }
     }
@@ -491,6 +519,7 @@
     ret = av_fifo_write(s->fifo, &frame, 1);
     if (ret < 0)
         return ret;
+    s->nb_pending += frame.poc_diff;
 
     *queued = true;
 
@@ -658,6 +687,7 @@
     // Fetch a packet from the FIFO
     ret = av_fifo_read(s->fifo, &frame, 1);
     av_assert2(ret >= 0);
+    s->nb_pending -= frame.poc_diff;
     av_packet_move_ref(out, frame.pkt);
     av_packet_free(&frame.pkt);
 
@@ -673,13 +703,18 @@
         if (!s->eof) {
             // Remove the found entry from the tree
             DTS2PTSFrame dup = (DTS2PTSFrame) { NULL, frame.poc + 1, frame.poc_diff, frame.gop };
+            int64_t dts = out->pts;
             for (; dup.poc_diff > 0; dup.poc++, dup.poc_diff--) {
                 struct AVTreeNode *node = NULL;
-                if (!poc_node || poc_node->dts != out->pts)
+                if (!poc_node || poc_node->dts != dts)
                     continue;
+                // 2nd field nodes were inserted with this offset added
+                if (dts != AV_NOPTS_VALUE)
+                    dts += poc_node->duration / frame.poc_diff;
                 av_tree_insert(&s->root, poc_node, cmp_insert, &node);
                 av_refstruct_unref(&poc_node);
                 av_free(node);
+                s->nb_nodes--;
                 poc_node = av_tree_find(s->root, &dup, cmp_find, NULL);
             }
         }
@@ -704,6 +739,24 @@
             av_log(ctx, AV_LOG_WARNING, "No timestamp for POC %d in tree\n", frame.poc);
     } else
         av_log(ctx, AV_LOG_WARNING, "No timestamp for POC %d in tree\n", frame.poc);
+
+    // The pending packets consume nb_pending nodes; frames whose lookup above
+    // missed leave nodes behind which nothing consumes anymore. Keep the
+    // leftovers of up to MAX_DAMAGED_FRAMES frames, then evict the nodes
+    // unconsumed the longest.
+    // At EOF nodes are deliberately kept to regenerate timestamps from.
+    while (!s->eof && s->nb_nodes > s->nb_pending + 2 * MAX_DAMAGED_FRAMES) {
+        DTS2PTSNode *stale = NULL;
+        struct AVTreeNode *tnode = NULL;
+        av_tree_enumerate(s->root, &stale, NULL, find_stalest);
+        av_log(ctx, AV_LOG_WARNING, "Evicting unconsumed POC %d, GOP %d\n",
+               stale->poc, stale->gop);
+        av_tree_insert(&s->root, stale, cmp_insert, &tnode);
+        av_refstruct_unref(&stale);
+        av_free(tnode);
+        s->nb_nodes--;
+    }

ffmpeg-8.1.2.tar.xz/libavcodec/bsf/eac3_core.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bsf/eac3_core.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/bsf/truehd_core.c -> ffmpeg-8.1.3.tar.xz/libavcodec/bsf/truehd_core.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cavsdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cavsdec.c Changed

@@ -1268,10 +1268,11 @@
                 av_log(h->avctx, AV_LOG_WARNING, "no frame decoded\n");
             return FFMAX(0, buf_ptr - buf);
         }
-        input_size = (buf_end - buf_ptr) * 8;
+        input_size = buf_end - buf_ptr;
+        if ((ret = init_get_bits8(&h->gb, buf_ptr, input_size)) < 0)
+            return ret;
         switch (stc) {
         case CAVS_START_CODE:
-            init_get_bits(&h->gb, buf_ptr, input_size);
             decode_seq_header(h);
             break;
         case PIC_I_START_CODE:
@@ -1289,7 +1290,6 @@
             *got_frame = 0;
             if (!h->got_keyframe)
                 break;
-            init_get_bits(&h->gb, buf_ptr, input_size);
             h->stc = stc;
             if (decode_pic(h))
                 break;
@@ -1313,7 +1313,6 @@
             break;
         default:
             if (stc <= SLICE_MAX_START_CODE) {
-                init_get_bits(&h->gb, buf_ptr, input_size);
                 decode_slice_header(h, &h->gb);
             }
             break;

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_av1_syntax_template.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_av1_syntax_template.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_h265.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_h265.c Changed

@@ -142,7 +142,7 @@
                                         AV_INPUT_BUFFER_PADDING_SIZE); \
         if (!name ## _ref) \
             return AVERROR(ENOMEM); \
-        name = name ## _ref->data; \
+        name = (void *)name ## _ref->data; \
     } while (0)
 
 #define FUNC(name) FUNC_H265(name)
@@ -715,7 +715,18 @@
 }
 
 static CodedBitstreamUnitTypeDescriptor cbs_h265_unit_types = {
-    CBS_UNIT_TYPE_INTERNAL_REF(HEVC_NAL_VPS, H265RawVPS, extension_data.data),
+    {
+        .nb_unit_types     = 1,
+        .unit_type.list    = { HEVC_NAL_VPS },
+        .content_type      = CBS_CONTENT_TYPE_INTERNAL_REFS,
+        .content_size      = sizeof(H265RawVPS),
+        .type.ref          = {
+            .nb_offsets = 2,
+            .offsets    = { offsetof(H265RawVPS, extension_data.data),
+                            offsetof(H265RawVPS, hrd_parameters) }
+        },
+    },
+
     CBS_UNIT_TYPE_INTERNAL_REF(HEVC_NAL_SPS, H265RawSPS, extension_data.data),
     CBS_UNIT_TYPE_INTERNAL_REF(HEVC_NAL_PPS, H265RawPPS, extension_data.data),

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_h265.h -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_h265.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_h265_syntax_template.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_h265_syntax_template.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_h266.h -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_h266.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cbs_h266_syntax_template.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cbs_h266_syntax_template.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cfhd.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cfhd.c Changed

@@ -227,10 +227,11 @@
             s->planei.l_hj = NULL;
 
         for (int j = 0; j < DWT_LEVELS_3D; j++)
-            p->bandj0.read_ok =
-            p->bandj1.read_ok =
-            p->bandj2.read_ok =
-            p->bandj3.read_ok = 0;
+            for (unsigned k = 0; k < FF_ARRAY_ELEMS(p->bandj); k++) {
+                p->bandjk.a_width  = 0;
+                p->bandjk.a_height = 0;
+                p->bandjk.read_ok  = 0;
+            }
     }
     s->a_height = 0;
     s->a_width  = 0;
@@ -433,11 +434,6 @@
         } else if (tag == ChannelNumber) {
             s->channel_num = data;
             av_log(avctx, AV_LOG_DEBUG, "Channel number %"PRIu16"\n", data);
-            if (s->channel_num >= s->planes) {
-                av_log(avctx, AV_LOG_ERROR, "Invalid channel number\n");
-                ret = AVERROR(EINVAL);
-                goto end;
-            }
             init_plane_defaults(s);
         } else if (tag == SubbandNumber) {
             if (s->subband_num != 0 && data == 1 && (s->transform_type == 0 || s->transform_type == 2))  // hack
@@ -631,6 +627,18 @@
         } else
             av_log(avctx, AV_LOG_DEBUG,  "Unknown tag %i data %x\n", tag, data);
 
+        if (s->channel_num >= s->planes) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid channel number\n");
+            ret = AVERROR(EINVAL);
+            goto end;
+        }
+
+        if (got_buffer && (s->coded_width || s->coded_height || s->coded_format != AV_PIX_FMT_NONE)) {
+            av_log(avctx, AV_LOG_ERROR, "Header tag after end of header\n");
+            ret = AVERROR(EINVAL);
+            goto end;
+        }
+
         if (tag == BitstreamMarker && data == CoefficientSegment &&
             s->coded_format != AV_PIX_FMT_NONE) {
             int lowpass_height = s->planes->channel_num.band00.height;
@@ -918,8 +926,7 @@
     ff_thread_finish_setup(avctx);
 
     if (!s->a_width || !s->a_height || s->a_format == AV_PIX_FMT_NONE ||
-        s->a_transform_type == INT_MIN ||
-        s->coded_width || s->coded_height || s->coded_format != AV_PIX_FMT_NONE) {
+        s->a_transform_type == INT_MIN) {
         av_log(avctx, AV_LOG_ERROR, "Invalid dimensions\n");
         ret = AVERROR(EINVAL);
         goto end;
@@ -1224,7 +1231,7 @@
 
             if (lowpass_height > s->planeplane.band41.a_height || lowpass_width > s->planeplane.band41.a_width ||
                 !highpass_stride || s->planeplane.band41.width > s->planeplane.band41.a_width ||
-                lowpass_width < 3 || lowpass_height < 3) {
+                lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->planeplane.width) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
                 ret = AVERROR(EINVAL);
                 goto end;
@@ -1345,7 +1352,7 @@
 
             if (lowpass_height > s->planeplane.band41.a_height || lowpass_width > s->planeplane.band41.a_width ||
                 s->planeplane.band41.width > s->planeplane.band41.a_width ||
-                lowpass_width < 3 || lowpass_height < 3) {
+                lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 > s->planeplane.width) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
                 ret = AVERROR(EINVAL);
                 goto end;

ffmpeg-8.1.2.tar.xz/libavcodec/codec_internal.h -> ffmpeg-8.1.3.tar.xz/libavcodec/codec_internal.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/cook.c -> ffmpeg-8.1.3.tar.xz/libavcodec/cook.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_av1.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_av1.c Changed

@@ -33,6 +33,7 @@
 typedef struct D3D12AV1DecodeContext {
     D3D12VADecodeContext ctx;
     uint8_t *bitstream_buffer;
+    size_t bitstream_size;
 } D3D12AV1DecodeContext;
 
 #define D3D12_AV1_DECODE_CONTEXT(avctx) ((D3D12AV1DecodeContext *)D3D12VA_DECODE_CONTEXT(avctx))
@@ -77,6 +78,7 @@
     const AV1DecContext     *h            = avctx->priv_data;
     const AV1RawFrameHeader *frame_header = h->raw_frame_header;
     AV1DecodePictureContext *ctx_pic      = h->cur_frame.hwaccel_picture_private;
+    D3D12AV1DecodeContext   *av1_ctx      = D3D12_AV1_DECODE_CONTEXT(avctx);
     int offset = 0;
     uint32_t tg_start, tg_end;
 
@@ -91,7 +93,11 @@
         ctx_pic->bitstream      = (uint8_t *)buffer;
         ctx_pic->bitstream_size = size;
     } else {
-        ctx_pic->bitstream = D3D12_AV1_DECODE_CONTEXT(avctx)->bitstream_buffer;
+        if (ctx_pic->bitstream_size + (uint64_t)size > av1_ctx->bitstream_size) {
+            av_log(avctx, AV_LOG_ERROR, "Slice bitstream size exceeds internal buffer!\n");
+            return AVERROR(EINVAL);
+        }
+        ctx_pic->bitstream = av1_ctx->bitstream_buffer;
         memcpy(ctx_pic->bitstream + ctx_pic->bitstream_size, buffer, size);
         tg_start = h->tg_start;
         tg_end   = h->tg_end;
@@ -112,6 +118,7 @@
 
 static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer)
 {
+    D3D12VADecodeContext    *ctx          = D3D12VA_DECODE_CONTEXT(avctx);
     const AV1DecContext     *h            = avctx->priv_data;
     AV1DecodePictureContext *ctx_pic      = h->cur_frame.hwaccel_picture_private;
     void *mapped_data;
@@ -121,6 +128,11 @@
     args->Size  = sizeof(DXVA_Tile_AV1) * ctx_pic->tile_count;
     args->pData = ctx_pic->tiles;
 
+    if (ctx_pic->bitstream_size > ctx->bitstream_size) {
+        av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n");
+        return AVERROR(EINVAL);
+    }
+
     input_args->CompressedBitstream = (D3D12_VIDEO_DECODE_COMPRESSED_BITSTREAM){
         .pBuffer = buffer,
         .Offset  = 0,
@@ -174,7 +186,8 @@
         return ret;
 
     if (!av1_ctx->bitstream_buffer) {
-        av1_ctx->bitstream_buffer = av_malloc(ff_d3d12va_get_suitable_max_bitstream_size(avctx));
+        av1_ctx->bitstream_size = ff_d3d12va_get_suitable_max_bitstream_size(avctx);
+        av1_ctx->bitstream_buffer = av_malloc(av1_ctx->bitstream_size);
         if (!av1_ctx->bitstream_buffer)
             return AVERROR(ENOMEM);
     }
@@ -188,6 +201,7 @@
 
     if (ctx->bitstream_buffer)
         av_freep(&ctx->bitstream_buffer);
+    ctx->bitstream_size = 0;
 
     return ff_d3d12va_decode_uninit(avctx);
 }

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_h264.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_h264.c Changed

@@ -105,6 +105,7 @@
 #define START_CODE_SIZE 3
 static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer)
 {
+    D3D12VADecodeContext     *ctx             = D3D12VA_DECODE_CONTEXT(avctx);
     const H264Context        *h               = avctx->priv_data;
     const H264Picture        *current_picture = h->cur_pic_ptr;
     H264DecodePictureContext *ctx_pic         = current_picture->hwaccel_picture_private;
@@ -113,6 +114,7 @@
     uint8_t *mapped_data, *mapped_ptr;
     DXVA_Slice_H264_Short *slice;
     D3D12_VIDEO_DECODE_FRAME_ARGUMENT *args;
+    UINT bitstream_size = ctx->bitstream_size;
 
     if (FAILED(ID3D12Resource_Map(buffer, 0, NULL, (void **)&mapped_data))) {
         av_log(avctx, AV_LOG_ERROR, "Failed to map D3D12 Buffer resource!\n");
@@ -127,14 +129,22 @@
         position = slice->BSNALunitDataLocation;
         size     = slice->SliceBytesInBuffer;
 
+        if (START_CODE_SIZE + (uint64_t)size > bitstream_size) {
+            av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n");
+            ID3D12Resource_Unmap(buffer, 0, NULL);
+            return AVERROR(EINVAL);
+        }
+
         slice->SliceBytesInBuffer += START_CODE_SIZE;
         slice->BSNALunitDataLocation = mapped_ptr - mapped_data;
 
         *(uint32_t *)mapped_ptr = START_CODE;
         mapped_ptr += START_CODE_SIZE;
+        bitstream_size -= START_CODE_SIZE;
 
         memcpy(mapped_ptr, &ctx_pic->bitstreamposition, size);
         mapped_ptr += size;
+        bitstream_size -= size;
     }
 
     ID3D12Resource_Unmap(buffer, 0, NULL);

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_hevc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_hevc.c Changed

@@ -101,6 +101,7 @@
 #define START_CODE_SIZE 3
 static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer)
 {
+    D3D12VADecodeContext     *ctx             = D3D12VA_DECODE_CONTEXT(avctx);
     const HEVCContext        *h               = avctx->priv_data;
     const HEVCFrame          *current_picture = h->cur_frame;
     HEVCDecodePictureContext *ctx_pic         = current_picture->hwaccel_picture_private;
@@ -109,6 +110,7 @@
     uint8_t *mapped_data, *mapped_ptr;
     DXVA_Slice_HEVC_Short *slice;
     D3D12_VIDEO_DECODE_FRAME_ARGUMENT *args;
+    UINT bitstream_size = ctx->bitstream_size;
 
     if (FAILED(ID3D12Resource_Map(buffer, 0, NULL, (void **)&mapped_data))) {
         av_log(avctx, AV_LOG_ERROR, "Failed to map D3D12 Buffer resource!\n");
@@ -123,14 +125,22 @@
         position = slice->BSNALunitDataLocation;
         size = slice->SliceBytesInBuffer;
 
+        if (START_CODE_SIZE + (uint64_t)size > bitstream_size) {
+            av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n");
+            ID3D12Resource_Unmap(buffer, 0, NULL);
+            return AVERROR(EINVAL);
+        }
+
         slice->SliceBytesInBuffer += START_CODE_SIZE;
         slice->BSNALunitDataLocation = mapped_ptr - mapped_data;
 
         *(uint32_t *)mapped_ptr = START_CODE;
         mapped_ptr += START_CODE_SIZE;
+        bitstream_size -= START_CODE_SIZE;
 
         memcpy(mapped_ptr, &ctx_pic->bitstreamposition, size);
         mapped_ptr += size;
+        bitstream_size -= size;
     }
 
     ID3D12Resource_Unmap(buffer, 0, NULL);

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_mpeg2.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_mpeg2.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_vc1.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_vc1.c Changed

@@ -94,6 +94,7 @@
 
 static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer)
 {
+    D3D12VADecodeContext      *ctx          = D3D12VA_DECODE_CONTEXT(avctx);
     const VC1Context *v                     = avctx->priv_data;
     const MpegEncContext      *s            = &v->s;
     D3D12DecodePictureContext *ctx_pic      = s->cur_pic.ptr->hwaccel_picture_private;
@@ -101,6 +102,7 @@
 
     const unsigned mb_count = s->mb_width * (s->mb_height >> v->field_mode);
     uint8_t *mapped_data, *mapped_ptr;
+    UINT bitstream_size = ctx->bitstream_size;
 
     static const uint8_t start_code = { 0, 0, 1, 0x0d };
 
@@ -115,6 +117,12 @@
         unsigned position     = slice->dwSliceDataLocation;
         unsigned size         = slice->dwSliceBitsInBuffer / 8;
 
+        if ((uint64_t)size + ((avctx->codec_id == AV_CODEC_ID_VC1) ? sizeof(start_code) : 0) > bitstream_size) {
+            av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n");
+            ID3D12Resource_Unmap(buffer, 0, NULL);
+            return AVERROR(EINVAL);
+        }
+
         slice->dwSliceDataLocation = mapped_ptr - mapped_data;
         if (i < ctx_pic->slice_count - 1)
             slice->wNumberMBsInSlice = slice1.wNumberMBsInSlice - slice0.wNumberMBsInSlice;
@@ -129,11 +137,13 @@
                 mapped_ptr3 = 0x0b;
 
             mapped_ptr += sizeof(start_code);
+            bitstream_size -= sizeof(start_code);
             slice->dwSliceBitsInBuffer += sizeof(start_code) * 8;
         }
 
         memcpy(mapped_ptr, &ctx_pic->bitstreamposition, size);
         mapped_ptr += size;
+        bitstream_size -= size;
     }
 
     ID3D12Resource_Unmap(buffer, 0, NULL);

ffmpeg-8.1.2.tar.xz/libavcodec/d3d12va_vp9.c -> ffmpeg-8.1.3.tar.xz/libavcodec/d3d12va_vp9.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/decode.c -> ffmpeg-8.1.3.tar.xz/libavcodec/decode.c Changed

@@ -369,12 +369,18 @@
                 int64_t diff_ts = av_rescale_q(avci->skip_samples,
                                                (AVRational){1, avctx->sample_rate},
                                                avctx->pkt_timebase);
-                if (frame->pts != AV_NOPTS_VALUE)
-                    frame->pts += diff_ts;
-                if (frame->pkt_dts != AV_NOPTS_VALUE)
-                    frame->pkt_dts += diff_ts;
-                if (frame->duration >= diff_ts)
-                    frame->duration -= diff_ts;
+                if (diff_ts != AV_NOPTS_VALUE) {
+                    if (frame->pts != AV_NOPTS_VALUE)
+                        frame->pts = av_sat_add64(frame->pts, diff_ts);
+                    if (frame->pkt_dts != AV_NOPTS_VALUE)
+                        frame->pkt_dts = av_sat_add64(frame->pkt_dts, diff_ts);
+                    if (frame->duration >= diff_ts)
+                        frame->duration = av_sat_sub64(frame->duration, diff_ts);
+                } else {
+                    frame->pts = AV_NOPTS_VALUE;
+                    frame->pkt_dts = AV_NOPTS_VALUE;
+                    frame->duration = 0;
+                }
             } else
                 av_log(avctx, AV_LOG_WARNING, "Could not update timestamps for skipped samples.\n");
 
@@ -395,7 +401,7 @@
                 int64_t diff_ts = av_rescale_q(frame->nb_samples - discard_padding,
                                                (AVRational){1, avctx->sample_rate},
                                                avctx->pkt_timebase);
-                frame->duration = diff_ts;
+                frame->duration = diff_ts == AV_NOPTS_VALUE ? 0 : diff_ts;
             } else
                 av_log(avctx, AV_LOG_WARNING, "Could not update timestamps for discarded samples.\n");

ffmpeg-8.1.2.tar.xz/libavcodec/dolby_e.c -> ffmpeg-8.1.3.tar.xz/libavcodec/dolby_e.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/dovi_rpudec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/dovi_rpudec.c Changed

@@ -405,6 +405,9 @@
         VALIDATE(rpu0, 25, 25); /* NAL prefix */
         rpu++;
         rpu_size--;
+        /* Strip trailing padding zero bytes */
+        while (rpu_size && !rpurpu_size - 1)
+            rpu_size--;
     }
 
     if ((ret = init_get_bits8(gb, rpu, rpu_size)) < 0)
@@ -582,6 +585,8 @@
 
         mapping->num_x_partitions = get_ue_golomb_long(gb) + 1;
         mapping->num_y_partitions = get_ue_golomb_long(gb) + 1;
+        VALIDATE(mapping->num_x_partitions, 1, 0xFFFF);
+        VALIDATE(mapping->num_y_partitions, 1, 0xFFFF);
         /* End of rpu_data_header(), start of vdr_rpu_data_payload() */
 
         for (int c = 0; c < 3; c++) {
@@ -708,7 +713,8 @@
             return ret;
         }
 
-        if (get_bits_left(gb) > 48 /* padding + CRC32 + terminator */) {
+        /* ue(1) + ue(0) + level + CRC32 + terminator */
+        if (get_bits_left(gb) >= 3 + 1 + 8 + 32 + 8) {
             if ((ret = parse_ext_blocks(s, gb, 2, dm_compression, err_recognition)) < 0) {
                 ff_dovi_ctx_unref(s);
                 return ret;

ffmpeg-8.1.2.tar.xz/libavcodec/dovi_rpuenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/dovi_rpuenc.c Changed

@@ -367,6 +367,87 @@
     }
 }
 
+static int validate_ue_golomb_value(uint64_t value)
+{
+    return value <= 0xFFFE;
+}
+
+static int validate_se_golomb_value(int64_t value)
+{
+    return value >= -0x7FFF && value <= 0x7FFF;
+}
+
+static int validate_ue_coef(const AVDOVIRpuDataHeader *hdr, uint64_t coef)
+{
+    if (hdr->coef_log2_denom >= 63)
+        return 0;
+    return validate_ue_golomb_value(coef >> hdr->coef_log2_denom);
+}
+
+static int validate_se_coef(const AVDOVIRpuDataHeader *hdr, int64_t coef)
+{
+    if (hdr->coef_log2_denom >= 63)
+        return 0;
+    return validate_se_golomb_value(coef >> hdr->coef_log2_denom);
+}
+
+static int validate_mapping_for_generation(const AVDOVIRpuDataHeader *hdr,
+                                           const AVDOVIDataMapping *mapping)
+{
+    if (!mapping->num_x_partitions || mapping->num_x_partitions > 0xFFFF ||
+        !mapping->num_y_partitions || mapping->num_y_partitions > 0xFFFF)
+        return 0;
+
+    for (int c = 0; c < 3; c++) {
+        const AVDOVIReshapingCurve *curve = &mapping->curvesc;
+
+        if (curve->num_pivots < 2 || curve->num_pivots > AV_DOVI_MAX_PIECES + 1)
+            return 0;
+
+        for (int i = 1; i < curve->num_pivots; i++)
+            if (curve->pivotsi < curve->pivotsi - 1)
+                return 0;
+
+        for (int i = 0; i < curve->num_pivots - 1; i++) {
+            switch (curve->mapping_idci) {
+            case AV_DOVI_MAPPING_POLYNOMIAL:
+                if (curve->poly_orderi < 1 || curve->poly_orderi > 2)
+                    return 0;
+                for (int k = 0; k <= curve->poly_orderi; k++)
+                    if (!validate_se_coef(hdr, curve->poly_coefik))
+                        return 0;
+                break;
+            case AV_DOVI_MAPPING_MMR:
+                if (curve->mmr_orderi < 1 || curve->mmr_orderi > 3)
+                    return 0;
+                if (!validate_se_coef(hdr, curve->mmr_constanti))
+                    return 0;
+                for (int j = 0; j < curve->mmr_orderi; j++)
+                    for (int k = 0; k < 7; k++)
+                        if (!validate_se_coef(hdr, curve->mmr_coefijk))
+                            return 0;
+                break;
+            default:
+                return 0;
+            }
+        }
+    }
+
+    if (mapping->nlq_method_idc != AV_DOVI_NLQ_NONE) {
+        if (mapping->nlq_method_idc != AV_DOVI_NLQ_LINEAR_DZ)
+            return 0;
+        for (int c = 0; c < 3; c++) {
+            const AVDOVINLQParams *nlq = &mapping->nlqc;
+            if (!validate_ue_coef(hdr, nlq->vdr_in_max) ||
+                !validate_ue_coef(hdr, nlq->linear_deadzone_slope) ||
+                !validate_ue_coef(hdr, nlq->linear_deadzone_threshold))
+                return 0;
+        }
+    }
+
+    return 1;
+}
+
 static int av_q2den(AVRational q, int den)
 {
     if (!q.den || q.den == den)
@@ -595,10 +676,19 @@
         return AVERROR_INVALIDDATA;
     }
 
+    if (!validate_mapping_for_generation(hdr, mapping)) {
+        av_log(s->logctx, AV_LOG_ERROR, "Coefficient out of range for RPU\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!(flags & FF_DOVI_COMPRESS_RPU))
         dv_md_compression = AV_DOVI_COMPRESSION_NONE;
 
     vdr_rpu_id = mapping->vdr_rpu_id;
+    if (vdr_rpu_id < 0 || vdr_rpu_id > DOVI_MAX_DM_ID) {
+        av_log(s->logctx, AV_LOG_ERROR, "Invalid VDR RPU id %d\n", vdr_rpu_id);
+        return AVERROR_INVALIDDATA;
+    }
     use_prev_vdr_rpu = 0;
 
     if (!s->vdrvdr_rpu_id) {
@@ -636,7 +726,7 @@
             return AVERROR(ENOMEM);
     }
 
-    vdr_dm_metadata_present = memcmp(color, &ff_dovi_color_default, sizeof(*color));
+    vdr_dm_metadata_present = !!memcmp(color, &ff_dovi_color_default, sizeof(*color));
     if (metadata->num_ext_blocks)
         vdr_dm_metadata_present = 1;

ffmpeg-8.1.2.tar.xz/libavcodec/dvbsub_parser.c -> ffmpeg-8.1.3.tar.xz/libavcodec/dvbsub_parser.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/dvdsubenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/dvdsubenc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/exr.c -> ffmpeg-8.1.3.tar.xz/libavcodec/exr.c Changed

@@ -267,7 +267,9 @@
 static int rle_uncompress(const EXRContext *ctx, const uint8_t *src, int compressed_size,
                           int uncompressed_size, EXRThreadData *td)
 {
-    rle(td->tmp, src, compressed_size, uncompressed_size);
+    int ret = rle(td->tmp, src, compressed_size, uncompressed_size);
+    if (ret < 0)
+        return ret;
 
     av_assert1(uncompressed_size % 2 == 0);
 
@@ -2265,6 +2267,16 @@
     if (bytestream2_get_bytes_left(gb)/8 < nb_blocks)
         return AVERROR_INVALIDDATA;
 
+    if (avctx->max_pixels) {
+        int64_t block_pixels = s->is_tile
+            ? (int64_t)FFMIN(s->tile_attr.xSize, s->xdelta) *
+                      FFMIN(s->tile_attr.ySize, s->ydelta)
+            : (int64_t)s->xdelta *
+                      FFMIN(s->scan_lines_per_block, s->ydelta);
+        if (nb_blocks > avctx->max_pixels / FFMAX(block_pixels, 1))
+            return AVERROR_INVALIDDATA;
+    }
+
     // check offset table and recreate it if need
     if (!s->is_tile && bytestream2_peek_le64(gb) == 0) {
         PutByteContext offset_table_writer;

ffmpeg-8.1.2.tar.xz/libavcodec/fflcms2.c -> ffmpeg-8.1.3.tar.xz/libavcodec/fflcms2.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/ffv1dec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/ffv1dec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/get_buffer.c -> ffmpeg-8.1.3.tar.xz/libavcodec/get_buffer.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/h264_direct.c -> ffmpeg-8.1.3.tar.xz/libavcodec/h264_direct.c Changed

@@ -184,20 +184,25 @@
 static void await_reference_mb_row(const H264Context *const h, H264Ref *ref,
                                    int mb_y)
 {
+    if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_FRAME))
+        return;
+
     int ref_field         = ref->reference - 1;
     int ref_field_picture = ref->parent->field_picture;
     int ref_height        = 16 * h->mb_height >> ref_field_picture;
-
-    if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_FRAME))
-        return;
+    int row               = FFMIN(16 * mb_y >> ref_field_picture, ref_height - 1);
 
     /* FIXME: It can be safe to access mb stuff
      * even if pixels aren't deblocked yet. */
 
-    ff_thread_await_progress(&ref->parent->tf,
-                             FFMIN(16 * mb_y >> ref_field_picture,
-                                   ref_height - 1),
+    ff_thread_await_progress(&ref->parent->tf, row,
                              ref_field_picture && ref_field);
+
+    /* A frame references a field pair as a whole, so the wait above covers
+     * its bottom field only, while the colocated data is read from the field
+     * selected by col_parity. The two are decoded by different threads. */
+    if (ref_field_picture && !FIELD_PICTURE(h))
+        ff_thread_await_progress(&ref->parent->tf, row, 0);
 }
 
 static void pred_spatial_direct_motion(const H264Context *const h, H264SliceContext *sl,
@@ -287,7 +292,8 @@
         return;
     }
 
-    if (IS_INTERLACED(sl->ref_list10.parent->mb_typemb_xy)) { // AFL/AFR/FR/FL -> AFL/FL
+    if (sl->ref_list10.parent->field_picture ||
+        IS_INTERLACED(sl->ref_list10.parent->mb_typemb_xy)) { // AFL/AFR/FR/FL -> AFL/FL
         if (!IS_INTERLACED(*mb_type)) {                    //     AFR/FR    -> AFL/FL
             mb_y  = (sl->mb_y & ~1) + sl->col_parity;
             mb_xy = sl->mb_x +
@@ -505,7 +511,8 @@
     await_reference_mb_row(h, &sl->ref_list10,
                            sl->mb_y + !!IS_INTERLACED(*mb_type));
 
-    if (IS_INTERLACED(sl->ref_list10.parent->mb_typemb_xy)) { // AFL/AFR/FR/FL -> AFL/FL
+    if (sl->ref_list10.parent->field_picture ||
+        IS_INTERLACED(sl->ref_list10.parent->mb_typemb_xy)) { // AFL/AFR/FR/FL -> AFL/FL
         if (!IS_INTERLACED(*mb_type)) {                    //     AFR/FR    -> AFL/FL
             mb_y  = (sl->mb_y & ~1) + sl->col_parity;
             mb_xy = sl->mb_x +

ffmpeg-8.1.2.tar.xz/libavcodec/h264_slice.c -> ffmpeg-8.1.3.tar.xz/libavcodec/h264_slice.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/hap.c -> ffmpeg-8.1.3.tar.xz/libavcodec/hap.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/hevc/hevcdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/hevc/hevcdec.c Changed

