Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Builder ffmpegsos-solaris10-sparc Build #14236

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

Projectffmpeg
Repositoryhttps://git.ffmpeg.org/ffmpeg.git
Branchmaster
Revisionb5902e69c71bf556958f9fded99d1bcea2d7298c
Got Revisionb5902e69c71bf556958f9fded99d1bcea2d7298c
Changes54 changes

BuildSlave:

unstable10s

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-sparc' triggered this build

Steps and Logfiles:

  1. git update ( 14 secs )
    1. stdio
  2. shell 'gsed -i ...' ( 0 secs )
    1. stdio
  3. shell_1 'gsed -i ...' ( 0 secs )
    1. stdio
  4. shell_2 'gsed -i ...' failed ( 0 secs )
    1. stdio
  5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 10 secs )
    1. stdio
    2. config.log
  6. shell_4 'gmake fate-rsync' failed ( 0 secs )
    1. stdio
  7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
    1. stdio
    2. configure.log
    3. compile.log
    4. test.log

Build Properties:

NameValueSource
branch master Build
builddir /export/home/buildbot-unstable10s/slave/ffmpegsos-solaris10-sparc slave
buildername ffmpegsos-solaris10-sparc Builder
buildnumber 14236 Build
codebase Build
got_revision b5902e69c71bf556958f9fded99d1bcea2d7298c Git
project ffmpeg Build
repository https://git.ffmpeg.org/ffmpeg.git Build
revision b5902e69c71bf556958f9fded99d1bcea2d7298c Build
scheduler schedule-ffmpegsos-solaris10-sparc Scheduler
slavename unstable10s BuildSlave
workdir /export/home/buildbot-unstable10s/slave/ffmpegsos-solaris10-sparc slave (deprecated)

Forced Build Properties:

NameLabelValue

Responsible Users:

  1. Michael Niedermayer
  2. zhang xingxing

Timing:

StartSun Oct 11 04:06:59 2026
EndSun Oct 11 04:07:25 2026
Elapsed26 secs

All Changes:

:

  1. Change #285375

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:43:40
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 87941e8765c129bd9f3090481145772f14d14fb8

    Comments

    avfilter/vf_tiltandshift: keep the initial black padding within the frame
Fixes: heap buffer overflow (write)
Fixes: ypfajWK7GTuH
Found-by: Zheng Yu @ Depthfirst

    Changed files

    • libavfilter/vf_tiltandshift.c

  2. Change #285376

    Category ffmpeg
    Changed by zhang xingxing <2388969553ohnoyoudont@qq.com>
    Changed at Sun 11 Oct 2026 02:44:16
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision bb4b95c68fd4d6e0051d4436f64cea06640e6c00

    Comments

    avfilter/vf_vidstabtransform: close the transforms file on parse failure
Found-by: zhang xingxing
Fixes: FILE leak
Fixes: iXnhUsbrxJo8
Fixes: swarm-File-descriptor-leak-on-transform-file-parse-failure-4e8d03

    Changed files

    • libavfilter/vf_vidstabtransform.c

  3. Change #285377

    Category ffmpeg
    Changed by zhang xingxing <2388969553ohnoyoudont@qq.com>
    Changed at Sun 11 Oct 2026 02:44:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 6ef0b9b0fc3ca02787497e03342f248601183a0b

    Comments

    avfilter/dnn/dnn_backend_openvino: reject model inputs that are not 4-dimensional
Found-by: zhang xingxing
Fixes: out of array read
Fixes: WobrPAzJQZg5

    Changed files

    • libavfilter/dnn/dnn_backend_openvino.c

  4. Change #285378

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:44:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 32d2145fa55c1d94a9ec23783e01d1cdfd229534

    Comments

    avfilter/dnn/dnn_backend_openvino: return an error when an output port cannot be looked up
Found during triage/review of the security report WobrPAzJQZg5
Fixes: null pointer dereference

    Changed files

    • libavfilter/dnn/dnn_backend_openvino.c

  5. Change #285379

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:45:42
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3fdca8345bcbbe7995a494a2ded42ebe7e577f6f

    Comments

    avfilter/vf_libopencv: let the shape file alone define the element size
For CV_SHAPE_CUSTOM the documentation states that cols and rows from the
filter parameters are ignored and the size is taken from the file, but
read_shape_from_file() used the caller supplied values as a baseline:
*rows was incremented and *cols was raised to the file width. Reset both
so that only the file content matters.

