Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Builder ffmpegsos-solaris10-sparc Build #14250

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

Projectffmpeg
Repositoryhttps://git.ffmpeg.org/ffmpeg.git
Branchmaster
Revision24e860f6d3c4f2ebae65ed7649e2a8860d512879
Got Revision24e860f6d3c4f2ebae65ed7649e2a8860d512879
Changes56 changes

BuildSlave:

unstable10s

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-sparc' triggered this build

Steps and Logfiles:

  1. git update ( 18 secs )
    1. stdio
  2. shell 'gsed -i ...' ( 0 secs )
    1. stdio
  3. shell_1 'gsed -i ...' ( 2 secs )
    1. stdio
  4. shell_2 'gsed -i ...' failed ( 1 secs )
    1. stdio
  5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 18 secs )
    1. stdio
    2. config.log
  6. shell_4 'gmake fate-rsync' failed ( 0 secs )
    1. stdio
  7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
    1. stdio
    2. configure.log
    3. compile.log
    4. test.log

Build Properties:

NameValueSource
branch master Build
builddir /export/home/buildbot-unstable10s/slave/ffmpegsos-solaris10-sparc slave
buildername ffmpegsos-solaris10-sparc Builder
buildnumber 14250 Build
codebase Build
got_revision 24e860f6d3c4f2ebae65ed7649e2a8860d512879 Git
project ffmpeg Build
repository https://git.ffmpeg.org/ffmpeg.git Build
revision 24e860f6d3c4f2ebae65ed7649e2a8860d512879 Build
scheduler schedule-ffmpegsos-solaris10-sparc Scheduler
slavename unstable10s BuildSlave
workdir /export/home/buildbot-unstable10s/slave/ffmpegsos-solaris10-sparc slave (deprecated)

Forced Build Properties:

NameLabelValue

Responsible Users:

  1. Michael Niedermayer

Timing:

StartTue Oct 13 03:47:56 2026
EndTue Oct 13 03:48:39 2026
Elapsed42 secs

All Changes:

:

  1. Change #285742

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 8f48624cdb5f70996ffc2d8b17c491957a784ef2

    Comments

    avcodec/dcadec: skip reserved speaker positions when exporting the downmix matrix
Out of array read Replicated through UnModified FFmpeg with ASAN

Fixes: out of array read
Fixes: 562992376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_DEC_fuzzer-6657589774188544
Fixes: XsCYzcvQNPUj
Regression since: 57708daf619c1de0ea25366ef11e527f292acd55

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/dcadec.c

  2. Change #285743

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3fece4fad440b09fb212dbf9293bc19cbb5feb59

    Comments

    avformat/wavdec: saturate the next tag offset after a saturated RF64 data end
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t'
Fixes: 538780590/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5528579277651968
Fixes: LkQQ7nojUzdg
Regression since: 5bbc00c05d6e78542d09bb56c55759ce6b53c139

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/wavdec.c

  3. Change #285744

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 58416458a0ba176464a42d894cd4aabfd54171a7

    Comments

    avformat/mov: treat a negative rescaled edit list duration as overflow
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: -9223372036854775808 + -72057594037927936 cannot be represented in type 'int64_t'
Fixes: 538868974/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5819272002338816
Fixes: erHRV4uA0F71

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  4. Change #285745

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a9c070e52fecb7fb247db829130899db07953823

    Comments

    avcodec/tiff: compute the DNG tile count without overflowing
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: 8224 + 2147483647 cannot be represented in type 'int'
Fixes: 554665253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_DEC_fuzzer-5826816041091072
Fixes: CiA9e8B5xODW

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/tiff.c

  5. Change #285746

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 49f214e2a86f678062b9834a7f4769ccb3eb8890

    Comments

    avcodec/jpeg2000htdec: apply the ROI shift as an unsigned shift
Undefined shift Replicated through UnModified FFmpeg with UBSAN

Fixes: left shift of 448 by 23 places cannot be represented in type 'int32_t'
Fixes: 538245301/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5803355348467712
Fixes: QvL1tuhWgRGM