@@ -2934,7 +2934,7 @@
     int64_t startheader, cmpt = 0;
     int i, j, res = 0;
 
-    if (s->sh.slice_ctb_addr_rs + s->sh.num_entry_point_offsets * sps->ctb_width >= sps->ctb_width * sps->ctb_height) {
+    if (s->sh.slice_ctb_addr_rs + s->sh.num_entry_point_offsets * (int64_t)sps->ctb_width >= sps->ctb_width * (int64_t)sps->ctb_height) {
         av_log(s->avctx, AV_LOG_ERROR, "WPP ctb addresses are wrong (%d %d %d %d)\n",
             s->sh.slice_ctb_addr_rs, s->sh.num_entry_point_offsets,
             sps->ctb_width, sps->ctb_height
@@ -3543,6 +3543,11 @@
         (s->nuh_layer_id > 0 && !(s->layers_active_decode & (1 << layer_idx))))
         return 0;
 
+    // the first slice of this picture was skipped, so drop the remaining
+    // slices before parsing, the context is stale for them
+    if (s->skipping_frame && !show_bits1(gb))
+        return 0;
+
     ret = hls_slice_header(&s->sh, s, gb);
     // Once hls_slice_header has been called, the context is inconsistent with the slice header
     // until the context is reinitialized according to the contents of the new slice header
@@ -3557,8 +3562,12 @@
         (s->avctx->skip_frame >= AVDISCARD_NONKEY && !IS_IRAP(s)) ||
         ((s->nal_unit_type == HEVC_NAL_RASL_R || s->nal_unit_type == HEVC_NAL_RASL_N) &&
          s->no_rasl_output_flag)) {
+        if (s->sh.first_slice_in_pic_flag)
+            s->skipping_frame = 1;
         return 0;
     }
+    if (s->sh.first_slice_in_pic_flag)
+        s->skipping_frame = 0;
 
     // switching to a new layer, mark previous layer's frame (if any) as done
     if (s->cur_layer != layer_idx &&
@@ -4054,6 +4063,7 @@
     s->poc_tid0   = s0->poc_tid0;
     s->eos        = s0->eos;
     s->no_rasl_output_flag = s0->no_rasl_output_flag;
+    s->skipping_frame = s0->skipping_frame;
 
     s->is_nalff        = s0->is_nalff;
     s->nal_length_size = s0->nal_length_size;
@@ -4199,6 +4209,7 @@
     ff_dovi_ctx_flush(&s->dovi_ctx);
     av_buffer_unref(&s->rpu_buf);
     s->eos = 1;
+    s->skipping_frame = 0;
 
     if (FF_HW_HAS_CB(avctx, flush))
         FF_HW_SIMPLE_CALL(avctx, flush);

ffmpeg-8.1.2.tar.xz/libavcodec/hevc/hevcdec.h -> ffmpeg-8.1.3.tar.xz/libavcodec/hevc/hevcdec.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/hevc/ps.c -> ffmpeg-8.1.3.tar.xz/libavcodec/hevc/ps.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/hevc/refs.c -> ffmpeg-8.1.3.tar.xz/libavcodec/hevc/refs.c Changed

@@ -499,15 +499,16 @@
 
 /* add a reference with the given poc to the list and mark it as used in DPB */
 static int add_candidate_ref(HEVCContext *s, HEVCLayerContext *l,
-                             RefPicList *list,
+                             RefPicList *rps, int list_idx,
                              int poc, int ref_flag, uint8_t use_msb)
 {
+    RefPicList *list = &rpslist_idx;
     HEVCFrame *ref = find_ref_idx(s, l, poc, use_msb);
 
     if (ref == s->cur_frame || list->nb_refs >= HEVC_MAX_REFS)
         return AVERROR_INVALIDDATA;
 
-    if (!IS_IRAP(s)) {
+    if (!IS_IRAP(s) && list_idx != ST_FOLL && list_idx != LT_FOLL) {
         int ref_corrupt = !ref || ref->flags & (HEVC_FRAME_FLAG_CORRUPT |
                                                 HEVC_FRAME_FLAG_UNAVAILABLE);
         int recovering = HEVC_IS_RECOVERING(s);
@@ -572,7 +573,7 @@
         else
             list = ST_CURR_AFT;
 
-        ret = add_candidate_ref(s, l, &rpslist, poc,
+        ret = add_candidate_ref(s, l, rps, list, poc,
                                 HEVC_FRAME_FLAG_SHORT_REF, 1);
         if (ret < 0)
             goto fail;
@@ -583,7 +584,7 @@
         int poc  = long_rps->poci;
         int list = long_rps->usedi ? LT_CURR : LT_FOLL;
 
-        ret = add_candidate_ref(s, l, &rpslist, poc,
+        ret = add_candidate_ref(s, l, rps, list, poc,
                                 HEVC_FRAME_FLAG_LONG_REF, long_rps->poc_msb_presenti);
         if (ret < 0)
             goto fail;
@@ -600,7 +601,7 @@
          * always 1, so only RefPicSetInterLayer0 can ever contain a frame. */
         if (l0->cur_frame) {
             // inter-layer refs are treated as short-term here, cf. F.8.1.6
-            ret = add_candidate_ref(s, l0, &rpsINTER_LAYER0, l0->cur_frame->poc,
+            ret = add_candidate_ref(s, l0, rps, INTER_LAYER0, l0->cur_frame->poc,
                                     HEVC_FRAME_FLAG_SHORT_REF, 1);
             if (ret < 0)
                 goto fail;

ffmpeg-8.1.2.tar.xz/libavcodec/huffyuv.h -> ffmpeg-8.1.3.tar.xz/libavcodec/huffyuv.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/huffyuvdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/huffyuvdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/huffyuvenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/huffyuvenc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/internal.h -> ffmpeg-8.1.3.tar.xz/libavcodec/internal.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/jpeg2000dec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/jpeg2000dec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/jpeglsdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/jpeglsdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/lcldec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/lcldec.c Changed

@@ -119,6 +119,9 @@
         }
     }
 
+    if (destptr < destptr_end)
+        memset(destptr, 0, destptr_end - destptr);
+
     return destptr - destptr_bak;
 }
 
@@ -152,8 +155,11 @@
     if (expected != (unsigned int)zstream->total_out) {
         av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n",
                expected, zstream->total_out);
-        if (expected > (unsigned int)zstream->total_out)
+        if (expected > (unsigned int)zstream->total_out) {
+            memset(c->decomp_buf + offset + zstream->total_out, 0,
+                   c->decomp_size - offset - zstream->total_out);
             return (unsigned int)zstream->total_out;
+        }
         return AVERROR_UNKNOWN;
     }
     return zstream->total_out;
@@ -283,6 +289,8 @@
             ret = zlib_decomp(avctx, buf + 8 + mthread_inlen, len - 8 - mthread_inlen,
                               mthread_outlen, mthread_outlen);
             if (ret < 0) return ret;
+            memset(c->decomp_buf + mthread_outlen + ret, 0,
+                   c->decomp_size - mthread_outlen - ret);
             len = c->decomp_size;
         } else {
             int ret = zlib_decomp(avctx, buf, len, 0, c->decomp_size);

ffmpeg-8.1.2.tar.xz/libavcodec/leaddec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/leaddec.c Changed

@@ -184,6 +184,15 @@
     calc_dequant(dequant0, ff_mjpeg_std_luminance_quant_tbl, q);
     calc_dequant(dequant1, ff_mjpeg_std_chrominance_quant_tbl, q);
 
+    int mb_size_log2 = 4 - (avctx->pix_fmt == AV_PIX_FMT_YUV444P);
+    int blocks_per_mb = 2 + (1<<mb_size_log2)*(1<<mb_size_log2) / 64 - 2*yuv20p_half;
+    // Check against a lower bound of the input bitstream size
+    // Each block has at least a dc and ac code
+    // The smallest DC and AC code are each 2 bit
+    // There are cases where a column at the right or row at the bottom cannot be encoded, these are disregarded in this check as they do not fulfill the contract of encoding width x height pixels. They are either unsupported by the format or our implementation is incorrect
+    if ((avpkt->size - 8LL) * 8 < AV_CEIL_RSHIFT(avctx->width, mb_size_log2) * AV_CEIL_RSHIFT(avctx->height, mb_size_log2) * blocks_per_mb * (2 + 2))
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;

ffmpeg-8.1.2.tar.xz/libavcodec/libcodec2.c -> ffmpeg-8.1.3.tar.xz/libavcodec/libcodec2.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/libfdk-aacdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/libfdk-aacdec.c Changed

@@ -21,6 +21,7 @@
 
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
+#include "libavutil/intreadwrite.h"
 #include "libavutil/mem.h"
 #include "libavutil/opt.h"
 #include "avcodec.h"
@@ -63,7 +64,11 @@
 #if FDKDEC_VER_AT_LEAST(2, 5) // 2.5.10
     int output_delay_set;
     int flush_samples;
-    int delay_samples;
+    int skip_samples;
+    int output_delay;
+    int discard_padding;
+    int64_t last_pts;
+    int64_t last_dts;
 #endif
     AVChannelLayout downmix_layout;
 } FDKAACDecContext;
@@ -137,7 +142,10 @@
     if (!s->output_delay_set && info->outputDelay) {
         // Set this only once.
         s->flush_samples    = info->outputDelay;
-        s->delay_samples    = info->outputDelay;
+        s->skip_samples     = info->outputDelay;
+        s->output_delay     = info->outputDelay;
+        s->last_pts         = AV_NOPTS_VALUE;
+        s->last_dts         = AV_NOPTS_VALUE;
         s->output_delay_set = 1;
     }
 #endif
@@ -269,7 +277,7 @@
     }
 
     if (s->downmix_layout.nb_channels > 0 &&
-        s->downmix_layout.order != AV_CHANNEL_ORDER_NATIVE) {
+        s->downmix_layout.order == AV_CHANNEL_ORDER_NATIVE) {
         int downmix_channels = -1;
 
         switch (s->downmix_layout.u.mask) {
@@ -381,7 +389,6 @@
     AAC_DECODER_ERROR err;
     UINT valid = avpkt->size;
     UINT flags = 0;
-    int input_offset = 0;
 
     if (avpkt->size) {
         err = aacDecoder_Fill(s->handle, &avpkt->data, &avpkt->size, &valid);
@@ -420,35 +427,76 @@
         goto end;
     frame->nb_samples = avctx->frame_size;
 
+    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
+        goto end;
+
 #if FDKDEC_VER_AT_LEAST(2, 5) // 2.5.10
     if (flags & AACDEC_FLUSH) {
+        if (s->last_pts != AV_NOPTS_VALUE)
+            frame->pts = av_sat_add64(s->last_pts,
+                                      av_rescale_q(frame->nb_samples, avctx->time_base,
+                                                   (AVRational){ 1, avctx->sample_rate }));
+        if (s->last_dts != AV_NOPTS_VALUE)
+            frame->pkt_dts = av_sat_add64(s->last_dts,
+                                          av_rescale_q(frame->nb_samples, avctx->time_base,
+                                                       (AVRational){ 1, avctx->sample_rate }));
+
         // Only return the right amount of samples at the end; if calling the
         // decoder with AACDEC_FLUSH, it will keep returning frames indefinitely.
         frame->nb_samples = FFMIN(s->flush_samples, frame->nb_samples);
         av_log(s, AV_LOG_DEBUG, "Returning %d/%d delayed samples.\n",
                                 frame->nb_samples, s->flush_samples);
+        if (s->skip_samples || s->discard_padding) {
+            AVFrameSideData *sd = av_frame_get_side_data(frame, AV_FRAME_DATA_SKIP_SAMPLES);
+            if (!sd) {
+                sd = av_frame_new_side_data(frame, AV_FRAME_DATA_SKIP_SAMPLES, 10);
+                if (sd)
+                    memset(sd->data, 0, 10);
+            }
+            if (sd && sd->size >= 10) {
+                AV_WL32(sd->data,     s->skip_samples);
+                AV_WL32(sd->data + 4, s->discard_padding);
+            }
+            s->skip_samples = 0;
+            s->discard_padding = 0;
+        }
         s->flush_samples -= frame->nb_samples;
+        s->last_pts = frame->pts;
+        s->last_dts = frame->pkt_dts;
     } else {
-        // Trim off samples from the start to compensate for extra decoder
-        // delay. We could also just adjust the pts, but this avoids
-        // including the extra samples in the output altogether.
-        if (s->delay_samples) {
-            int drop_samples = FFMIN(s->delay_samples, frame->nb_samples);
-            av_log(s, AV_LOG_DEBUG, "Dropping %d/%d delayed samples.\n",
-                                    drop_samples, s->delay_samples);
-            s->delay_samples  -= drop_samples;
-            frame->nb_samples -= drop_samples;
-            input_offset = drop_samples * avctx->ch_layout.nb_channels;
-            if (frame->nb_samples <= 0)
-                return 0;
+        AVFrameSideData *sd = av_frame_get_side_data(frame, AV_FRAME_DATA_SKIP_SAMPLES);
+        if (!sd && s->skip_samples) {
+            sd = av_frame_new_side_data(frame, AV_FRAME_DATA_SKIP_SAMPLES, 10);
+            if (sd)
+                memset(sd->data, 0, 10);
         }
+        if (sd && sd->size >= 10) {
+            int skip_samples = AV_RL32(sd->data);
+            s->discard_padding = AV_RL32(sd->data + 4);
+            if (s->discard_padding >= s->output_delay) {
+                AV_WL32(sd->data + 4, s->discard_padding - s->output_delay);
+                s->discard_padding = s->output_delay;
+            } else
+                AV_WL32(sd->data + 4, 0);
+            AV_WL32(sd->data, skip_samples + s->skip_samples);
+            s->skip_samples = 0;
+        }
+        if (frame->pts != AV_NOPTS_VALUE && s->output_delay)
+            frame->pts = av_sat_sub64(frame->pts,
+                                      av_rescale_q(s->output_delay,
+                                                   (AVRational){ 1, avctx->sample_rate },
+                                                   avctx->time_base));
+        if (frame->pkt_dts != AV_NOPTS_VALUE && s->output_delay)
+            frame->pkt_dts = av_sat_sub64(frame->pkt_dts,
+                                          av_rescale_q(s->output_delay,
+                                                       (AVRational){ 1, avctx->sample_rate },
+                                                       avctx->time_base));
+        s->last_pts = frame->pts;
+        s->last_dts = frame->pkt_dts;
     }
 #endif
 
-    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
-        goto end;
-
-    memcpy(frame->extended_data0, s->decoder_buffer + input_offset,
+    memcpy(frame->extended_data0, s->decoder_buffer,
            avctx->ch_layout.nb_channels * frame->nb_samples *
            av_get_bytes_per_sample(avctx->sample_fmt));
 
@@ -470,6 +518,25 @@
     if ((err = aacDecoder_SetParam(s->handle,
                                    AAC_TPDEC_CLEAR_BUFFER, 1)) != AAC_DEC_OK)
         av_log(avctx, AV_LOG_WARNING, "failed to clear buffer when flushing\n");
+
+#if FDKDEC_VER_AT_LEAST(2, 5) // 2.5.10
+    s->skip_samples = 0;
+    s->discard_padding = 0;
+    s->flush_samples = 0;
+    s->output_delay = 0;
+    s->last_pts = AV_NOPTS_VALUE;
+    s->last_dts = AV_NOPTS_VALUE;
+    s->output_delay_set = 0;
+
+    // Call aacDecoder_DecodeFrame() with flush and clear history flags as the
+    // above aacDecoder_SetParam() call is seemingly not sufficient.
+    // Ignore the return code given it will not be AAC_DEC_OK if nothing is
+    // buffered internally (e.g. trying to flush the decoder before passing a
+    // single packet to it).
+    aacDecoder_DecodeFrame(s->handle, (INT_PCM *) s->decoder_buffer,
+                           s->decoder_buffer_size / sizeof(INT_PCM),
+                           AACDEC_FLUSH | AACDEC_CLRHIST);
+#endif
 }
 
 const FFCodec ff_libfdk_aac_decoder = {

ffmpeg-8.1.2.tar.xz/libavcodec/lzf.c -> ffmpeg-8.1.3.tar.xz/libavcodec/lzf.c Changed

@@ -32,6 +32,7 @@
 #include "libavutil/mem.h"
 
 #include "bytestream.h"
+#include "defs.h"
 #include "lzf.h"
 
 #define LZF_LITERAL_MAX (1 << 5)
@@ -62,8 +63,8 @@
 
         if (s < LZF_LITERAL_MAX) {
             s++;
-            if (s > *allocated_size - len) {
-                ret = lzf_realloc(buf, len + s, allocated_size);
+            if (s + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) {
+                ret = lzf_realloc(buf, len + s + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;
@@ -87,8 +88,8 @@
             if (off > len)
                 return AVERROR_INVALIDDATA;
 
-            if (l > *allocated_size - len) {
-                ret = lzf_realloc(buf, len + l, allocated_size);
+            if (l + AV_INPUT_BUFFER_PADDING_SIZE > *allocated_size - len) {
+                ret = lzf_realloc(buf, len + l + AV_INPUT_BUFFER_PADDING_SIZE, allocated_size);
                 if (ret < 0)
                     return ret;
                 p = *buf + len;
@@ -101,6 +102,9 @@
         }
     }
 
+    if (*buf)
+        memset(*buf + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
     *size = len;
 
     return 0;

ffmpeg-8.1.2.tar.xz/libavcodec/lzf.h -> ffmpeg-8.1.3.tar.xz/libavcodec/lzf.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/mace.c -> ffmpeg-8.1.3.tar.xz/libavcodec/mace.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/mips/cabac.h -> ffmpeg-8.1.3.tar.xz/libavcodec/mips/cabac.h Changed

@@ -101,7 +101,14 @@
 #else
         "slt          %tmp0,         %c_bytestream,     %c_bytestream_end  \n\t"
         PTR_ADDIU    "%tmp2,         %c_bytestream,     0x02                 \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movn         %c_bytestream, %tmp2,             %tmp0              \n\t"
+#else
+        "beqz         %tmp0,         2f                                      \n\t"
+        " nop                                                               \n\t"
+        "move         %c_bytestream, %tmp2                               \n\t"
+        "2:                                                                 \n\t"
+#endif
 #endif
         "1:                                                        \n\t"
     : bit"=&r"(bit), tmp0"=&r"(tmp0), tmp1"=&r"(tmp1), tmp2"=&r"(tmp2),
@@ -152,14 +159,29 @@
 #else
         "slt        %tmp0,         %c_bytestream, %c_bytestream_end \n\t"
         PTR_ADDIU  "%tmp1,         %c_bytestream, 0x02                \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movn       %c_bytestream, %tmp1,         %tmp0             \n\t"
+#else
+        "beqz       %tmp0,         2f                                  \n\t"
+        " nop                                                            \n\t"
+        "move       %c_bytestream, %tmp1                              \n\t"
+        "2:                                                              \n\t"
+#endif
 #endif
         "1:                                                               \n\t"
         PTR_SLL    "%tmp1,         %c_range,      0x11                \n\t"
         "slt        %tmp0,         %c_low,        %tmp1             \n\t"
         PTR_SUBU   "%tmp1,         %c_low,        %tmp1             \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movz       %res,          %one,          %tmp0             \n\t"
         "movz       %c_low,        %tmp1,         %tmp0             \n\t"
+#else
+        "bnez       %tmp0,         2f                                \n\t"
+        " nop                                                      \n\t"
+        "move       %res,          %one                          \n\t"
+        "move       %c_low,        %tmp1                         \n\t"
+        "2:                                                       \n\t"
+#endif
         : tmp0"=&r"(tmp0), tmp1"=&r"(tmp1), res"+&r"(res),
           c_range"+&r"(c->range), c_low"+&r"(c->low),
           c_bytestream"+&r"(c->bytestream)
@@ -204,15 +226,36 @@
 #else
         "slt        %tmp0,         %c_bytestream, %c_bytestream_end \n\t"
         PTR_ADDIU  "%tmp1,         %c_bytestream, 0x02                \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movn       %c_bytestream, %tmp1,         %tmp0             \n\t"
+#else
+        "beqz       %tmp0,         2f                                  \n\t"
+        " nop                                                            \n\t"
+        "move       %c_bytestream, %tmp1                              \n\t"
+        "2:                                                              \n\t"
+#endif
 #endif
         "1:                                                               \n\t"
         PTR_SLL    "%tmp1,         %c_range,      0x11                \n\t"
         "slt        %tmp0,         %c_low,        %tmp1             \n\t"
         PTR_SUBU   "%tmp1,         %c_low,        %tmp1             \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movz       %c_low,        %tmp1,         %tmp0             \n\t"
+#else
+        "bnez       %tmp0,         2f                                  \n\t"
+        " nop                                                            \n\t"
+        "move       %c_low,        %tmp1                              \n\t"
+        "2:                                                              \n\t"
+#endif
         PTR_SUBU   "%tmp1,         %zero,         %res              \n\t"
+#if HAVE_MIPS32R2 || HAVE_MIPS64R2
         "movn       %res,          %tmp1,         %tmp0             \n\t"
+#else
+        "beqz       %tmp0,         3f                                  \n\t"
+        " nop                                                            \n\t"
+        "move       %res,          %tmp1                              \n\t"
+        "3:                                                              \n\t"
+#endif
         : tmp0"=&r"(tmp0), tmp1"=&r"(tmp1), res"+&r"(res),
           c_range"+&r"(c->range), c_low"+&r"(c->low),
           c_bytestream"+&r"(c->bytestream)

ffmpeg-8.1.2.tar.xz/libavcodec/mips/hevcpred_msa.c -> ffmpeg-8.1.3.tar.xz/libavcodec/mips/hevcpred_msa.c Changed

@@ -18,7 +18,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-#include "libavcodec/hevc/dec.h"
+#include "libavcodec/hevc/hevcdec.h"
 #include "libavutil/mips/generic_macros_msa.h"
 #include "hevcpred_mips.h"
 
@@ -1924,8 +1924,8 @@
     int cur_tb_addr =
         pps->min_tb_addr_zs(y_tb) * (sps->tb_mask + 2) + (x_tb);
 
-    ptrdiff_t stride = s->frame->linesizec_idx / sizeof(uint8_t);
-    uint8_t *src = (uint8_t *) s->frame->datac_idx + x + y * stride;
+    ptrdiff_t stride = s->cur_frame->f->linesizec_idx / sizeof(uint8_t);
+    uint8_t *src = (uint8_t *) s->cur_frame->f->datac_idx + x + y * stride;
 
     int min_pu_width = sps->min_pu_width;
 
@@ -2416,7 +2416,8 @@
     }
 }
 
-void ff_intra_pred_8_32x32_msa(HEVCLocalContext *lc, int x0, int y0, int c_idx)
+void ff_intra_pred_8_32x32_msa(HEVCLocalContext *lc, const HEVCPPS *pps,
+                               int x0, int y0, int c_idx)
 {
     v16u8 vec0, vec1;
     v8i16 tmp0, tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7;
@@ -2440,8 +2441,8 @@
     int cur_tb_addr =
         pps->min_tb_addr_zs(y_tb) * (sps->tb_mask + 2) + (x_tb);
 
-    ptrdiff_t stride = s->frame->linesizec_idx / sizeof(uint8_t);
-    uint8_t *src = (uint8_t *) s->frame->datac_idx + x + y * stride;
+    ptrdiff_t stride = s->cur_frame->f->linesizec_idx / sizeof(uint8_t);
+    uint8_t *src = (uint8_t *) s->cur_frame->f->datac_idx + x + y * stride;
 
     int min_pu_width = sps->min_pu_width;

ffmpeg-8.1.2.tar.xz/libavcodec/mips/vc1dsp_msa.c -> ffmpeg-8.1.3.tar.xz/libavcodec/mips/vc1dsp_msa.c Changed

@@ -408,7 +408,7 @@
     cnst_para1 = __msa_fill_h(para_valuehmode - 11);
     cnst_para2 = __msa_fill_h(para_valuehmode - 12);
     cnst_para3 = __msa_fill_h(para_valuehmode - 13);
-    r = 64 - rnd;
+    r = 64 - rnd - /* bias */ 128 * 128;
     cnst_r = __msa_fill_h(r);
     // col 0 ~ 7
     t0 = cnst_para1 * t1 + cnst_para2 * t2 - cnst_para0 * t0 - cnst_para3 * t3;
@@ -425,7 +425,15 @@
     t4 >>= 7, t5 >>= 7, t6 >>= 7, t7 >>= 7;
     TRANSPOSE8x8_SH_SH(t0, t1, t2, t3, t4, t5, t6, t7,
                        t0, t1, t2, t3, t4, t5, t6, t7);
-    CLIP_SH8_0_255(t0, t1, t2, t3, t4, t5, t6, t7);
+    cnst_r = __msa_fill_h(128); // undo bias
+    t0 = __msa_sat_s_h(t0, 7) + cnst_r;
+    t1 = __msa_sat_s_h(t1, 7) + cnst_r;
+    t2 = __msa_sat_s_h(t2, 7) + cnst_r;
+    t3 = __msa_sat_s_h(t3, 7) + cnst_r;
+    t4 = __msa_sat_s_h(t4, 7) + cnst_r;
+    t5 = __msa_sat_s_h(t5, 7) + cnst_r;
+    t6 = __msa_sat_s_h(t6, 7) + cnst_r;
+    t7 = __msa_sat_s_h(t7, 7) + cnst_r;
     PCKEV_B4_SH(t1, t0, t3, t2, t5, t4, t7, t6, t0, t1, t2, t3);
     ST_D8(t0, t1, t2, t3, 0, 1, 0, 1, 0, 1, 0, 1, dst, stride);
 }

ffmpeg-8.1.2.tar.xz/libavcodec/mjpegdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/mjpegdec.c Changed

@@ -383,6 +383,7 @@
     }
 
     s->nb_components = nb_components;
+    s->nb_seq_component_scans = 0;
     s->h_max         = 1;
     s->v_max         = 1;
     for (i = 0; i < nb_components; i++) {
@@ -1784,6 +1785,16 @@
     if (s->mjpb_skiptosod)
         bytestream2_skip(&s->gB, s->mjpb_skiptosod);
 
+    if (!s->progressive && !s->lossless &&
+        s->avctx->codec_id != AV_CODEC_ID_MXPEG) {
+        s->nb_seq_component_scans += s->nb_components_sos;
+        if (s->nb_seq_component_scans > s->nb_components) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "too many scans for a sequential image\n");
+            return AVERROR_INVALIDDATA;
+        }
+    }
+
     if (s->avctx->hwaccel) {
         const uint8_t *buf_ptr;
         size_t buf_size;
@@ -2407,6 +2418,7 @@
     int is16bit;
 
     s->force_pal8 = 0;
+    s->total_ls_decoded_height = 0;
 
     s->buf_size = buf_size;
 
@@ -2773,7 +2785,7 @@
             }
         }
     }
-    if (s->flipped && !s->rgb) {
+    if (s->flipped && !s->rgb && !s->bayer) {
         ret = av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &hshift, &vshift);
         if (ret)
             return ret;

ffmpeg-8.1.2.tar.xz/libavcodec/mjpegdec.h -> ffmpeg-8.1.3.tar.xz/libavcodec/mjpegdec.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/mpeg4videodec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/mpeg4videodec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/nellymoserdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/nellymoserdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/nvdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/nvdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/nvenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/nvenc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/pgssubdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/pgssubdec.c Changed

@@ -537,6 +537,16 @@
         sub->rectssub->num_rects++ = rect;
         rect->type = SUBTITLE_BITMAP;
 
+        /* Allocate the palette now so that the error paths below, which
+         * leave the rect empty, still hand consumers a complete bitmap
+         * rect rather than one with a NULL palette. */
+        rect->nb_colors = 256;
+        rect->data1   = av_mallocz(AVPALETTE_SIZE);
+        if (!rect->data1)
+            return AVERROR(ENOMEM);
+        if (!ctx->forced_subs_only || ctx->presentation.objectsi.composition_flag & 0x40)
+            memcpy(rect->data1, palette->clut, rect->nb_colors * sizeof(uint32_t));
+
         /* Process bitmap */
         object = find_object(ctx->presentation.objectsi.id, &ctx->objects);
         if (!object) {
@@ -577,14 +587,6 @@
                 continue;
             }
         }
-        /* Allocate memory for colors */
-        rect->nb_colors = 256;
-        rect->data1   = av_mallocz(AVPALETTE_SIZE);
-        if (!rect->data1)
-            return AVERROR(ENOMEM);
-
-        if (!ctx->forced_subs_only || ctx->presentation.objectsi.composition_flag & 0x40)
-            memcpy(rect->data1, palette->clut, rect->nb_colors * sizeof(uint32_t));
     }
     return 1;
 }

ffmpeg-8.1.2.tar.xz/libavcodec/pngdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/pngdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/pngenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/pngenc.c Changed

@@ -72,6 +72,8 @@
     int color_type;
     int bits_per_pixel;
 
+    AVBufferRef *exif_data;
+
     // APNG
     uint32_t palette_checksum;   // Used to ensure a single unique palette
     uint32_t sequence_number;
@@ -377,7 +379,6 @@
 {
     AVFrameSideData *side_data;
     PNGEncContext *s = avctx->priv_data;
-    AVBufferRef *exif_data = NULL;
     int ret;
 
     /* write png header */
@@ -419,17 +420,10 @@
         }
     }
 
-    ret = ff_exif_get_buffer(avctx, pict, &exif_data, AV_EXIF_TIFF_HEADER);
-    if (exif_data) {
-        // png_write_chunk accepts an int, not a size_t, so we have to check overflow
-        if (exif_data->size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
-            // that's a very big exif chunk, probably a bug
-            av_log(avctx, AV_LOG_ERROR, "extremely large EXIF buffer detected, not writing\n");
-        else
-            png_write_chunk(&s->bytestream, MKTAG('e','X','I','f'), exif_data->data, exif_data->size);
-        av_buffer_unref(&exif_data);
-    } else if (ret < 0) {
-        av_log(avctx, AV_LOG_WARNING, "unable to attach EXIF metadata: %s\n", av_err2str(ret));
+    if (s->exif_data) {
+        /* we checked for overflow when we attached the buffer to s->exif_data */
+        png_write_chunk(&s->bytestream, MKTAG('e','X','I','f'), s->exif_data->data, s->exif_data->size);
+        av_buffer_unref(&s->exif_data);
     }
 
     side_data = av_frame_get_side_data(pict, AV_FRAME_DATA_ICC_PROFILE);
@@ -649,25 +643,30 @@
 static int add_exif_profile_size(AVCodecContext *avctx, const AVFrame *pict,
                                  uint64_t *max_packet_size)
 {
-    const AVFrameSideData *sd;
     uint64_t new_pkt_size;
-    /* includes orientation tag */
-    const int base_exif_size = 92;
-    uint64_t estimated_exif_size;
+    PNGEncContext *s = avctx->priv_data;
 
-    sd = av_frame_get_side_data(pict, AV_FRAME_DATA_EXIF);
-    estimated_exif_size = sd ? sd->size : 0;
-    sd = av_frame_get_side_data(pict, AV_FRAME_DATA_DISPLAYMATRIX);
-    if (sd)
-        estimated_exif_size += base_exif_size;
+    int result = ff_exif_get_buffer(avctx, pict, &s->exif_data, AV_EXIF_TIFF_HEADER);
+    if (!s->exif_data) {
+        if (result < 0)
+            av_log(avctx, AV_LOG_WARNING, "unable to attach EXIF metadata: %s\n", av_err2str(result));
+        return 0;
+    }
 
