27180 Commits

Author SHA1 Message Date
Marvin Scholz
da821ec316 avformat: rtspdec: use stored replies for SET_PARAMETER command
Makes the reply reading completely non-blocking and reliably reports
the reply even when interleaved packets are read.
2026-02-19 17:18:12 +01:00
Marvin Scholz
b63f69fccf avformat: rtsp: add functions to allow stored replies
This adds the ability to have a stored reply, needed for the
SET_PARAMETERS command feature to reliably report the reply even
while intermediate packets are read.
2026-02-19 17:18:12 +01:00
Marvin Scholz
5daa45fa01 avformat: rtsp: fix log message formatting 2026-02-19 17:18:12 +01:00
Marvin Scholz
b59471f8c8 avformat: rtsp: do not skip packets in SET_PARAMETER command handling
Return EAGAIN so the client has a chance to read the pending packets
instead of just silently discarding them internally.
2026-02-19 17:18:12 +01:00
Marvin Scholz
6d8950f046 avformat: rtsp: handle interleaved pending packets
Fixes the behavior when calling ff_rtsp_read_reply again after it
was called at another place with return_on_interleaved_data set to
true. Before, it would result in completely corrupting the internal
state as the $ interleaved packet marker would have already been read
which the next run of ff_rtsp_read_reply would look for but never find
it, trying to read packet data as RTSP message.
2026-02-19 17:18:12 +01:00
Marvin Scholz
44065ea878 avformat/rtspdec: Add SET_PARAMETER command support
Add SET_PARAMETER support, this allows sending SET_PARAMETER requests to
the server using the API.
2026-02-19 17:18:12 +01:00
Marvin Scholz
368ecdd3a4 rtsp: expose rtsp_send_cmd_with_content_async
Add the ff_ prefix and move the declaration to the header, so it can
be used in other places like rtspdec in a future commit.
2026-02-19 17:18:11 +01:00
Marvin Scholz
633dcf71e8 avformat: Add new demuxer command API
This new API adds the ability to send commands to the demuxer and also
receive replies to these commands.

It is useful in cases like the RTSP demuxer, where it might be desirable
for the API user to send commands like SET_PARAMETER or PLAY and PAUSE.

Sending and receiving are decoupled, as to not require waiting for a
reply when sending, as with some demuxers and depending on the command
it could be necessary to process further packets in the meantime
before requesting a reply.
2026-02-19 17:18:11 +01:00
Marvin Scholz
cf755be215 lavf: replace read_{play,pause} by a single callback 2026-02-19 17:18:11 +01:00
Romain Beauxis
0e89d993c5 libavformat/oggenc.c: re-initialize stream on new metadata. 2026-02-18 16:25:06 +00:00
Niklas Haas
4cefbc54c4 avformat/http: add missing check to connection re-use
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21685
Fixes: e03b034e45
See-Also: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21693
2026-02-18 12:57:55 +00:00
Michael Niedermayer
237d03717f avformat/icodec: Check size
Fixes: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
Fixes: 471688026/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5616495813263360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-18 08:20:10 +00:00
Jack Lau
cbdb325424 avformat/tls_openssl: update the outdated comments
Loading CA certificate is supported.

Remove unrelated comments.

The underlying socket can be tcp or udp.

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-17 13:58:14 +00:00
Jack Lau
479c40f595 avformat/tls_openssl: use EINVAL when X509_digest failed
This function just calculate and copy the fingerprint
to the provided buf, will not allocate memory.

It fails when the input (such as cert) is invalid.

Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-17 13:58:14 +00:00
Michael Niedermayer
bce0e22133 avformat/lrcdec: Check ss for finiteness
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 471604230/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-5474264750030848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-17 13:49:41 +00:00
Michael Niedermayer
82fbb04d07 avformat/http: Also count redirects from the cache
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-17 13:43:37 +00:00
Michael Niedermayer
ba3639bc90 avformat/http: allow adjusting the redirect limit
Idea from: BapToutatis and also curl and wget have equivalent options

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-17 13:43:37 +00:00
Jack Lau
1fd128ef3a avformat/tls_gnutls: update the comment since the underlying socket can be TCP or UDP
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-17 13:27:09 +00:00
Jack Lau
546d565d07 avformat/tls_gnutls: limit the written size to data MTU
Signed-off-by: Jack Lau <jacklau1222gm@gmail.com>
2026-02-17 13:27:09 +00:00
Marton Balint
693ca902c1 avformat/matroskaenc: write AlphaMode flag for all VP8 and VP9 pixel formats with alpha
Let's check the pixel format descriptor flags instead of hardcoding a specific
pixel format.

Signed-off-by: Marton Balint <cus@passwd.hu>
2026-02-15 20:28:31 +01:00
Marton Balint
9515cb236b avformat/matroskaenc: only write AlphaMode for VP8 and VP9
AlphaMode should indicate whether the BlockAdditional Element with BlockAddID
of "1" contains Alpha data, as defined by to the Codec Mapping for the `CodecID`.