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/jpeg2000htdec.c

  6. Change #285747

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 7c7c0870596a33521dcc12fadd116d1ca90eac10

    Comments

    avcodec/av1dec: reject a tile group whose tg_end is beyond NumTiles
Division by zero Replicated through API with UBSAN

Fixes: division by zero
Fixes: 539034287/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6190309328093184
Fixes: oovCgd09vKl2

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/av1dec.c

  7. Change #285748

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 561130d30b2a71aa36095366382272b2595fe919

    Comments

    avcodec/aac/aacdec_usac_mps212: avoid shifting a negative IPD index
Undefined shift Replicated through API with UBSAN

Fixes: left shift of negative value -1
Fixes: 536321788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_DEC_fuzzer-4601480396210176
Fixes: IsFvv6HEhVCP

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/aac/aacdec_usac_mps212.c

  8. Change #285749

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision af1ed02d6830c732470a92dd4e7a006b3e451f1c

    Comments

    tools/target_bsf_fuzzer: skip filters that av_bsf_alloc() does not support
This is not a security issue.

Fixes: 538624321/clusterfuzz-testcase-minimized-ffmpeg_BSF_LCEVC_MERGE_fuzzer-6371982149746688
Fixes: lrIny8K4GGmb

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • tools/target_bsf_fuzzer.c

  9. Change #285750

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a106a10679e41fc1932bd8fc75bcee2b6ee443f5

    Comments

    avcodec/cbs_apv: reject a frame width or height of 0
Division by zero Replicated through API with UBSAN

Fixes: division by zero
Fixes: 538197062/clusterfuzz-testcase-minimized-ffmpeg_BSF_APV_METADATA_fuzzer-6204722298814464
Fixes: p9U20UaYiMFw

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/cbs_apv_syntax_template.c

  10. Change #285751

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 60795d2f6e1b5a5a9a9362975635f787ae008e67

    Comments

    avcodec/imm5: switch to the receive_frame API
Pull packets with ff_decode_get_packet() and receive from the sub-decoder
until it has no frame left before feeding it the next packet. This also
drains the sub-decoder at EOF instead of dropping its delayed frames.

Assertion failure Replicated through API

Fixes: assertion failure
Fixes: 538301564/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IMM5_fuzzer-5256353978580992
Fixes: PFQtJZPcOsLc

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/imm5.c

  11. Change #285752

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3df42b4cae0f15bb695761316dc70049fbbaec02

    Comments

    avformat/sbgdec: reject tone-sets with more than 16 channels
Out of memory Replicated through API

Fixes: out of memory
Fixes: 474457174/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6678348798689280
Fixes: CjKWQoTOOUJW

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/sbgdec.c

  12. Change #285753

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 548cf658c019ee34123280a8b19f7dc30c86d6e8

    Comments

    avcodec/eatgq: reject packets too small for the frame before allocating it
Timeout Replicated through API

Fixes: Timeout
Fixes: 557846267/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6100142894415872
Fixes: a3IxtdH9wk9F

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/eatgq.c

  13. Change #285754

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision c7eefe191aa5c391a72a0f5174ebd78ff8934fdc

    Comments

    avformat/wtvdec: reject file allocation tables that list a sector more than once
A sub-file holds each of its sectors once, so a table that lists a
sector more than once is rejected when the sub-file is opened.

Out of memory Replicated through API

Fixes: out of memory
Fixes: 472529274/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5867226843643904
Fixes: 12e707wVt9Ky

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/wtvdec.c

  14. Change #285755

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 10b6349503826faed0d1d20b39b5ebd8bc51d1e6

    Comments

    avformat/mov: bound the edit list rebuilt sample index
Out of memory Replicated through API

Fixes: out of memory
Fixes: 476170159/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6100179299401728
Fixes: 6p8Ik9Q1ozLW

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  15. Change #285756

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 2defa3985ac653099d5568f2679f35b5e9c427b4

    Comments

    avcodec/mjpegdec: handle THP restart intervals in all scan types
Timeout Replicated through API

Fixes: Timeout
Fixes: 565276248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-6001511570931712
Fixes: Z70IPpK3idWD
Regression since: 5672c410a6adc2764791e7fcc0e34acea07ac263