-    if (!estimated_exif_size)
+    /* png_write_chunk accepts an int, not a size_t, so we have to check overflow */
+    if (s->exif_data->size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
+        /* that's a very big exif chunk, probably a bug */
+        av_log(avctx, AV_LOG_ERROR, "extremely large EXIF buffer detected, not writing\n");
+        av_buffer_unref(&s->exif_data);
         return 0;
+    }
 
     /* 12 is the png chunk header size */
-    new_pkt_size = *max_packet_size + estimated_exif_size + 12;
-    if (new_pkt_size < *max_packet_size)
+    new_pkt_size = *max_packet_size + s->exif_data->size + 12;
+    if (new_pkt_size < *max_packet_size) {
+        av_buffer_unref(&s->exif_data);
         return AVERROR_INVALIDDATA;
+    }
 
     *max_packet_size = new_pkt_size;
 
@@ -1258,6 +1257,7 @@
     ff_deflate_end(&s->zstream);
     av_frame_free(&s->last_frame);
     av_frame_free(&s->prev_frame);
+    av_buffer_unref(&s->exif_data);
     av_freep(&s->last_frame_packet);
     av_freep(&s->extra_data);
     s->extra_data_size = 0;

ffmpeg-8.1.2.tar.xz/libavcodec/ppc/vp8dsp_altivec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/ppc/vp8dsp_altivec.c Changed

@@ -136,7 +136,7 @@
         if (w == 16) {
             FILTER_H(f16l, 8);
             filt = vec_packsu(f16h, f16l);
-            vec_st(filt, 0, dst);
+            unaligned_store(filt, dst);
         } else {
             filt = vec_packsu(f16h, f16h);
             vec_ste((vec_u32)filt, 0, (uint32_t*)dst);
@@ -235,7 +235,7 @@
         if (w == 16) {
             FILTER_V(f16l, vec_mulo);
             filt = vec_packsu(f16h, f16l);
-            vec_st(filt, 0, dst);
+            unaligned_store(filt, dst);
         } else {
             filt = vec_packsu(f16h, f16h);
             if (w == 4)
@@ -317,10 +317,10 @@
 // -funroll-loops w/ this is bad - 74 cycles again.
 // all this is on a 7450, tuning for the 7450
     for (i = 0; i < h; i += 4) {
-        vec_st(load_with_perm_vec(0, src, perm), 0, dst);
-        vec_st(load_with_perm_vec(sstride, src, perm), dstride, dst);
-        vec_st(load_with_perm_vec(sstride2, src, perm), dstride2, dst);
-        vec_st(load_with_perm_vec(sstride3, src, perm), dstride3, dst);
+        unaligned_store(load_with_perm_vec(0, src, perm), dst);
+        unaligned_store(load_with_perm_vec(sstride, src, perm), dst + dstride);
+        unaligned_store(load_with_perm_vec(sstride2, src, perm), dst + dstride2);
+        unaligned_store(load_with_perm_vec(sstride3, src, perm), dst + dstride3);
         src += sstride4;
         dst += dstride4;
     }

ffmpeg-8.1.2.tar.xz/libavcodec/pthread_frame.c -> ffmpeg-8.1.3.tar.xz/libavcodec/pthread_frame.c Changed

@@ -890,17 +890,18 @@
     }
     p->thread_init = NEEDS_CLOSE;
 
-    if (first) {
+    if (first)
         update_context_from_thread(avctx, copy, 1);
 
-        av_frame_side_data_free(&avctx->decoded_side_data, &avctx->nb_decoded_side_data);
-        for (int i = 0; i < copy->nb_decoded_side_data; i++) {
-            err = av_frame_side_data_clone(&avctx->decoded_side_data,
-                                           &avctx->nb_decoded_side_data,
-                                           copy->decoded_side_datai, 0);
-            if (err < 0)
-                return err;
-        }
+    const AVCodecContext *src = first ? copy : avctx;
+    AVCodecContext       *dst = first ? avctx : copy;
+    av_frame_side_data_free(&dst->decoded_side_data, &dst->nb_decoded_side_data);
+    for (int i = 0; i < src->nb_decoded_side_data; i++) {
+        err = av_frame_side_data_clone(&dst->decoded_side_data,
+                                       &dst->nb_decoded_side_data,
+                                       src->decoded_side_datai, 0);
+        if (err < 0)
+            return err;
     }
 
     atomic_init(&p->debug_threads, (copy->debug & FF_DEBUG_THREADS) != 0);

ffmpeg-8.1.2.tar.xz/libavcodec/rasc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/rasc.c Changed

@@ -320,6 +320,11 @@
     return 0;
 }
 
+static inline int dlta_room(unsigned cx, unsigned w, unsigned bpp, unsigned need)
+{
+    return cx + need <= w * bpp;
+}
+
 #define NEXT_LINE                        \
     if (cx >= w * s->bpp) {              \
         cx = 0;                          \
@@ -418,6 +423,8 @@
         case 4:
             fill = bytestream2_get_byte(&dc);
             while (len > 0 && cy > 0) {
+                if (!dlta_room(cx, w, s->bpp, 4))
+                    return AVERROR_INVALIDDATA;
                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
                 AV_WL32(b2 + cx, fill);
                 cx++;
@@ -427,6 +434,8 @@
         case 7:
             fill = bytestream2_get_le32(&dc);
             while (len > 0 && cy > 0) {
+                if (!dlta_room(cx, w, s->bpp, 4))
+                    return AVERROR_INVALIDDATA;
                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
                 AV_WL32(b2 + cx, fill);
                 cx += 4;
@@ -443,6 +452,8 @@
             while (len > 0 && cy > 0) {
                 unsigned v0, v1;
 
+                if (!dlta_room(cx, w, s->bpp, 4))
+                    return AVERROR_INVALIDDATA;
                 v0 = AV_RL32(b2 + cx);
                 v1 = AV_RL32(b1 + cx);
                 AV_WL32(b2 + cx, v1);
@@ -454,6 +465,8 @@
         case 13:
             while (len > 0 && cy > 0) {
                 fill = bytestream2_get_le32(&dc);
+                if (!dlta_room(cx, w, s->bpp, 4))
+                    return AVERROR_INVALIDDATA;
                 AV_WL32(b1 + cx, AV_RL32(b2 + cx));
                 AV_WL32(b2 + cx, fill);
                 cx += 4;

ffmpeg-8.1.2.tar.xz/libavcodec/riscv/flacdsp_rvv.S -> ffmpeg-8.1.3.tar.xz/libavcodec/riscv/flacdsp_rvv.S Changed

@@ -22,6 +22,7 @@
 
 func ff_flac_lpc16_rvv, zve32x, b
         lpad    0
+        ble     a4, a2, 2f
         vtype_vli t0, a2, t2, e32, ta, ma
         vsetvl  zero, a2, t0
         vle32.v v8, (a1)
@@ -41,13 +42,14 @@
         sw      t0, (a0)
         addi    a0, a0, 4
         bnez    a4, 1b
-
+2:
         ret
 endfunc
 
 #if (__riscv_xlen == 64)
 func ff_flac_lpc32_rvv, zve64x, zba
         lpad    0
+        ble     a4, a2, 2f
         addi    t2, a2, -16
         ble     t2, zero, ff_flac_lpc32_rvv_simple
         vsetivli zero, 1, e64, m1, ta, ma
@@ -74,12 +76,13 @@
         sw      t0, (a0)
         addi    a0, a0, 4
         bnez    a4, 1b
-
+2:
         ret
 endfunc
 
 func ff_flac_lpc32_rvv_simple, zve64x, b
         lpad    0
+        ble     a4, a2, 2f
         vtype_vli t3, a2, t1, e64, ta, ma
         vntypei t2, t3
         vsetvl  zero, a2, t3 // e64
@@ -103,12 +106,13 @@
         sw      t0, (a0)
         addi    a0, a0, 4
         bnez    a4, 1b
-
+2:
         ret
 endfunc
 
 func ff_flac_lpc33_rvv, zve64x, b
         lpad    0
+        ble     a5, a3, 2f
         vtype_vli t0, a3, t1, e64, ta, ma
         vsetvl  zero, a3, t0
         vmv.s.x v0, zero
@@ -131,7 +135,7 @@
         sd      t0, (a0)
         addi    a0, a0, 8
         bnez    a5, 1b
-
+2:
         ret
 endfunc
 #endif

ffmpeg-8.1.2.tar.xz/libavcodec/rscc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/rscc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/rv34.c -> ffmpeg-8.1.3.tar.xz/libavcodec/rv34.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/screenpresso.c -> ffmpeg-8.1.3.tar.xz/libavcodec/screenpresso.c Changed

@@ -137,6 +137,9 @@
         return AVERROR_INVALIDDATA;
     }
 
+    /* Codec has aligned strides */
+    src_linesize = FFALIGN(avctx->width * component_size, 4);
+
     /* Inflate the frame after the 2 byte header */
     ret = uncompress(ctx->inflated_buf, &length,
                      avpkt->data + 2, avpkt->size - 2);
@@ -144,14 +147,16 @@
         av_log(avctx, AV_LOG_ERROR, "Deflate error %d.\n", ret);
         return AVERROR_UNKNOWN;
     }
+    if (length < src_linesize * avctx->height) {
+        av_log(avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %d are needed\n",
+               length, src_linesize * avctx->height);
+        return AVERROR_INVALIDDATA;
+    }
 
     ret = ff_reget_buffer(avctx, ctx->current, 0);
     if (ret < 0)
         return ret;
 
-    /* Codec has aligned strides */
-    src_linesize = FFALIGN(avctx->width * component_size, 4);
-
     /* When a keyframe is found, copy it (flipped) */
     if (keyframe)
         av_image_copy_plane(ctx->current->data0 +

ffmpeg-8.1.2.tar.xz/libavcodec/tdsc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/tdsc.c Changed

@@ -146,8 +146,7 @@
 {
     TDSCContext *ctx = avctx->priv_data;
     const uint8_t *cursor = ctx->cursor;
-    int x = ctx->cursor_x - ctx->cursor_hot_x;
-    int y = ctx->cursor_y - ctx->cursor_hot_y;
+    int x, y;
     int w = ctx->cursor_w;
     int h = ctx->cursor_h;
     int i, j;
@@ -155,6 +154,16 @@
     if (!ctx->cursor)
         return;
 
+    /* A cursor position outside the frame is invalid; skip drawing it.
+     * cursor_x/y come straight from the bitstream, so bound them before
+     * the (16 bit) hot spot shift to avoid overflowing the clip math. */
+    if ((unsigned)ctx->cursor_x >= ctx->width ||
+        (unsigned)ctx->cursor_y >= ctx->height)
+        return;
+
+    x = ctx->cursor_x - ctx->cursor_hot_x;
+    y = ctx->cursor_y - ctx->cursor_hot_y;
+
     if (x + w > ctx->width)
         w = ctx->width - x;
     if (y + h > ctx->height)
@@ -201,12 +210,6 @@
     ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4;
     cursor_fmt = bytestream2_get_le32(&ctx->gbc);
 
-    if (ctx->cursor_x >= avctx->width || ctx->cursor_y >= avctx->height) {
-        av_log(avctx, AV_LOG_ERROR,
-               "Invalid cursor position (%d.%d outside %dx%d).\n",
-               ctx->cursor_x, ctx->cursor_y, avctx->width, avctx->height);
-        return AVERROR_INVALIDDATA;
-    }
     if (ctx->cursor_w < 1 || ctx->cursor_w > 256 ||
         ctx->cursor_h < 1 || ctx->cursor_h > 256) {
         av_log(avctx, AV_LOG_ERROR,
@@ -482,11 +485,15 @@
             return ret;
         init_refframe = 1;
     }
-    ctx->refframe->width  = ctx->width  = w;
-    ctx->refframe->height = ctx->height = h;
+    ctx->width  = w;
+    ctx->height = h;
 
     /* Allocate the reference frame if not already done or on size change */
     if (init_refframe) {
+        av_frame_unref(ctx->refframe);
+        ctx->refframe->format = avctx->pix_fmt;
+        ctx->refframe->width  = w;
+        ctx->refframe->height = h;
         ret = av_frame_get_buffer(ctx->refframe, 0);
         if (ret < 0)
             return ret;

ffmpeg-8.1.2.tar.xz/libavcodec/tiff.c -> ffmpeg-8.1.3.tar.xz/libavcodec/tiff.c Changed

@@ -526,6 +526,7 @@
     uint8_t *zbuf;
     unsigned long outlen;
     int ret, line;
+    int rows = is_yuv ? (lines + s->subsampling1 - 1) / s->subsampling1 : lines;
     outlen = width * lines;
     zbuf   = av_malloc(outlen);
     if (!zbuf)
@@ -545,6 +546,12 @@
         av_free(zbuf);
         return AVERROR_UNKNOWN;
     }
+    if (outlen < (unsigned long)width * rows) {
+        av_log(s->avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %lu are needed\n",
+               outlen, (unsigned long)width * rows);
+        av_free(zbuf);
+        return AVERROR_INVALIDDATA;
+    }
     src = zbuf;
     for (line = 0; line < lines; line++) {
         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
@@ -592,6 +599,7 @@
 {
     uint64_t outlen = width * (uint64_t)lines;
     int ret, line;
+    int rows = is_yuv ? (lines + s->subsampling1 - 1) / s->subsampling1 : lines;
     uint8_t *buf = av_malloc(outlen);
     if (!buf)
         return AVERROR(ENOMEM);
@@ -610,6 +618,12 @@
         av_free(buf);
         return AVERROR_UNKNOWN;
     }
+    if (outlen < (uint64_t)width * rows) {
+        av_log(s->avctx, AV_LOG_ERROR, "Uncompressed %"PRIu64" bytes, but %"PRIu64" are needed\n",
+               outlen, (uint64_t)width * rows);
+        av_free(buf);
+        return AVERROR_INVALIDDATA;
+    }
     src = buf;
     for (line = 0; line < lines; line++) {
         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {

ffmpeg-8.1.2.tar.xz/libavcodec/utils.c -> ffmpeg-8.1.3.tar.xz/libavcodec/utils.c Changed

@@ -315,6 +315,21 @@
             h_align = 8;
         }
         break;
+    case AV_PIX_FMT_BAYER_BGGR8:
+    case AV_PIX_FMT_BAYER_RGGB8:
+    case AV_PIX_FMT_BAYER_GBRG8:
+    case AV_PIX_FMT_BAYER_GRBG8:
+    case AV_PIX_FMT_BAYER_BGGR16LE:
+    case AV_PIX_FMT_BAYER_BGGR16BE:
+    case AV_PIX_FMT_BAYER_RGGB16LE:
+    case AV_PIX_FMT_BAYER_RGGB16BE:
+    case AV_PIX_FMT_BAYER_GBRG16LE:
+    case AV_PIX_FMT_BAYER_GBRG16BE:
+    case AV_PIX_FMT_BAYER_GRBG16LE:
+    case AV_PIX_FMT_BAYER_GRBG16BE:
+        w_align = FFMAX(w_align, 2);
+        h_align = FFMAX(h_align, 2);
+        break;
     default:
         break;
     }
@@ -979,6 +994,22 @@
     return props;
 }
 
+static void put_timecode_fields(PutBitContext *pb, AVRational rate, uint32_t tc)
+{
+    unsigned hours, minutes, seconds, frames, drop;
+
+    ff_timecode_set_smpte(&drop, &hours, &minutes, &seconds, &frames, rate, tc, 0, 0);
+
+    put_bits(pb, 5, 0);      // counting_type
+    put_bits(pb, 1, 1);      // full_timestamp_flag
+    put_bits(pb, 1, 0);      // discontinuity_flag
+    put_bits(pb, 1, drop);   // cnt_dropped_flag
+    put_bits(pb, 9, frames);
+    put_bits(pb, 6, seconds);
+    put_bits(pb, 6, minutes);
+    put_bits(pb, 5, hours);
+}
+
 int ff_alloc_timecode_sei(const AVFrame *frame, AVRational rate, size_t prefix_len,
                      void **data, size_t *sei_size)
 {
@@ -1008,26 +1039,47 @@
     put_bits(&pb, 2, m); // num_clock_ts
 
     for (int j = 1; j <= m; j++) {
-        unsigned hh, mm, ss, ff, drop;
-        ff_timecode_set_smpte(&drop, &hh, &mm, &ss, &ff, rate, tcj, 0, 0);
-
         put_bits(&pb, 1, 1); // clock_timestamp_flag
         put_bits(&pb, 1, 1); // units_field_based_flag
-        put_bits(&pb, 5, 0); // counting_type
-        put_bits(&pb, 1, 1); // full_timestamp_flag
-        put_bits(&pb, 1, 0); // discontinuity_flag
-        put_bits(&pb, 1, drop);
-        put_bits(&pb, 9, ff);
-        put_bits(&pb, 6, ss);
-        put_bits(&pb, 6, mm);
-        put_bits(&pb, 5, hh);
-        put_bits(&pb, 5, 0);
+        put_timecode_fields(&pb, rate, tcj);
+        put_bits(&pb, 5, 0); // time_offset_length
     }
     flush_put_bits(&pb);
 
     return 0;
 }
 
+int ff_alloc_timecode_metadata_av1(const AVFrame *frame, AVRational rate,
+                                   void **data, size_t *size)
+{
+    AVFrameSideData *sd = NULL;
+    PutBitContext pb;
+    uint32_t *tc;
+
+    if (frame)
+        sd = av_frame_get_side_data(frame, AV_FRAME_DATA_S12M_TIMECODE);
+
+    *data = NULL;
+    if (!sd)
+        return 0;
+    tc = (uint32_t*)sd->data;
+    if (!(tc0 & 3)) // num_clock_ts
+        return 0;
+
+    *size = 5;
+    *data = av_mallocz(*size);
+    if (!*data)
+        return AVERROR(ENOMEM);
+
+    init_put_bits(&pb, *data, *size);
+    put_timecode_fields(&pb, rate, tc1);
+    put_bits(&pb, 5, 1); // time_offset_length
+    put_bits(&pb, 1, 0); // time_offset_value
+    flush_put_bits(&pb);
+
+    return 0;
+}
+
 int64_t ff_guess_coded_bitrate(AVCodecContext *avctx)
 {
     AVRational framerate = avctx->framerate;

ffmpeg-8.1.2.tar.xz/libavcodec/vc1_block.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vc1_block.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/version.h -> ffmpeg-8.1.3.tar.xz/libavcodec/version.h Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vorbisdec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vorbisdec.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vorbisenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vorbisenc.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vp8.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vp8.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vp9.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vp9.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan/ffv1_dec_setup.comp.glsl -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan/ffv1_dec_setup.comp.glsl Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan_av1.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan_av1.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan_encode_av1.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan_encode_av1.c Changed

@@ -159,7 +159,7 @@
     return 0;
 }
 
-static void set_name_slot(int slot, int *slot_indices, uint32_t allowed_idx, int group)
+static int set_name_slot(int slot, int *slot_indices, uint32_t allowed_idx, int group)
 {
     int from = group ? AV1_REF_FRAME_GOLDEN : 0;
     int to = group ? AV1_REFS_PER_FRAME : AV1_REF_FRAME_GOLDEN;
@@ -167,7 +167,7 @@
     for (int i = from; i < to; i++) {
         if ((slot_indicesi == -1) && (allowed_idx & (1 << i))) {
             slot_indicesi = slot;
-            return;
+            return i;
         }
     }
 
@@ -377,12 +377,12 @@
         for (int i = 0; i < AV1_REFS_PER_FRAME; i++)
             ap->av1pic_info.ref_frame_idxi = ap_ref->slot;
 
-        ap->av1pic_info.primary_ref_frame = ap_ref->slot;
         ap->av1pic_info.ref_order_hintap_ref->slot = ref->display_order - ap_ref->last_idr_frame;
         rc_group = VK_VIDEO_ENCODE_AV1_RATE_CONTROL_GROUP_PREDICTIVE_KHR;
         pred_mode = VK_VIDEO_ENCODE_AV1_PREDICTION_MODE_SINGLE_REFERENCE_KHR;
         ref_name_mask = enc->caps.singleReferenceNameMask;
-        set_name_slot(ap_ref->av1pic_info.current_frame_id, name_slots, ref_name_mask, 0);
+        ap->av1pic_info.primary_ref_frame =
+            set_name_slot(ap_ref->av1pic_info.current_frame_id, name_slots, ref_name_mask, 0);
 
 //        vpic->ref_frame_ctrl_l0.fields.search_idx0 = AV1_REF_FRAME_LAST;
 
@@ -422,11 +422,11 @@
         ref = pic->refs0pic->nb_refs0 - 1;
         ap_ref = ref->codec_priv;
         ap->last_idr_frame = ap_ref->last_idr_frame;
-        ap->av1pic_info.primary_ref_frame = ap_ref->slot;
         ap->av1pic_info.ref_order_hintap_ref->slot = ref->display_order - ap_ref->last_idr_frame;
         for (int i = 0; i < AV1_REF_FRAME_GOLDEN; i++)
             ap->av1pic_info.ref_frame_idxi = ap_ref->slot;
-        set_name_slot(ap_ref->av1pic_info.current_frame_id, name_slots, ref_name_mask, 0);
+        ap->av1pic_info.primary_ref_frame =
+            set_name_slot(ap_ref->av1pic_info.current_frame_id, name_slots, ref_name_mask, 0);
 
         ref = pic->refs1pic->nb_refs1 - 1;
         ap_ref = ref->codec_priv;
@@ -1023,7 +1023,7 @@
     } else {
         av_log(avctx, AV_LOG_ERROR, "Unable to get feedback for AV1 sequence header = %zu\n",
                data_size);
-        return err;
+        return AVERROR_EXTERNAL;
     }
 
     ret = vk->GetEncodedVideoSessionParametersKHR(s->hwctx->act_dev, &params_info,
@@ -1031,7 +1031,8 @@
                                                   &data_size, data);
     if (ret != VK_SUCCESS) {
         av_log(avctx, AV_LOG_ERROR, "Error writing feedback units\n");
-        return err;
+        err = AVERROR_EXTERNAL;
+        goto end;
     }
 
     av_log(avctx, AV_LOG_VERBOSE, "Feedback units written, overrides: %i\n",
@@ -1040,20 +1041,21 @@
     params_feedback.hasOverrides = 1;
 
     /* No need to sync any overrides */
+    err = 0;
     if (!params_feedback.hasOverrides)
-        return 0;
+        goto end;
 
     /* Parse back tne units and override */
     err = parse_feedback_units(avctx, data, data_size);
     if (err < 0)
-        return err;
+        goto end;
 
     /* Create final session parameters */
     err = create_session_params(avctx);
-    if (err < 0)
-        return err;
 
-    return 0;
+end:
+    av_free(data);
+    return err;
 }
 
 static int vulkan_encode_av1_add_obu(AVCodecContext *avctx,

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan_encode_h264.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan_encode_h264.c Changed

@@ -1148,7 +1148,7 @@
             return AVERROR(ENOMEM);
     } else {
         av_log(avctx, AV_LOG_ERROR, "Unable to get feedback for H.264 units = %zu\n", data_size);
-        return err;
+        return AVERROR_EXTERNAL;
     }
 
     ret = vk->GetEncodedVideoSessionParametersKHR(s->hwctx->act_dev, &params_info,
@@ -1156,7 +1156,8 @@
                                                   &data_size, data);
     if (ret != VK_SUCCESS) {
         av_log(avctx, AV_LOG_ERROR, "Error writing feedback units\n");
-        return err;
+        err = AVERROR_EXTERNAL;
+        goto end;
     }
 
     av_log(avctx, AV_LOG_VERBOSE, "Feedback units written, overrides: %i (SPS: %i PPS: %i)\n",
@@ -1168,22 +1169,23 @@
     h264_params_feedback.hasStdPPSOverrides = 1;
 
     /* No need to sync any overrides */
+    err = 0;
     if (!params_feedback.hasOverrides)
-        return 0;
+        goto end;
 
     /* Parse back tne units and override */
     err = parse_feedback_units(avctx, data, data_size,
                                h264_params_feedback.hasStdSPSOverrides,
                                h264_params_feedback.hasStdPPSOverrides);
     if (err < 0)
-        return err;
+        goto end;
 
     /* Create final session parameters */
     err = create_session_params(avctx);
-    if (err < 0)
-        return err;
 
-    return 0;
+end:
+    av_free(data);
+    return err;
 }
 
 static int vulkan_encode_h264_add_nal(AVCodecContext *avctx,

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan_encode_h265.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan_encode_h265.c Changed

@@ -1317,7 +1317,7 @@
             return AVERROR(ENOMEM);
     } else {
         av_log(avctx, AV_LOG_ERROR, "Unable to get feedback for H.265 units = %zu\n", data_size);
-        return err;
+        return AVERROR_EXTERNAL;
     }
 
     ret = vk->GetEncodedVideoSessionParametersKHR(s->hwctx->act_dev, &params_info,
@@ -1325,7 +1325,8 @@
                                                   &data_size, data);
     if (ret != VK_SUCCESS) {
         av_log(avctx, AV_LOG_ERROR, "Error writing feedback units\n");
-        return err;
+        err = AVERROR_EXTERNAL;
+        goto end;
     }
 
     av_log(avctx, AV_LOG_VERBOSE, "Feedback units written, overrides: %i (SPS: %i PPS: %i VPS: %i)\n",
@@ -1339,22 +1340,23 @@
     h265_params_feedback.hasStdPPSOverrides = 1;
 
     /* No need to sync any overrides */
+    err = 0;
     if (!params_feedback.hasOverrides)
-        return 0;
+        goto end;
 
     /* Parse back tne units and override */
     err = parse_feedback_units(avctx, data, data_size,
                                h265_params_feedback.hasStdSPSOverrides,
                                h265_params_feedback.hasStdPPSOverrides);
     if (err < 0)
-        return err;
+        goto end;
 
     /* Create final session parameters */
     err = create_session_params(avctx);
-    if (err < 0)
-        return err;
 
-    return 0;
+end:
+    av_free(data);
+    return err;
 }
 
 static int vulkan_encode_h265_add_nal(AVCodecContext *avctx,

ffmpeg-8.1.2.tar.xz/libavcodec/vulkan_hevc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vulkan_hevc.c Changed

@@ -757,6 +757,13 @@
             continue;
         }
 
+        if (nb_refs >= HEVC_MAX_REFS) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Too many reference frames in DPB: %d >= %d\n",
+                   nb_refs, HEVC_MAX_REFS);
+            return AVERROR_INVALIDDATA;
+        }
+
         err = vk_hevc_fill_pict(avctx, &hp->ref_srcidx, &vp->ref_slotsidx,
                                 &vp->refsidx, &hp->vkh265_refsidx,
                                 &hp->h265_refsidx, (HEVCFrame *)ref, 0, i);
@@ -766,6 +773,13 @@
         nb_refs++;
     }
 
+    if (h->rpsST_CURR_BEF.nb_refs > FF_ARRAY_ELEMS(hp->h265pic.RefPicSetStCurrBefore) ||
+        h->rpsST_CURR_AFT.nb_refs > FF_ARRAY_ELEMS(hp->h265pic.RefPicSetStCurrAfter)  ||
+        h->rpsLT_CURR.nb_refs     > FF_ARRAY_ELEMS(hp->h265pic.RefPicSetLtCurr)) {
+        av_log(avctx, AV_LOG_ERROR, "Too many reference frames\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     memset(hp->h265pic.RefPicSetStCurrBefore, 0xff, 8);
     for (int i = 0; i < h->rpsST_CURR_BEF.nb_refs; i++) {
         HEVCFrame *frame = h->rpsST_CURR_BEF.refi;
@@ -875,6 +889,9 @@
                 vksps_p.vcl_hdr, &vksps_p.ptl, &vksps_p.dpbm,
                 &vksps_p.pal, vksps_p.str, &vksps_p.ltr);
 
+        if (sps->vps->vps_num_hrd_parameters > HEVC_MAX_SUB_LAYERS)
+            return AVERROR_INVALIDDATA;
+
         vkvps_p.sls = vkvps_ps;
         set_vps(sps->vps, &vkvps, &vkvps_p.ptl, &vkvps_p.dpbm,
                 vkvps_p.hdr, vkvps_p.sls);

ffmpeg-8.1.2.tar.xz/libavcodec/vvc/dec.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vvc/dec.c Changed

@@ -86,6 +86,8 @@
 
         for (int i = 0; i < l->nb_tabs; i++) {
             Tab *t = l->tabs + i;
+            if (!t->size)
+                continue;
             *t->tab = l->zero ? av_mallocz(t->size) : av_malloc(t->size);
             if (!*t->tab)
                 return AVERROR(ENOMEM);
@@ -245,17 +247,15 @@
 
     tl_init(l, 0, changed);
 
-    for (int c_idx = 0; c_idx < c_end; c_idx++) {
-        const int w = width  >> (sps ? sps->hshiftc_idx : 0);
-        const int h = height >> (sps ? sps->vshiftc_idx : 0);
+    /* Add size 0 tabs for the components beyond c_end, so tl_free() frees
+     * tabs allocated under a previous, larger chroma format. */
+    for (int c_idx = 0; c_idx < VVC_MAX_SAMPLE_ARRAYS; c_idx++) {
+        const int active = c_idx < c_end;
+        const int w = active ? width  >> (sps ? sps->hshiftc_idx : 0) : 0;
+        const int h = active ? height >> (sps ? sps->vshiftc_idx : 0) : 0;
+        const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA;
         TL_ADD(sao_pixel_buffer_hc_idx, (w * 2 * ctu_height) << ps);
         TL_ADD(sao_pixel_buffer_vc_idx, (h * 2 * ctu_width)  << ps);
-    }
-
-    for (int c_idx = 0; c_idx < c_end; c_idx++) {
-        const int w = width  >> (sps ? sps->hshiftc_idx : 0);
-        const int h = height >> (sps ? sps->vshiftc_idx : 0);
-        const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA;
         for (int i = 0; i < 2; i++) {
             TL_ADD(alf_pixel_buffer_hc_idxi, (w * border_pixels * ctu_height) << ps);
             TL_ADD(alf_pixel_buffer_vc_idxi, h * ALF_PADDING_SIZE * ctu_width);
@@ -301,7 +301,7 @@
     const int has_ibc    = sps ? sps->r->sps_ibc_enabled_flag : 0;
     const int changed    = fc->tab.sz.chroma_format_idc != chroma_idc ||
         fc->tab.sz.ctu_height != ctu_height ||
-        fc->tab.sz.ctu_size != ctu_size ||
+        fc->tab.sz.ctu_size != ctu_size * ctu_size ||
         fc->tab.sz.pixel_shift != ps;
 
     fc->tab.sz.ibc_buffer_width = ctu_size ? 2 * MAX_CTU_SIZE * MAX_CTU_SIZE / ctu_size : 0;
@@ -369,13 +369,11 @@
     const VVCPPS *pps            = fc->ps.pps;
     const int ctu_count          = pps->ctb_count;
     const int pic_size_in_min_pu = pps->min_pu_width * pps->min_pu_height;
-    int ret;
 
     free_cus(fc);
 