This also removes two remaining out-of-bounds accesses in the fill loop,
which are reachable with a custom shape file whose content is empty or
whose last line lacks the terminating newline.

Assisted-by: Fairy

    Changed files

    • libavfilter/vf_libopencv.c

  6. Change #285380

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:45:42
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a02f66e1cfd67dd7d6070c2e6018ef0bb6d2f7ee

    Comments

    avfilter/vf_libopencv: index the shape file with size_t
Fixes: signed integer overflow
Found during review of the read_shape_from_file() fixes

    Changed files

    • libavfilter/vf_libopencv.c

  7. Change #285381

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:45:42
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e7ffc5703914481084ad9b8d2f44e6908e5f9802

    Comments

    avfilter/vf_libopencv: do not count the newline into the width of the following line
Fixes: structuring element one column too wide
Found during review of the read_shape_from_file() fixes

    Changed files

    • libavfilter/vf_libopencv.c

  8. Change #285382

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:45:42
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision b58d3afe5e165198600aed8688d3b14cca82ecc4

    Comments

    avfilter/vf_libopencv: count a last line without terminating newline
Fixes: last row of the shape file dropped
Found during review of the read_shape_from_file() fixes

    Changed files

    • libavfilter/vf_libopencv.c

  9. Change #285383

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:45:42
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 40010b3586b0c54bfa5cd217096ccc59b92b9322

    Comments

    avfilter/vf_libopencv: free the shape values when read_shape_from_file() fails
Fixes: memleak
Found during review of the read_shape_from_file() fixes

    Changed files

    • libavfilter/vf_libopencv.c

  10. Change #285384

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:46:04
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision ecd5dfc308a164757e7f25b1afefd8db21b43cf9

    Comments

    avcodec/pcx: zero the rest of a scanline the input ends in
Fixes: use of uninitialized memory
Fixes: 0WI64ughd0tM
Regression since: 50617fce07 (RLE)
Found-by: Adrian Junge (vurlo)
Replicated through UnModified FFmpeg

    Changed files

    • libavcodec/pcx.c

  11. Change #285385

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:46:36
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 279f225d98da287c9aee789fe4f9a20cd27b5032

    Comments

    avfilter/af_arnndn: require the model layers to fit the network compute_rnn() runs
Reject a model whose layer sizes do not follow these relations. All
published rnnoise-nu models follow them.

The fix suggested in the report bounded the vad_output and
denoise_output inputs by the aligned state allocations instead.

Fixes: heap-buffer-overflow
Fixes: BiaeRPmt9wwq
Found-by: Hongduo Zhao

    Changed files

    • libavfilter/af_arnndn.c

  12. Change #285386

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:46:36
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 9cd6040422fc479e7a8d4d822930cd7551f6fffd

    Comments

    avfilter/af_arnndn: reject model layers without inputs or neurons
Fixes: out of array access
Found during review of the security fix for BiaeRPmt9wwq
Replicated through UnModified FFmpeg

    Changed files

    • libavfilter/af_arnndn.c

  13. Change #285387

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:46:36
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 0bde53877771460042421917a5fff29b322d42bb

    Comments

    cosmetics: avfilter/af_arnndn: use NB_FEATURES for the size of the feature vector
INPUT_SIZE was a second name for the same 42 element feature vector
that NB_FEATURES describes.

