27180 Commits

Author SHA1 Message Date
James Almer
f10c0ae276 avformat/mov: Fix multiple issues related to mov_read_iref_dimg()
forward errors and cleanup in teh failure cases

Fixes: freeing uninitialized pointers
Fixes: 487160965/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6525162874011648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-05 02:43:30 +00:00
zengshuang
9d73d10c50 avformat,avcodec: use PRI format macros for uint32_t in log messages
Use PRIu32/PRIX32 format specifiers instead of %d/%u/%X for uint32_t
variables in av_log calls. On some platforms (e.g. NuttX), uint32_t is
typedef'd as unsigned long rather than unsigned int, which triggers
-Wformat warnings despite both types being 4 bytes. Using PRI macros
is the portable way to match the actual underlying type of uint32_t.

Signed-off-by: zengshuang <zengshuang@xiaomi.com>
2026-03-04 10:40:12 +00:00
Michael Niedermayer
8d3b044f84 avformat/mov: check for duplicate stsd before changing state
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-04 10:17:35 +00:00
Niklas Haas
613925a96e avformat/http: fix Cache-Control header parsing
This was calling atoi() on `p + offset`, which is nonsense (p may point to
the start of the cache-control string, which does not necessarilly coincide
with the location of the max-age value). Based on the code, the intent
was clearly to parse the value *after* the matched substring.
2026-03-04 08:49:53 +00:00
Niklas Haas
7a348f662d avformat/http: close stale connection on wrong seek
If http_seek_internal() gives us an unexpected position, we should
close the connection to avoid leaking reading incorrect bytes on subsequent
reads.
2026-03-04 08:49:53 +00:00
Niklas Haas
fcc1a03a0e avformat/http: move retry label (cosmetic)
Move this closer to the corresponding `goto`. From the PoV of the control
flow, these placements are completely identical.
2026-03-04 08:49:53 +00:00
Niklas Haas
142d999fda avformat/http: restore offset on http_open_cnx() failure
The retry path restores this offset, but the failure path does not. This
is especially important for the case of the continuation handler in
http_read_stream(), which may result in subsequent loop iterations (after
repeated failures to read additional data) seeking to the wrong offset.
2026-03-04 08:49:53 +00:00
Niklas Haas
f5ddf1c4a8 avformat/http: fix http_connect() offset mismatch error code
This (arbitrarily) returns -1, which happens to be AVERROR(EPERM) on my
machine. Return the more descriptive AVERORR(EIO) instead.

Also add a log message to explain what's going on.
2026-03-04 08:49:53 +00:00
Niklas Haas
fb7558dcb0 avformat/http: avoid int overflow
This was meant to accumulate int64_t timestamp values.

Fixes: b8daba42cd
2026-03-04 08:49:53 +00:00
Michael Niedermayer
e392fb8c9c avformat/mov: use 64bit in CENC subsample bounds checks
Found-by: Quang Luong <oss@engineer.ink>
Found-by: PrymEvol
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-03 11:49:10 +00:00
Michael Niedermayer
32e4ddeda3 avformat/vividas: Reset n_audio_subpackets on error
Fixes: signed integer overflow: -63 - 2147483594 cannot be represented in type 'int'
Fixes: 486530208/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-4694818252193792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-03 03:28:03 +01:00
Michael Niedermayer
a4d40f853a avformat/matroskadec: Check that end_time_ns >= start_time_ns
Fixes: signed integer overflow: -8659510451449931520 - 2205846422852077376 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 486358507/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4896911086911488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-03 02:41:56 +01:00
Michael Niedermayer
927ae7a0d5 avformat/dhav: Check avio_seek() return
Fixes: infinite loop
Fixes: 472567148/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-4520943574908928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-03 01:04:37 +01:00
Michael Niedermayer
b2f1657087 avformat/segafilm: dont read uninitialized value
scratch[20] doesnt exist in version 0

Fixes: use of uninitialized memory
Fixes: 471664627/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-4738726971637760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
2026-03-03 00:48:38 +01:00
Michael Niedermayer
0465a9bb8f avformat/demux: Fix integer overflows in select_from_pts_buffer()
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long long'); cast to an unsigned type to negate this value to itself
Fixes: 473334102/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5109540931829760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-02 19:04:26 +01:00
Jack Lau
80d5fb2ee9 avformat/whip: use av_dict_set_int() for payload_type and ssrc
Now WHIP can directly pass SSRC as UINT32 instead of
converting it as INT for match wrong rtpenc option
range Since 69568479a9.