-    ret = frame_context_for_each_tl(fc, tl_create);
-    if (ret < 0)
-        return ret;
+    if (frame_context_for_each_tl(fc, tl_create) < 0)
+        goto fail;
 
     // for error handling case, we may call free_cus before VVC_TASK_STAGE_INIT, so we need to set cus to 0 here
     memset(fc->tab.cus, 0, sizeof(*fc->tab.cus) * ctu_count);
@@ -386,7 +384,7 @@
         av_refstruct_pool_uninit(&fc->rpl_tab_pool);
         fc->rpl_tab_pool = av_refstruct_pool_alloc(ctu_count * sizeof(RefPicListTab), 0);
         if (!fc->rpl_tab_pool)
-            return AVERROR(ENOMEM);
+            goto fail;
     }
 
     if (fc->tab.sz.pic_size_in_min_pu != pic_size_in_min_pu) {
@@ -394,7 +392,7 @@
         fc->tab_dmvr_mvf_pool = av_refstruct_pool_alloc(
             pic_size_in_min_pu * sizeof(MvField), AV_REFSTRUCT_POOL_FLAG_ZERO_EVERY_TIME);
         if (!fc->tab_dmvr_mvf_pool)
-            return AVERROR(ENOMEM);
+            goto fail;
     }
 
     fc->tab.sz.ctu_count          = pps->ctb_count;
@@ -410,6 +408,11 @@
     fc->tab.sz.pixel_shift        = sps->pixel_shift;
 
     return 0;
+
+fail:
+    fc->tab.sz.ctu_count = 0;
+    pic_arrays_free(fc);
+    return AVERROR(ENOMEM);
 }
 
 int ff_vvc_per_frame_init(VVCFrameContext *fc)

ffmpeg-8.1.2.tar.xz/libavcodec/vvc/ps.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vvc/ps.c Changed

@@ -1439,7 +1439,7 @@
     sh->min_qt_sizeCHROMA = 1 << min_qt_log2_size_yCHROMA;
 }
 
-static void sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
+static int sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
 {
     if (sps->sps_entry_point_offsets_present_flag) {
         for (int i = 1, j = 0; i < sh->num_ctus_in_curr_slice; i++) {
@@ -1450,10 +1450,14 @@
             if (pps->ctb_to_row_bdctb_addr_y != pps->ctb_to_row_bdpre_ctb_addr_y ||
                 pps->ctb_to_col_bdctb_addr_x != pps->ctb_to_col_bdpre_ctb_addr_x ||
                 (ctb_addr_y != pre_ctb_addr_y && sps->sps_entropy_coding_sync_enabled_flag)) {
+                if (j >= VVC_MAX_ENTRY_POINTS)
+                    return AVERROR_INVALIDDATA;
                 sh->entry_point_start_ctuj++ = i;
             }
         }
     }
+
+    return 0;
 }
 
 static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps)
@@ -1473,7 +1477,9 @@
     sh_qp_y(sh, pps, ph);
     sh_deblock_offsets(sh);
     sh_partition_constraints(sh, sps, ph);
-    sh_entry_points(sh, sps, fps->pps);
+    ret = sh_entry_points(sh, sps, fps->pps);
+    if (ret < 0)
+        return ret;
 
     return 0;
 }

ffmpeg-8.1.2.tar.xz/libavcodec/vvc/refs.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vvc/refs.c Changed

@@ -381,6 +381,12 @@
 
     for (int i = 0; i < FF_ARRAY_ELEMS(fc->DPB); i++) {
         VVCFrame *ref = &fc->DPBi;
+
+        // In the specification, the current frame is not considered part of
+        // the DPB at this stage, therefore we treat it as if it's not there.
+        if (ref == fc->ref)
+            continue;
+
         if (ref->frame->buf0 && ref->sequence == s->seq_decode) {
             if ((ref->poc & mask) == poc)
                 return ref;
@@ -451,12 +457,14 @@
 static int add_candidate_ref(VVCContext *s, VVCFrameContext *fc, RefPicList *list,
                              int poc, int ref_flag, uint8_t use_msb)
 {
-    VVCFrame *ref   = find_ref_idx(s, fc, poc, use_msb);
     VVCRefPic *refp = &list->refslist->nb_refs;
+    VVCFrame *ref;
 
-    if (ref == fc->ref || list->nb_refs >= VVC_MAX_REF_ENTRIES)
+    if (use_msb && poc == fc->ref->poc || list->nb_refs >= VVC_MAX_REF_ENTRIES)
         return AVERROR_INVALIDDATA;
 
+    ref = find_ref_idx(s, fc, poc, use_msb);
+
     if (!IS_CVSS(s)) {
         const bool ref_corrupt = !ref || (ref->flags & VVC_FRAME_FLAG_CORRUPT);
         const bool recovering  = s->no_output_before_recovery_flag &&

ffmpeg-8.1.2.tar.xz/libavcodec/vvc/thread.c -> ffmpeg-8.1.3.tar.xz/libavcodec/vvc/thread.c Changed

ffmpeg-8.1.2.tar.xz/libavcodec/wavpackenc.c -> ffmpeg-8.1.3.tar.xz/libavcodec/wavpackenc.c Changed

ffmpeg-8.1.2.tar.xz/libavdevice/android_camera.c -> ffmpeg-8.1.3.tar.xz/libavdevice/android_camera.c Changed

ffmpeg-8.1.2.tar.xz/libavdevice/version.h -> ffmpeg-8.1.3.tar.xz/libavdevice/version.h Changed

ffmpeg-8.1.2.tar.xz/libavfilter/Makefile -> ffmpeg-8.1.3.tar.xz/libavfilter/Makefile Changed

ffmpeg-8.1.2.tar.xz/libavfilter/aarch64/vf_bwdif_init_aarch64.c -> ffmpeg-8.1.3.tar.xz/libavfilter/aarch64/vf_bwdif_init_aarch64.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/af_acrossover.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_acrossover.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/af_adeclick.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_adeclick.c Changed

@@ -130,8 +130,8 @@
         return AVERROR(ENOMEM);
 
     {
-        double *tx_in2, *tx_out2;
-        AVTXContext *tx, *itx;
+        double *tx_in2 = { NULL }, *tx_out2 = { NULL };
+        AVTXContext *tx = NULL, *itx = NULL;
         av_tx_fn tx_fn, itx_fn;
         int ret, tx_size;
         double scale;
@@ -141,19 +141,21 @@
         scale = 1.0;
         ret = av_tx_init(&tx, &tx_fn, AV_TX_DOUBLE_RDFT, 0, tx_size, &scale, 0);
         if (ret < 0)
-            return ret;
+            goto tx_end;
 
         scale = 1.0 / tx_size;
         ret = av_tx_init(&itx, &itx_fn, AV_TX_DOUBLE_RDFT, 1, tx_size, &scale, 0);
         if (ret < 0)
-            return ret;
+            goto tx_end;
 
         tx_in0  = av_calloc(tx_size + 2, sizeof(*tx_in0));
         tx_in1  = av_calloc(tx_size + 2, sizeof(*tx_in1));
         tx_out0 = av_calloc(tx_size + 2, sizeof(*tx_out0));
         tx_out1 = av_calloc(tx_size + 2, sizeof(*tx_out1));
-        if (!tx_in0 || !tx_in1 || !tx_out0 || !tx_out1)
-            return AVERROR(ENOMEM);
+        if (!tx_in0 || !tx_in1 || !tx_out0 || !tx_out1) {
+            ret = AVERROR(ENOMEM);
+            goto tx_end;
+        }
 
         for (int n = 0; n < s->window_size - s->hop_size; n++)
             tx_in0n = 1.0;
@@ -180,6 +182,7 @@
         for (int n = 0; n < s->window_size; n++)
             s->window_func_lutn = tx_out0n * scale;
 
+tx_end:
         av_tx_uninit(&tx);
         av_tx_uninit(&itx);
 
@@ -187,6 +190,9 @@
         av_freep(&tx_in1);
         av_freep(&tx_out0);
         av_freep(&tx_out1);
+
+        if (ret < 0)
+            return ret;
     }
 
     av_frame_free(&s->in);

ffmpeg-8.1.2.tar.xz/libavfilter/af_aecho.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_aecho.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/af_aiir.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_aiir.c Changed

@@ -377,7 +377,7 @@
         }
 
         p = NULL;
-        if (av_sscanf(arg, "%lf", &s->iiri.g) != 1) {
+        if (av_sscanf(arg, "%lf", &s->iiri.g) != 1 || !isfinite(s->iiri.g)) {
             av_log(ctx, AV_LOG_ERROR, "Invalid gains supplied: %s\n", arg);
             av_freep(&old_str);
             return AVERROR(EINVAL);
@@ -404,7 +404,7 @@
             break;
 
         p = NULL;
-        if (av_sscanf(arg, "%lf", &dsti) != 1) {
+        if (av_sscanf(arg, "%lf", &dsti) != 1 || !isfinite(dsti)) {
             av_log(ctx, AV_LOG_ERROR, "Invalid coefficients supplied: %s\n", arg);
             av_freep(&old_str);
             return AVERROR(EINVAL);
@@ -429,7 +429,8 @@
             break;
 
         p = NULL;
-        if (av_sscanf(arg, format, &dsti*2, &dsti*2+1) != 2) {
+        if (av_sscanf(arg, format, &dsti*2, &dsti*2+1) != 2 ||
+            !isfinite(dsti*2) || !isfinite(dsti*2+1)) {
             av_log(ctx, AV_LOG_ERROR, "Invalid coefficients supplied: %s\n", arg);
             av_freep(&old_str);
             return AVERROR(EINVAL);

ffmpeg-8.1.2.tar.xz/libavfilter/af_arnndn.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_arnndn.c Changed

@@ -1023,7 +1023,7 @@
     float E = 0;
     float *ceps_0, *ceps_1, *ceps_2;
     float spec_variability = 0;
-    LOCAL_ALIGNED_32(float, Ly, NB_BANDS);
+    LOCAL_ALIGNED_32(float, Ly, FFALIGN(NB_BANDS, 4));
     LOCAL_ALIGNED_32(float, p, WINDOW_SIZE);
     float pitch_bufPITCH_BUF_SIZE>>1;
     int pitch_index;
@@ -1057,6 +1057,7 @@
     for (int i = 0; i < NB_BANDS; i++)
         Expi = Expi / sqrtf(.001f+Exi*Epi);
 
+    memset(Exp + NB_BANDS, 0, (FFALIGN(NB_BANDS, 4) - NB_BANDS) * sizeof(*Exp));
     dct(s, tmp, Exp);
 
     for (int i = 0; i < NB_DELTA_CEPS; i++)
@@ -1082,6 +1083,7 @@
         return 1;
     }
 
+    memset(Ly + NB_BANDS, 0, (FFALIGN(NB_BANDS, 4) - NB_BANDS) * sizeof(*Ly));
     dct(s, features, Ly);
     features0 -= 12;
     features1 -= 4;
@@ -1364,7 +1366,7 @@
     AVComplexFloat PWINDOW_SIZE;
     float xFRAME_SIZE;
     float ExNB_BANDS, EpNB_BANDS;
-    LOCAL_ALIGNED_32(float, Exp, NB_BANDS);
+    LOCAL_ALIGNED_32(float, Exp, FFALIGN(NB_BANDS, 4));
     float featuresNB_FEATURES;
     float gNB_BANDS;
     float gfFREQ_SIZE;

ffmpeg-8.1.2.tar.xz/libavfilter/af_firequalizer.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_firequalizer.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/af_pan.c -> ffmpeg-8.1.3.tar.xz/libavfilter/af_pan.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/afir_template.c -> ffmpeg-8.1.3.tar.xz/libavfilter/afir_template.c Changed

@@ -140,7 +140,7 @@
     const ftype *in = (const ftype *)s->in->extended_datach + ioffset;
     ftype *blockout, *ptr = (ftype *)out->extended_datach + offset;
     const int min_part_size = s->min_part_size;
-    const int nb_samples = FFMIN(min_part_size, out->nb_samples - offset);
+    const int nb_samples = FFMIN(min_part_size, s->in->nb_samples - ioffset);
     const int nb_segments = s->nb_segmentsselir;
     const float dry_gain = s->dry_gain;
     const float wet_gain = s->wet_gain;
@@ -246,6 +246,8 @@
                              int min_part_size, int ch, int offset,
                              int prev_selir, int selir)
 {
+    const int nb_samples = FFMIN(min_part_size, s->in->nb_samples - offset);
+
     if (ctx->is_disabled || s->prev_is_disabled) {
         const ftype *in = (const ftype *)s->in->extended_datach + offset;
         const ftype *xfade0 = (const ftype *)s->xfade0->extended_datach;
@@ -257,15 +259,15 @@
         if (ctx->is_disabled && !s->prev_is_disabled) {
             memset(src0, 0, min_part_size * sizeof(ftype));
             fn(fir_quantum)(ctx, s->fadein0, ch, offset, 0, selir);
-            for (int n = 0; n < min_part_size; n++)
+            for (int n = 0; n < nb_samples; n++)
                 dstn = xfade1n * src0n + xfade0n * inn;
         } else if (!ctx->is_disabled && s->prev_is_disabled) {
             memset(src1, 0, min_part_size * sizeof(ftype));
             fn(fir_quantum)(ctx, s->fadein1, ch, offset, 0, selir);
-            for (int n = 0; n < min_part_size; n++)
+            for (int n = 0; n < nb_samples; n++)
                 dstn = xfade1n * inn + xfade0n * src1n;
         } else {
-            memcpy(dst, in, sizeof(ftype) * min_part_size);
+            memcpy(dst, in, sizeof(ftype) * nb_samples);
         }
     } else if (prev_selir != selir && s->loadingch != 0) {
         const ftype *xfade0 = (const ftype *)s->xfade0->extended_datach;
@@ -281,11 +283,11 @@
         fn(fir_quantum)(ctx, s->fadein1, ch, offset, 0, selir);
 
         if (s->loadingch > s->max_offsetselir) {
-            for (int n = 0; n < min_part_size; n++)
+            for (int n = 0; n < nb_samples; n++)
                 dstn = xfade1n * src0n + xfade0n * src1n;
             s->loadingch = 0;
         } else {
-            memcpy(dst, src0, min_part_size * sizeof(ftype));
+            memcpy(dst, src0, nb_samples * sizeof(ftype));
         }
     } else {
         fn(fir_quantum)(ctx, out, ch, offset, offset, selir);

ffmpeg-8.1.2.tar.xz/libavfilter/dnn/dnn_backend_common.c -> ffmpeg-8.1.3.tar.xz/libavfilter/dnn/dnn_backend_common.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/dnn/dnn_backend_common.h -> ffmpeg-8.1.3.tar.xz/libavfilter/dnn/dnn_backend_common.h Changed

ffmpeg-8.1.2.tar.xz/libavfilter/dnn/dnn_backend_openvino.c -> ffmpeg-8.1.3.tar.xz/libavfilter/dnn/dnn_backend_openvino.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/dnn/dnn_backend_tf.c -> ffmpeg-8.1.3.tar.xz/libavfilter/dnn/dnn_backend_tf.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/dnn/dnn_backend_torch.cpp -> ffmpeg-8.1.3.tar.xz/libavfilter/dnn/dnn_backend_torch.cpp Changed

ffmpeg-8.1.2.tar.xz/libavfilter/f_metadata.c -> ffmpeg-8.1.3.tar.xz/libavfilter/f_metadata.c Changed

ffmpeg-8.1.3.tar.xz/libavfilter/scale_filters.c Added

ffmpeg-8.1.2.tar.xz/libavfilter/vaf_spectrumsynth.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vaf_spectrumsynth.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/version.h -> ffmpeg-8.1.3.tar.xz/libavfilter/version.h Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_boxblur.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_boxblur.c Changed

@@ -25,6 +25,7 @@
  * Ported from MPlayer libmpcodecs/vf_boxblur.c.
  */
 
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 #include "libavutil/mem.h"
 #include "libavutil/opt.h"
@@ -65,6 +66,7 @@
     for (fmt = 0; av_pix_fmt_desc_get(fmt); fmt++) {
         const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt);
         if (!(desc->flags & (AV_PIX_FMT_FLAG_HWACCEL | AV_PIX_FMT_FLAG_BITSTREAM | AV_PIX_FMT_FLAG_PAL)) &&
+            desc->comp0.depth <= 16 &&
             (desc->flags & AV_PIX_FMT_FLAG_PLANAR || desc->nb_components == 1) &&
             (!(desc->flags & AV_PIX_FMT_FLAG_BE) == !HAVE_BIGENDIAN || desc->comp0.depth == 8) &&
             (ret = ff_add_format(&formats, fmt)) < 0)
@@ -163,7 +165,10 @@
                         int len, int radius, int pixsize)
 {
     if (pixsize == 1) blur8 (dst, dst_step   , src, src_step   , len, radius);
-    else              blur16((uint16_t*)dst, dst_step>>1, (const uint16_t*)src, src_step>>1, len, radius);
+    else if (pixsize == 2)
+                      blur16((uint16_t*)dst, dst_step>>1, (const uint16_t*)src, src_step>>1, len, radius);
+    else
+        av_assert0(0);
 }
 
 static inline void blur_power(uint8_t *dst, int dst_step, const uint8_t *src, int src_step,

ffmpeg-8.1.2.tar.xz/libavfilter/vf_bwdif.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_bwdif.c Changed

@@ -77,24 +77,15 @@
             uint8_t *next = &yadif->next->datatd->planey * linesize;
             uint8_t *dst  = &td->frame->datatd->planey * td->frame->linesizetd->plane;
             if (yadif->current_field == YADIF_FIELD_END) {
-                if ((y < 3) || ((y + 3) >= td->h)) {
-                    s->dsp.filter_edge(dst, prev, cur, next, td->w,
-                                   (y + df) < td->h ? refs : -refs,
-                                   y > (df - 1) ? -refs : refs,
-                                   refs << 1, -(refs << 1),
-                                   td->parity ^ td->tff, clip_max,
-                                   (y < 2) || ((y + 3) > td->h) ? 0 : 1);
-                } else {
-                    s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs,
-                                    y > (df - 1) ? -refs : refs,
-                                    (y + 3*df) < td->h ? 3 * refs : -refs,
-                                    y > (3*df - 1) ? -3 * refs : refs,
-                                    td->parity ^ td->tff, clip_max);
-                }
+                s->dsp.filter_intra(dst, cur, td->w, (y + 1) < td->h ? refs : -refs,
+                                y > 0 ? -refs : refs,
+                                (y + 3) < td->h ? 3 * refs : -refs,
+                                y > 2 ? -3 * refs : refs,
+                                td->parity ^ td->tff, clip_max);
             } else if ((y < 4) || ((y + 5) > td->h)) {
                 s->dsp.filter_edge(dst, prev, cur, next, td->w,
-                               (y + df) < td->h ? refs : -refs,
-                               y > (df - 1) ? -refs : refs,
+                               (y + 1) < td->h ? refs : -refs,
+                               y > 0 ? -refs : refs,
                                refs << 1, -(refs << 1),
                                td->parity ^ td->tff, clip_max,
                                (y < 2) || ((y + 3) > td->h) ? 0 : 1);

ffmpeg-8.1.2.tar.xz/libavfilter/vf_colorconstancy.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_colorconstancy.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_decimate.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_decimate.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_floodfill.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_floodfill.c Changed

@@ -39,8 +39,8 @@
     int d4;
 
     int nb_planes;
-    int back, front;
     Points *points;
+    unsigned int points_size;
 
     int (*is_same)(const AVFrame *frame, int x, int y,
                    unsigned s0, unsigned s1, unsigned s2, unsigned s3);
@@ -270,11 +270,6 @@
        }
     }
 
-    s->front = s->back = 0;
-    s->points = av_calloc(inlink->w * inlink->h, 4 * sizeof(Points));
-    if (!s->points)
-        return AVERROR(ENOMEM);
-
     return 0;
 }
 
@@ -292,7 +287,22 @@
     int s3 = s->s3;
     const int w = frame->width;
     const int h = frame->height;
+    size_t nb_points, points_size;
     int i, ret;
+    int front = 0;
+
+    if (w > UINT16_MAX + 1 || h > UINT16_MAX + 1 ||
+        av_size_mult(w, h, &nb_points) < 0 ||
+        av_size_mult(nb_points, 4 * sizeof(*s->points), &points_size) < 0) {
+        av_frame_free(&frame);
+        return AVERROR(EINVAL);
+    }
+
+    av_fast_malloc(&s->points, &s->points_size, points_size);
+    if (!s->points) {
+        av_frame_free(&frame);
+        return AVERROR(ENOMEM);
+    }
 
     if (is_inside(s->x, s->y, w, h)) {
         s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3);
@@ -310,9 +320,9 @@
             goto end;
 
         if (s->is_same(frame, s->x, s->y, s0, s1, s2, s3)) {
-            s->pointss->front.x = s->x;
-            s->pointss->front.y = s->y;
-            s->front++;
+            s->pointsfront.x = s->x;
+            s->pointsfront.y = s->y;
+            front++;
         }
 
         if (ret = ff_inlink_make_frame_writable(link, &frame)) {
@@ -320,34 +330,34 @@
             return ret;
         }
 
-        while (s->front > s->back) {
+        while (front > 0) {
             int x, y;
 
-            s->front--;
-            x = s->pointss->front.x;
-            y = s->pointss->front.y;
+            front--;
+            x = s->pointsfront.x;
+            y = s->pointsfront.y;
 
             if (s->is_same(frame, x, y, s0, s1, s2, s3)) {
                 s->set_pixel(frame, x, y, d0, d1, d2, d3);
 
                 if (is_inside(x + 1, y, w, h)) {
-                    s->pointss->front  .x = x + 1;
-                    s->pointss->front++.y = y;
+                    s->pointsfront  .x = x + 1;
+                    s->pointsfront++.y = y;
                 }
 
                 if (is_inside(x - 1, y, w, h)) {
-                    s->pointss->front  .x = x - 1;
-                    s->pointss->front++.y = y;
+                    s->pointsfront  .x = x - 1;
+                    s->pointsfront++.y = y;
                 }
 
                 if (is_inside(x, y + 1, w, h)) {
-                    s->pointss->front  .x = x;
-                    s->pointss->front++.y = y + 1;
+                    s->pointsfront  .x = x;
+                    s->pointsfront++.y = y + 1;
                 }
 
                 if (is_inside(x, y - 1, w, h)) {
-                    s->pointss->front  .x = x;
-                    s->pointss->front++.y = y - 1;
+                    s->pointsfront  .x = x;
+                    s->pointsfront++.y = y - 1;
                 }
             }
         }

ffmpeg-8.1.2.tar.xz/libavfilter/vf_hqdn3d.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_hqdn3d.c Changed

@@ -165,12 +165,8 @@
             case 14: ret = denoise_depth(__VA_ARGS__, 14); break;             \
             case 16: ret = denoise_depth(__VA_ARGS__, 16); break;             \
         }                                                                     \
-        if (ret < 0) {                                                        \
-            av_frame_free(&out);                                              \
-            if (!direct)                                                      \
-                av_frame_free(&in);                                           \
+        if (ret < 0)                                                          \
             return ret;                                                       \
-        }                                                                     \
     } while (0)
 
 static void precalc_coefs(double dist25, int depth, int16_t *ct)
@@ -283,12 +279,15 @@
     ff_hqdn3d_init_x86(s);
 #endif
 
+    s->format = inlink->format;
+    s->width  = inlink->w;
+    s->height = inlink->h;
+
     return 0;
 }
 
 typedef struct ThreadData {
     AVFrame *in, *out;
-    int direct;
 } ThreadData;
 
 static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs)
@@ -297,7 +296,6 @@
     const ThreadData *td = data;
     AVFrame *out = td->out;
     AVFrame *in = td->in;
-    int direct = td->direct;
 
     denoise(s, in->datajob_nr, out->datajob_nr,
                 s->linejob_nr, &s->frame_prevjob_nr,
@@ -314,10 +312,21 @@
 {
     AVFilterContext *ctx  = inlink->dst;
     AVFilterLink *outlink = ctx->outputs0;
+    HQDN3DContext *s = ctx->priv;
 
     AVFrame *out;
     int direct = av_frame_is_writable(in) && !ctx->is_disabled;
     ThreadData td;
+    int ret3;
+
+    if (in->format != s->format ||
+        in->width  != s->width  ||
+        in->height != s->height) {
+        av_log(ctx, AV_LOG_ERROR,
+               "Frame size or format changed without filter graph reinitialization\n");
+        av_frame_free(&in);
+        return AVERROR(EINVAL);
+    }
 
     if (direct) {
         out = in;
@@ -333,9 +342,16 @@
 
     td.in = in;
     td.out = out;
-    td.direct = direct;
     /* one thread per plane */
-    ff_filter_execute(ctx, do_denoise, &td, NULL, 3);
+    ff_filter_execute(ctx, do_denoise, &td, ret, 3);
+    for (int i = 0; i < FF_ARRAY_ELEMS(ret); i++) {
+        if (reti < 0) {
+            av_frame_free(&out);
+            if (!direct)
+                av_frame_free(&in);
+            return reti;
+        }
+    }
 
     if (ctx->is_disabled) {
         av_frame_free(&out);

ffmpeg-8.1.2.tar.xz/libavfilter/vf_hqdn3d.h -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_hqdn3d.h Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_lut3d.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_lut3d.c Changed

@@ -644,7 +644,6 @@
     int ret, i, j, k, size, size2;
 
     lut3d->lutsize = size = 33;
-    size2 = size * size;
 
     NEXT_LINE(skip_line(line));
     if (!strncmp(line, "3DLUTSIZE ", 10)) {
@@ -656,6 +655,7 @@
     ret = allocate_3dlut(ctx, size, 0);
     if (ret < 0)
         return ret;
+    size2 = lut3d->lutsize2;
 
     for (k = 0; k < size; k++) {
         for (j = 0; j < size; j++) {
@@ -681,13 +681,13 @@
 
     while (fgets(line, sizeof(line), f)) {
         if (!strncmp(line, "LUT_3D_SIZE", 11)) {
-            int ret, i, j, k;
+            int ret, i, j, k, size2;
             const int size = strtol(line + 12, NULL, 0);
-            const int size2 = size * size;
 
             ret = allocate_3dlut(ctx, size, 0);
             if (ret < 0)
                 return ret;
+            size2 = lut3d->lutsize2;
 
             for (k = 0; k < size; k++) {
                 for (j = 0; j < size; j++) {
@@ -999,7 +999,6 @@
             }
 
             size = size_r;
-            size2 = size * size;
 
             if (prelut_sizes0 && prelut_sizes1 && prelut_sizes2)
                 prelut = 1;
@@ -1007,6 +1006,7 @@
             ret = allocate_3dlut(ctx, size, prelut);
             if (ret < 0)
                 goto end;
+            size2 = lut3d->lutsize2;
 
             for (int k = 0; k < size; k++) {
                 for (int j = 0; j < size; j++) {

ffmpeg-8.1.2.tar.xz/libavfilter/vf_quirc.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_quirc.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_removelogo.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_removelogo.c Changed

@@ -311,22 +311,18 @@
        the filter is applied, the mask size is determined on a pixel
        by pixel basis, with pixels nearer the edge of the logo getting
        smaller mask sizes. */
-    mask = (int ***)av_malloc_array(s->max_mask_size + 1, sizeof(int **));
+    mask = av_calloc(s->max_mask_size + 1, sizeof(*mask));
     if (!mask)
         return AVERROR(ENOMEM);
 
     for (a = 0; a <= s->max_mask_size; a++) {
-        maska = (int **)av_malloc_array((a * 2) + 1, sizeof(int *));
-        if (!maska) {
-            av_free(mask);
-            return AVERROR(ENOMEM);
-        }
+        maska = av_calloc((a * 2) + 1, sizeof(*maska));
+        if (!maska)
+            goto mask_fail;
         for (b = -a; b <= a; b++) {
-            maskab + a = (int *)av_malloc_array((a * 2) + 1, sizeof(int));
-            if (!maskab + a) {
-                av_free(mask);
-                return AVERROR(ENOMEM);
-            }
+            maskab + a = av_malloc_array((a * 2) + 1, sizeof(*maskab + a));
+            if (!maskab + a)
+                goto mask_fail;
             for (c = -a; c <= a; c++) {
                 if ((b * b) + (c * c) <= (a * a)) /* Circular 0/1 mask. */
                     maskab + ac + a = 1;
@@ -351,6 +347,16 @@
     SHOW_LOGO_INFO(half);
 
     return 0;
+
+mask_fail:
+    for (a = 0; a <= s->max_mask_size; a++) {
+        if (maska)
+            for (b = 0; b < (a * 2) + 1; b++)
+                av_free(maskab);
+        av_free(maska);
+    }
+    av_free(mask);
+    return AVERROR(ENOMEM);
 }
 
 static int config_props_input(AVFilterLink *inlink)

ffmpeg-8.1.2.tar.xz/libavfilter/vf_scale_cuda.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_scale_cuda.c Changed

@@ -22,14 +22,19 @@
 
 #include <float.h>
 #include <stdio.h>
+#include <string.h>
 
 #include "libavutil/common.h"
 #include "libavutil/hwcontext.h"
 #include "libavutil/hwcontext_cuda_internal.h"
 #include "libavutil/cuda_check.h"
 #include "libavutil/internal.h"
+#include "libavutil/mem.h"
 #include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
+#include "libavutil/refstruct.h"
+
+#include "libswscale/filters.h"
 
 #include "avfilter.h"
 #include "filters.h"
@@ -51,11 +56,15 @@
     {AV_PIX_FMT_YUV420P10,"planar10"},
     {AV_PIX_FMT_YUV422P10,"planar10"},
     {AV_PIX_FMT_YUV444P10,"planar10"},
+    {AV_PIX_FMT_YUV444P10MSB,"planar16"},
+    {AV_PIX_FMT_YUV444P12MSB,"planar16"},
     {AV_PIX_FMT_YUV444P16,"planar16"},
     {AV_PIX_FMT_NV12,     "semiplanar8"},
     {AV_PIX_FMT_NV16,     "semiplanar8"},
     {AV_PIX_FMT_P010,     "semiplanar10"},
     {AV_PIX_FMT_P210,     "semiplanar10"},
+    {AV_PIX_FMT_P012,     "semiplanar16"},
+    {AV_PIX_FMT_P212,     "semiplanar16"},
     {AV_PIX_FMT_P016,     "semiplanar16"},
     {AV_PIX_FMT_P216,     "semiplanar16"},
     {AV_PIX_FMT_0RGB32,   "bgr0"},
@@ -81,6 +90,30 @@
     INTERP_ALGO_COUNT
 };
 
+enum {
+    FILTER_OUT,
+    FILTER_TMP,
+    FILTER_NB,
+};
+
+typedef struct CUDAScaleFilter {
+    CUdeviceptr weights; ///< floatdst_sizefilter_size
+    CUdeviceptr offsets; ///< intdst_size
+    int filter_size;
+    int dst_size;
+} CUDAScaleFilter;
+
+typedef struct CUDATex {
+    CUtexObject tex4;
+    CUdeviceptr data4;
+    int         linesize4;
+    int         width, height;
+    int         log2_chroma_w, log2_chroma_h;
+    int         crop_left, crop_top, crop_width, crop_height;
+    int         color_range;
+    int         external_data;
+} CUDATex;
+
 typedef struct CUDAScaleContext {
     const AVClass *class;
 