Only VP8 and VP9 Codec Mappings define this, so writing it for all codecs with
a pixel format of YUVA420P, or for codecs other than VP8/VP9 (if the alpha_mode
metadata entry was set) was wrong.

Signed-off-by: Marton Balint <cus@passwd.hu>
2026-02-15 20:28:31 +01:00
Michael Niedermayer
6ee3e59ce2 avformat/flvdec: Check *size in cts parsing
Fixes: Assertion buf_size >= 0 failed
Fixes: 471553942/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5982849812725760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-15 06:37:19 +00:00
James Almer
e1484a30e5 avformat/dtshddec: properly support priming and padding samples
Don't just export initial_padding, but also take it into account for timestamps
by adjusting the stream's start_time. Also, export the padding samples in a way
that's actually supported, as currently trailing_padding is unused so no user
will look at it.

For the sake of not reducing coverage and because the lossy tests have reference
files that contain the priming samples, add the skip_manual flags2 to the tests
so we still output them. A new ffprobe call will ensure the demuxer behavior is
tested too.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-12 09:59:54 -03:00
Rost Kurylo
95101ecc65 avformat/unix: Fix 'operation unsupported' error when reading from unixgram sockets
Sockets of type SOCK_DGRAM don't support listen(), so it was
impossible to read from "unixgram" sockets in ffmpeg.

Signed-off-by: Rost Kurylo <rost.kurylo@netint.ca>
2026-02-11 20:41:49 +00:00
Nicolas Gaullier
f9bf45b8fd avformat/isom_tags: add specific fourccs for in24/in32 LE
Add support for decoding 42ni and 23ni in mov/mp4.

Note that in24/in32 can be either LE or BE thanks to enda atom,
so this patch leaves the muxer unchanged.

Fixes #21445.

Signed-off-by: Nicolas Gaullier <nicolas.gaullier@cji.paris>
2026-02-11 20:39:31 +00:00
Michael Niedermayer
4f97e52042 avformat/cafdec: Check nb_entries in read_info_chunk()
Fixes: Timeout
Fixes: 477315122/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5274792315125760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-11 01:17:30 +00:00
Andreas Rheinhardt
f6d89a7bed avformat/spdif: Make enum IEC61937DataType at least 16bits
Fixes the spdif-dca-master FATE-test when compiling with
-fshort-enums.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
fcfb33922f avformat/cafenc: don't keep track of nb packets ourselves
Just reuse AVStream.nb_frames.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 11:32:56 +01:00
Andreas Rheinhardt
96475bfa21 avformat/cafenc: Simplify writing pakt box
Assemble it already in caf_write_packet(). This has the advantage
of reducing the amount of buffers used; it also allows to avoid
a seek when writing the trailer and avoids function call overhead
(for the avio_w8(); it also reduces codesize).

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 11:31:17 +01:00
Michael Niedermayer
521d18cea3 avformat/img2dec: Check avio_size() for failure
More complete fix for #YWH-PGM40646-32

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 01:19:00 +01:00
Michael Niedermayer
19c78cd6d9 avformat/mpegtsenc: Check remaining space in SDT
Fixes: out of array access
Fixes: VULN-8

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 01:07:19 +01:00
Michael Niedermayer
ca1c1f29ce avformat/img2enc: Check split planes packet size
Fixes: out of array read
Fixes: VULN-6/poc.raw

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 00:54:41 +01:00
Michael Niedermayer
b740b85872 avformat/yuv4mpegen: Sanity check input packet frame dimensions
Fixes: out of array access if a filter-graph is used the injects changing dimensions

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 00:40:52 +01:00
Niklas Haas
f2b13f783a avformat: add AVFormatContext.name
Analog to AVFilterContext. May be used to set a custom logging name to
disambiguate multiple AVFormatContext instances in the logs.
2026-02-09 14:01:14 +00:00
Michael Niedermayer
9bfa1635ae avformat/iff: Error out with 0 channel loudspeaker configuration
Fixes: division by 0
Fixes: 478005965/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5748337088462848
Fixes: 472226169/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4528777763028992

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-09 04:25:04 +00:00
Ted Meyer
a58cb16e27 Fix overflow in STSD parser
Reset `sc->stsd_count` before parsing entries. This number doesn't get
reset, which means that multiple parse passes can increment it past the
`sc->extradata` array end and cause OOB writes.
2026-02-09 02:38:16 +00:00
James Almer
303fd126a8 avformat/iamf: replace av_assert0(0) with av_unreachable
Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
James Almer
8665748584 avformat/iamf_reader: sanitize block and subblock durations and count
Abort earlier if subblock durations are inconsistent with their containing block,
and ensure each subblock duration is at least 1.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
James Almer
34ac6f6b07 avformat/iamf_parse: sanitize block and subblock durations and count
Abort earlier if subblock durations are inconsistent with their containing block,
and ensure each subblock duration is at least 1.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
Michael Niedermayer
a5007428e8 avformat/scd: Use ffio_read_size()
Fixes: use of uninitialized memory
Fixes: 471771529/clusterfuzz-testcase-minimized-ffmpeg_dem_SCD_fuzzer-5328203515494400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-08 02:25:14 +01:00
Niklas Haas
b8daba42cd avformat/http: report connection statistics
Helpful to track the impact of options like -multiple_requests, -probing_size
or -short_seek_size.
2026-02-07 10:02:36 +00:00
Niklas Haas
4f5d91e43f avformat/http: allow limiting initial request size
Sometimes, HTTP sources require a lot of seeking during probing / header
parsing (especially for formats like MXF). Currently, we need to completely
tear down and re-establish the connection most times this happens, which puts
a lot of stress on the network stack and also results in transmission of
possibly many unnecessary bytes.