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/mjpegdec.c
    • libavcodec/mjpegdec.h

  16. Change #285757

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 660833977850014e767c0a15d1da3f1b9ea86f4c

    Comments

    avcodec/adpcm: compute the Rhetorex step index update in 32-bit wrapping arithmetic
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: 1962519552 + 223346688 cannot be represented in type 'int'
Fixes: 570730457/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_RHETOREX_DEC_fuzzer-5448669789487104
Fixes: zBNgmUo4QhnW

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/adpcm.c

  17. Change #285758

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 1a2d690da2f28b1177b56e2498a82de2db0efd8d

    Comments

    avcodec/h264_cabac: do not adjust the CABAC mb_type of SI slices
Undefined shift Replicated through API with UBSAN on i386

Fixes: left shift of 1621233664 by 2 places cannot be represented in type 'int'
Fixes: 538751135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5842595151151104
Fixes: 88lh9wyp3VpG

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/h264_cabac.c

  18. Change #285759

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 42e81e00c67d0446307bf3f5e43a9d4082d48bec

    Comments

    avcodec/vvc/cabac: reject entropy coding sync without entry points
Undefined shift Replicated through UnModified FFmpeg with UBSAN

Fixes: left shift of 539332544 by 2 places cannot be represented in type 'int'
Fixes: 543314355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-6530021460869120
Fixes: zNquwYqrjFd2

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/vvc/cabac.c

  19. Change #285760

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision c69aff745431c73e546bdad988ec23f74c79979c

    Comments

    avcodec/exif: stop following an IFD chain that loops
Stop at the first offset that was already parsed.

Timeout Replicated through API

Fixes: Timeout
Fixes: 561208791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5447460856856576
Fixes: PrLc2prh3sxt
Regression since: 784aa09fa8222f6704d953b5035f8d0f0bec1623

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/exif.c

  20. Change #285761

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 26bf8651a8d88f722598c90f6afe7067e9a296dd

    Comments

    avcodec/exif: bound the parsed IFD entries by the size of the EXIF buffer
Every entry of a well formed IFD tree is a distinct 12 byte record
inside the buffer, so a tree cannot have more entries than the buffer
holds records. Count the parsed entries and reject the tree once that
number is exceeded.

Timeout Replicated through UnModified FFmpeg

Found during triage/debugging of OSS-Fuzz issue 561208791

Fixes: Timeout
Fixes: yiiM6atofYKk/nested16.jpg / gen_nested_jpg.py
Fixes: yiiM6atofYKk

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/exif.c

  21. Change #285762

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 42982a9b8af63d5462951bba6a31be48fc8221d9

    Comments

    avcodec/ftr: reject sub-decoder output that yields no frame
Assertion failure Replicated through UnModified FFmpeg

Found during triage/review of OSS-Fuzz issue 538301564

Fixes: assertion failure
Fixes: Z2pdJZ9KWkmq/ftr-idend.wav / mkftr.py
Fixes: Z2pdJZ9KWkmq

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/ftr.c

  22. Change #285763

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 93739f4bbbad0991b238f2f82f511c3a1c3f247d

    Comments

    avformat/wtvdec: append depth-2 allocation table blocks at the current sector count
Found during triage/review of OSS-Fuzz issue 472529274

Fixes: VqowcCmeBsvg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/wtvdec.c

  23. Change #285764

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision b8f74a99fbea9edceda911f90be3b6f330c34173

    Comments

    avcodec/cbs_h266: allocate the VPS profile_tier_level array on demand
Allocate the array for the number of PTLs the VPS signals, like the
extension data. This shrinks H266RawVPS to 41 KB.