@@ -112,14 +145,19 @@
 
     CUcontext   cu_ctx;
     CUmodule    cu_module;
-    CUfunction  cu_func;
-    CUfunction  cu_func_uv;
+    CUfunction  cu_funcFILTER_NB;
+    CUfunction  cu_func_uvFILTER_NB;
     CUstream    cu_stream;
 
     int interp_algo;
     int interp_use_linear;
     int interp_as_integer;
 
+    CUDAScaleFilter filtersFILTER_NB;
+    CUDAScaleFilter filters_uvFILTER_NB;
+    CUDATex inter_tex;
+    int use_filters; /* -1 for auto */
+
     float param;
 } CUDAScaleContext;
 
@@ -138,17 +176,48 @@
     return 0;
 }
 
+static void filter_uninit(CudaFunctions *cu, CUDAScaleFilter *filter)
+{
+    if (filter->weights)
+        cu->cuMemFree(filter->weights);
+    if (filter->offsets)
+        cu->cuMemFree(filter->offsets);
+    memset(filter, 0, sizeof(*filter));
+}
+
+static void cuda_tex_uninit(CudaFunctions *cu, CUDATex *t)
+{
+    for (int i = 0; i < FF_ARRAY_ELEMS(t->tex); i++) {
+        if (t->texi)
+            cu->cuTexObjectDestroy(t->texi);
+        if (t->datai && !t->external_data)
+            cu->cuMemFree(t->datai);
+    }
+
+    memset(t, 0, sizeof(*t));
+}
+
 static av_cold void cudascale_uninit(AVFilterContext *ctx)
 {
     CUDAScaleContext *s = ctx->priv;
 
-    if (s->hwctx && s->cu_module) {
+    if (s->hwctx) {
         CudaFunctions *cu = s->hwctx->internal->cuda_dl;
         CUcontext dummy;
 
         CHECK_CU(cu->cuCtxPushCurrent(s->hwctx->cuda_ctx));
-        CHECK_CU(cu->cuModuleUnload(s->cu_module));
-        s->cu_module = NULL;
+
+        cuda_tex_uninit(cu, &s->inter_tex);
+        for (int i = 0; i < FF_ARRAY_ELEMS(s->filters); i++) {
+            filter_uninit(cu, &s->filtersi);
+            filter_uninit(cu, &s->filters_uvi);
+        }
+
+        if (s->cu_module) {
+            CHECK_CU(cu->cuModuleUnload(s->cu_module));
+            s->cu_module = NULL;
+        }
+
         CHECK_CU(cu->cuCtxPopCurrent(&dummy));
     }
 
@@ -194,6 +263,69 @@
     return ret;
 }
 
+static av_cold int inter_buf_init(AVFilterContext *ctx, int out_width, int in_height)
+{
+    CUDAScaleContext *s = ctx->priv;
+    CudaFunctions *cu = s->hwctx->internal->cuda_dl;
+    int ret = 0;
+
+    cuda_tex_uninit(cu, &s->inter_tex);
+    s->inter_tex = (CUDATex) {
+        .width          = out_width,
+        .height         = in_height,
+        .crop_width     = out_width,
+        .crop_height    = in_height,
+        .log2_chroma_w  = s->out_desc->log2_chroma_w,
+        .log2_chroma_h  = s->in_desc->log2_chroma_h,
+    };
+
+    for (int i = 0; i < s->in_planes; i++) {
+        const int is_chroma = i == 1 || i == 2;
+        const int sub_x   = is_chroma ? s->inter_tex.log2_chroma_w : 0;
+        const int sub_y   = is_chroma ? s->inter_tex.log2_chroma_h : 0;
+        const int plane_w = AV_CEIL_RSHIFT(out_width, sub_x);
+        const int plane_h = AV_CEIL_RSHIFT(in_height, sub_y);
+        const int sizeof_pixel = (s->in_plane_depthsi <= 8 ? 1 : 2) *
+                                  s->in_plane_channelsi;
+
+        size_t pitch;
+        ret = CHECK_CU(cu->cuMemAllocPitch(&s->inter_tex.datai, &pitch,
+                                           (size_t) plane_w * sizeof_pixel,
+                                           plane_h, 16));
+        if (ret < 0)
+            goto fail;
+        s->inter_tex.linesizei = pitch;
+
+        CUDA_TEXTURE_DESC tex_desc = {
+            /* inter tex is always read as float */
+            .filterMode = CU_TR_FILTER_MODE_POINT,
+        };
+
+        CUDA_RESOURCE_DESC res_desc = {
+            .resType = CU_RESOURCE_TYPE_PITCH2D,
+            .res.pitch2D.format = s->in_plane_depthsi <= 8 ?
+                                  CU_AD_FORMAT_UNSIGNED_INT8 :
+                                  CU_AD_FORMAT_UNSIGNED_INT16,
+            .res.pitch2D.numChannels  = s->in_plane_channelsi,
+            .res.pitch2D.devPtr       = s->inter_tex.datai,
+            .res.pitch2D.pitchInBytes = pitch,
+            .res.pitch2D.width        = plane_w,
+            .res.pitch2D.height       = plane_h,
+        };
+
+        ret = CHECK_CU(cu->cuTexObjectCreate(&s->inter_tex.texi, &res_desc,
+                                             &tex_desc, NULL));
+        if (ret < 0)
+            goto fail;
+    }

ffmpeg-8.1.2.tar.xz/libavfilter/vf_scale_cuda.cu -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_scale_cuda.cu Changed

@@ -28,7 +28,9 @@
                                    int dst_width, int dst_height,
                                    int src_left, int src_top,
                                    int src_width, int src_height,
-                                   int bit_depth, float param);
+                                   int bit_depth, float param,
+                                   const float *weights, const int *offsets,
+                                   int filter_size);
 
 // --- CONVERSION LOGIC ---
 
@@ -90,14 +92,16 @@
     __device__ static inline void N(cudaTextureObject_t src_tex4, T *dst4, int xo, int yo, \
                                     int dst_width, int dst_height, int dst_pitch,              \
                                     int src_left, int src_top, int src_width, int src_height,  \
-                                    float param, int mpeg_range)
+                                    float param, int mpeg_range,                               \
+                                    const float *weights, const int *offsets, int filter_size)
 
 #define SUB_F(m, plane) \
     subsample_func_##m(src_texplane, xo, yo, \
                        dst_width, dst_height,  \
                        src_left, src_top,      \
                        src_width, src_height,  \
-                       in_bit_depth, param)
+                       in_bit_depth, param,    \
+                       weights, offsets, filter_size)
 
 // FFmpeg passes pitch in bytes, CUDA uses potentially larger types
 #define FIXED_PITCH \
@@ -1095,7 +1099,9 @@
                                              int dst_width, int dst_height,
                                              int src_left, int src_top,
                                              int src_width, int src_height,
-                                             int bit_depth, float param)
+                                             int bit_depth, float param,
+                                             const float *weights, const int *offsets,
+                                             int filter_size)
 {
     float hscale = (float)src_width / (float)dst_width;
     float vscale = (float)src_height / (float)dst_height;
@@ -1111,7 +1117,9 @@
                                               int dst_width, int dst_height,
                                               int src_left, int src_top,
                                               int src_width, int src_height,
-                                              int bit_depth, float param)
+                                              int bit_depth, float param,
+                                              const float *weights, const int *offsets,
+                                              int filter_size)
 {
     float hscale = (float)src_width / (float)dst_width;
     float vscale = (float)src_height / (float)dst_height;
@@ -1143,7 +1151,9 @@
                                              int dst_width, int dst_height,
                                              int src_left, int src_top,
                                              int src_width, int src_height,
-                                             int bit_depth, float param)
+                                             int bit_depth, float param,
+                                             const float *weights, const int *offsets,
+                                             int filter_size)
 {
     float hscale = (float)src_width / (float)dst_width;
     float vscale = (float)src_height / (float)dst_height;
@@ -1173,6 +1183,43 @@
 #undef PIX
 }
 
+enum ScaleDir {
+    SCALE_DIR_X,
+    SCALE_DIR_Y,
+};
+
+template<typename T, int dir>
+__device__ static inline T Subsample_Generic(cudaTextureObject_t tex,
+                                             int xo, int yo,
+                                             int dst_width, int dst_height,
+                                             int src_left, int src_top,
+                                             int src_width, int src_height,
+                                             int bit_depth, float param,
+                                             const float *weights, const int *offsets,
+                                             int filter_size)
+{
+    const float factor = bit_depth > 8 ? 0xFFFF : 0xFF;
+
+    floatT sum;
+    vec_set_scalar(sum, 0.0f);
+
+    if (dir == SCALE_DIR_X) {
+        const float *row = &weightsxo * filter_size;
+        const float x = 0.5f + src_left + offsetsxo;
+        const float y = 0.5f + src_top  + yo;
+        for (int i = 0; i < filter_size; i++)
+            sum += tex2D<floatT>(tex, x + i, y) * rowi;
+    } else {
+        const float *col = &weightsyo * filter_size;
+        const float x = 0.5f + src_left + xo;
+        const float y = 0.5f + src_top  + offsetsyo;
+        for (int i = 0; i < filter_size; i++)
+            sum += tex2D<floatT>(tex, x, y + i) * coli;
+    }
+
+    return from_floatN<T, floatT>(sum * factor);
+}
+
 /// --- FUNCTION EXPORTS ---
 
 #define KERNEL_ARGS(T) CUDAScaleKernelParams params
@@ -1194,7 +1241,10 @@
         params.dst_width, params.dst_height, params.dst_pitch, \
         params.src_left, params.src_top,                \
         params.src_width, params.src_height,            \
-        params.param, params.mpeg_range);
+        params.param, params.mpeg_range,                \
+        (const float*) params.weights,                  \
+        (const int*) params.offsets,                    \
+        params.filter_size);
 
 extern "C" {
 
@@ -1357,4 +1407,46 @@
 LANCZOS_KERNELS_RGB(bgr0)
 LANCZOS_KERNELS_RGB(rgba)
 LANCZOS_KERNELS_RGB(bgra)
+
+#define GENERIC_KERNEL(D, DIR, C, S) \
+    __global__ void Subsample_Generic_##D##_##C##S(                     \
+        KERNEL_ARGS(Convert_##C::out_T##S))                             \
+    {                                                                   \
+        SUBSAMPLE((Convert_##C::Convert##S<                             \
+                       Subsample_Generic<Convert_##C::in_T, DIR>,       \
+                       Subsample_Generic<Convert_##C::in_T_uv, DIR> >), \
+                  Convert_##C::out_T##S) \
+    }
+
+#define GENERIC_KERNEL_RAW(C) \
+    GENERIC_KERNEL(h, SCALE_DIR_X, C,)      \
+    GENERIC_KERNEL(h, SCALE_DIR_X, C,_uv)   \
+    GENERIC_KERNEL(v, SCALE_DIR_Y, C,)      \
+    GENERIC_KERNEL(v, SCALE_DIR_Y, C,_uv)
+
+#define GENERIC_KERNELS(C) \
+    GENERIC_KERNEL_RAW(planar8_ ## C)       \
+    GENERIC_KERNEL_RAW(planar10_ ## C)      \
+    GENERIC_KERNEL_RAW(planar16_ ## C)      \
+    GENERIC_KERNEL_RAW(semiplanar8_ ## C)   \
+    GENERIC_KERNEL_RAW(semiplanar10_ ## C)  \
+    GENERIC_KERNEL_RAW(semiplanar16_ ## C)
+
+#define GENERIC_KERNELS_RGB(C) \
+    GENERIC_KERNEL_RAW(rgb0_ ## C)  \
+    GENERIC_KERNEL_RAW(bgr0_ ## C)  \
+    GENERIC_KERNEL_RAW(rgba_ ## C)  \
+    GENERIC_KERNEL_RAW(bgra_ ## C)
+
+GENERIC_KERNELS(planar8)
+GENERIC_KERNELS(planar10)
+GENERIC_KERNELS(planar16)
+GENERIC_KERNELS(semiplanar8)
+GENERIC_KERNELS(semiplanar10)
+GENERIC_KERNELS(semiplanar16)
+
+GENERIC_KERNELS_RGB(rgb0)
+GENERIC_KERNELS_RGB(bgr0)
+GENERIC_KERNELS_RGB(rgba)
+GENERIC_KERNELS_RGB(bgra)
 }

ffmpeg-8.1.2.tar.xz/libavfilter/vf_scale_cuda.h -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_scale_cuda.h Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_scale_d3d11.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_scale_d3d11.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_swaprect.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_swaprect.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_thumbnail_cuda.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_thumbnail_cuda.c Changed

@@ -44,7 +44,10 @@
     AV_PIX_FMT_YUV420P,
     AV_PIX_FMT_YUV444P,
     AV_PIX_FMT_P010,
+    AV_PIX_FMT_P012,
     AV_PIX_FMT_P016,
+    AV_PIX_FMT_YUV444P10MSB,
+    AV_PIX_FMT_YUV444P12MSB,
     AV_PIX_FMT_YUV444P16,
 };
 
@@ -226,12 +229,15 @@
             histogram + 512, in->data2, in->width, in->height, in->linesize2, 1);
         break;
     case AV_PIX_FMT_P010LE:
+    case AV_PIX_FMT_P012LE:
     case AV_PIX_FMT_P016LE:
         thumbnail_kernel(ctx, s->cu_func_ushort, 1,
             histogram, in->data0, in->width, in->height, in->linesize0, 2);
         thumbnail_kernel(ctx, s->cu_func_ushort2, 2,
             histogram + 256, in->data1, in->width / 2, in->height / 2, in->linesize1, 2);
         break;
+    case AV_PIX_FMT_YUV444P10MSB:
+    case AV_PIX_FMT_YUV444P12MSB:
     case AV_PIX_FMT_YUV444P16:
         thumbnail_kernel(ctx, s->cu_func_ushort2, 1,
             histogram, in->data0, in->width, in->height, in->linesize0, 2);
@@ -284,7 +290,8 @@
         return ret;
 
     if (hw_frames_ctx->sw_format == AV_PIX_FMT_NV12 || hw_frames_ctx->sw_format == AV_PIX_FMT_YUV420P ||
-        hw_frames_ctx->sw_format == AV_PIX_FMT_P010LE || hw_frames_ctx->sw_format == AV_PIX_FMT_P016LE)
+        hw_frames_ctx->sw_format == AV_PIX_FMT_P010LE || hw_frames_ctx->sw_format == AV_PIX_FMT_P012LE ||
+        hw_frames_ctx->sw_format == AV_PIX_FMT_P016LE)
     {
         int i;
         for (i = 256; i < HIST_SIZE; i++)

ffmpeg-8.1.2.tar.xz/libavfilter/vf_uspp.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_uspp.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_v360.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_v360.c Changed

@@ -806,7 +806,7 @@
 static inline int reflectx(int x, int y, int w, int h)
 {
     if (y < 0 || y >= h)
-        return w - 1 - x;
+        return av_clip(w - 1 - x, 0, w - 1);
 
     return mod(x, w);
 }
@@ -1867,9 +1867,14 @@
     const float theta = atanf(r) * 2.f;
     const float sin_theta = sinf(theta);
 
-    vec0 = x / r * sin_theta;
-    vec1 = y / r * sin_theta;
-    vec2 = cosf(theta);
+    if (r > 0.f) {
+        vec0 = x / r * sin_theta;
+        vec1 = y / r * sin_theta;
+        vec2 = cosf(theta);
+    } else {
+        vec0 = vec1 = 0.f;
+        vec2 = 1.f;
+    }
 
     return 1;
 }
@@ -1971,9 +1976,14 @@
     const float theta = asinf(r) * 2.f;
     const float sin_theta = sinf(theta);
 
-    vec0 = x / r * sin_theta;
-    vec1 = y / r * sin_theta;
-    vec2 = cosf(theta);
+    if (r > 0.f) {
+        vec0 = x / r * sin_theta;
+        vec1 = y / r * sin_theta;
+        vec2 = cosf(theta);
+    } else {
+        vec0 = vec1 = 0.f;
+        vec2 = 1.f;
+    }
 
     return 1;
 }
@@ -4266,6 +4276,10 @@
                     out_mask = s->out_transform(s, j, i, height, width, vec);
                 else
                     out_mask = s->out_transform(s, i, j, width, height, vec);
+                if (!isfinite(vec0) || !isfinite(vec1) || !isfinite(vec2)) {
+                    vec0 = vec1 = 0.f;
+                    vec2 = 1.f;
+                }
                 offset_vector(vec, s->h_offset, s->v_offset);
                 normalize_vector(vec);
                 av_assert1(!isnan(vec0) && !isnan(vec1) && !isnan(vec2));
@@ -4309,6 +4323,20 @@
     return 0;
 }
 
+static void projection_min_size(int projection, int *min_w, int *min_h)
+{
+    switch (projection) {
+    case CUBEMAP_3_2:  *min_w = 3; *min_h = 2; break;
+    case CUBEMAP_1_6:  *min_w = 1; *min_h = 6; break;
+    case CUBEMAP_6_1:  *min_w = 6; *min_h = 1; break;
+    case EQUIANGULAR:  *min_w = 5; *min_h = 9; break;
+    case BARREL:       *min_w = 5; *min_h = 2; break;
+    case BARREL_SPLIT: *min_w = 3; *min_h = 4; break;
+    case DUAL_FISHEYE: *min_w = 2; *min_h = 1; break;
+    default:           *min_w = 1; *min_h = 1; break;
+    }
+}
+
 static int config_output(AVFilterLink *outlink)
 {
     AVFilterContext *ctx = outlink->src;
@@ -4488,6 +4516,22 @@
         return AVERROR(EINVAL);
     }
 
+    {
+        int min_w, min_h;
+        const int pw = s->in_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h)
+                                       : AV_CEIL_RSHIFT(w, desc->log2_chroma_w);
+        const int ph = s->in_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w)
+                                       : AV_CEIL_RSHIFT(h, desc->log2_chroma_h);
+
+        projection_min_size(s->in, &min_w, &min_h);
+        if (pw < min_w || ph < min_h) {
+            av_log(ctx, AV_LOG_ERROR,
+                   "Input %dx%d is too small for the input projection "
+                   "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h);
+            return AVERROR(EINVAL);
+        }
+    }
+
     switch (s->in) {
     case EQUIRECTANGULAR:
         s->in_transform = xyz_to_equirect;
@@ -4875,6 +4919,22 @@
 
     set_dimensions(s->pr_width, s->pr_height, w, h, desc);
 
+    {
+        int min_w, min_h;
+        const int pw = s->out_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h)
+                                        : AV_CEIL_RSHIFT(w, desc->log2_chroma_w);
+        const int ph = s->out_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w)
+                                        : AV_CEIL_RSHIFT(h, desc->log2_chroma_h);
+
+        projection_min_size(s->out, &min_w, &min_h);
+        if (pw < min_w || ph < min_h) {
+            av_log(ctx, AV_LOG_ERROR,
+                   "Output %dx%d is too small for the output projection "
+                   "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h);
+            return AVERROR(EINVAL);
+        }
+    }
+
     switch (s->out_stereo) {
     case STEREO_2D:
         out_offset_w = out_offset_h = 0;

ffmpeg-8.1.2.tar.xz/libavfilter/vf_vif.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_vif.c Changed

ffmpeg-8.1.2.tar.xz/libavfilter/vf_xpsnr.c -> ffmpeg-8.1.3.tar.xz/libavfilter/vf_xpsnr.c Changed

@@ -273,7 +273,7 @@
     const uint32_t       w = s->plane_width 0; /* luma image width in pixels */
     const uint32_t       h = s->plane_height0;/* luma image height in pixels */
     const double         r = (double)(w * h) / (3840.0 * 2160.0); /* UHD ratio */
-    const uint32_t       b = FFMAX(0, 4 * (int32_t) (32.0 * sqrt(r) +
+    const uint32_t       b = FFMAX(1, 4 * (int32_t) (32.0 * sqrt(r) +
                                                      0.5)); /* block size, integer multiple of 4 for SIMD */
     const uint32_t   w_blk = (w + b - 1) / b; /* luma width in units of blocks */
     const double   avg_act = sqrt(16.0 * (double) (1 << (2 * s->depth - 9)) / sqrt(FFMAX(0.00001,
@@ -399,7 +399,7 @@
     XPSNRContext *const s = ctx->priv;
     const uint32_t      w = s->plane_width 0;  /* luma image width in pixels */
     const uint32_t      h = s->plane_height0; /* luma image height in pixels */
-    const uint32_t      b = FFMAX(0, 4 * (int32_t) (32.0 * sqrt((double) (w * h) / (3840.0 * 2160.0)) + 0.5)); /* block size */
+    const uint32_t      b = FFMAX(1, 4 * (int32_t) (32.0 * sqrt((double) (w * h) / (3840.0 * 2160.0)) + 0.5)); /* block size */
     const uint32_t  w_blk = (w + b - 1) / b;  /* luma width in units of blocks */
     const uint32_t  h_blk = (h + b - 1) / b; /* luma height in units of blocks */
     AVFrame *master, *ref = NULL;

ffmpeg-8.1.2.tar.xz/libavfilter/vsrc_gfxcapture_winrt.cpp -> ffmpeg-8.1.3.tar.xz/libavfilter/vsrc_gfxcapture_winrt.cpp Changed

ffmpeg-8.1.2.tar.xz/libavformat/Makefile -> ffmpeg-8.1.3.tar.xz/libavformat/Makefile Changed

ffmpeg-8.1.2.tar.xz/libavformat/av1.c -> ffmpeg-8.1.3.tar.xz/libavformat/av1.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/binka.c -> ffmpeg-8.1.3.tar.xz/libavformat/binka.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/codec2.c -> ffmpeg-8.1.3.tar.xz/libavformat/codec2.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/concatdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/concatdec.c Changed

@@ -73,6 +73,7 @@
     ConcatMatchMode stream_match_mode;
     unsigned auto_convert;
     int segment_time_metadata;
+    int recursion_depth;
 } ConcatContext;
 
 static int concat_probe(const AVProbeData *probe)
@@ -357,6 +358,12 @@
     if (ret < 0)
         return ret;
 
+    ret = av_dict_set_int(&options, "recursion_depth", cat->recursion_depth - 1, 0);
+    if (ret < 0) {
+        av_dict_free(&options);
+        return ret;
+    }
+
     if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) < 0 ||
         (ret = avformat_find_stream_info(cat->avf, NULL)) < 0) {
         av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url);
@@ -364,6 +371,7 @@
         avformat_close_input(&cat->avf);
         return ret;
     }
+    av_dict_set(&options, "recursion_depth", NULL, 0);
     if (options) {
         av_log(avf, AV_LOG_WARNING, "Unused options for '%s'.\n", file->url);
         /* TODO log unused options once we have a proper string API */
@@ -665,6 +673,11 @@
     unsigned i;
     int ret;
 
+    if (cat->recursion_depth <= 0) {
+        av_log(avf, AV_LOG_ERROR, "Too deep recursion\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     ret = concat_parse_script(avf);
     if (ret < 0)
         return ret;
@@ -940,6 +953,8 @@
       OFFSET(auto_convert), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, DEC },
     { "segment_time_metadata", "output file segment start time and duration as packet metadata",
       OFFSET(segment_time_metadata), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, DEC },
+    { "recursion_depth", "max recursion depth",
+      OFFSET(recursion_depth), AV_OPT_TYPE_INT, {.i64 = 10}, 0, INT_MAX, DEC },
     { NULL }
 };

ffmpeg-8.1.2.tar.xz/libavformat/dashdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/dashdec.c Changed

@@ -581,7 +581,7 @@
     return type;
 }
 
-static struct fragment *get_fragment(char *range)
+static struct fragment *get_fragment(AVFormatContext *s, char *range)
 {
     struct fragment *seg = av_mallocz(sizeof(struct fragment));
 
@@ -592,6 +592,11 @@
     if (range) {
         char *str_end_offset;
         char *str_offset = av_strtok(range, "-", &str_end_offset);
+        if (!str_offset || !str_end_offset) {
+            av_log(s, AV_LOG_WARNING, "%s will get invalid range\n", range);
+            av_freep(&seg);
+            return NULL;
+        }
         seg->url_offset = strtoll(str_offset, NULL, 10);
         seg->size = strtoll(str_end_offset, NULL, 10) - seg->url_offset + 1;
     }
@@ -617,7 +622,7 @@
         range_val = xmlGetProp(fragmenturl_node, "range");
         if (initialization_val || range_val) {
             free_fragment(&rep->init_section);
-            rep->init_section = get_fragment(range_val);
+            rep->init_section = get_fragment(s, range_val);
             xmlFree(range_val);
             if (!rep->init_section) {
                 xmlFree(initialization_val);
@@ -638,7 +643,7 @@
         media_val = xmlGetProp(fragmenturl_node, "media");
         range_val = xmlGetProp(fragmenturl_node, "mediaRange");
         if (media_val || range_val) {
-            struct fragment *seg = get_fragment(range_val);
+            struct fragment *seg = get_fragment(s, range_val);
             xmlFree(range_val);
             if (!seg) {
                 xmlFree(media_val);
@@ -1468,8 +1473,7 @@
         num = pls->first_seq_no + pls->n_timelines - 1;
         for (i = 0; i < pls->n_timelines; i++) {
             if (pls->timelinesi->repeat == -1) {
-                int length_of_each_segment = pls->timelinesi->duration / pls->fragment_timescale;
-                num =  c->period_duration / length_of_each_segment;
+                num = pls->timelinesi->duration ? av_rescale(c->period_duration, pls->fragment_timescale, pls->timelinesi->duration) : pls->first_seq_no;
             } else {
                 num += pls->timelinesi->repeat;
             }
@@ -1503,8 +1507,11 @@
         free_fragment_list(rep_dest);
         if (rep_src->start_number > (rep_dest->start_number + rep_dest->n_fragments))
             rep_dest->cur_seq_no = 0;
-        else
+        else {
             rep_dest->cur_seq_no += rep_src->start_number - rep_dest->start_number;
+            if (rep_dest->cur_seq_no < 0)
+                rep_dest->cur_seq_no = 0;
+        }
         rep_dest->fragments    = rep_src->fragments;
         rep_dest->n_fragments  = rep_src->n_fragments;
         rep_dest->parent  = rep_src->parent;
@@ -1561,7 +1568,7 @@
     for (i = 0; i < n_videos; i++) {
         struct representation *cur_video = videosi;
         struct representation *ccur_video = c->videosi;
-        if (cur_video->timelines) {
+        if (cur_video->timelines && cur_video->fragment_timescale > 0) {
             // calc current time
             int64_t currentTime = get_segment_start_time_based_on_timeline(cur_video, cur_video->cur_seq_no) / cur_video->fragment_timescale;
             // update segments
@@ -1577,7 +1584,7 @@
     for (i = 0; i < n_audios; i++) {
         struct representation *cur_audio = audiosi;
         struct representation *ccur_audio = c->audiosi;
-        if (cur_audio->timelines) {
+        if (cur_audio->timelines && cur_audio->fragment_timescale > 0) {
             // calc current time
             int64_t currentTime = get_segment_start_time_based_on_timeline(cur_audio, cur_audio->cur_seq_no) / cur_audio->fragment_timescale;
             // update segments
@@ -1624,7 +1631,7 @@
     int reload_count = 0;
 
     while (( !ff_check_interrupt(c->interrupt_callback)&& pls->n_fragments > 0)) {
-        if (pls->cur_seq_no < pls->n_fragments) {
+        if (pls->cur_seq_no >= 0 && pls->cur_seq_no < pls->n_fragments) {
             seg_ptr = pls->fragmentspls->cur_seq_no;
             seg = av_mallocz(sizeof(struct fragment));
             if (!seg) {

ffmpeg-8.1.2.tar.xz/libavformat/dashenc.c -> ffmpeg-8.1.3.tar.xz/libavformat/dashenc.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/demux.c -> ffmpeg-8.1.3.tar.xz/libavformat/demux.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/genh.c -> ffmpeg-8.1.3.tar.xz/libavformat/genh.c Changed

@@ -22,6 +22,7 @@
 #include "libavutil/channel_layout.h"
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
+#include "avio_internal.h"
 #include "demux.h"
 #include "internal.h"
 
@@ -132,14 +133,18 @@
             return AVERROR_PATCHWELCOME;
         }
 
-        ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels);
+        ret = ff_alloc_extradata(st->codecpar, 32 * st->codecpar->ch_layout.nb_channels);
+        if (ret < 0)
+            return ret;
         for (ch = 0; ch < st->codecpar->ch_layout.nb_channels; ch++) {
             if (coef_type & 1) {
                 avpriv_request_sample(s, "coef_type & 1");
                 return AVERROR_PATCHWELCOME;
             } else {
                 avio_seek(s->pb, coefch, SEEK_SET);
-                avio_read(s->pb, st->codecpar->extradata + 32 * ch, 32);
+                ret = ffio_read_size(s->pb, st->codecpar->extradata + 32 * ch, 32);
+                if (ret < 0)
+                    return ret;
             }
         }
 
@@ -172,6 +177,11 @@
         par->ch_layout.nb_channels > 1) {
         int i, ch;
 
+        if (c->interleave_size != 2) {
+            avpriv_request_sample(s, "type1 THP interleave size %d", c->interleave_size);
+            return AVERROR_PATCHWELCOME;
+        }
+
         if (avio_feof(s->pb))
             return AVERROR_EOF;
         ret = av_new_packet(pkt, 8 * par->ch_layout.nb_channels);

ffmpeg-8.1.2.tar.xz/libavformat/gopher.c -> ffmpeg-8.1.3.tar.xz/libavformat/gopher.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/hevc.c -> ffmpeg-8.1.3.tar.xz/libavformat/hevc.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/hls.c -> ffmpeg-8.1.3.tar.xz/libavformat/hls.c Changed

@@ -374,9 +374,10 @@
     return var;
 }
 
-static void handle_variant_args(struct variant_info *info, const char *key,
+static void handle_variant_args(void *context, const char *key,
                                 int key_len, char **dest, int *dest_len)
 {
+    struct variant_info *info = context;
     if (!strncmp(key, "BANDWIDTH=", key_len)) {
         *dest     =        info->bandwidth;
         *dest_len = sizeof(info->bandwidth);
@@ -398,9 +399,10 @@
      char iv35;
 };
 
-static void handle_key_args(struct key_info *info, const char *key,
+static void handle_key_args(void *context, const char *key,
                             int key_len, char **dest, int *dest_len)
 {
+    struct key_info *info = context;
     if (!strncmp(key, "METHOD=", key_len)) {
         *dest     =        info->method;
         *dest_len = sizeof(info->method);
@@ -831,7 +833,7 @@
         if (c->http_persistent)
             av_dict_set(&opts, "multiple_requests", "1", 0);
 