And Converting SSRC from UINT32 to INT64 is safe to
pass by av_dict_set_int().

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-03-01 07:02:34 +00:00
Steven Liu
93be3e37db avformat/rtmpproto: add vvc1 string into enhanced_codecs list
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2026-03-01 04:21:45 +00:00
Steven Liu
0de45f556c avformat/flvdec: support demux vvc in enhanced flv
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2026-03-01 04:21:45 +00:00
Steven Liu
9ceb932c36 avformat/flvenc: support mux vvc in enhanced flv
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2026-03-01 04:21:45 +00:00
James Almer
0390793dc3 avcodec/cbs: add support for LCEVC bitstreams
As defined in ISO/IEC 23094-2:2021/FDAM 1:2023

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-28 16:12:33 -03:00
Adrien Guinet
da9a6d51f5 avformat/mov: add support for multiple decryption keys
This commit introduces new options to support more than one decryption
keys:
* add a decryption_keys option to MOV, that supports a dictionary of
  KID=>key (in hex), using AV_OPT_TYPE_DICT
* add the corresponding cenc_decryption_keys option to DASH

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-02-28 04:01:08 +01:00
Neko Asakura
69568479a9 avformat/rtpenc: use unsigned type for ssrc option
The ssrc option used AV_OPT_TYPE_INT with range [INT_MIN, INT_MAX],
but the underlying struct field is uint32_t and RFC 3550 defines SSRC
as a 32-bit identifier covering the full [0, UINT32_MAX] range. This
caused ffmpeg to reject any SSRC value above INT_MAX (~2.1 billion),
which is roughly half of all valid values.

The auto-generated fallback path (av_get_random_seed()) already
returns uint32_t and can produce values above INT_MAX, creating an
inconsistency where the automatic path succeeds but the explicit
-ssrc option rejects the same value.

Change the option to AV_OPT_TYPE_UINT with range [0, UINT32_MAX]
to match the field type and allow the full identifier space.

Fixes ticket #9080.

Signed-off-by: Neko Asakura <neko.asakura@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-28 01:23:12 +00:00
James Almer
16ee3d8d99 avformat/mov: fix cases where we discard iamf packets from enabled streams
Given the entire iamf struct is inside a single Track, if the first iamf stream
(which is the one sharing the index and id from the Track) was to be disabled,
then packets from every iamf stream would be discarded.
Fix this by actually going through the entire iamf Sample and discarding those
from the disabled streams only.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-27 11:01:25 -03:00
James Almer
51aef95ba1 avformat/mov: fix setting iamf stream id offsets
If we were to add the highest id of a non iamf stream as offset to iamf stream
ids, and one of the latter was 0, then an id overlap would ocurr.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-27 11:00:58 -03:00
Jack Lau
7505cea0e9 avformat/whip: skip the unmatch nack packet through ssrc
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-27 12:42:05 +00:00
Jack Lau
7e48c0afc9 avformat/whip: add missing ":" in "a=rtcp-fb" when generate sdp
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-27 12:42:05 +00:00
Jack Lau
d7820156f9 avformat/whip: add RTX support
See https://datatracker.ietf.org/doc/html/rfc4588

Parse sequence number from NACKs, then create RTX
packet and send it.

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>

avformat/whip: set NACK logs as DEBUG

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-27 12:42:05 +00:00
Jack Lau
e7757d8f2e avformat/whip: add rtp history store and find method
This patch aims to enable rtp history store for RTX

Signed-off-by: Jack Lau <jacklau1222@qq.com>
2026-02-27 12:42:05 +00:00
Niklas Haas
2e7078cda6 avformat/http: add -request-size option
It has come to my attention that a way to limit the request range size
would be useful in general, for reasons beyond just speeding up initial
header parsing.

This patch generalizez -initial_request_size to -request_size. I decided
to continue allowing both options to be used simultaneously, so users can
e.g. set -request_size to something large like 10 MiB, but still use a smaller
size for initial header parsing (e.g. 256 KiB).