    Changed files

    • libavfilter/af_arnndn.c

  14. Change #285388

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:46:36
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 5474b1e05a6d235cea5fd62bc0266c62e4de8947

    Comments

    avfilter/af_arnndn: zero the GRU input vectors before filling them
Fixes: use of uninitialized memory
Found during review of the security fix for BiaeRPmt9wwq
Replicated through UnModified FFmpeg

    Changed files

    • libavfilter/af_arnndn.c

  15. Change #285389

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:48:32
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision f9df3577ac40aaee06f82f05eab8249cbab3cd33

    Comments

    avcodec/vqavideo: allocate the codebook zeroed
Fixes: use of uninitialized memory
Fixes: Tt4RMe2vAHv6
Fixes: trithem-vqa-cbf0-short-read-2389ec50.vqa
Fixes: vqa-cbf0-empty-variant.vqa
Found-by: Trithem90

    Changed files

    • libavcodec/vqavideo.c

  16. Change #285390

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:50:46
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 7c73707355708c846f718cca90096bc1a33c8989

    Comments

    avcodec/huffyuvdec: zero the rest of a row the input ends in
The decode_plane_bitstream() cases were found during triage of the
security report kqvngdpsCPjK

Fixes: use of uninitialized memory
Fixes: kqvngdpsCPjK
Regression since: f6577bd9cf (decode_bgr_1())
Found-by: Adrian Junge (vurlo)
Replicated through UnModified FFmpeg

    Changed files

    • libavcodec/huffyuvdec.c

  17. Change #285391

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:52:56
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 694934cc05a58cc9ed8116f79cca4cf8e8ad7cf2

    Comments

    avcodec/aac/aacdec_usac: store the element count only after the elements parsed
Fixes: stack buffer overflow
Fixes: CJwFCf3E6R4m
Fixes: ANT-2026-5C280R3A
Fixes: ANT-2026-5C280R3A-attack_a.flv
Fixes: ANT-2026-5C280R3A-attack_b.flv
See: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22956
Regression since: baad75cafa
Found-by: Claude and Ada Logics

    Changed files

    • libavcodec/aac/aacdec_usac.c

  18. Change #285392

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:52:56
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 7442df24f59109e9bee7a55c4fa40d34ed69c638

    Comments

    avcodec/aac/aacdec_usac: check the return value of ff_aac_output_configure()
ff_aac_usac_decode_frame() went on decoding the frame after the output
configuration failed.

Found during triage/review of a security report.

    Changed files

    • libavcodec/aac/aacdec_usac.c

  19. Change #285393

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:53:40
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e1dfa3d477229d78b38d2f57163e00cb44080753

    Comments

    avfilter/vsrc_life: factor the grid allocation out of both init paths

    Changed files

    • libavfilter/vsrc_life.c

  20. Change #285394

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:53:40
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision d09971584b8444d79ee7d5b803a7510e0d3a6ce0

    Comments

    avfilter/vsrc_life: reject grids whose cell count does not fit in an int
Fixes: heap-buffer-overflow
Fixes: signed integer overflow
Fixes: WY5AA7zfuNDv
Found-by: Hongduo Zhao

    Changed files

    • libavfilter/vsrc_life.c

  21. Change #285395

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 02:53:40
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 5603b5992d283cd91e76d26aab717c6bc5ed80fd

    Comments

    avfilter/vsrc_life: reject pattern files larger than INT_MAX bytes
The prescan of the pattern file counts bytes, columns and lines in int,
which overflows for a file larger than INT_MAX bytes.

Found during triage/review of the security report WY5AA7zfuNDv

    Changed files

    • libavfilter/vsrc_life.c

  22. Change #285396

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 041098a1a3bee481a1c8e905257ba04dad0c60a1

    Comments

    avformat/rtmppkt: Make the packet header buffer large enough
The fix is the one recommended in the report.

Fixes: out of array write
Fixes: BvkwW4Yd19HN
Fixes: AISLE-2026-0111-00462
Stack out of array write Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtmppkt.c

  23. Change #285397

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 09282853e82a1a881e7e5b061030063f48df2b95

    Comments

    avformat/rtmppkt: Terminate truncated AMF strings at the bytes read
Fixes: use of uninitialized memory
Fixes: Fid2Ij03ilhP
Fixes: AISLE-2026-0111-00158
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtmppkt.c

  24. Change #285398

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 96994cbf55da07f3611152e51c6a237fa3e556d8

    Comments

    avformat/whip: Only accept http resource urls from the Location header
Fixes: local file truncation
Fixes: NAqYLq2oM12K
Fixes: AISLE-2026-0111-00068
Local file truncation Replicated through UnModified FFmpeg with a local WHIP test server
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/whip.c

  25. Change #285399

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 7a4da23a852b88f2b29187a0c908dc0b911612f9

    Comments

    avformat/rtpenc_vc2hq: Stop on data units shorter than their header
The fix is the one recommended in the report.