Out of memory Replicated through API

Found during triage/review of OSS-Fuzz issue 529105369

Fixes: out of memory
Fixes: b0PmzXuS2hhp/vps10k.bin / gen_vps.py
Fixes: b0PmzXuS2hhp

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/cbs_h266.c
    • libavcodec/cbs_h266.h
    • libavcodec/cbs_h266_syntax_template.c

  24. Change #285765

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision ed85a019cfa1e8ef6858f4824128b4fb95068948

    Comments

    avformat/sbgdec: compute the extradata size of the intervals in 64 bits
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN, only with -max_alloc raised above its default

Found during triage/review of OSS-Fuzz issue 474457174

Fixes: tETfcRw9ov1Y/a.sbg / gen_a.py
Fixes: tETfcRw9ov1Y

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/sbgdec.c

  25. Change #285766

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 90d45b94f610555ecee8d86e2ebdefab8b1454a7

    Comments

    avformat/sbgdec: bound the number of events a script expands to
Out of memory Replicated through API

Found during triage/review of OSS-Fuzz issue 474457174

Fixes: out of memory
Fixes: Cw8GY4kWak6W/b24.sbg / gen_b.py
Fixes: Cw8GY4kWak6W

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/sbgdec.c

  26. Change #285767

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 7521ca2ca6d7ddb9ec363d7abe26b3dcc095bd3a

    Comments

    avformat/sbgdec: fix the timestamps of the events expanded from blocks
Found during triage/review of OSS-Fuzz issue 474457174

Fixes: QLpKsyxye22s

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/sbgdec.c

  27. Change #285768

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3a7a9e5dd3f3d9988b31b85fdea44ef427223c38

    Comments

    avutil/dict: copy dictionaries without duplicate keys in linear time
Timeout Replicated through API

Found during triage/review of OSS-Fuzz issue 561208791

Fixes: Timeout
Fixes: W8DJK4OR7cgk/flat300.bin / gen_flat.py
Fixes: W8DJK4OR7cgk

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavutil/dict.c

  28. Change #285769

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 9181f3a92495e93c4bf0a1bcab00992ed59397d1

    Comments

    avformat/mov: compute the time to sample position of an edit directly
find_prev_closest_index() walked the time to sample table from the
first sample up to the sample an edit starts at, for every edit of a
track with composition offsets, so the index rebuild cost
elst_count * nb_samples. An 800 kB file with 50000 edits over 200000
samples took 58 seconds to open.

Timeout Replicated through UnModified FFmpeg

Found during triage/review of OSS-Fuzz issue 476170159

Fixes: Timeout
Fixes: 6w5v8aNoJQB4/slow.mp4 / genmp4.py
Fixes: 6w5v8aNoJQB4

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  29. Change #285770

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 9bca133c03662a0a199fb6ddfa6ee2090e01caa1

    Comments

    avformat/mov: saturate the audio pre-roll search time of an edit
The search for the frame one second before an audio edit subtracted the
time scale from the edit media time, which overflows for media times
near INT64_MIN. Any result below the first index entry is clamped to it
anyway, so saturating the subtraction keeps the search unchanged.

Signed integer overflow Replicated through API with UBSAN

Found during triage/review of OSS-Fuzz issue 476170159

Fixes: signed integer overflow: -9223372036854775808 - 1000 cannot be represented in type 'int64_t'
Fixes: b9W8hJVNRZGN/neg-audio-min.mp4
Fixes: b9W8hJVNRZGN

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  30. Change #285771

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 1ed0bf80ad485ec7f4baaca0c293f6a6e9ab9db7

    Comments

    avformat/mov: keep the duration of edits with a negative media time
The overflow check of the rescaled edit duration added the media time as
an unsigned value, so a negative media time wrapped the sum and the
duration of any edit starting more than its duration before composition
time 0 was zeroed, dropping the edit. The media time of an edit is a
composition time (ISO/IEC 14496-12 8.6.6.3) and composition times are
negative when signed composition offsets place the first frames before
zero (8.6.1.3), with the smallest one recommended to match the start of
the first edit (8.6.1.4).

Found during triage/review of OSS-Fuzz issue 476170159

Fixes: dDfkF1EeYsUC
Regression since: 2882d30e3acfc3155e2be11db653c7c721f94f34

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  31. Change #285772

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision e11ab8285859ef067fbb3339f64eefabad10e367

    Comments

    avformat/mov: skip empty edits in the middle of an edit list
Only empty edits at the start of the list were skipped; an empty edit
after a non-empty one was replayed as media starting at time -1, so the
first frames of the track were emitted again where the presentation has
a gap (ISO/IEC 14496-12 8.6.6.3). Skip every empty edit; its duration
still advances the timeline so the following edit starts after the gap,
while only the leading ones keep counting towards the start time.

