Builder ffmpeg64-solaris10-sparc Build #14510

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpeg64-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 19 secs )
   1. stdio
2. shell 'gsed -i ...' ( 1 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 3 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 12 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_64.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. James Almer

   jamrialohnoyoudont@gmail.com
2. Michael Niedermayer

   michaelohnoyoudont@niedermayer.cc
3. Umar Pathan

   helloohnoyoudont@umar.ac

Timing:

All Changes:

:

1. Change #285336

   Category	ffmpeg
   Changed by	James Almer <jamrialohnoyoudont@gmail.com>
   Changed at	Sat 10 Oct 2026 23:27:56
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	e70b1eddba1028e84dff6acbf7ce80336a2ccbe4

   Comments

   avutil/opt: do not free a custom channel map the source still points to
   av_opt_copy() documents that after it returns, allocated options in src
   and dst no longer alias each other, even when dst was memdup'ed from src.
   For AV_OPT_TYPE_CHLAYOUT it passed such aliased layouts straight to
   av_channel_layout_copy(), which frees the custom map in dst and then
   copies from the now freed map in src.
   
   Handle this in opt_copy_elem(), like the AV_OPT_TYPE_DICT case, by
   forgetting the aliased map in dst before the copy.
   
   Fixes: heap-use-after-free
   Fixes: BTOI3sLHWE0g
   Found-by: Joshua Rogers <joshua.rogers@aisle.com>

   Changed files

   • libavutil/opt.c

2. Change #285337

   Category	ffmpeg
   Changed by	Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
   Changed at	Sat 10 Oct 2026 23:27:56
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	99867ef095837e569959d2175709606033345b64

   Comments

   avutil/tests/opt: copy options into a memdup'ed object holding a custom channel layout

   Changed files

   • libavutil/tests/opt.c
   • tests/ref/fate/opt

3. Change #285338

   Category	ffmpeg
   Changed by	Umar Pathan <helloohnoyoudont@umar.ac>
   Changed at	Sat 10 Oct 2026 23:30:33
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	9cfea1ceb8274fa0b3ea54fafc3eedda47cf2c53

   Comments

   lavc/vvc: Validate the slice address against the PPS slice count
   The picture level slice index accumulated in sh_slice_address() and in the
   CBS slice header parser (num_entry_points derivation) is used to index the
   VVC_MAX_SLICES-sized PPS arrays without a range check. When the current
   subpicture holds no slice top-left corner, the accumulated index can reach
   pps_num_slices_in_pic_minus1 + 1 and read one entry past
   slice_start_offset[] / num_ctus_in_slice[] and, in the parser, past
   pps_slice_width_in_tiles_minus1[] / slice_height_in_ctus[], aliasing
   unrelated struct fields.
   
   The aliased values then inflate num_entry_points beyond the number of
   entry points the decoder-side walk of the same slice produces, so
   slice_init_entry_points() consumes entry_point_start_ctu[] entries that
   were never refreshed for the current picture. On a picture smaller than an
   earlier one the stale values exceed num_ctus_in_curr_slice, and the entry
   point walks in slice_init_entry_points() and ff_vvc_frame_submit() read
   ctb_addr_in_curr_slice[] past the end of the ctb_addr_in_slice
   allocation. The values read out of bounds then index fc->tab.slice_idx[]
   out of bounds.
   
   Fixes: out of array access
   Fixes: heap-buffer-overflow
   Found-by: Umar Pathan (Umar0x)
   Signed-off-by: Umar Pathan <hello@umar.ac>
   Fixes: ccSUzeWGhBGj
   Out of array read Replicated through UnModified FFmpeg with ASAN,UBSAN

   Changed files

   • libavcodec/cbs_h266_syntax_template.c
   • libavcodec/vvc/ps.c

4. Change #285339

   Category	ffmpeg
   Changed by	Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
   Changed at	Sat 10 Oct 2026 23:30:33
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	33f238c7bd9cbcb3eada4b7b92aa27a27d4bb4a8

   Comments

   avcodec/vvc: Reject slices whose entry point walk does not match num_entry_points
   Hardening for ccSUzeWGhBGj
   Found-by: Umar Pathan (Umar0x)

   Changed files

   • libavcodec/vvc/ps.c

5. Change #285340

   Category	ffmpeg
   Changed by	Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
   Changed at	Sat 10 Oct 2026 23:30:33
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	406d19261cfe58279876ecacd384d14bc714425f

   Comments

   avcodec/cbs_h266: Reject subpictures without slices
   Hardening for ccSUzeWGhBGj
   Found-by: Umar Pathan (Umar0x)

   Changed files

   • libavcodec/cbs_h266_syntax_template.c