Fixes: infinite loop
Fixes: HRhmcrDPRPyf
Fixes: AISLE-2026-0111-00262
Infinite loop Replicated through UnModified FFmpeg with valid Dirac samples
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpenc_vc2hq.c

  26. Change #285400

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision ab4e5b6394136ee8de4fe6104308eae2f3dccf42

    Comments

    avformat/rtpenc_vc2hq: Limit picture fragments to 65535 bytes
Fixes: infinite loop
Fixes: 8SQ71eGHsyRR
Infinite loop Replicated through UnModified FFmpeg with a vc2 stream from the vc2 encoder
Found during triage of the security report HRhmcrDPRPyf

    Changed files

    • libavformat/rtpenc_vc2hq.c

  27. Change #285401

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e23be4d5a11f380cb842622a08416af95b8e523b

    Comments

    avformat/rtpenc_vc2hq: Limit the bit reader to the transform parameters
Fixes: NULL pointer dereference
Fixes: nd3rLqSpKgo5
Fixes: AISLE-2026-0111-00571
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpenc_vc2hq.c

  28. Change #285402

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3d6a441fd35e5891b0470af8c1bf216965116f31

    Comments

    avformat/rtpdec_rfc4175: Clear the frame buffer
The fix is the one recommended in the report.

Fixes: use of uninitialized memory
Fixes: V8a3e2cGQI7w
Fixes: AISLE-2026-0111-00477
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpdec_rfc4175.c

  29. Change #285403

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e5fe2cbebcb666bb132ab26d8dacbace383936c7

    Comments

    avformat/rtpdec_h264: Ignore framesize attributes without a height
Fixes: out of array read
Fixes: xfnEsbsbvEIX
Fixes: AISLE-2026-0111-00033
Stack out of array read Replicated through UnModified FFmpeg (ffprobe) with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpdec_h264.c

  30. Change #285404

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision bc6140f3972b740c6304addaefe5bbbb6046b856

    Comments

    avformat/rdt: Check that the stream has an RMStream
Fixes: NULL pointer dereference
Fixes: PXsIMPp0wPaW
Fixes: AISLE-2026-0111-00472
NULL pointer dereference Replicated through UnModified FFmpeg (ffprobe) with ASAN,UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rdt.c

  31. Change #285405

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a487fcd268142c30d7f85c5bc6a4753cfc4477c1

    Comments

    avformat/sdp: Set the address type in resolve_destination() without network
The fix is the one recommended in the report.

Fixes: use of uninitialized memory
Fixes: YcBNmSVOpm32
Fixes: AISLE-2026-0111-00272
Use of uninitialized memory Replicated through API with Valgrind in a --disable-network build
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/sdp.c

  32. Change #285406

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 94c3187ef7384735b2902abb34a95cbe2400a159

    Comments

    avformat/mmst: Fail when the ASF header has no packet size or no streams
The fix is the one recommended in the report.

Fixes: NULL pointer dereference
Fixes: 1eA5JUo2ED6K
Fixes: AISLE-2026-0111-00154
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/mmst.c

  33. Change #285407

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision b65f572aebeac1e722590ab5451285403c297839

    Comments

    avformat/rtpdec_asf: Reject ASF packet lengths beyond the RTP payload
The check is the one recommended in the report.

Fixes: use of uninitialized memory
Fixes: 9sWoEae5AABB
Fixes: AISLE-2026-0111-00026
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpdec_asf.c

  34. Change #285408

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision ba6d9a5ccc2cd5e4b701fcdd3ac703e31c9709ac

    Comments

    avformat/rtpenc_vc2hq: Stop at the picture end in the quantization matrix loop
Fixes: Timeout
Fixes: 6xQwaeAd0XlH
Timeout Replicated through UnModified FFmpeg (-strict experimental) with time measurement
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_vc2hq.c

  35. Change #285409

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision bceb10aa04fdef4fc04d4684720b0640b1e95675

    Comments

    avformat/rtpenc_vc2hq: Send the data unit that has no next parse offset
Not a security issue.