Found during triage/review of OSS-Fuzz issue 476170159

Fixes: qqcLfY5ZRyHL
Regression since: 97f47fd601d0e380109f501e4aabff71ffbad052

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/mov.c

  32. Change #285773

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a8d0a523e0ede3596b05cb45ccec283cb0a67048

    Comments

    avformat/asfdec_o: reject Simple Index Objects whose size does not fit an int64
Timeout Replicated through API

Fixes: Timeout
Fixes: 472415045/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5931601155653632
Fixes: nsrEzoEJYM73

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/asfdec_o.c

  33. Change #285774

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 8dcba5f266ee3ccb1ba920939979038aa1d87504

    Comments

    avformat/asfdec_o: reject packets positioned beyond INT64_MAX/2
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: -9223372036854754902 - 29780 cannot be represented in type 'int64_t'
Fixes: 490256472/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5108938455711744
Fixes: bbbW1GCPwyFw
Regression since: 736e9e69d5dbbe1d81885dfef59917eb915d2f96

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/asfdec_o.c

  34. Change #285775

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 96eea3824100b195294ebba9570c6a66427a4920

    Comments

    avcodec/proresenc_kostya: keep the worst-case slice size free before encoding a slice
Assertion failure Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm) and through UnModified FFmpeg with a 10-bit noise input and -bits_per_mb 128

Fixes: assertion failure
Fixes: 471605669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-5471300752834560
Fixes: Jmc4pJGx6NWH

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/proresenc_kostya.c

  35. Change #285776

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision d75429af4c008cabb4644e9ece34bfff1cd607df

    Comments

    avformat/asfdec_o: truncate a media object whose payload data ends at EOF
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

Found during triage/review of OSS-Fuzz issues 472415045 and 490256472

Fixes: use of uninitialized memory
Fixes: h3BedIQL9KeL

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/asfdec_o.c

  36. Change #285777

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision f8860aebb1dfc168ed6613e1fc15b826811ab35e

    Comments

    avformat/asfdec_o: deinterleave spread audio completely
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind

Found during triage/review of OSS-Fuzz issues 472415045 and 490256472

Fixes: use of uninitialized memory
Fixes: mPhE3ApFVs7s

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavformat/asfdec_o.c

  37. Change #285778

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision f603c70284cddbb415644b447abe820368c01b16

    Comments

    avcodec/txd: reject unsupported d3d formats before allocating the frame
Timeout Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm)

Fixes: Timeout
Fixes: 505670915/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5106192354705408
Fixes: qiaJQYzDp7vx

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/txd.c

  38. Change #285779

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 17c71e3772d23dc797a230a3ce360c137ddad0a3

    Comments

    avcodec/elbg: keep the total error in 64 bits
Signed integer overflow Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm) with UBSAN

Fixes: signed integer overflow: 2147483647 - -106589 cannot be represented in type 'int'
Fixes: 472729757/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5712538546536448
Fixes: fwDAxlQNlnpn
Regression since: ddc176d0eed7bd140c134c2b0923b575b13570c0

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/elbg.c

  39. Change #285780

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision dde2f1b0778b3dabc91b31843cc95a03f54ad2b2

    Comments

    avcodec/ratecontrol: keep the wanted bits inside the int64 range in both directions
Signed integer overflow Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm) with UBSAN

Fixes: signed integer overflow: 167640 - -9223372036854775808 cannot be represented in type 'int64_t'
Fixes: 9.22337e+18 is outside the range of representable values of type 'long'
Fixes: 565995849/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5651323392163840
Fixes: tYZSxpyV9Sjx
Regression since: 7147c3c911f4ebf5bd1c21444423d8f78c6541ea

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/ratecontrol.c

  40. Change #285781

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 01:55:55
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 0eeb79fcc5b2761e8fdd3d0cfc5e5ba0e786645a

    Comments

    avcodec/jpeg2000htdec: reject background coefficients whose ROI shift exceeds the sample precision
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

    Changed files

    • libavcodec/jpeg2000htdec.c

  41. Change #285782

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 52b653190c001e132ef35ee6f113b0f413d16e79

    Comments

    avformat/nut: Fix files with many streams
The demuxer rejected files with more than 256 streams, it now uses
max_streams as the limit and stores frame code stream ids as int.