Fixes: https://github.com/mpv-player/mpv/issues/8655
2026-02-27 09:20:33 +00:00
Nariman-Sayed
477bf79b06 avformat/tls_openssl: use SHA-256 instead of SHA-1 for self-signed cert
SHA-1 is deprecated and considered cryptographically weak.
Replace EVP_sha1() with EVP_sha256() when signing self-generated
certificates to comply with modern security standards.
2026-02-26 22:25:29 +00:00
Zhao Zhili
fddf881c06 avformat: use int instead of enum for AVOption fields
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2026-02-26 11:40:16 +08:00
Jack Lau
659892cda6 avformat/tls_mbedtls: generate self-signed cert and key when none is provided in listen mode
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-25 03:27:03 +00:00
Jack Lau
55f5cfafeb avformat/tls_mbedtls: set dtls remote addr in listen mode
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-25 03:27:03 +00:00
Jack Lau
35ccd5f3de avformat/tls_mbedtls: add dtls support
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-25 03:27:03 +00:00
Jack Lau
dc4c798970 avformat: Use ff_*_muxer directly
These muxers already set hard dependencies in
configure so they cannot be enabled unless the
dependencies are enabled.

So these error handling is unreachable.

Directly Using ff_*_muxer is simpler than calling
av_guess_format()

Refer to 289cb3beff

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-25 02:55:43 +00:00
Michael Niedermayer
989d6ddea0 avformat/wtvdec: Check that language is fully read
Fixes: use-of-uninitialized-value
Fixes: 483856523/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5221422609006592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-24 10:22:37 +00:00
Nariman-Sayed
186e388716 avformat/whip: use ffurl_closep instead of ffurl_close for dtls_uc 2026-02-24 02:58:34 +00:00
Marvin Scholz
64fafd63f0 avformat: remove HLS protocol
The use of this protocol was already discouraged and warned about
for years with the recommendation to use the HLS demuxer instead.
2026-02-23 20:20:20 +01:00
James Almer
40e0463113 avformat/mov: free item_name on infe entry parsing failure
Fixes regression since 28c330d0f3.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-22 23:16:15 -03:00
James Almer
c3aa28f23d avformat/mov: check for EOF in more loops
Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-23 00:43:50 +00:00
James Almer
28c330d0f3 avformat/mov: abort if the queried item doesn't exist instead of overwriting it
The check for item presence was insufficient as it would result in the last
item in the array being overwritten if it existed even if the id didn't match.

Fixes: Assertion ref failed at src/libavformat/mov.c:10649
Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5312542695292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-23 00:43:50 +00:00
Nariman-Sayed
9bc4109b23 avformat/tls_openssl: fix memory leak in cert_from_pem_string
When PEM_read_bio_X509 fails, BIO was not freed, causing memory leak.
Free BIO before returning NULL to prevent resource leak.
2026-02-22 22:39:43 +00:00
Andreas Rheinhardt
b22b65f2f8 avformat/hlsenc: Return error upon error, fix shadowing
Introduced in 65fc0db581.

Reviewed-by: Marvin Scholz <epirat07@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-22 00:23:00 +01:00
Marvin Scholz
ca011ee754 avformat: Bump version and add APIChanges entry
Needed after the recent addition of the command APIs.
2026-02-21 20:03:52 +01:00
Andreas Rheinhardt
0b77f79191 avutil/attributes_internal: Add attribute_nonstring
This attribute is used to signal to the compiler
that an array object initialized via a string literal
is not a real string and may lack the space for
the trailing zero, as in char fourcc[4]="FOUR".

This is in preparation for enabling
the -Wunterminated-string-initialization warning.

Reviewed-by: J. Dekker <jdek@itanimul.li>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-20 11:59:37 +01:00
Vignesh Venkat
51349e31fc avformat/whip: Avoid uninitialized pointer read
Do not try to free the io context if it was never allocated.

Fixes coverity #1665383

Signed-off-by: Vignesh Venkatasubramanian <vigneshv@google.com>
2026-02-20 01:12:27 +00:00
Marvin Scholz
e8a07be1c2 avformat: rtsp: fix logging of reply sequence number 2026-02-20 01:31:06 +01:00
Marvin Scholz
8d46d88f05 avformat: rtspdec: fix leaks in rtsp_read_command_reply
Reorder to avoid allocation if there is nothing to read and also solve
a memory leak in that case.

Also make sure to free the RTSPMessageHeader, which is not passed
to the caller.
2026-02-20 01:31:06 +01:00
Romain Beauxis
0be94a16d6 libavformat/oggdec.c: fix ogg_{save,restore,reset} w.r.t. new_extradata. 2026-02-19 16:45:42 +00:00
Marvin Scholz
8030e3b899 avformat: rtspdec: do not allow SET_PARAMETER command too early 2026-02-19 17:18:12 +01:00