Builder ffmpegsos-solaris10-i386 Build #13553

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 5 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 7 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Michael Niedermayer

   michaelohnoyoudont@niedermayer.cc
2. Nicholas Carlini

   nicholasohnoyoudont@carlini.com

Timing:

All Changes:

:

1. Change #261054

   Category	ffmpeg
   Changed by	Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
   Changed at	Sat 14 Mar 2026 21:23:17
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	12303cd922d9cfb21b6160dcdd18083815f839b8

   Comments

   avcodec/cbs_h266_syntax_template: Check tile_y
   Fixes: invalid state leading to out of array access
   Fixes: 490615782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4711353817563136
   
   Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
   Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

   Changed files

   • libavcodec/cbs_h266_syntax_template.c

2. Change #261055

   Category	ffmpeg
   Changed by	Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
   Changed at	Sat 14 Mar 2026 21:23:53
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	770bc1c23a18fe72874e888e1be123a21620acb5

   Comments

   avcodec/aac/aacdec_usac_mps212: Introduce a temporary array for ff_aac_ec_data_dec()
   This also reverts: c2364e92229ac33b07ae5158f51f4a08fdb0288c
   
   Fixes: out of array access (testcase exists but did not replicate for me)
   
   Founbd-by: Gil Portnoy <dddhkts1@gmail.com>
   Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

   Changed files

   • libavcodec/aac/aacdec_usac_mps212.c

3. Change #261056

   Category	ffmpeg
   Changed by	Nicholas Carlini <nicholasohnoyoudont@carlini.com>
   Changed at	Sat 14 Mar 2026 22:01:41
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	55bf0e6cd5a46b26b0ebd2374ad2625a7133e4ee

   Comments

   avformat/mpegts: remove JPEG-XS early return on invalid header_size
   new_pes_packet() moves a buffer with pkt->buf = pes->buffer before
   JPEG-XS validation. If header_size > pkt->size, an early return leaves
   pes->buffer as a stale alias of pkt->buf with refcount 1. Later,
   mpegts_read_packet() calls av_packet_unref(), freeing the buffer
   through pkt->buf. The flush loop then re-enters new_pes_packet() and
   dereferences the dangling pes->buffer; a second path hits it via
   av_buffer_unref() in handle_packets() after a seek.
   
   Drop the early return. The packet is delivered with AV_PKT_FLAG_CORRUPT
   set, matching the PES-size-mismatch case above, and the function falls
   through to the normal cleanup path. The else guards the header trim so
   pkt->data/pkt->size stay valid for the memset.
   
   Fixes: use after free
   Fixes regression since 16f89d342e.
   
   Found-by: Nicholas Carlini <nicholas@carlini.com>

   Changed files

   • libavformat/mpegts.c