The invalid stream ids and the stream limit of the demuxer were found
during triage of the security report.

Fixes: out of array access
Fixes: 0tstIJT8grvU
Fixes: AISLE-2026-0111-00174
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: lPmeH2OaqLeE
Invalid frame code stream ids Replicated through UnModified FFmpeg
Fixes: OyhhaqyPDH4L
Unreadable output Replicated through UnModified FFmpeg
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/nut.h
    • libavformat/nutdec.c
    • libavformat/nutenc.c

  42. Change #285783

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision f69151b0f9ddf0be5b8d8264b11e7ba0b72abad1

    Comments

    avformat/mxfenc: Fail on unsupported D-10 audio codecs
Fixes: out of array read
Fixes: jQbdKiuH8zFh
Fixes: AISLE-2026-0111-00598
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/mxfenc.c

  43. Change #285784

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 0b1c279b62af82e422e3fc21ba6cc2fc3154dc76

    Comments

    avformat/wavenc: Reject peak envelope writing without channels
The fix is the one recommended in the report.

Fixes: out of array write
Fixes: LHiad3FmdAmI
Fixes: AISLE-2026-0111-00337
Out of array write Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/wavenc.c

  44. Change #285785

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision ff53919a2d8442058d58ba0e83d16cc9e29d73fb

    Comments

    avformat/img2enc: Compute the split plane sizes in 64 bit
64 bit plane sizes and rejecting non-positive dimensions were suggested in the report.

Fixes: out of array read
Fixes: signed integer overflow
Fixes: PbVEU2cWUlo7
Fixes: AISLE-2026-0111-00134
Out of array read Replicated through UnModified FFmpeg with ASAN
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/img2enc.c

  45. Change #285786

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision c2d0a6e5f4091a017c39b93fd5142cd65769daa1

    Comments

    avformat/apngenc: Reject new extradata larger than INT_MAX
The fix is one of the two recommended in the report.

Fixes: out of array access (unsupported av_max_alloc() > 2gb)
Fixes: zqJ6u5YsGyma
Fixes: AISLE-2026-0111-00586
Fixes: AISLE-2026-0110-00586
Negative size memcpy Replicated through API with ASAN, with av_max_alloc() raised above 2 GiB
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/apngenc.c

  46. Change #285787

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 78a29fd62f090b9ab42feb2cf9dddbb5d4d42f1e

    Comments

    avformat/latmenc: Take the extradata size as size_t
Validating the size before it is narrowed was suggested in the report.

Fixes: out of array write (unsupported av_max_alloc() > 2gb)
Fixes: uBIqgh88C9dX
Fixes: AISLE-2026-0111-00265
Out of array write Replicated through API with ASAN, with av_max_alloc() raised above 4 GiB
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/latmenc.c

  47. Change #285788

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 376e9bb3f69d55814861208126638113da4cf001

    Comments

    avformat/vvc: Infer vps_default_ptl_dpb_hrd_max_tid_flag as 1 when absent
H.266 7.4.3.3 infers it as 1. With 0, vps_ptl_max_tid was read from the
following bits and the profile, tier and level of the VPS were misread.

Fixes: wrong vvcC profile and level
Wrong vvcC profile and level Replicated through UnModified FFmpeg with a VPS with 2 layers and 1 sublayer

    Changed files

    • libavformat/vvc.c

  48. Change #285789

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 3d14f6f9e252cda9ea7a5686576778d64882a2eb

    Comments

    avformat/vvc: Check the number of sublayers
Not a security issue, the accesses stay inside the PTL records and only
their content is wrong.