-        ret = c->ctx->io_open(c->ctx, &in, url, AVIO_FLAG_READ, &opts);
+        ret = open_url(c->ctx, &in, url, &opts, NULL, NULL);
         av_dict_free(&opts);
         if (ret < 0)
             return ret;
@@ -864,14 +866,18 @@
     while (!avio_feof(in)) {
         ff_get_chomp_line(in, line, sizeof(line));
         if (av_strstart(line, "#EXT-X-STREAM-INF:", &ptr)) {
+            if (pls) {
+                av_log(c->ctx, AV_LOG_ERROR,
+                       "Master Playlist tag found in a Media Playlist\n");
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }
             is_variant = 1;
             memset(&variant_info, 0, sizeof(variant_info));
-            ff_parse_key_value(ptr, (ff_parse_key_val_cb) handle_variant_args,
-                               &variant_info);
+            ff_parse_key_value(ptr, handle_variant_args, &variant_info);
         } else if (av_strstart(line, "#EXT-X-KEY:", &ptr)) {
             struct key_info info = {{0}};
-            ff_parse_key_value(ptr, (ff_parse_key_val_cb) handle_key_args,
-                               &info);
+            ff_parse_key_value(ptr, handle_key_args, &info);
             key_type = KEY_NONE;
             has_iv = 0;
             if (!strcmp(info.method, "AES-128"))
@@ -885,8 +891,13 @@
             av_strlcpy(key, info.uri, sizeof(key));
         } else if (av_strstart(line, "#EXT-X-MEDIA:", &ptr)) {
             struct rendition_info info = {{0}};
-            ff_parse_key_value(ptr, (ff_parse_key_val_cb) handle_rendition_args,
-                               &info);
+            if (pls) {
+                av_log(c->ctx, AV_LOG_ERROR,
+                       "Master Playlist tag found in a Media Playlist\n");
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }
+            ff_parse_key_value(ptr, handle_rendition_args, &info);
             new_rendition(c, &info, url);
         } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", &ptr)) {
             int64_t t;

ffmpeg-8.1.2.tar.xz/libavformat/hls_sample_encryption.c -> ffmpeg-8.1.3.tar.xz/libavformat/hls_sample_encryption.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/hlsenc.c -> ffmpeg-8.1.3.tar.xz/libavformat/hlsenc.c Changed

@@ -30,12 +30,14 @@
 
 #include "libavutil/attributes_internal.h"
 #include "libavutil/avassert.h"
+#include "libavutil/macros.h"
 #include "libavutil/mathematics.h"
 #include "libavutil/avstring.h"
 #include "libavutil/bprint.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/mem.h"
 #include "libavutil/opt.h"
+#include "libavutil/parseutils.h"
 #include "libavutil/log.h"
 #include "libavutil/random_seed.h"
 #include "libavutil/time.h"
@@ -1130,20 +1132,31 @@
     return 0;
 }
 
-static int extract_segment_number(const char *filename) {
+static int extract_segment_number(const char *filename)
+{
     const char *dot = strrchr(filename, '.');
-    const char *num_start = dot - 1;
+    const char *num_start;
+    char *end;
+    long value;
 
-    while (num_start > filename && *num_start >= '0' && *num_start <= '9') {
-        num_start--;
-    }
-
-    num_start++;
+    if (!dot)
+        return -1;
+    if (dot == filename)
+        return -1;
 
+    num_start = dot;
+    while (num_start > filename &&
+           num_start-1 >= '0' && num_start-1 <= '9')
+        num_start--;
     if (num_start == dot)
         return -1;
 
-    return atoi(num_start);
+    errno = 0;
+    value = strtol(num_start, &end, 10);
+    if (errno == ERANGE || end != dot || value > INT_MAX)
+        return -1;
+
+    return (int)value;
 }
 
 static int parse_playlist(AVFormatContext *s, const char *url, VariantStream *vs)
@@ -1190,11 +1203,13 @@
             ptr = av_stristr(line, "URI=\"");
             if (ptr) {
                 ptr += strlen("URI=\"");
-                end = av_stristr(ptr, ",");
+                end = strchr(ptr, '"');
                 if (end) {
-                    av_strlcpy(vs->key_uri, ptr, end - ptr);
+                    av_strlcpy(vs->key_uri, ptr,
+                               FFMIN(end - ptr + 1, sizeof(vs->key_uri)));
                 } else {
-                    av_strlcpy(vs->key_uri, ptr, sizeof(vs->key_uri));
+                    ret = AVERROR_INVALIDDATA;
+                    goto fail;
                 }
             }
 
@@ -1203,29 +1218,32 @@
                 ptr += strlen("IV=0x");
                 end = av_stristr(ptr, ",");
                 if (end) {
-                    av_strlcpy(vs->iv_string, ptr, end - ptr);
+                    av_strlcpy(vs->iv_string, ptr, FFMIN(end - ptr + 1, sizeof(vs->iv_string)));
                 } else {
                     av_strlcpy(vs->iv_string, ptr, sizeof(vs->iv_string));
                 }
             }
         } else if (av_strstart(line, "#EXT-X-PROGRAM-DATE-TIME:", &ptr)) {
-            struct tm program_date_time;
-            int y,M,d,h,m,s;
-            double ms;
-            if (sscanf(ptr, "%d-%d-%dT%d:%d:%d.%lf", &y, &M, &d, &h, &m, &s, &ms) != 7) {
+            struct tm program_date_time = { 0 };
+            double ms = 0;
+            char *q = av_small_strptime(ptr, "%Y-%m-%dT%H:%M:%S", &program_date_time);
+
+            if (!q) {
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
-
-            program_date_time.tm_year = y - 1900;
-            program_date_time.tm_mon = M - 1;
-            program_date_time.tm_mday = d;
-            program_date_time.tm_hour = h;
-            program_date_time.tm_min = m;
-            program_date_time.tm_sec = s;
+            if (*q == '.')
+                ms = atof(q + 1);
             program_date_time.tm_isdst = -1;
 
-            discont_program_date_time = mktime(&program_date_time);
+            errno = 0;
+            time_t t = mktime(&program_date_time);
+            if (t == (time_t)-1 && errno == EOVERFLOW) {
+                ret = AVERROR_INVALIDDATA;
+                goto fail;
+            }
+            discont_program_date_time = t;
+
             discont_program_date_time += (double)(ms / 1000);
         } else if (av_strstart(line, "#", NULL)) {
             continue;
@@ -1459,6 +1477,7 @@
             avg_bandwidth = vs->avg_bitrate;
         } else {
             bandwidth = 0;
+            avg_bandwidth = 0;
             if (vid_st)
                 bandwidth += get_stream_bit_rate(vid_st);
             if (aud_st)
@@ -1603,7 +1622,7 @@
                                       en->size, en->pos, hls->baseurl,
                                       en->filename,
                                       en->discont_program_date_time ? &en->discont_program_date_time : prog_date_time_p,
-                                      en->keyframe_size, en->keyframe_pos, hls->flags & HLS_I_FRAMES_ONLY);
+                                      hls->flags & HLS_I_FRAMES_ONLY);
         if (en->discont_program_date_time)
             en->discont_program_date_time -= en->duration;
         if (ret < 0) {
@@ -1627,7 +1646,7 @@
         for (en = vs->segments; en; en = en->next) {
             ret = ff_hls_write_file_entry(hls->sub_m3u8_out, en->discont, byterange_mode,
                                           en->duration, 0, en->size, en->pos,
-                                          hls->baseurl, en->sub_filename, NULL, 0, 0, 0);
+                                          hls->baseurl, en->sub_filename, NULL, 0);
             if (ret < 0) {
                 av_log(s, AV_LOG_WARNING, "ff_hls_write_file_entry get error\n");
             }
@@ -2971,8 +2990,12 @@
         if (vs->has_video > 1)
             av_log(s, AV_LOG_WARNING, "More than a single video stream present, expect issues decoding it.\n");
         if (hls->segment_type == SEGMENT_TYPE_FMP4) {
+#if CONFIG_MP4_MUXER
             EXTERN const FFOutputFormat ff_mp4_muxer;
             vs->oformat = &ff_mp4_muxer.p;
+#else
+            return AVERROR_MUXER_NOT_FOUND;
+#endif
         } else {
             EXTERN const FFOutputFormat ff_mpegts_muxer;
             vs->oformat = &ff_mpegts_muxer.p;

ffmpeg-8.1.2.tar.xz/libavformat/hlsplaylist.c -> ffmpeg-8.1.3.tar.xz/libavformat/hlsplaylist.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/hlsplaylist.h -> ffmpeg-8.1.3.tar.xz/libavformat/hlsplaylist.h Changed

ffmpeg-8.1.2.tar.xz/libavformat/http.c -> ffmpeg-8.1.3.tar.xz/libavformat/http.c Changed

@@ -567,6 +567,7 @@
 
     s->end_chunked_post = 0;
     s->chunkend      = 0;
+    s->range_end     = 0;
     s->off           = 0;
     s->icy_data_read = 0;
 
@@ -1055,8 +1056,10 @@
     char *eql, *name;
 
     // ensure the cookie is parsable
-    if (parse_set_cookie(p, &new_params))
+    if (parse_set_cookie(p, &new_params)) {
+        av_dict_free(&new_params);
         return -1;
+    }
 
     // if there is no cookie value there is nothing to parse
     cookie_entry = av_dict_iterate(new_params, NULL);
@@ -1663,6 +1666,7 @@
     s->off              = 0;
     s->icy_data_read    = 0;
     s->filesize         = UINT64_MAX;
+    s->range_end        = 0;
     s->willclose        = 0;
     s->end_chunked_post = 0;
     s->end_header       = 0;
@@ -2161,14 +2165,16 @@
         s->hd = NULL;
     }
 
-    /* if it fails, continue on old connection */
     if ((ret = http_open_cnx(h, &options)) < 0) {
+        /* if it fails, continue on old connection if possible */
+        if (old_hd) {
+            memcpy(s->buffer, old_buf, old_buf_size);
+            s->buf_ptr = s->buffer;
+            s->buf_end = s->buffer + old_buf_size;
+            s->hd      = old_hd;
+            s->off     = old_off;
+        }
         av_dict_free(&options);
-        memcpy(s->buffer, old_buf, old_buf_size);
-        s->buf_ptr = s->buffer;
-        s->buf_end = s->buffer + old_buf_size;
-        s->hd      = old_hd;
-        s->off     = old_off;
         return ret;
     }
     av_dict_free(&options);

ffmpeg-8.1.2.tar.xz/libavformat/iamf_parse.c -> ffmpeg-8.1.3.tar.xz/libavformat/iamf_parse.c Changed

@@ -609,6 +609,7 @@
 static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
                        unsigned int type,
                        const IAMFAudioElement *audio_element,
+                       const IAMFCodecConfig *codec_config,
                        AVIAMFParamDefinition **out_param_definition)
 {
     IAMFParamDefinition *param_definition = NULL;
@@ -631,14 +632,10 @@
 
     if (mode == 0) {
         duration = ffio_read_leb(pb);
-        if (!duration)
+        if (!duration || duration > av_rescale(codec_config->nb_samples,
+                                               codec_config->sample_rate, parameter_rate)) {
+            av_log(s, AV_LOG_ERROR, "Invalid block duration in parameter_id %u\n", parameter_id);
             return AVERROR_INVALIDDATA;
-        if (audio_element) {
-            const IAMFCodecConfig *codec_config = ff_iamf_get_codec_config(c, audio_element->codec_config_id);
-            if (duration > av_rescale(codec_config->nb_samples, codec_config->sample_rate, parameter_rate)) {
-                av_log(s, AV_LOG_ERROR, "Invalid block duration in parameter_id %u\n", parameter_id);
-                return AVERROR_INVALIDDATA;
-            }
         }
         constant_subblock_duration = ffio_read_leb(pb);
         if (constant_subblock_duration == 0)
@@ -668,7 +665,7 @@
 
         if (constant_subblock_duration == 0) {
             subblock_duration = ffio_read_leb(pb);
-            if (duration - total_duration > subblock_duration) {
+            if (subblock_duration > duration - total_duration) {
                 av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id);
                 av_free(param);
                 return AVERROR_INVALIDDATA;
@@ -899,13 +896,17 @@
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
-            ret = param_parse(s, c, pbc, type, audio_element, &element->demixing_info);
+            ret = param_parse(s, c, pbc, type,
+                              audio_element, codec_config,
+                              &element->demixing_info);
         } else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) {
             if (element->recon_gain_info) {
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
-            ret = param_parse(s, c, pbc, type, audio_element, &element->recon_gain_info);
+            ret = param_parse(s, c, pbc, type,
+                              audio_element, codec_config,
+                              &element->recon_gain_info);
         } else {
             unsigned param_definition_size = ffio_read_leb(pbc);
             avio_skip(pbc, param_definition_size);
@@ -960,6 +961,7 @@
 static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
 {
     AVIAMFMixPresentation *mix;
+    const IAMFCodecConfig *codec_config = NULL;
     IAMFMixPresentation **tmp, *mix_presentation = NULL;
     FFIOContext b;
     AVIOContext *pbc;
@@ -1009,6 +1011,11 @@
     mix_presentation->cmix = mix;
 
     mix_presentation->count_label = ffio_read_leb(pbc);
+    if (mix_presentation->count_label > len - avio_tell(pbc)) {
+        mix_presentation->count_label = 0;
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
     mix_presentation->language_label = av_calloc(mix_presentation->count_label,
                                                  sizeof(*mix_presentation->language_label));
     if (!mix_presentation->language_label) {
@@ -1035,6 +1042,12 @@
     }
 
     nb_submixes = ffio_read_leb(pbc);
+    if (!nb_submixes) {
+        av_log(s, AV_LOG_ERROR, "Mix presentation %u has no submixes\n", mix_presentation_id);
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
+
     for (int i = 0; i < nb_submixes; i++) {
         AVIAMFSubmix *sub_mix;
         unsigned nb_elements, nb_layouts;
@@ -1046,9 +1059,17 @@
         }
 
         nb_elements = ffio_read_leb(pbc);
+        if (!nb_elements) {
+            av_log(s, AV_LOG_ERROR, "Submix %d from Mix presentation %u has no audio elements\n",
+                   i, mix_presentation_id);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+
         for (int j = 0; j < nb_elements; j++) {
             AVIAMFSubmixElement *submix_element;
             IAMFAudioElement *audio_element = NULL;
+            const IAMFCodecConfig *config = NULL;
             unsigned int rendering_config_extension_size;
 
             submix_element = av_iamf_submix_add_element(sub_mix);
@@ -1071,6 +1092,7 @@
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
+            config = ff_iamf_get_codec_config(c, audio_element->codec_config_id);
 
             for (int k = 0; k < mix_presentation->count_label; k++) {
                 char *annotation = NULL;
@@ -1089,14 +1111,22 @@
             avio_skip(pbc, rendering_config_extension_size);
 
             ret = param_parse(s, c, pbc, AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN,
-                              audio_element,
+                              audio_element, config,
                               &submix_element->element_mix_config);
             if (ret < 0)
                 goto fail;
             submix_element->default_mix_gain = av_make_q(sign_extend(avio_rb16(pbc), 16), 1 << 8);
+
+            if (!codec_config || (config->nb_samples >
+                                  av_rescale(codec_config->nb_samples,
+                                             codec_config->sample_rate,
+                                             config->sample_rate)))
+                codec_config = config;
         }
 
-        ret = param_parse(s, c, pbc, AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN, NULL, &sub_mix->output_mix_config);
+        ret = param_parse(s, c, pbc, AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN,
+                          NULL, codec_config,
+                          &sub_mix->output_mix_config);
         if (ret < 0)
             goto fail;
         sub_mix->default_mix_gain = av_make_q(sign_extend(avio_rb16(pbc), 16), 1 << 8);

ffmpeg-8.1.2.tar.xz/libavformat/iamf_writer.c -> ffmpeg-8.1.3.tar.xz/libavformat/iamf_writer.c Changed

@@ -100,12 +100,18 @@
 }
 
 static int fill_codec_config(IAMFContext *iamf, const AVStreamGroup *stg,
-                             IAMFCodecConfig *codec_config)
+                             IAMFCodecConfig *codec_config, void *log_ctx)
 {
     const AVStream *st = stg->streams0;
     IAMFCodecConfig **tmp;
     int j, ret = 0;
 
+    if (!st->codecpar->frame_size) {
+        av_log(log_ctx, AV_LOG_ERROR, "frame_size is unset for stream id %d\n",
+               st->id);
+        return AVERROR(EINVAL);
+    }
+
     codec_config->codec_id = st->codecpar->codec_id;
     codec_config->codec_tag = st->codecpar->codec_tag;
     switch (codec_config->codec_id) {
@@ -308,7 +314,7 @@
     if (!codec_config)
         return AVERROR(ENOMEM);
 
-    ret = fill_codec_config(iamf, stg, codec_config);
+    ret = fill_codec_config(iamf, stg, codec_config, log_ctx);
     if (ret < 0) {
         av_free(codec_config);
         return ret;
@@ -1239,9 +1245,10 @@
 
     if (codec_config->codec_id == AV_CODEC_ID_OPUS) {
         // IAMF's num_samples_to_trim_at_start is the same as Opus's pre-skip.
-        skip_samples = pkt->dts < 0
-            ? av_rescale(-pkt->dts, 48000, pkt->time_base.den)
-            : 0;
+        if (!skip_samples)
+            skip_samples = pkt->dts < 0
+                ? av_rescale(-pkt->dts, 48000, pkt->time_base.den)
+                : 0;
         discard_padding = av_rescale(discard_padding, 48000, pkt->time_base.den);
     }

ffmpeg-8.1.2.tar.xz/libavformat/iff.c -> ffmpeg-8.1.3.tar.xz/libavformat/iff.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/imfdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/imfdec.c Changed

@@ -255,7 +255,20 @@
             return AVERROR_INVALIDDATA;
         }
 
-        uri = xmlNodeGetContent(ff_imf_xml_get_child_element_by_name(node, "Path"));
+        xmlNodePtr path_node = ff_imf_xml_get_child_element_by_name(node, "Path");
+        if (!path_node) {
+            av_log(s, AV_LOG_ERROR, "Unable to parse asset map XML - missing Path element in Chunk\n");
+            ret = AVERROR_INVALIDDATA;
+            break;
+        }
+        uri = xmlNodeGetContent(path_node);
+        if (!uri || !uri0) {
+            av_log(s, AV_LOG_ERROR, "Unable to parse asset map XML - empty Path element in Chunk\n");
+            xmlFree(uri);
+            ret = AVERROR_INVALIDDATA;
+            break;
+        }
+
         if (!imf_uri_is_url(uri) && !imf_uri_is_unix_abs_path(uri) && !imf_uri_is_dos_abs_path(uri))
             asset->absolute_uri = av_append_path_component(base_url, uri);
         else
@@ -525,6 +538,12 @@
     track->index = track_index;
     track->duration = av_make_q(0, 1);
 
+    if (!virtual_track->resource_count) {
+        av_log(s, AV_LOG_ERROR, "Virtual track has no resources\n");
+        ret = AVERROR_INVALIDDATA;
+        goto clean_up;
+    }
+
     for (uint32_t i = 0; i < virtual_track->resource_count; i++) {
         av_log(s,
                AV_LOG_DEBUG,

ffmpeg-8.1.2.tar.xz/libavformat/librist.c -> ffmpeg-8.1.3.tar.xz/libavformat/librist.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/mlvdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/mlvdec.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/mov.c -> ffmpeg-8.1.3.tar.xz/libavformat/mov.c Changed

@@ -3837,6 +3837,9 @@
     default_group_description_index = version >= 2 ? avio_rb32(pb) : 0;
     entry_count = avio_rb32(pb);
 
+    if (entry_count > atom.size)
+        return AVERROR_INVALIDDATA;
+
     av_freep(&sc->sgpd_sync);
     sc->sgpd_sync_count = entry_count;
     sc->sgpd_sync = av_calloc(entry_count, sizeof(*sc->sgpd_sync));
@@ -4764,7 +4767,7 @@
             sc->time_offset = start_time -  (uint64_t)empty_duration;
             sc->min_corrected_pts = start_time;
             if (!mov->advanced_editlist)
-                current_dts = -sc->time_offset;
+                current_dts = -av_clip64(sc->time_offset, -INT64_MAX, INT64_MAX);
         }
 
         if (!multiple_edits && !mov->advanced_editlist &&
@@ -4784,8 +4787,10 @@
         int rap_group_present = sc->rap_group_count && sc->rap_group;
         int key_off = (sc->keyframe_count && sc->keyframes0 > 0) || (sc->stps_count && sc->stps_data0 > 0);
 
+        av_assert0(sc->dts_shift >= 0);
+        if (current_dts < INT64_MIN + sc->dts_shift)
+            return;
         current_dts -= sc->dts_shift;
-
         if (!sc->sample_count || sti->nb_index_entries || sc->tts_count)
             return;
         if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries)
@@ -4881,6 +4886,8 @@
                 current_offset += sample_size;
                 stream_size += sample_size;
 
+                if (current_dts > INT64_MAX - sc->tts_datastts_index.duration)
+                    return;
                 current_dts += sc->tts_datastts_index.duration;
 
                 distance++;
@@ -4990,6 +4997,8 @@
                        size, samples);
 
                 current_offset += size;
+                if (current_dts > INT64_MAX - samples)
+                    return;
                 current_dts += samples;
                 chunk_samples -= samples;
             }
@@ -5007,9 +5016,9 @@
 
     // Update start time of the stream.
     if (st->start_time == AV_NOPTS_VALUE && st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && sti->nb_index_entries > 0) {
-        st->start_time = sti->index_entries0.timestamp + sc->dts_shift;
+        st->start_time = av_sat_add64(sti->index_entries0.timestamp, sc->dts_shift);
         if (sc->tts_data) {
-            st->start_time += sc->tts_data0.offset;
+            st->start_time = av_sat_add64(st->start_time, sc->tts_data0.offset);
         }
     }
 
@@ -5365,20 +5374,23 @@
     avio_skip(pb, 4);
     count = avio_rb32(pb);
     atom.size -= 8;
-    if (count >= UINT_MAX / sizeof(*c->meta_keys)) {
+    if (count > atom.size / 8 || count >= UINT_MAX / sizeof(*c->meta_keys)) {
         av_log(c->fc, AV_LOG_ERROR,
                "The 'keys' atom with the invalid key count: %"PRIu32"\n", count);
         return AVERROR_INVALIDDATA;
     }
 
-    c->meta_keys_count = count + 1;
-    c->meta_keys = av_mallocz(c->meta_keys_count * sizeof(*c->meta_keys));
+    c->meta_keys = av_malloc_array(count + 1, sizeof(*c->meta_keys));
     if (!c->meta_keys)
         return AVERROR(ENOMEM);
 
+    c->meta_keys0 = NULL;
+    c->meta_keys_count = 1;
     for (i = 1; i <= count; ++i) {
         uint32_t key_size = avio_rb32(pb);
         uint32_t type = avio_rl32(pb);
+        c->meta_keysi = NULL;
+        c->meta_keys_count = i + 1;
         if (key_size < 8 || key_size > atom.size) {
             av_log(c->fc, AV_LOG_ERROR,
                    "The key# %"PRIu32" in meta has invalid size:"
@@ -5391,10 +5403,13 @@
             avio_skip(pb, key_size);
             continue;
         }
-        c->meta_keysi = av_mallocz(key_size + 1);
+        c->meta_keysi = av_malloc(key_size + 1);
         if (!c->meta_keysi)
             return AVERROR(ENOMEM);
-        avio_read(pb, c->meta_keysi, key_size);
+        int ret = ffio_read_size(pb, c->meta_keysi, key_size);
+        if (ret < 0)
+            return ret;
+        c->meta_keysikey_size = 0;
     }
 
     return 0;
@@ -5871,6 +5886,31 @@
     if (flags & MOV_TRUN_DATA_OFFSET)        data_offset        = avio_rb32(pb);
     if (flags & MOV_TRUN_FIRST_SAMPLE_FLAGS) first_sample_flags = avio_rb32(pb);
 
+    int entry_size =  !!(flags & MOV_TRUN_SAMPLE_DURATION) * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_SIZE)     * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_FLAGS)    * 4
+                    + !!(flags & MOV_TRUN_SAMPLE_CTS)      * 4;
+    int64_t sample_data_size = avio_size(sc->pb);
+    int64_t max_entries = INT64_MAX;
+
+    if (sample_data_size > 0)
+        max_entries = sample_data_size - sti->nb_index_entries;
+    if (entry_size) {
+        int64_t size = sc->pb == pb ? sample_data_size : avio_size(pb);
+        int64_t pos  = avio_tell(pb);
+        int64_t left = atom.size - 8 - !!(flags & MOV_TRUN_DATA_OFFSET)        * 4
+                                     - !!(flags & MOV_TRUN_FIRST_SAMPLE_FLAGS) * 4;
+
+        if (pos >= 0 && size >= pos)
+            left = FFMIN(left, size - pos);
+        max_entries = FFMIN(max_entries, left / entry_size);
+    }
+    if (entries > max_entries) {
+        av_log(c->fc, AV_LOG_ERROR, "trun sample count %u exceeds the %"PRId64" "
+               "samples the input can hold\n", entries, max_entries);
+        return AVERROR_INVALIDDATA;
+    }
+
     frag_stream_info = get_current_frag_stream_info(&c->frag_index);
     if (frag_stream_info) {
         if (frag_stream_info->next_trun_dts != AV_NOPTS_VALUE) {
@@ -9264,10 +9304,11 @@
     return ret;
 }
 
-static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version)
+static int mov_read_iref_cdsc(MOVContext *c, AVIOContext *pb, uint32_t type, int version, uint32_t size)
 {
     HEIFItem *from_item = NULL;
     int entries;
+    int item_id_size = version ? 4 : 2;
     int from_item_id = version ? avio_rb32(pb) : avio_rb16(pb);
     const HEIFItemRef ref = { type, from_item_id };
 
@@ -9278,6 +9319,11 @@
     }
 
     entries = avio_rb16(pb);
+    if ((int64_t)entries * item_id_size > (int64_t)size - item_id_size - 2) {
+        av_log(c->fc, AV_LOG_ERROR, "iref %s entry count %d exceeds the sub-box size\n",
+               av_fourcc2str(type), entries);
+        return AVERROR_INVALIDDATA;
+    }
     /* 'to' item ids */
     for (int i = 0; i < entries; i++) {
         HEIFItem *item = get_heif_item(c, version ? avio_rb32(pb) : avio_rb16(pb));
@@ -9316,13 +9362,13 @@
     }
 
     while (atom.size) {
-        uint32_t type, size = avio_rb32(pb);
         int64_t next = avio_tell(pb);
+        uint32_t type, size = avio_rb32(pb);
 
-        if (size < 14 || next < 0 || next > INT64_MAX - size)
+        if (size < 14 || size > atom.size || next > INT64_MAX - size)
             return AVERROR_INVALIDDATA;
 
-        next += size - 4;
+        next += size;
         type = avio_rl32(pb);
         switch (type) {
         case MKTAG('d','i','m','g'):
@@ -9332,7 +9378,7 @@
             break;
         case MKTAG('c','d','s','c'):
         case MKTAG('t','h','m','b'):
-            ret = mov_read_iref_cdsc(c, pb, type, version);
+            ret = mov_read_iref_cdsc(c, pb, type, version, size - 8);
             if (ret < 0)
                 return ret;
             break;

ffmpeg-8.1.2.tar.xz/libavformat/movenc.c -> ffmpeg-8.1.3.tar.xz/libavformat/movenc.c Changed

@@ -3310,8 +3310,10 @@
             if (roll_samples_remaining > 0)
                 distance = 0;
             /* Verify distance is a maximum of 32 (2.5ms) packets. */
-            if (distance > 32)
+            if (distance > 32) {
+                av_freep(&sgpd_entries);
                 return AVERROR_INVALIDDATA;
+            }
             if (i && distance == sgpd_entriesentries.roll_distance) {
                 sgpd_entriesentries.count++;
             } else {
@@ -6592,11 +6594,13 @@
             return 0;
         }
 
-        buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
-        avio_wb32(s->pb, buf_size + 8);
-        ffio_wfourcc(s->pb, "mdat");
-        avio_write(s->pb, buf, buf_size);
-        ffio_reset_dyn_buf(mov->mdat_buf);
+        if (mov->mdat_buf) {
+            buf_size = avio_get_dyn_buf(mov->mdat_buf, &buf);
+            avio_wb32(s->pb, buf_size + 8);
+            ffio_wfourcc(s->pb, "mdat");
+            avio_write(s->pb, buf, buf_size);
+            ffio_reset_dyn_buf(mov->mdat_buf);
+        }
 
         if (mov->flags & FF_MOV_FLAG_GLOBAL_SIDX)
             mov->reserved_header_pos = avio_tell(s->pb);

ffmpeg-8.1.2.tar.xz/libavformat/mpeg.c -> ffmpeg-8.1.3.tar.xz/libavformat/mpeg.c Changed

@@ -841,6 +841,20 @@
             }
 
             if (!st || st->id != stream_id) {
+                st = NULL;
+                for (i = 0; i < s->nb_streams; i++) {
+                    if (s->streamsi->id == stream_id) {
+                        st = s->streamsi;
+                        break;
+                    }
+                }
+            }
+            if (!st) {
+                if (s->nb_streams >= FF_ARRAY_ELEMS(vobsub->q)) {
+                    av_log(s, AV_LOG_ERROR, "Maximum number of subtitle streams reached\n");
+                    ret = AVERROR_INVALIDDATA;
+                    goto end;
+                }
                 st = avformat_new_stream(s, NULL);
                 if (!st) {
                     ret = AVERROR(ENOMEM);
@@ -865,14 +879,14 @@
             timestamp = (hh*3600LL + mm*60LL + ss) * 1000LL + ms + delay;
             timestamp = av_rescale_q(timestamp, av_make_q(1, 1000), st->time_base);
 
-            sub = ff_subtitles_queue_insert(&vobsub->qs->nb_streams - 1, "", 0, 0);
+            sub = ff_subtitles_queue_insert(&vobsub->qst->index, "", 0, 0);
             if (!sub) {
                 ret = AVERROR(ENOMEM);
                 goto end;
             }
             sub->pos = pos;
             sub->pts = timestamp;
-            sub->stream_index = s->nb_streams - 1;
+            sub->stream_index = st->index;
 
         } else if (!strncmp(line, "alt:", 4)) {
             const char *p = line + 4;

ffmpeg-8.1.2.tar.xz/libavformat/mpegenc.c -> ffmpeg-8.1.3.tar.xz/libavformat/mpegenc.c Changed

@@ -128,14 +128,14 @@
     return put_bytes_output(&pb);
 }
 
-static int put_system_header(AVFormatContext *ctx, uint8_t *buf,
+static int put_system_header(AVFormatContext *ctx, uint8_t *buf, int buf_size,
                              int only_for_stream_id)
 {
     MpegMuxContext *s = ctx->priv_data;
     int size, i, private_stream_coded, id;
     PutBitContext pb;
 