This patch adds an option to allow FFmpeg to request partial ranges during
the initialization stage. This is done until the initial request size is fully
read, after which we fall back to the normal behavior (i.e. infinite streaming
via an unbounded request).

The usefulness of this is limited without also specifying -multiple_requests 1,
since otherwise there is little point to requesting partial ranges to begin
with. (However, it is semantically independent, so we keep it that way.)
2026-02-07 10:02:36 +00:00
Niklas Haas
e03b034e45 avformat/http: re-use keep-alive connection for small seeks
When the previous reply was a partial response (e.g. due to a seek to the
end of the file), and the remaining data from that partial response is
below the short seek size threshold, we can serve this seek by just draining
that data and re-using the existing connection.

This can currently only happen when using keep-alive connections
(-multiple_requests 1) and seeking from the end of the file to somewhere
else, in which case the file's tail can be drained and the connection re-used.

Under other circumstances, however, we still need to force a reconnection,
because we do not yet send partial range requests. (This will be changed in the
following commit)

We need to take special care not to regress the existing fallback logic
for when `http_open_cnx` fails, so here is a quick case analysis:

non-drain path:
- identical to the current

soft drain fails: (ffurl_read error path)
- s->hd = old_hd = NULL
- http_open_cnx() always opens a new connection
- on failure, old buffer is restored and s->hd remains NULL

soft drain succeeds, http_open_cnx() fails:
- s->hd is set to NULL by http_open_cnx() failure path
- old_hd was never set, so remains NULL
- old buffer is restored, s->hd remains NULL

In either case, the outcome that any (previously valid) buffer is left as-is,
the offset is unchanged, and the connection ends up closed (s->hd == NULL).
This is okay to do after the previous change to http_buf_read, which allows
it to internally re-open the connection if needed.
2026-02-07 10:02:36 +00:00
Niklas Haas
bf1722a9c6 avformat/http: request more data after partial response
If the Content-Range indicates a smaller range than what we expected,
we should send a new request for the remainder before attempting to read
more.

Again, this commit is theoretically non-functional on its own, since any
conforming HTTP server should give us the entire range we asked for in the
first place, but it is semantically independent from and prepares us for the
following changes.
2026-02-07 10:02:36 +00:00
Niklas Haas
6336fa3335 avformat/http: return EIO if s->hd is NULL
This could conceivably happen currently if the user tries reading more
bytes after the last chunk has already been received. In this case,
we currently segfault - but simply returning AVERROR(EIO) seems more
reasonable and lets the higher end retry the connection in this case.
2026-02-07 10:02:36 +00:00
Niklas Haas
ca2c5ff412 avformat/http: parse range size from Content-Range header
In the event that the range returned is smaller than the true filesize, we
should only expect to receive that many bytes - not the entire rest of the
file.

This commit is theoretically non-functional on its own, since any conforming
HTTP server will always return us the full file range, but I wanted to split
it off from the subsequent changes in order to make review easier.
2026-02-07 10:02:36 +00:00
Niklas Haas
19cae9151c avformat/http: print error on HTTP response failure
This currently fails silently with zero indication of what the problem might
be, which tripped me up a bit while debugging.
2026-02-07 10:02:36 +00:00
Niklas Haas
5f95a1e714 avformat/http: fix noop seek check
This fails to consider the case of whence == SEEK_END and the resulting
offset happening to exactly match the current position.

Reorder the check to compute the target position first, then compare.
2026-02-07 10:02:36 +00:00
Andreas Rheinhardt
12747e6296 avformat/matroskaenc: Parse Opus packet durations ourselves
This avoids avpriv functions from lavc/opus/parse.c
(which parse way more than we need, necessitating
parsing the extradata).
It furthermore makes the output of the muxer consistent,
i.e. no longer depending upon whether the Opus parser
or decoder are enabled (the avpriv functions would just
return AVERROR(ENOSYS)).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-06 14:05:14 +01:00
James Almer
3ab8b976c1 avformat/matroskaenc: parse Opus packets to write proper durations
Before this patch, the last packet in the affected fate test would be written
without a BlockDuration element despite the packet's duration being shorter
than the Opus frame size.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-05 23:21:49 -03:00