Fixes: IUOlTN86QoY1
Fixes: AISLE-2026-0111-00046
Array index out of bounds Replicated through API with UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/vvc.c

  49. Change #285790

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 61db65d3825e9923de1ed31a1bdb78ba3b60fc2e

    Comments

    avformat/vvc: Infer the level of the highest sublayer from general_level_idc
Not a security issue, the read stays inside the configuration record and
the inferred level is not written.

Fixes: CSTqrrUsg2ce
Array index out of bounds Replicated through API with UBSAN
Found during triage of the security report IUOlTN86QoY1

    Changed files

    • libavformat/vvc.c

  50. Change #285791

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 6fdfafa31a535c5a6b50712ee85f59c0a7a02bd4

    Comments

    avformat/movenc: Check the pixel format for AVIF output
Fixes: NULL pointer dereference
Fixes: UwVT8CSrU4Oh
Fixes: AISLE-2026-0111-00172
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN,UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/movenc.c

  51. Change #285792

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 6d40aa17395aaba80922441bcfb58399a88475e3

    Comments

    avformat/oggenc: Reset the current page when it cannot be buffered
On allocation failure the full page stayed in the stream context, and
the next segment was added past its 255 entry segment table.

Fixes: out of array access
Fixes: flOsaBhTFc6F
Fixes: AISLE-2026-0111-00072
Negative size memset Replicated through API with ASAN and av_max_alloc() lowered after the header
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/oggenc.c

  52. Change #285793

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision a659cd842b122e2f41973ac7c4e826426cc0d756

    Comments

    avformat/oggenc: Propagate page buffering errors
Return the error, as recommended in the report AISLE-2026-0111-00072.

Not a security issue.

Fixes: TjbJ8BXPA93x
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/oggenc.c

  53. Change #285794

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 403b3c294f765a0a3395cb3ffb72e23d8633cb56

    Comments

    avformat/options: Set the stream group type after allocating its parameters
The fix is one of the two recommended in the report.

Fixes: NULL pointer dereference
Fixes: Ks5s2XRvqzXe
Fixes: AISLE-2026-0111-00423
NULL pointer dereference Replicated through UnModified FFprobe with an allocation failure injected by gdb
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/options.c

  54. Change #285795

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision c4fa2d351e174575ec3f2cd766d5e0abb964527d

    Comments

    avformat/mpegtsenc: Check the size of H.26x packets with prepended data
Fixes: out of array write (unsupported config av_max_alloc() >2gb)
Fixes: signed integer overflow
Fixes: GL61hVKFlOuU
Fixes: AISLE-2026-0111-00224
Out of array write Replicated through API with ASAN, with av_max_alloc() raised above 2 GiB
Signed integer overflow Replicated through API with UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/mpegtsenc.c

  55. Change #285796

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 112b0bbab237b937921b8e4356699095743f63df

    Comments

    avformat/gxfenc: Do not read past the end of MPEG-2 packets shorter than 2 bytes
Checking the index before the read was suggested in the report.

Fixes: NULL pointer dereference
Fixes: mOGFdmxuya4M
Fixes: AISLE-2026-0111-00065
NULL pointer dereference Replicated through API with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>

    Changed files

    • libavformat/gxfenc.c

  56. Change #285797

    Category ffmpeg
    Changed by Michael Niedermayer <michaelohnoyoudont@niedermayer.cc>
    Changed at Tue 13 Oct 2026 04:29:51
    Repository https://git.ffmpeg.org/ffmpeg.git
    Project ffmpeg
    Branch master
    Revision 24e860f6d3c4f2ebae65ed7649e2a8860d512879

    Comments

    avformat/mpegtsenc: Check the size of Opus packets before adding the control header
Not a security issue.

Fixes: signed integer overflow
Fixes: aPjAIXKxDfoa
Signed integer overflow Replicated through API with UBSAN
Found during triage of the security report GL61hVKFlOuU

    Changed files

    • libavformat/mpegtsenc.c
BuildBot (0.8.14) working for the OpenCSW Buildbot project.
Page built: Wed 14 Oct 2026 21:03:19 (CEST)