-    init_put_bits(&pb, buf, 128);
+    init_put_bits(&pb, buf, buf_size);
 
     put_bits32(&pb, SYSTEM_HEADER_START_CODE);
     put_bits(&pb, 16, 0);
@@ -473,6 +473,16 @@
         if (!stream->fifo)
             return AVERROR(ENOMEM);
     }
+
+    /* The system header is emitted, right after the pack header (which is at
+     * most 14 bytes), into the fixed 128-byte buffer used by flush_packet().
+     * Reject configurations whose system header would not fit. */
+    if (get_system_header_size(ctx) > 128 - 14) {
+        av_log(ctx, AV_LOG_ERROR,
+               "Too many streams to fit the MPEG program stream system header\n");
+        return AVERROR(EINVAL);
+    }
+
     bitrate       = 0;
     audio_bitrate = 0;
     video_bitrate = 0;
@@ -657,6 +667,7 @@
     int size, payload_size, startcode, id, stuffing_size, header_len;
     int packet_size;
     uint8_t buffer128;
+    uint8_t *buf_end = buffer + sizeof(buffer);
     int zero_trail_bytes = 0;
     int pad_packet_bytes = 0;
     int pes_flags;
@@ -682,7 +693,7 @@
              * audio packet (see VCD standard p. IV-7 and IV-8). */
 
             if (stream->packet_number == 0) {
-                size     = put_system_header(ctx, buf_ptr, id);
+                size     = put_system_header(ctx, buf_ptr, buf_end - buf_ptr, id);
                 buf_ptr += size;
             }
         } else if (s->is_dvd) {
@@ -697,7 +708,7 @@
                 }
 
                 if (stream->bytes_to_iframe == 0 || s->packet_number == 0) {
-                    size     = put_system_header(ctx, buf_ptr, 0);
+                    size     = put_system_header(ctx, buf_ptr, buf_end - buf_ptr, 0);
                     buf_ptr += size;
                     size     = buf_ptr - buffer;
                     avio_write(ctx->pb, buffer, size);
@@ -730,7 +741,7 @@
             }
         } else {
             if ((s->packet_number % s->system_header_freq) == 0) {
-                size     = put_system_header(ctx, buf_ptr, 0);
+                size     = put_system_header(ctx, buf_ptr, buf_end - buf_ptr, 0);
                 buf_ptr += size;
             }
         }

ffmpeg-8.1.2.tar.xz/libavformat/mpegts.c -> ffmpeg-8.1.3.tar.xz/libavformat/mpegts.c Changed

@@ -51,6 +51,9 @@
  * synchronization is lost */
 #define MAX_RESYNC_SIZE 65536
 
+/* payload of a TS packet which carries no adaptation field */
+#define TS_PAYLOAD_SIZE (TS_PACKET_SIZE - 4)
+
 #define MAX_MP4_DESCR_COUNT 16
 
 #define MOD_UNLIKELY(modulus, dividend, divisor, prev_dividend)                \
@@ -211,7 +214,7 @@
     {"skip_clear", "skip clearing programs", offsetof(MpegTSContext, skip_clear), AV_OPT_TYPE_BOOL,
      {.i64 = 0}, 0, 1, 0 },
     {"max_packet_size", "maximum size of emitted packet", offsetof(MpegTSContext, max_packet_size), AV_OPT_TYPE_INT,
-     {.i64 = 204800}, 1, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM },
+     {.i64 = 204800}, TS_PAYLOAD_SIZE, INT_MAX/2, AV_OPT_FLAG_DECODING_PARAM },
     { NULL },
 };
 
@@ -583,7 +586,7 @@
         av_buffer_unref(&pes->buffer);
         /* referenced private data will be freed later in
          * avformat_close_input (pes->st->priv_data == pes) */
-        if (!pes->st || pes->merged_st) {
+        if (!pes->st || pes->merged_st || !pes->st->priv_data) {
             av_freep(&filter->u.pes_filter.opaque);
         }
     }
@@ -1416,8 +1419,14 @@
         case MPEGTS_PAYLOAD:
             do {
                 int max_packet_size = ts->max_packet_size;
-                if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size)
-                    max_packet_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size;
+                if (pes->PES_packet_length && pes->PES_packet_length + PES_START_SIZE > pes->pes_header_size) {
+                    const int pes_payload_size = pes->PES_packet_length + PES_START_SIZE - pes->pes_header_size;
+
+                    if (pes_payload_size > ts->max_packet_size)
+                        pes->PES_packet_length = 0;
+                    else
+                        max_packet_size = pes_payload_size;
+                }
 
                 if (pes->data_index > 0 &&
                     pes->data_index + buf_size > max_packet_size) {

ffmpeg-8.1.2.tar.xz/libavformat/oggdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/oggdec.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/os_support.h -> ffmpeg-8.1.3.tar.xz/libavformat/os_support.h Changed

ffmpeg-8.1.2.tar.xz/libavformat/rawutils.c -> ffmpeg-8.1.3.tar.xz/libavformat/rawutils.c Changed

@@ -29,15 +29,21 @@
     int ret;
     AVPacket *pkt = *ppkt;
     int64_t bpc = par->bits_per_coded_sample != 15 ? par->bits_per_coded_sample : 16;
-    int min_stride = (par->width * bpc + 7) >> 3;
-    int with_pal_size = min_stride * par->height + 1024;
-    int contains_pal = bpc == 8 && pkt->size == with_pal_size;
-    int size = contains_pal ? min_stride * par->height : pkt->size;
-    int stride = size / par->height;
-    int padding = expected_stride - FFMIN(expected_stride, stride);
-    int y;
+    int64_t min_stride = (par->width * bpc + 7) >> 3;
+    int with_pal_size, contains_pal, size, stride, padding, y;
     AVPacket *new_pkt;
 
+    if (par->height <= 0 || min_stride <= 0 || expected_stride <= 0 ||
+        min_stride      > (INT_MAX - 1024) / par->height ||
+        expected_stride > (INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / par->height)
+        return AVERROR(EINVAL);
+
+    with_pal_size = min_stride * par->height + 1024;
+    contains_pal  = bpc == 8 && pkt->size == with_pal_size;
+    size          = contains_pal ? min_stride * par->height : pkt->size;
+    stride        = size / par->height;
+    padding       = expected_stride - FFMIN(expected_stride, stride);
+
     if (pkt->size == expected_stride * par->height)
         return 0;
     if (size != stride * par->height)

ffmpeg-8.1.2.tar.xz/libavformat/rtpdec_asf.c -> ffmpeg-8.1.3.tar.xz/libavformat/rtpdec_asf.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/rtpenc_av1.c -> ffmpeg-8.1.3.tar.xz/libavformat/rtpenc_av1.c Changed

@@ -116,8 +116,15 @@
             if (!num_lebs) {
                 break;
             }
-            buf_ptr += num_lebs + obu_size;
-            rem_size -= num_lebs + obu_size;
+            buf_ptr += num_lebs;
+            rem_size -= num_lebs;
+            // bound OBU payload against remaining data to avoid pointer/size
+            // wraparound (mirrors the check in the packetization loop below)
+            if (obu_size > (uint32_t) rem_size) {
+                break;
+            }
+            buf_ptr += obu_size;
+            rem_size -= obu_size;
         }
 #else // RTPENC_AV1_SEARCH_SEQ_HEADER
         av_log(ctx, AV_LOG_DEBUG, "Marking FIRST packet\n");
@@ -160,7 +167,7 @@
             obu_hdr &= ~AV1F_OBU_HAS_SIZE_FIELD; // remove size field
             // read out explicit OBU size
             num_lebs = parse_leb(ctx, obu_ptr, frame_size, &obu_size);
-            if (!num_lebs) {
+            if (num_lebs <= 0) {
                 return;
             }
             obu_ptr += num_lebs;
@@ -170,7 +177,7 @@
             return;
         }
 
-        if ((long) obu_size > frame_size) {
+        if (obu_size > (unsigned) frame_size) {
             av_log(ctx, AV_LOG_ERROR, "AV1 OBU size %d larger than remaining frame size %d\n", obu_size, frame_size);
             return;
         }

ffmpeg-8.1.2.tar.xz/libavformat/rtpenc_vc2hq.c -> ffmpeg-8.1.3.tar.xz/libavformat/rtpenc_vc2hq.c Changed

@@ -33,16 +33,23 @@
 #define DIRAC_PIC_NR_SIZE                    4
 #define DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT      0xEC
 
-static void send_packet(AVFormatContext *ctx, uint8_t parse_code, int info_hdr_size, const uint8_t *buf, int size, int i, int f, int rtp_m)
+static int send_packet(AVFormatContext *ctx, uint8_t parse_code, int info_hdr_size, const uint8_t *buf, int size, int i, int f, int rtp_m)
 {
     RTPMuxContext *rtp_ctx = ctx->priv_data;
 
+    if (size < 0 ||
+        size > rtp_ctx->max_payload_size - RTP_VC2HQ_PL_HEADER_SIZE - info_hdr_size) {
+        av_log(ctx, AV_LOG_ERROR, "VC-2 data unit too large for RTP payload buffer\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     AV_WB16(&rtp_ctx->buf0, 0); /* extended sequence number */
     AV_WB8 (&rtp_ctx->buf2, i ? (f ? (0x03) : (0x02)) : 0x00); /* flags: interlaced, second field */
     AV_WB8 (&rtp_ctx->buf3, parse_code);
     if (size > 0)
         memcpy(&rtp_ctx->buf4 + info_hdr_size, buf, size);
     ff_rtp_send_data(ctx, rtp_ctx->buf, RTP_VC2HQ_PL_HEADER_SIZE + info_hdr_size + size, rtp_m);
+    return 0;
 }
 
 static int send_picture(AVFormatContext *ctx, const uint8_t *buf, int size, int interlaced)
@@ -85,7 +92,8 @@
     AV_WB16(&info_hdr 6, size_scaler);
     AV_WB16(&info_hdr 8, frag_len);
     AV_WB16(&info_hdr10, 0 /* nr. of slices */);
-    send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 12, buf, frag_len, interlaced, second_field, 0);
+    if (send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 12, buf, frag_len, interlaced, second_field, 0) < 0)
+        return AVERROR_INVALIDDATA;
     buf += frag_len;
     size -= frag_len;
 
@@ -97,7 +105,8 @@
         AV_WB16(&info_hdr14, 0 /* slice y */);
 
         size -= frag_len;
-        send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 16, buf, frag_len, interlaced, second_field, size > 0 ? 0 : 1);
+        if (send_packet(ctx, DIRAC_RTP_PCODE_HQ_PIC_FRAGMENT, 16, buf, frag_len, interlaced, second_field, size > 0 ? 0 : 1) < 0)
+            return AVERROR_INVALIDDATA;
         buf += frag_len;
     }
     return 0;

ffmpeg-8.1.2.tar.xz/libavformat/rtsp.c -> ffmpeg-8.1.3.tar.xz/libavformat/rtsp.c Changed

@@ -1868,6 +1868,32 @@
     ffurl_closep(&rt->rtsp_hd);
 }
 
+static int rtsp_url_same_origin(const char *url1, const char *url2)
+{
+    char proto1128, proto2128;
+    char host11024, host21024;
+    int port1, port2;
+
+    av_url_split(proto1, sizeof(proto1), NULL, 0, host1, sizeof(host1),
+                 &port1, NULL, 0, url1);
+    av_url_split(proto2, sizeof(proto2), NULL, 0, host2, sizeof(host2),
+                 &port2, NULL, 0, url2);
+
+    if (!proto10 || !proto20 || !host10 || !host20)
+        return 0;
+
+    if (port1 < 0)
+        port1 = !av_strcasecmp(proto1, "rtsps") ? RTSPS_DEFAULT_PORT
+                                                : RTSP_DEFAULT_PORT;
+    if (port2 < 0)
+        port2 = !av_strcasecmp(proto2, "rtsps") ? RTSPS_DEFAULT_PORT
+                                                : RTSP_DEFAULT_PORT;
+
+    return !av_strcasecmp(proto1, proto2) &&
+           !av_strcasecmp(host1, host2) &&
+           port1 == port2;
+}
+
 int ff_rtsp_connect(AVFormatContext *s)
 {
     RTSPState *rt = s->priv_data;
@@ -2181,7 +2207,13 @@
     ff_rtsp_close_streams(s);
     ff_rtsp_close_connections(s);
     if (reply->status_code >=300 && reply->status_code < 400 && s->iformat) {
-        int ret = ff_format_check_set_url(s, reply->location);
+        int ret;
+
+        if (!rtsp_url_same_origin(s->url, reply->location)) {
+            memset(rt->auth, 0, sizeof(rt->auth));
+            memset(&rt->auth_state, 0, sizeof(rt->auth_state));
+        }
+        ret = ff_format_check_set_url(s, reply->location);
         if (ret < 0) {
             err = ret;
             goto fail2;

ffmpeg-8.1.2.tar.xz/libavformat/scd.c -> ffmpeg-8.1.3.tar.xz/libavformat/scd.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/sierravmd.c -> ffmpeg-8.1.3.tar.xz/libavformat/sierravmd.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/spdifdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/spdifdec.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/spdifenc.c -> ffmpeg-8.1.3.tar.xz/libavformat/spdifenc.c Changed

ffmpeg-8.1.3.tar.xz/libavformat/tests/rename.c Added

@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2026 Christopher Decker
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+
+#include <stdio.h>
+
+#if HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+#include "libavutil/random_seed.h"
+
+#include "libavformat/os_support.h"
+
+static int create_file(const char *path)
+{
+    FILE *f = fopen(path, "wb");
+    if (!f)
+        return -1;
+    fputs("ffmpeg rename test\n", f);
+    fclose(f);
+    return 0;
+}
+
+static int file_exists(const char *path)
+{
+    FILE *f = fopen(path, "rb");
+    if (!f)
+        return 0;
+    fclose(f);
+    return 1;
+}
+
+int main(void)
+{
+    char src64;
+    char dst64;
+    unsigned seed = av_get_random_seed();
+    int ret = 0;
+
+    snprintf(src, sizeof(src), "ff-rename-test-%08x.src", seed);
+    snprintf(dst, sizeof(dst), "ff-rename-test-%08x.dst", seed);
+
+    if (create_file(src) < 0) {
+        perror("create src");
+        return 1;
+    }
+
+    /* rename() must follow POSIX semantics and return 0 on success. */
+    if (rename(src, dst) != 0) {
+        perror("rename");
+        ret = 1;
+        goto cleanup;
+    }
+
+    if (file_exists(src)) {
+        fprintf(stderr, "source still exists after rename\n");
+        ret = 1;
+        goto cleanup;
+    }
+
+    if (!file_exists(dst)) {
+        fprintf(stderr, "destination missing after rename\n");
+        ret = 1;
+        goto cleanup;
+    }
+
+    /* Renaming a nonexistent source must fail with a -1 return. */
+    if (rename(src, dst) != -1) {
+        fprintf(stderr, "rename of nonexistent source unexpectedly succeeded\n");
+        ret = 1;
+        goto cleanup;
+    }
+
+cleanup:
+    unlink(src);
+    unlink(dst);
+    return ret;
+}

ffmpeg-8.1.2.tar.xz/libavformat/tls_gnutls.c -> ffmpeg-8.1.3.tar.xz/libavformat/tls_gnutls.c Changed

@@ -532,6 +532,7 @@
     uint16_t gnutls_flags = 0;
     gnutls_x509_crt_t cert = NULL;
     gnutls_x509_privkey_t pkey = NULL;
+    int have_cert_pkey = 0;
     int ret;
 
     ff_gnutls_init();
@@ -556,16 +557,6 @@
         }
     }
 
-    if (s->is_dtls)
-        gnutls_flags |= GNUTLS_DATAGRAM;
-
-    if (s->listen)
-        gnutls_flags |= GNUTLS_SERVER;
-    else
-        gnutls_flags |= GNUTLS_CLIENT;
-    gnutls_init(&c->session, gnutls_flags);
-    if (!s->listen && !s->numerichost)
-        gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, s->host, strlen(s->host));
     gnutls_certificate_allocate_credentials(&c->cred);
     if (s->ca_file) {
         ret = gnutls_certificate_set_x509_trust_file(c->cred, s->ca_file, GNUTLS_X509_FMT_PEM);
@@ -589,6 +580,7 @@
             ret = AVERROR(EIO);
             goto fail;
         }
+        have_cert_pkey = 1;
     } else if (s->cert_file || s->key_file) {
         av_log(h, AV_LOG_ERROR, "cert and key required\n");
     } else if (s->cert_buf && s->key_buf) {
@@ -600,6 +592,7 @@
             ret = AVERROR(EINVAL);
             goto fail;
         }
+        have_cert_pkey = 1;
     } else if (s->cert_buf || s->key_buf) {
         av_log(h, AV_LOG_ERROR, "cert and key required\n");
     }
@@ -621,7 +614,27 @@
             ret = AVERROR(EINVAL);
             goto fail;
         }
+
+        have_cert_pkey = 1;
     }
+
+    if (s->is_dtls)
+        gnutls_flags |= GNUTLS_DATAGRAM;
+
+    if (s->listen)
+        gnutls_flags |= GNUTLS_SERVER;
+    else {
+        gnutls_flags |= GNUTLS_CLIENT;
+#if GNUTLS_VERSION_NUMBER >= 0x030500
+        if (have_cert_pkey)
+            gnutls_flags |= GNUTLS_FORCE_CLIENT_CERT;
+#endif
+    }
+
+    gnutls_init(&c->session, gnutls_flags);
+
+    if (!s->listen && !s->numerichost)
+        gnutls_server_name_set(c->session, GNUTLS_NAME_DNS, s->host, strlen(s->host));
     gnutls_credentials_set(c->session, GNUTLS_CRD_CERTIFICATE, c->cred);
     gnutls_transport_set_pull_function(c->session, gnutls_url_pull);
     gnutls_transport_set_push_function(c->session, gnutls_url_push);

ffmpeg-8.1.2.tar.xz/libavformat/tls_mbedtls.c -> ffmpeg-8.1.3.tar.xz/libavformat/tls_mbedtls.c Changed

@@ -468,6 +468,7 @@
     TLSContext *tls_ctx = h->priv_data;
     TLSShared *shr = &tls_ctx->tls_shared;
     URLContext *uc = shr->is_dtls ? shr->udp : shr->tcp;
+    uint32_t verify_res_flags;
     int ret;
 
     uc->flags &= ~AVIO_FLAG_NONBLOCK;
@@ -483,6 +484,18 @@
         }
     }
 
+    if (shr->verify) {
+        // check the result of the certificate verification
+        if ((verify_res_flags = mbedtls_ssl_get_verify_result(&tls_ctx->ssl_context)) != 0) {
+            av_log(h, AV_LOG_ERROR, "mbedtls_ssl_get_verify_result reported problems "\
+                                    "with the certificate verification, returned flags: %"PRIu32"\n",
+                                    verify_res_flags);
+            if (verify_res_flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
+                av_log(h, AV_LOG_ERROR, "The certificate is not correctly signed by the trusted CA.\n");
+            return AVERROR(EIO);
+        }
+    }
+
     return ret;
 }
 
@@ -650,7 +663,7 @@
         goto fail;
     }
 
-    if (!shr->listen && !shr->numerichost) {
+    if (!shr->listen) {
         if ((ret = mbedtls_ssl_set_hostname(&tls_ctx->ssl_context, shr->host)) != 0) {
             av_log(h, AV_LOG_ERROR, "mbedtls_ssl_set_hostname returned %d\n", ret);
             goto fail;

ffmpeg-8.1.2.tar.xz/libavformat/tls_openssl.c -> ffmpeg-8.1.3.tar.xz/libavformat/tls_openssl.c Changed

@@ -866,16 +866,38 @@
     SSL_set_ex_data(c->ssl, 0, c);
     SSL_CTX_set_info_callback(c->ctx, openssl_info_callback);
     init_bio_method(h);
-    if (!s->listen && !s->numerichost) {
+    if (!s->listen) {
+        // Pin a numeric host to the certificate's iPAddress SAN and everything else
+        // to the hostname. Classify s->host with the same AI_NUMERICHOST rule tls.c
+        // uses and hand OpenSSL the binary address, so legacy numeric forms (e.g.
+        // 2130706433) are pinned as IPs instead of falling back to hostname matching.
+        // A verifyhost=<name> override leaves s->host non-numeric and binds by name.
+        struct addrinfo hints = { .ai_flags = AI_NUMERICHOST }, *ai = NULL;
+        int is_numeric_host = !getaddrinfo(s->host, NULL, &hints, &ai);
+        int ok;
+
         // By default OpenSSL does too lax wildcard matching
         SSL_set_hostflags(c->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
-        if (!SSL_set1_host(c->ssl, s->host)) {
-            av_log(h, AV_LOG_ERROR, "Failed to set hostname for TLS/SSL verification: %s\n",
-                openssl_get_error(c));
+        if (is_numeric_host) {
+            void *addr = ai->ai_family == AF_INET6 ?
+                (void *)&((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr :
+                (void *)&((struct sockaddr_in  *)ai->ai_addr)->sin_addr;
+            ok = X509_VERIFY_PARAM_set1_ip(SSL_get0_param(c->ssl), addr,
+                                           ai->ai_family == AF_INET6 ? 16 : 4);
+        } else {
+            ok = SSL_set1_host(c->ssl, s->host);
+        }
+        if (ai)
+            freeaddrinfo(ai);
+        if (!ok) {
+            av_log(h, AV_LOG_ERROR, "Failed to set %s for TLS/SSL verification: %s\n",
+                is_numeric_host ? "IP" : "hostname", openssl_get_error(c));
             ret = AVERROR_EXTERNAL;
             goto fail;
         }
-        if (!SSL_set_tlsext_host_name(c->ssl, s->host)) {
+        // SNI MUST NOT carry a literal IP address (RFC 6066 sec. 3); suppress it for
+        // numeric transport hosts, matching the GnuTLS backend.
+        if (!s->numerichost && !SSL_set_tlsext_host_name(c->ssl, s->host)) {
             av_log(h, AV_LOG_ERROR, "Failed to set hostname for SNI: %s\n", openssl_get_error(c));
             ret = AVERROR_EXTERNAL;
             goto fail;

ffmpeg-8.1.2.tar.xz/libavformat/ty.c -> ffmpeg-8.1.3.tar.xz/libavformat/ty.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/version.h -> ffmpeg-8.1.3.tar.xz/libavformat/version.h Changed

ffmpeg-8.1.2.tar.xz/libavformat/vpk.c -> ffmpeg-8.1.3.tar.xz/libavformat/vpk.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/wavdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/wavdec.c Changed

ffmpeg-8.1.2.tar.xz/libavformat/wvdec.c -> ffmpeg-8.1.3.tar.xz/libavformat/wvdec.c Changed

ffmpeg-8.1.2.tar.xz/libavutil/encryption_info.c -> ffmpeg-8.1.3.tar.xz/libavutil/encryption_info.c Changed

ffmpeg-8.1.2.tar.xz/libavutil/hwcontext_cuda.c -> ffmpeg-8.1.3.tar.xz/libavutil/hwcontext_cuda.c Changed

ffmpeg-8.1.2.tar.xz/libavutil/opt.c -> ffmpeg-8.1.3.tar.xz/libavutil/opt.c Changed

ffmpeg-8.1.2.tar.xz/libavutil/pixdesc.c -> ffmpeg-8.1.3.tar.xz/libavutil/pixdesc.c Changed

@@ -3780,7 +3780,7 @@
     int i;
 
     for (i = 0; i < FF_ARRAY_ELEMS(color_range_names); i++) {
-        if (av_strstart(name, color_range_namesi, NULL))
+        if (!strcmp(name, color_range_namesi))
             return i;
     }
 
@@ -3805,7 +3805,7 @@
         if (!color_primaries_namesi)
             continue;
 
-        if (av_strstart(name, color_primaries_namesi, NULL))
+        if (!strcmp(name, color_primaries_namesi))
             return i;
     }
 
@@ -3813,7 +3813,7 @@
         if (!color_primaries_names_exti)
             continue;
 
-        if (av_strstart(name, color_primaries_names_exti, NULL))
+        if (!strcmp(name, color_primaries_names_exti))
             return AVCOL_PRI_EXT_BASE + i;
     }
 
@@ -3838,7 +3838,7 @@
         if (!color_transfer_namesi)
             continue;
 
-        if (av_strstart(name, color_transfer_namesi, NULL))
+        if (!strcmp(name, color_transfer_namesi))
             return i;
     }
 
@@ -3846,7 +3846,7 @@
         if (!color_transfer_names_exti)
             continue;
 
-        if (av_strstart(name, color_transfer_names_exti, NULL))
+        if (!strcmp(name, color_transfer_names_exti))
             return AVCOL_TRC_EXT_BASE + i;
     }
 
@@ -3867,7 +3867,7 @@
         if (!color_space_namesi)
             continue;
 
-        if (av_strstart(name, color_space_namesi, NULL))
+        if (!strcmp(name, color_space_namesi))
             return i;
     }
 
@@ -3888,7 +3888,7 @@
         if (!chroma_location_namesi)
             continue;
 
-        if (av_strstart(name, chroma_location_namesi, NULL))
+        if (!strcmp(name, chroma_location_namesi))
             return i;
     }
 
@@ -3930,7 +3930,7 @@
         if (!alpha_mode_namesi)
             continue;
 
-        if (av_strstart(name, alpha_mode_namesi, NULL))
+        if (!strcmp(name, alpha_mode_namesi))
             return i;
     }

ffmpeg-8.1.2.tar.xz/libavutil/ppc/util_altivec.h -> ffmpeg-8.1.3.tar.xz/libavutil/ppc/util_altivec.h Changed

ffmpeg-8.1.2.tar.xz/libavutil/rational.c -> ffmpeg-8.1.3.tar.xz/libavutil/rational.c Changed

ffmpeg-8.1.2.tar.xz/libavutil/version.h -> ffmpeg-8.1.3.tar.xz/libavutil/version.h Changed

ffmpeg-8.1.2.tar.xz/libavutil/x86/asm.h -> ffmpeg-8.1.3.tar.xz/libavutil/x86/asm.h Changed

ffmpeg-8.1.2.tar.xz/libswresample/aarch64/audio_convert_neon.S -> ffmpeg-8.1.3.tar.xz/libswresample/aarch64/audio_convert_neon.S Changed

@@ -24,15 +24,15 @@
 
 function swri_oldapi_conv_flt_to_s16_neon, export=1
 oldapi_conv_flt_to_s16_neon:
-        subs            x2,  x2,  #8
+        subs            w2,  w2,  #8
         ld1             {v0.4s}, x1,  #16
         fcvtzs          v4.4s,  v0.4s,  #31
         ld1             {v1.4s}, x1,  #16
         fcvtzs          v5.4s,  v1.4s,  #31
         b.eq            3f
-        ands            x12, x2,  #~15
+        ands            w12, w2,  #~15
         b.eq            2f
-1:      subs            x12, x12, #16
+1:      subs            w12, w12, #16
         sqrshrn         v4.4h,  v4.4s,  #16
         ld1             {v2.4s}, x1,  #16
         fcvtzs          v6.4s,  v2.4s,  #31
@@ -48,7 +48,7 @@
         fcvtzs          v5.4s,  v1.4s,  #31
         st1             {v6.8h}, x0,  #16
         b.ne            1b
-        ands            x2,  x2,  #15
+        ands            w2,  w2,  #15
         b.eq            3f
 2:      ld1             {v2.4s}, x1,  #16
         sqrshrn         v4.4h,  v4.4s,  #16
@@ -70,7 +70,7 @@
 function swri_oldapi_conv_fltp_to_s16_2ch_neon, export=1
 oldapi_conv_fltp_to_s16_2ch_neon:
         ldp             x4,  x5,  x1
-        subs            x2,  x2,  #8
+        subs            w2,  w2,  #8
         ld1             {v0.4s},  x4, #16
         fcvtzs          v4.4s,  v0.4s,  #31
         ld1             {v1.4s},  x4, #16
@@ -80,9 +80,9 @@
         ld1             {v3.4s},  x5, #16
         fcvtzs          v7.4s,  v3.4s,  #31
         b.eq            3f
-        ands            x12, x2,  #~15
+        ands            w12, w2,  #~15
         b.eq            2f
-1:      subs            x12, x12, #16
+1:      subs            w12, w12, #16
         ld1             {v16.4s}, x4, #16
         fcvtzs          v20.4s, v16.4s, #31
         sri             v6.4s,  v4.4s,  #16
@@ -108,7 +108,7 @@
         fcvtzs          v7.4s,  v3.4s,  #31
         st1             {v23.4s}, x0, #16
         b.ne            1b
-        ands            x2,  x2,  #15
+        ands            w2,  w2,  #15
         b.eq            3f
 2:      sri             v6.4s,  v4.4s,  #16
         ld1             {v0.4s},  x4, #16
@@ -132,6 +132,7 @@
 endfunc
 
 function swri_oldapi_conv_fltp_to_s16_nch_neon, export=1
+        sxtw            x3,  w3
         cmp             w3,  #2
         b.eq            oldapi_conv_fltp_to_s16_2ch_neon
         b.gt            1f

ffmpeg-8.1.2.tar.xz/libswresample/version.h -> ffmpeg-8.1.3.tar.xz/libswresample/version.h Changed

ffmpeg-8.1.2.tar.xz/libswscale/Makefile -> ffmpeg-8.1.3.tar.xz/libswscale/Makefile Changed