Found during triage of the security report HRhmcrDPRPyf

    Changed files

    • libavformat/rtpenc_vc2hq.c

  36. Change #285410

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 5c25cb34530c11e4da2cc6fdccfacba1f261f74e

    Comments

    avformat/rtpenc_vc2hq: Write the extended sequence number
RFC 8450 requires the high order 16 bits of the 32 bit packet sequence
number in the payload header, 0 was always written. Count the wraps of
the RTP sequence number in the RTP muxer.

Not a security issue.

Found during triage of the security report HRhmcrDPRPyf

    Changed files

    • libavformat/rtpenc.c
    • libavformat/rtpenc.h
    • libavformat/rtpenc_vc2hq.c

  37. Change #285411

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 06291d49f4b6a5b20de82acb368390ed0faf7ad9

    Comments

    avformat/rtpenc_vc2hq: Reject transform parameters that run past the picture
Not a security issue.

Fixes: GOnB0bwaMBbJ
Byte after the picture sent Replicated through UnModified FFmpeg
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_vc2hq.c

  38. Change #285412

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3d1023f1bde5aed2430f89b67fa65ca10730b442

    Comments

    avformat/rtpenc_vc2hq: Reject transform parameters longer than 65535 bytes
Not a security issue.

Fixes: GOnB0bwaMBbJ
Truncated transform parameters Replicated through UnModified FFmpeg
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_vc2hq.c

  39. Change #285413

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e61908e508c2aa99b726b5529192ac0a04c8a437

    Comments

    avformat/rtpenc_vc2hq: Read the quantization matrix as specified
Not a security issue.

Fixes: lJyVgdTNfBGb
Wrong transform parameters length Replicated through UnModified FFmpeg
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_vc2hq.c

  40. Change #285414

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 8d8616a51000186400b9bbe9d952d94bc587507b

    Comments

    avformat/rtpdec_opus: Reject empty payloads
RFC 7587 4.2 and RFC 6716 [R1]: a payload holds one Opus packet of at least 1 byte

The check is the one recommended in the report.

Fixes: use of uninitialized memory
Fixes: eytzTgq45tAh
Fixes: AISLE-2026-0111-00215
Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/rtpdec_opus.c

  41. Change #285415

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 6296187f33f3f9729e5fc902bd9104a058cdb33a

    Comments

    avformat/rtpenc_vc2hq: Reject Slice Prefix Bytes and Slice Size Scaler above 65535
RFC 8450 4.4 limits both to 16 bits, larger values were written
truncated into the payload header.

Not a security issue.

Fixes: 8IKJMRzK0zk6
Truncated payload header values Replicated through UnModified FFmpeg with RTP capture
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_vc2hq.c

  42. Change #285416

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 353cb778b1f13de93badde3f708531069858dcc3

    Comments

    avformat/rtpenc_h263_rfc2190: Limit the bit reader to the picture header
Fixes: NULL pointer dereference
Fixes: signed integer overflow
Fixes: 2zAkARzDBRFd
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Found during triage of the security report nd3rLqSpKgo5

    Changed files

    • libavformat/rtpenc_h263_rfc2190.c

  43. Change #285417

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 03:31:37
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 5f2187392e0c38d9fcc937e12b48b1f57716e5a0

    Comments

    avformat/rtpdec_asf: Free the reassembled packet before replacing it
Fixes: memleak
Fixes: sggQJVux0zI6
Memleak Replicated through UnModified FFmpeg with Valgrind
Found during triage of the security report 9sWoEae5AABB

    Changed files

    • libavformat/rtpdec_asf.c

  44. Change #285418

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision fba9c0961c1701f2a2cd02d9a56923111dc11b09

    Comments

    avformat/dashdec: Skip LCEVC grouping for representations without codecs
The fix is the one recommended in the report.