ffmpeg-8.1.3.tar.xz/libswscale/filters.c Added

@@ -0,0 +1,453 @@
+/*
+ * Copyright (C) 2026 Niklas Haas
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <math.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <libavutil/attributes.h>
+#include <libavutil/avassert.h>
+#include <libavutil/error.h>
+#include <libavutil/mem.h>
+
+#include "filters.h"
+
+#ifdef _WIN32
+#  define j1 _j1
+#endif
+
+/* Maximum (pre-stretching) radius (for tunable filters) */
+#define RADIUS_MAX 10.0
+
+/* Defined only on 0, radius. */
+typedef double (*SwsFilterKernel)(double x, const double *params);
+
+typedef struct SwsFilterFunction {
+    char name16;
+    double radius; /* negative means resizable */
+    SwsFilterKernel kernel;
+    SwsFilterKernel window; /* optional */
+    double paramsSWS_NUM_SCALER_PARAMS; /* default params */
+} SwsFilterFunction;
+
+static const SwsFilterFunction filter_functionsSWS_SCALE_NB;
+
+static double scaler_sample(const SwsFilterFunction *f, double x)
+{
+    x = fabs(x);
+    if (x > f->radius)
+        return 0.0;
+
+    double w = f->kernel(x, f->params);
+    if (f->window)
+        w *= f->window(x / f->radius, f->params);
+    return w;
+}
+
+static void compute_row(SwsFilterWeights *f, const SwsFilterFunction *fun,
+                        double radius, double ratio_inv, double stretch_inv,
+                        int dst_pos, double *tmp)
+{
+    int *out = &f->weightsdst_pos * f->filter_size;
+    int *pos = &f->offsetsdst_pos;
+
+    /**
+     * Explanation of the 0.5 offsets: Normally, pixel samples are assumed
+     * to be representative of the center of their containing area; e.g. for
+     * a 2x2 image, the samples are located at {0.5, 1.5}^2. However, with
+     * integer indexing, we round sample positions down (0-based indexing).
+     * So the (0, 0) sample is actually located at (0.5, 0.5) and represents
+     * the entire square from (0,0) to (1,1). When normalizing between different
+     * image sizes, we therefore need to add/subtract off these 0.5 offsets.
+     */
+    const double src_pos = (dst_pos + 0.5) * ratio_inv - 0.5 + f->offset;
+    if (f->filter_size == 1) {
+        *pos = fmin(fmax(round(src_pos), 0.0), f->src_size - 1);
+        *out = SWS_FILTER_SCALE;
+        return;
+    }
+
+    /* First pixel that is actually within the filter envelope */
+    const double start_pos = src_pos - radius;
+    int64_t start_idx = ceil(start_pos);
+    start_idx = FFMAX(start_idx, 0); /* edge clamping */
+    start_idx = FFMIN(start_idx, f->src_size - f->filter_size);
+    const double offset = start_idx - src_pos;
+    *pos = start_idx;
+
+    /**
+     * Generate raw filter weights with maximum precision. Sum the positive
+     * and negative weights separately to avoid catastrophic cancellation. This
+     * summation order should already give the best precision because abs(w)
+     * is monotonically decreasing
+     */
+    const double base = stretch_inv * offset;
+    double wsum_pos = 0.0, wsum_neg = 0.0;
+    for (int i = 0; i < f->filter_size; i++) {
+        tmpi = scaler_sample(fun, base + stretch_inv * i);
+        if (tmpi >= 0)
+            wsum_pos += tmpi;
+        else
+            wsum_neg += tmpi;
+    }
+
+    const double wsum = wsum_pos + wsum_neg;
+    av_assert0(wsum > 0);
+
+    /* Generate correctly rounded filter weights with error diffusion */
+    double error = 0.0;
+    int sum_pos = 0, sum_neg = 0;
+    for (int i = 0; i < f->filter_size; i++) {
+        if (i == f->filter_size - 1) {
+            /* Ensure weights sum to exactly SWS_FILTER_SCALE */
+            outi = SWS_FILTER_SCALE - sum_pos - sum_neg;
+        } else {
+            const double w = tmpi / wsum + error;
+            outi = round(w * SWS_FILTER_SCALE);
+            error = w - (double) outi / SWS_FILTER_SCALE;
+        }
+        if (outi >= 0)
+            sum_pos += outi;
+        else
+            sum_neg += outi;
+    }
+
+    if (sum_pos > f->sum_positive)
+        f->sum_positive = sum_pos;
+    if (sum_neg < f->sum_negative)
+        f->sum_negative = sum_neg;
+}
+
+static void sws_filter_free(AVRefStructOpaque opaque, void *obj)
+{
+    SwsFilterWeights *filter = obj;
+    av_refstruct_unref(&filter->weights);
+    av_refstruct_unref(&filter->offsets);
+}
+
+static bool validate_params(const SwsFilterFunction *fun, SwsScaler scaler)
+{
+    switch (scaler) {
+    case SWS_SCALE_GAUSSIAN:
+        return fun->params0 >= 0.0; /* sigma */
+    case SWS_SCALE_LANCZOS:
+        return fun->params0 >= 1.0 && fun->params0 <= RADIUS_MAX; /* radius */
+    case SWS_SCALE_BICUBIC:
+        return fun->params0 < 3.0; /* B param (division by zero) */
+    default:
+        return true;
+    }
+}
+
+static double filter_radius(const SwsFilterFunction *fun)
+{
+    const double bound = fun->radius;
+    const double step  = 1e-2;
+
+    double radius = bound;
+    double prev = 0.0, fprev = 1.0; /* f(0) is always 1.0 */
+    double integral = 0.0;
+    for (double x = step; x < bound + step; x += step) {
+        const double fx = scaler_sample(fun, x);
+        integral += (fprev + fx) * step; /* trapezoidal rule (mirrored) */
+        double cutoff = SWS_MAX_REDUCE_CUTOFF * integral;
+        if ((fprev > cutoff && fx <= cutoff) || (fprev < -cutoff && fx >= -cutoff)) {
+            /* estimate crossing with secant method; note that we have to
+             * bias by the cutoff to find the actual cutoff radius */
+            double estimate = fx + (fx > fprev ? cutoff : -cutoff);
+            double root = x - estimate * (x - prev) / (fx - fprev);
+            radius = fmin(root, bound);
+        }
+        prev  = x;
+        fprev = fx;
+    }
+
+    return radius;
+}
+
+int ff_sws_filter_generate(void *log, const SwsFilterParams *params,
+                           SwsFilterWeights **out)
+{
+    SwsScaler scaler = params->scaler;
+    if (scaler >= SWS_SCALE_NB)
+        return AVERROR(EINVAL);
+
+    if (scaler == SWS_SCALE_AUTO)
+        scaler = SWS_SCALE_BICUBIC;
+
+    double virtual_size = params->virtual_size;
+    if (!virtual_size)
+        virtual_size = params->dst_size;
+
+    const double ratio = virtual_size / params->src_size;

ffmpeg-8.1.3.tar.xz/libswscale/filters.h Added

@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2026 Niklas Haas
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef SWSCALE_FILTERS_H
+#define SWSCALE_FILTERS_H
+
+#include <libavutil/refstruct.h>
+
+typedef enum SwsScaler {
+    SWS_SCALE_AUTO = 0,
+    SWS_SCALE_BILINEAR, ///< bilinear filtering
+    SWS_SCALE_BICUBIC,  ///< 2-tap cubic BC-spline
+    SWS_SCALE_POINT,    ///< nearest neighbor (point sampling)
+    SWS_SCALE_AREA,     ///< area averaging
+    SWS_SCALE_GAUSSIAN, ///< 2-tap gaussian approximation
+    SWS_SCALE_SINC,     ///< unwindowed sinc
+    SWS_SCALE_LANCZOS,  ///< 3-tap sinc/sinc
+    SWS_SCALE_SPLINE,   ///< unwindowned natural cubic spline
+    SWS_SCALE_NB,       ///< not part of the ABI
+    SWS_SCALE_MAX_ENUM = 0x7FFFFFFF, ///< force size to 32 bits, not a valid filter type
+} SwsScaler;
+
+#define SWS_NUM_SCALER_PARAMS 2
+#define SWS_MAX_REDUCE_CUTOFF 0.002
+#define SWS_PARAM_DEFAULT     123456
+
+/* Design constants of the filtering subsystem */
+enum {
+    /**
+     * 14-bit coefficients are picked to fit comfortably within int16_t
+     * for efficient SIMD processing (e.g. pmaddwd on x86). Conversely, this
+     * limits the maximum filter size to 256, to avoid excessive precision
+     * loss. (Consider that 14 - 8 = 6 bit effective weight resolution)
+     *
+     * Note that this limitation would not apply to floating-point filters,
+     * and in a future update to this code, we could gain the ability to
+     * generate unbounded floating point filters directly.
+     */
+    SWS_FILTER_SCALE    = (1 << 14),
+    SWS_FILTER_SIZE_MAX = 256,
+};
+
+/* Parameters for filter generation. */
+typedef struct SwsFilterParams {
+    /**
+     * The filter kernel and parameters to use.
+     */
+    SwsScaler scaler;
+    double scaler_paramsSWS_NUM_SCALER_PARAMS;
+
+    /**
+     * The relative sizes of the input and output images. Used to determine
+     * the number of rows in the output, as well as the fractional offsets of
+     * the samples in each row.
+     */
+    int src_size;
+    int dst_size;
+
+    /**
+     * The virtual output size. If zero, this is assumed to be the same as
+     * `dst_size`. Matters for e.g. chroma subsampling, where the the luma
+     * plane may be smaller than the dst_size. For example, a 99x99 input
+     * image has a chroma size of 50x50, which would be 100x100 after
+     * chroma upscaling; but is sampled only at 99x99 resolution. In this
+     * instance, dst_size is 99x99 and virtual_size is 100x100.
+     *
+     * The upscaling offset from this shift is implicit and does not need
+     * to be accounted for in `offset`. In other words, `offset` is taken
+     * relative to the virtual size, not the sampled size.
+     */
+    double virtual_size;
+
+    /**
+     * The sample offset, in units of input pixels. This is added onto all
+     * sampled coordinates directly, i.e. a value of offset = 1.0 would shift
+     * the output to the top/left by one whole source pixel.
+     */
+    double offset;
+} SwsFilterParams;
+
+/**
+ * Represents a computed filter kernel.
+ */
+typedef struct SwsFilterWeights {
+    /**
+     * The number of source texels to convolve over for each row.
+     */
+    int filter_size;
+
+    /**
+     * The computed look-up table (LUT). This is interpreted as a 2D array with
+     * dimensions dst_heightrow_size. The inner rows contain the `row_size`
+     * samples to convolve with the corresponding input pixels. The outer
+     * coordinate is indexed by the position of the sample to reconstruct.
+     */
+    int *weights; /* refstruct */
+    size_t num_weights;
+
+    /**
+     * The computed source pixel positions for each row of the filter. This
+     * indexes into the source image, and gives the position of the first
+     * source pixel to convolve with for each entry.
+     */
+    int *offsets; /* refstruct */
+
+    /**
+     * Copy of the parameters used to generate this filter, for reference.
+     */
+    int src_size;
+    int dst_size;
+    double virtual_size;
+    double offset;
+
+    /**
+     * Extra metadata about the filter, used to inform the optimizer / range
+     * tracker about the filter's behavior.
+     */
+    char name16;    /* name of the configured filter kernel */
+    int sum_positive; /* (maximum) sum of all positive weights */
+    int sum_negative; /* (minimum) sum of all negative weights */
+} SwsFilterWeights;
+
+/**
+ * Generate a filter kernel for the given parameters. The generated filter is
+ * allocated as a refstruct and must be unref'd by the caller.
+ *
+ * Returns 0 or a negative error code. In particular, this may return:
+ * - AVERROR(ENOMEM) if memory allocation fails.
+ * - AVERROR(EINVAL) if the provided parameters are invalid (e.g. out of range).
+ * - AVERROR(ENOTSUP) if the generated filter would exceed SWS_FILTER_SIZE_MAX.
+ **/
+int ff_sws_filter_generate(void *log_ctx, const SwsFilterParams *params,
+                           SwsFilterWeights **out);
+
+#endif /* SWSCALE_FILTERS_H */

ffmpeg-8.1.2.tar.xz/libswscale/hscale_fast_bilinear.c -> ffmpeg-8.1.3.tar.xz/libswscale/hscale_fast_bilinear.c Changed

ffmpeg-8.1.2.tar.xz/libswscale/loongarch/output.S -> ffmpeg-8.1.3.tar.xz/libswscale/loongarch/output.S Changed

@@ -173,91 +173,30 @@
     vinsgr2vr.h  vr1,   t5,    5
     vinsgr2vr.h  vr1,   t6,    6
     vinsgr2vr.h  vr1,   t7,    7
-    vsub.h       vr0,   vr0,   vr0
-    vilvl.h      vr2,   vr0,   vr1
-    vilvh.h      vr3,   vr0,   vr1
-
     andi         t8,    a2,    7
     srli.d       a2,    a2,    3
     beqz         a2,    2f
 1:
-    vld          vr1,   a0,    0
-    addi.d       a0,    a0,    16
-    vshuf4i.d    vr0,   vr1,   8
-    vexth.w.h    vr4,   vr0
-    vexth.w.h    vr5,   vr1
+    vld           vr2,   a0,    0
+    addi.d        a0,    a0,    16
+    vavg.h        vr4,   vr1,   vr2
+    vssrani.bu.h  vr4,   vr4,   6
 
-    vadd.w       vr4,   vr2,   vr4
-    vadd.w       vr5,   vr3,   vr5
-    vsrai.w      vr4,   vr4,   7
-    vsrai.w      vr5,   vr5,   7
-    vclip255.w   vr4,   vr4
-    vclip255.w   vr5,   vr5
-    vpickev.h    vr1,   vr5,   vr4
-    vpickev.b    vr1,   vr1,   vr1
-    fst.d        f1,    a1,    0
-    addi.d       a1,    a1,    8
-    addi.d       a2,    a2,    -1
-    bnez         a2,    1b
+    fst.d         f4,    a1,    0
+    addi.d        a1,    a1,    8
+    addi.d        a2,    a2,    -1
+    blt           zero,  a2,    1b
 2:
     beqz         t8,    4f
+    vld          vr2,   a0,     0
+    vavg.h       vr4,   vr1,    vr2
+    vssrani.bu.h vr4,   vr4,    6
 3:
-    add.w        a4,    a4,    t8
-    addi.w       t1,    a4,    1
-    addi.w       t2,    a4,    2
-    addi.w       t3,    a4,    3
-    addi.w       t4,    a4,    4
-    addi.w       t5,    a4,    5
-    addi.w       t6,    a4,    6
-    addi.w       t7,    a4,    7
-    andi         t0,    a4,    7
-    andi         t1,    t1,    7
-    andi         t2,    t2,    7
-    andi         t3,    t3,    7
-    andi         t4,    t4,    7
-    andi         t5,    t5,    7
-    andi         t6,    t6,    7
-    andi         t7,    t7,    7
-    ldx.bu       t0,    a3,    t0
-    ldx.bu       t1,    a3,    t1
-    ldx.bu       t2,    a3,    t2
-    ldx.bu       t3,    a3,    t3
-    ldx.bu       t4,    a3,    t4
-    ldx.bu       t5,    a3,    t5
-    ldx.bu       t6,    a3,    t6
-    ldx.bu       t7,    a3,    t7
-    vinsgr2vr.h  vr1,   t0,    0
-    vinsgr2vr.h  vr1,   t1,    1
-    vinsgr2vr.h  vr1,   t2,    2
-    vinsgr2vr.h  vr1,   t3,    3
-    vinsgr2vr.h  vr1,   t4,    4
-    vinsgr2vr.h  vr1,   t5,    5
-    vinsgr2vr.h  vr1,   t6,    6
-    vinsgr2vr.h  vr1,   t7,    7
-    vsub.h       vr0,   vr0,   vr0
-    vilvl.h      vr2,   vr0,   vr1
-    vilvh.h      vr3,   vr0,   vr1
-
-    addi.d       a0,    a0,    -16
-    add.d        a0,    a0,    t8
-    add.d        a0,    a0,    t8
-    addi.d       a1,    a1,    -8
-    add.d        a1,    a1,    t8
-
-    vld          vr1,   a0,    0
-    vshuf4i.d    vr0,   vr1,   8
-    vexth.w.h    vr4,   vr0
-    vexth.w.h    vr5,   vr1
-
-    vadd.w       vr4,   vr2,   vr4
-    vadd.w       vr5,   vr3,   vr5
-    vsrai.w      vr4,   vr4,   7
-    vsrai.w      vr5,   vr5,   7
-    vclip255.w   vr4,   vr4
-    vclip255.w   vr5,   vr5
-    vpickev.h    vr1,   vr5,   vr4
-    vpickev.b    vr1,   vr1,   vr1
-    fst.d        f1,    a1,    0
+    vstelm.b     vr4,   a1,     0,  0
+    vbsrl.v      vr4,   vr4,    1
+    addi.d       t8,    t8,     -1
+    addi.d       a1,    a1,     1
+    bne          t8,    zero,   3b
 4:
 endfunc
 
@@ -294,95 +233,42 @@
     vinsgr2vr.h  vr1,   t6,    6
     vinsgr2vr.h  vr1,   t7,    7
     xvpermi.q    xr1,   xr1,   0
-    xvsub.h      xr0,   xr0,   xr0
-    xvilvl.h     xr2,   xr0,   xr1
-    xvilvh.h     xr3,   xr0,   xr1
 
     andi         t8,    a2,    15
     srli.d       a2,    a2,    4
     beqz         a2,    2f
 1:
-    xvld         xr1,   a0,    0
-    addi.d       a0,    a0,    32
-    xvpermi.d    xr0,   xr1,   0xa0
-    xvexth.w.h   xr4,   xr0
-    xvexth.w.h   xr5,   xr1
-
-    xvadd.w      xr4,   xr2,   xr4
-    xvadd.w      xr5,   xr3,   xr5
-    xvsrai.w     xr4,   xr4,   7
-    xvsrai.w     xr5,   xr5,   7
-    xvclip255.w  xr4,   xr4
-    xvclip255.w  xr5,   xr5
-    xvpickev.h   xr1,   xr5,   xr4
-    xvpickev.b   xr0,   xr1,   xr1
-    xvpermi.q    xr1,   xr0,   1
-    fst.d        f0,    a1,    0
-    fst.d        f1,    a1,    8
-    addi.d       a1,    a1,    16
-    addi.d       a2,    a2,    -1
-    bnez         a2,    1b
+    xvld          xr2,   a0,    0
+    addi.d        a0,    a0,    32
+    xvavg.h       xr4,   xr1,   xr2
+    xvssrani.bu.h xr4,   xr4,   6
+    xvstelm.d     xr4,   a1,    0,   0
+    xvstelm.d     xr4,   a1,    8,   2
+    addi.d        a1,    a1,    16
+    addi.d        a2,    a2,    -1
+    bnez          a2,    1b
 2:
-    beqz         t8,    4f
-3:
-    add.w        a4,    a4,    t8
-    addi.w       t1,    a4,    1
-    addi.w       t2,    a4,    2
-    addi.w       t3,    a4,    3
-    addi.w       t4,    a4,    4
-    addi.w       t5,    a4,    5
-    addi.w       t6,    a4,    6
-    addi.w       t7,    a4,    7
-    andi         t0,    a4,    7
-    andi         t1,    t1,    7
-    andi         t2,    t2,    7
-    andi         t3,    t3,    7
-    andi         t4,    t4,    7
-    andi         t5,    t5,    7
-    andi         t6,    t6,    7
-    andi         t7,    t7,    7
-    ldx.bu       t0,    a3,    t0
-    ldx.bu       t1,    a3,    t1
-    ldx.bu       t2,    a3,    t2
-    ldx.bu       t3,    a3,    t3
-    ldx.bu       t4,    a3,    t4
-    ldx.bu       t5,    a3,    t5
-    ldx.bu       t6,    a3,    t6
-    ldx.bu       t7,    a3,    t7
-    vinsgr2vr.h  vr1,   t0,    0
-    vinsgr2vr.h  vr1,   t1,    1
-    vinsgr2vr.h  vr1,   t2,    2
-    vinsgr2vr.h  vr1,   t3,    3
-    vinsgr2vr.h  vr1,   t4,    4
-    vinsgr2vr.h  vr1,   t5,    5
-    vinsgr2vr.h  vr1,   t6,    6
-    vinsgr2vr.h  vr1,   t7,    7
-    xvpermi.q    xr1,   xr1,   0
-    xvsub.h      xr0,   xr0,   xr0
-    xvilvl.h     xr2,   xr0,   xr1
-    xvilvh.h     xr3,   xr0,   xr1
-
-    addi.d       a0,    a0,    -32
-    add.d        a0,    a0,    t8
-    add.d        a0,    a0,    t8
-    addi.d       a1,    a1,    -16
-    add.d        a1,    a1,    t8
-
-    xvld         xr1,   a0,    0
-    xvpermi.d    xr0,   xr1,   0xa0
-    xvexth.w.h   xr4,   xr0
-    xvexth.w.h   xr5,   xr1
+    beqz          t8,    4f

ffmpeg-8.1.2.tar.xz/libswscale/output.c -> ffmpeg-8.1.3.tar.xz/libswscale/output.c Changed

ffmpeg-8.1.2.tar.xz/libswscale/ppc/swscale_vsx.c -> ffmpeg-8.1.3.tar.xz/libswscale/ppc/swscale_vsx.c Changed

ffmpeg-8.1.2.tar.xz/libswscale/ppc/yuv2rgb_altivec.c -> ffmpeg-8.1.3.tar.xz/libswscale/ppc/yuv2rgb_altivec.c Changed

ffmpeg-8.1.2.tar.xz/libswscale/swscale.h -> ffmpeg-8.1.3.tar.xz/libswscale/swscale.h Changed

ffmpeg-8.1.2.tar.xz/libswscale/swscale_unscaled.c -> ffmpeg-8.1.3.tar.xz/libswscale/swscale_unscaled.c Changed

@@ -1838,9 +1838,8 @@
     const int dstId = c->dstFormatBpp;
     rgbConvFn conv = NULL;
 
-#define IS_NOT_NE(bpp, desc) \
-    (((bpp + 7) >> 3) == 2 && \
-     (!(desc->flags & AV_PIX_FMT_FLAG_BE) != !HAVE_BIGENDIAN))
+#define IS_NOT_NE(Bpp, desc) \
+    (Bpp == 2 && (!(desc->flags & AV_PIX_FMT_FLAG_BE) != !HAVE_BIGENDIAN))
 
 #define CONV_IS(src, dst) (srcFormat == AV_PIX_FMT_##src && dstFormat == AV_PIX_FMT_##dst)
 
@@ -2282,13 +2281,13 @@
                            shiftonly) {
 #if HAVE_FAST_64BIT
                             for (; j < length - 3; j += 4) {
-                                uint64_t v = AV_RN64A(srcPtr2 + j) >> src_shift;
-                                AV_WN64A(dstPtr2 + j, (v << shift) << dst_shift);
+                                uint64_t v = AV_RN64(srcPtr2 + j) >> src_shift;
+                                AV_WN64(dstPtr2 + j, (v << shift) << dst_shift);
                             }
 #else
                             for (; j < length - 1; j += 2) {
-                                uint32_t v = AV_RN32A(srcPtr2 + j) >> src_shift;
-                                AV_WN32A(dstPtr2 + j, (v << shift) << dst_shift);
+                                uint32_t v = AV_RN32(srcPtr2 + j) >> src_shift;
+                                AV_WN32(dstPtr2 + j, (v << shift) << dst_shift);
                             }
 #endif
                         }

ffmpeg-8.1.2.tar.xz/libswscale/version.h -> ffmpeg-8.1.3.tar.xz/libswscale/version.h Changed

ffmpeg-8.1.2.tar.xz/libswscale/x86/hscale_fast_bilinear_simd.c -> ffmpeg-8.1.3.tar.xz/libswscale/x86/hscale_fast_bilinear_simd.c Changed

ffmpeg-8.1.2.tar.xz/tests/checkasm/flacdsp.c -> ffmpeg-8.1.3.tar.xz/tests/checkasm/flacdsp.c Changed

@@ -74,12 +74,25 @@
     for (int i = 0; i < BUF_SIZE; i++)
         dsti = sign_extend(rnd(), bps);
 
-    memcpy(dst0, dst, BUF_SIZE * sizeof (int32_t));
-    memcpy(dst1, dst, BUF_SIZE * sizeof (int32_t));
-    call_ref(dst0, coeffs, pred_order, qlevel, BUF_SIZE);
-    call_new(dst1, coeffs, pred_order, qlevel, BUF_SIZE);
-    if (memcmp(dst0, dst1, BUF_SIZE * sizeof (int32_t)) != 0)
-       fail();
+    const int test_lens = {
+        0,
+        pred_order - 1,
+        pred_order,
+        pred_order + 1,
+        BUF_SIZE,
+    };
+
+    for (int k = 0; k < FF_ARRAY_ELEMS(test_lens); k++) {
+        int len = test_lensk;
+        if (len < 0 || len > BUF_SIZE) continue;
+
+        memcpy(dst0, dst, BUF_SIZE * sizeof (int32_t));
+        memcpy(dst1, dst, BUF_SIZE * sizeof (int32_t));
+        call_ref(dst0, coeffs, pred_order, qlevel, len);
+        call_new(dst1, coeffs, pred_order, qlevel, len);
+        if (memcmp(dst0, dst1, BUF_SIZE * sizeof (int32_t)) != 0)
+           fail();
+    }
     bench_new(dst, coeffs, pred_order, qlevel, BUF_SIZE);
 }
 
@@ -103,12 +116,25 @@
         dsti = sign_extend64(((int64_t)rnd() << 1) | (rnd() & 1), 33);
     }
 
-    memcpy(dst0, dst, BUF_SIZE * sizeof (int64_t));
-    memcpy(dst1, dst, BUF_SIZE * sizeof (int64_t));
-    call_ref(dst0, residuals, coeffs, pred_order, qlevel, BUF_SIZE);
-    call_new(dst1, residuals, coeffs, pred_order, qlevel, BUF_SIZE);
-    if (memcmp(dst0, dst1, BUF_SIZE * sizeof (int64_t)) != 0)
-       fail();
+    const int test_lens = {
+        0,
+        pred_order - 1,
+        pred_order,
+        pred_order + 1,
+        BUF_SIZE,
+    };
+
+    for (int k = 0; k < FF_ARRAY_ELEMS(test_lens); k++) {
+        int len = test_lensk;
+        if (len < 0 || len > BUF_SIZE) continue;
+
+        memcpy(dst0, dst, BUF_SIZE * sizeof (int64_t));
+        memcpy(dst1, dst, BUF_SIZE * sizeof (int64_t));
+        call_ref(dst0, residuals, coeffs, pred_order, qlevel, len);
+        call_new(dst1, residuals, coeffs, pred_order, qlevel, len);
+        if (memcmp(dst0, dst1, BUF_SIZE * sizeof (int64_t)) != 0)
+           fail();
+    }
     bench_new(dst, residuals, coeffs, pred_order, qlevel, BUF_SIZE);
 }

ffmpeg-8.1.2.tar.xz/tests/checkasm/llviddsp.c -> ffmpeg-8.1.3.tar.xz/tests/checkasm/llviddsp.c Changed

ffmpeg-8.1.2.tar.xz/tests/fate/ffmpeg.mak -> ffmpeg-8.1.3.tar.xz/tests/fate/ffmpeg.mak Changed

@@ -267,6 +267,20 @@
     -c copy -f null -t 1 -
 FATE_FFMPEG-$(call REMUX, RAWVIDEO, NULL_MUXER) += fate-ffmpeg-streamcopy-t
 
+fate-ffmpeg-negative-t: tests/data/vsynth1.yuv
+fate-ffmpeg-negative-t: CMP = null
+fate-ffmpeg-negative-t: CMD = ffmpeg                                                               \
+    -stream_loop -1 -f rawvideo -s 352x288 -pix_fmt yuv420p -i $(TARGET_PATH)/tests/data/vsynth1.yuv \
+    -c copy -f null -t -1 -; test $$? -ne 0
+FATE_FFMPEG-$(call REMUX, RAWVIDEO, NULL_MUXER) += fate-ffmpeg-negative-t
+
+fate-ffmpeg-negative-input-t: tests/data/vsynth1.yuv
+fate-ffmpeg-negative-input-t: CMP = null
+fate-ffmpeg-negative-input-t: CMD = ffmpeg                                                        \
+    -stream_loop -1 -f rawvideo -s 352x288 -pix_fmt yuv420p -t -1 -i $(TARGET_PATH)/tests/data/vsynth1.yuv \
+    -c copy -f null -; test $$? -ne 0
+FATE_FFMPEG-$(call REMUX, RAWVIDEO, NULL_MUXER) += fate-ffmpeg-negative-input-t
+
 # Test loopback decoding and passing the output to a complex graph.
 fate-ffmpeg-loopback-decoding: tests/data/vsynth1.yuv
 fate-ffmpeg-loopback-decoding: CMD = transcode \

ffmpeg-8.1.2.tar.xz/tests/fate/filter-video.mak -> ffmpeg-8.1.3.tar.xz/tests/fate/filter-video.mak Changed

ffmpeg-8.1.2.tar.xz/tests/fate/hevc.mak -> ffmpeg-8.1.3.tar.xz/tests/fate/hevc.mak Changed

ffmpeg-8.1.2.tar.xz/tests/fate/libavformat.mak -> ffmpeg-8.1.3.tar.xz/tests/fate/libavformat.mak Changed

ffmpeg-8.1.2.tar.xz/tests/ref/fate/filter-bwdif-mode0 -> ffmpeg-8.1.3.tar.xz/tests/ref/fate/filter-bwdif-mode0 Changed

ffmpeg-8.1.2.tar.xz/tests/ref/fate/filter-bwdif-mode1 -> ffmpeg-8.1.3.tar.xz/tests/ref/fate/filter-bwdif-mode1 Changed

ffmpeg-8.1.2.tar.xz/tests/ref/fate/filter-bwdif10 -> ffmpeg-8.1.3.tar.xz/tests/ref/fate/filter-bwdif10 Changed

@@ -3,33 +3,33 @@
 #codec_id 0: rawvideo
 #dimensions 0: 720x576
 #sar 0: 16/15
-0,          9,          9,        1,  1244160, 0x4f0e6e1c
-0,         10,         10,        1,  1244160, 0x57152296
-0,         11,         11,        1,  1244160, 0x0074598b
-0,         12,         12,        1,  1244160, 0x44537bb8
-0,         13,         13,        1,  1244160, 0x6f27ab9c
-0,         14,         14,        1,  1244160, 0x1f195e10
-0,         15,         15,        1,  1244160, 0xc5644298
-0,         16,         16,        1,  1244160, 0x24c1230e
-0,         17,         17,        1,  1244160, 0x2651b213
-0,         18,         18,        1,  1244160, 0x88efe863
-0,         19,         19,        1,  1244160, 0x8bf0ada1
-0,         20,         20,        1,  1244160, 0x8b6c013a
-0,         21,         21,        1,  1244160, 0x69ebc579
-0,         22,         22,        1,  1244160, 0xa45d0f0c
-0,         23,         23,        1,  1244160, 0x272162e4
-0,         24,         24,        1,  1244160, 0x8c456817
-0,         25,         25,        1,  1244160, 0x872c58ee
-0,         26,         26,        1,  1244160, 0x9318cb95
-0,         27,         27,        1,  1244160, 0xcaec95f1
-0,         28,         28,        1,  1244160, 0x8b01a105
-0,         29,         29,        1,  1244160, 0x956de85e
-0,         30,         30,        1,  1244160, 0xa2998ab9
-0,         31,         31,        1,  1244160, 0xa56b5621
-0,         32,         32,        1,  1244160, 0x7bd6b161
-0,         33,         33,        1,  1244160, 0xbcb75d7a
-0,         34,         34,        1,  1244160, 0xe5e94727
-0,         35,         35,        1,  1244160, 0xf3145c67
-0,         36,         36,        1,  1244160, 0xcf63df5a
-0,         37,         37,        1,  1244160, 0x77d08ec8
-0,         38,         38,        1,  1244160, 0xc99d2eb2
+0,          9,          9,        1,  1244160, 0x71ca561b
+0,         10,         10,        1,  1244160, 0x6c25ebe8
+0,         11,         11,        1,  1244160, 0xae8e297d
+0,         12,         12,        1,  1244160, 0x20284ad0
+0,         13,         13,        1,  1244160, 0x95c57238
+0,         14,         14,        1,  1244160, 0x5ae32569
+0,         15,         15,        1,  1244160, 0x92401342
+0,         16,         16,        1,  1244160, 0x95ed0c85
+0,         17,         17,        1,  1244160, 0xb79398df
+0,         18,         18,        1,  1244160, 0x66a0dda3
+0,         19,         19,        1,  1244160, 0x906596c3
+0,         20,         20,        1,  1244160, 0x26f1da33
+0,         21,         21,        1,  1244160, 0xe317ad64
+0,         22,         22,        1,  1244160, 0x2f5fe488
+0,         23,         23,        1,  1244160, 0x7bd64c7b
+0,         24,         24,        1,  1244160, 0x7470479e
+0,         25,         25,        1,  1244160, 0x61653bee
+0,         26,         26,        1,  1244160, 0xb249a6cc
+0,         27,         27,        1,  1244160, 0x2cce6f74
+0,         28,         28,        1,  1244160, 0x711d7631
+0,         29,         29,        1,  1244160, 0xa304c119
+0,         30,         30,        1,  1244160, 0x3fb66044
+0,         31,         31,        1,  1244160, 0x97c11ba5
+0,         32,         32,        1,  1244160, 0xd8f37fed
+0,         33,         33,        1,  1244160, 0x33d541e7
+0,         34,         34,        1,  1244160, 0x2e2e2535
+0,         35,         35,        1,  1244160, 0xe26132bd
+0,         36,         36,        1,  1244160, 0x13b9b37b
+0,         37,         37,        1,  1244160, 0x05825e47
+0,         38,         38,        1,  1244160, 0x44f6f505

ffmpeg-8.1.3.tar.xz/tests/ref/fate/filter-scale-fast-bilinear-wide-edge Added

ffmpeg-8.1.2.tar.xz/tools/zmqsend.c -> ffmpeg-8.1.3.tar.xz/tools/zmqsend.c Changed

Changes of Revision 3