Fixes: NULL pointer dereference
Fixes: XmvwOQImSoeX
Fixes: AISLE-2026-0111-00259
NULL pointer dereference Replicated through UnModified FFmpeg (ffprobe) with UBSAN
Regression since: e7696357de
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/dashdec.c

  45. Change #285419

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 4505c22689e5865cb5f76830ffc01266317b3894

    Comments

    avformat/dashdec: Check that the referenced representation has an id
Fixes: NULL pointer dereference
Fixes: pBjbWIWDyAJK
NULL pointer dereference Replicated through UnModified FFmpeg (ffprobe) with UBSAN
Regression since: e7696357de
Found during triage of the security report XmvwOQImSoeX

    Changed files

    • libavformat/dashdec.c

  46. Change #285420

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 301a611370a0ba81f4a71d3b7ccd064623606c1b

    Comments

    avformat/imf_cpl: Do not free the marker label on scope allocation failure
Fixes: double free
Fixes: JLKmGHU1qVX5
Fixes: AISLE-2026-0111-00365
Double free Replicated through API with ASAN and an injected libxml2 allocation failure
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/imf_cpl.c

  47. Change #285421

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision bcb5d56b752cba0117eee5d6509dfc081de4c326

    Comments

    avformat/ttmlenc: Escape the language in the xml:lang attribute
Escaping the language was suggested in the report.

Fixes: XML injection
Fixes: NK8mSjRM3lQh
Fixes: AISLE-2026-0111-00112
XML injection Replicated through UnModified FFmpeg
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/ttmlenc.c

  48. Change #285422

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision bc2316e2d1dcc3a6687b7d46a3ed6bae42b8a9ba

    Comments

    avformat/webmdashenc: Escape the language in the lang attribute
Escaping the language was suggested in the report.

Fixes: XML injection
Fixes: f81gsd1fPSfe
Fixes: AISLE-2026-0111-00553
XML injection Replicated through UnModified FFmpeg
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/webmdashenc.c

  49. Change #285423

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 40922dead061fbc9d27c6ec11d3b3b8a41511bbc

    Comments

    avformat/dashenc: Use av_escape() in xmlescape()
The int based size computation of the open coded escaping overflows for
strings above about 1.4 GB, av_escape() checks the size.

Fixes: out of array write
Fixes: cu2EEgL7QRCV
Found during reviewt

    Changed files

    • libavformat/dashenc.c

  50. Change #285424

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision eef62f63a675232d7e605467d7930642be74309c

    Comments

    avformat/dashenc: Escape the language and role attributes
Fixes: XML injection
Fixes: qlmAqhtrE25j
XML injection Replicated through UnModified FFmpeg
Found during triage of the security report f81gsd1fPSfe

    Changed files

    • libavformat/dashenc.c

  51. Change #285425

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3fb40ab68f41dfcf3e12c91f6cc54b3e55e0b902

    Comments

    avformat/webmdashenc: Escape the metadata written into the manifest
Fixes: XML injection
Fixes: wQScoVJMhVGd
XML injection Replicated through UnModified FFmpeg
Found during triage of the security report f81gsd1fPSfe

    Changed files

    • libavformat/webmdashenc.c

  52. Change #285426

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision d84bb2fbcb08df9b0d09e0316bac864d1a625100

    Comments

    avformat/webmdashenc: Take the language from the escaped metadata

    Changed files

    • libavformat/webmdashenc.c

  53. Change #285427

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision c329af98737b78e05a4a0c134e48788e1ab8b7df

    Comments

    avformat/dashdec: Check the URL size accumulation for overflow
Checking the size accumulation for overflow was suggested in the report.

Fixes: left shift of negative value
Fixes: lNi0cBMALYfT
Fixes: AISLE-2026-0111-00522
Fixes: AISLE-2026-0110-00522
Fixes: AISLE-2026-0109-00522
Left shift of negative value Replicated through UnModified FFmpeg (ffprobe) with UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/dashdec.c

  54. Change #285428

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Sun 11 Oct 2026 04:37:58
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision b5902e69c71bf556958f9fded99d1bcea2d7298c

    Comments

    avformat/dash: Do not write into zero sized buffers in ff_dash_fill_tmpl_params()
The check is the one recommended in the report.

Fixes: lNi0cBMALYfT
Fixes: AISLE-2026-0111-00522
Fixes: AISLE-2026-0110-00522
Fixes: AISLE-2026-0109-00522
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/dash.c
BuildBot (0.8.14) working for the OpenCSW Buildbot project.
Page built: Thu 15 Oct 2026 02:17:36 (CEST)