parse_psfile() advances buf and decrements size while reading the
file, and then passed these to av_file_unmap() instead of what
av_file_map() returned. With mmap, munmap() then fails with EINVAL
because the pointer is no longer page aligned, so the mapping leaks on
every init and every psfile command; on builds without mmap, av_free()
is called on a pointer into the middle of the buffer.
Keep the mapped pointer and size and unmap those.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Send next while the final segment is active and compare all output frames. This covers rejection without truncating the remaining segment, using generated sources and no external samples.
Assisted-by: Fairy
process_command() called flush_segment() without checking that there is a
next segment. On the last segment this moved cur_idx past the inputs while
the outputs still wanted frames, so activate() accessed cat->in[] and
ctx->inputs[] out of bounds and crashed, e.g.
ffmpeg -f lavfi -i "testsrc2=d=0.2[a];testsrc2=d=1[b];[a][b]concat=n=2,sendcmd=c='0.3 concat next'" -f null -
Fail the command instead.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Fixes: Ju3bQZ3z2paC
Fixes: AISLE-2026-0150-00166
Fixes: memory leak
Memory leak Replicated through UnModified FFmpeg with ASAN (AVI with one
268435475 byte WVC1 packet holding a single slice start code)
Found-by: Joshua Rogers (AISLE)
Fixes: ZiiTReozL7KE
Fixes: AISLE-2026-0150-00435
Fixes: deadlock
Deadlock Replicated through UnModified FFmpeg with timeout (AVI with a
268435476 byte Mimic intra frame followed by inter frames; ffmpeg with
frame threading never exits)
Found-by: Joshua Rogers (AISLE)
Fixes: 1ivYPVLs04AI
Fixes: AISLE-2026-0150-00896
Fixes: use of uninitialized memory
Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
(CFHD AVI sample with the ImageHeight tag raised from 720 to 1080)
Found-by: Joshua Rogers (AISLE)
Fixes: 4dmaFsb0C0KW
Fixes: AISLE-2026-0150-00882
Fixes: use of uninitialized memory
Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
Found-by: Joshua Rogers (AISLE)
A vignette is applied to the test source and reversed with both
transforms, the PSNR against the source is compared with a tolerance.
Assisted-by: Claude
A level works in place on the lowpass lattice of the previous one, so
the mode needs 5 planes instead of 9 + 3 * levels and about an order of
magnitude less computation. Shrinkage is less effective without the
shift invariance of the undecimated transform.
Assisted-by: Claude
Every pass over a plane, the row and column passes of the transforms as
well as the box filters and the per coefficient operations of the
shrinkage, is split into slices of lines. The output does not depend on
the number of threads.
Assisted-by: Claude
Lowpass coefficients are stored at even and highpass ones at odd
positions of the line, so a level works in place on the lattice of the
previous level's lowpass coefficients. Reconstruction from a single
polyphase set needs no averaging, hence no factor 0.5.
Assisted-by: Claude
Dividing by the attenuation amplifies the noise and the quantization
steps of the dark areas by the same factor. The wavelet mode performs
the division in the pixel domain, then transforms the result and its
per pixel noise variance, propagated through the squared filter taps as
if the samples were uncorrelated, with the undecimated 9/7 wavelet.
Each detail coefficient is Wiener shrunk toward 0 with a signal
variance estimated from a 7x7 box of coefficients at the dilation of
the level, weighted by their precision and counted only when it exceeds
the noise by 3 standard errors of independent coefficients. The lowpass
of the top level averages over large areas and is kept, so the shade of
heavily attenuated areas survives.
Assisted-by: Claude
Makes the transform usable by other filters. The analysis filter taps become
a parameter so the same code can also propagate variances with squared taps.
Assisted-by: Claude
The size and checksum of the encoded file pin the slice layout and the
remap coding of a 704x576 float frame, which the 360x288 default slice
limit splits into 2x2 slices.
The escape code of a Golomb-Rice residual is 12 + bits long and
put_bits() writes at most 31 bits, so bits must stay below 20. The RCT
planes of remapped 32bit floats need log2 of the summed remap counts of
two planes, which a slice of at most 1<<18 pixels keeps within 19 bits.
The default slice size of 360x288 is within that, larger slices requested
with -slices were written with escape codes longer than put_bits()
supports. The assertion on k follows the same limit.
The testcases reproduce since b0c77e5a12.
Fixes: out of array read
Fixes: fAak9zecyttL/testcase/poc.vvc
Fixes: fAak9zecyttL/testcase/poc-entry-points.vvc
Fixes: fAak9zecyttL
Found-by: mzfr <security@mzfr.me>
Fixes: heap-use-after-free
Fixes: YtyT0QH1InrQ
Fixes: ANT-2026-13DK7NZD
Fixes: poc.264
Found-by: Claude and Ada Logics
Use after free Replicated through UnModified FFmpeg with ASAN
Fixes: negative-size-param
Fixes: assertion failure
Fixes: wzomtdUBffdP
Fixes: ANT-2026-G2YFQ5N2
Fixes: poc.exr
Found-by: Claude and Ada Logics
Negative size memcpy and assertion failure Replicated through UnModified FFmpeg with ASAN
Fixes: heap-buffer-overflow (read)
Fixes: BIqbuSbTJqAH
Fixes: ANT-2026-V2EPGE9M
Fixes: poc.avi
Found-by: Claude and Ada Logics
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: heap-buffer-overflow (write)
Fixes: GITTfi6VsK4u
Fixes: ANT-2026-5KX1BXM6
Fixes: poc.flv
Found-by: Claude and Ada Logics
Out of array write Replicated through UnModified FFmpeg with ASAN
Found during triage/review of the security report NzELYSvufGfQ
(ANT-2026-324B3XNF), which does not report this.
Fixes: pointer overflow
Pointer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: heap-buffer-overflow (read)
Fixes: NzELYSvufGfQ
Fixes: ANT-2026-324B3XNF
Fixes: ant-324b3xnf-avrn-64x32-flipped.avi
Found-by: Claude and Ada Logics
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: negative-size-param
Fixes: left shift of negative value
Fixes: 0IMcpiRlVAb5
Fixes: ANT-2026-QY2HYS5A
Fixes: poc.mkv
Found-by: Claude and Ada Logics
Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN
Fixes: negative-size-param
Fixes: left shift of negative value
Fixes: 0IMcpiRlVAb5
Fixes: ANT-2026-QY2HYS5A
Fixes: poc.mkv
Found-by: Claude and Ada Logics
Negative size memcpy Replicated through UnModified FFmpeg with ASAN and UBSAN
Fixes: heap-buffer-overflow (read)
Fixes: q0RFgfMenefI
Fixes: ANT-2026-HRT03RV0
Fixes: vvc-subpic-tiles.mkv
Found-by: Claude and Ada Logics
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: heap-buffer-overflow (read and write)
Fixes: signed integer overflow
Fixes: IhY7QcsV5nva
Fixes: ANT-2026-RYWQTXHH
Fixes: poc-median-65600x4.pgm
Found-by: Claude and Ada Logics
Out of array access Replicated through UnModified FFmpeg with ASAN and UBSAN
Fixes: heap-buffer-overflow (read)
Fixes: G8jPOZLbzYtj
Fixes: ANT-2026-22YEN9NA
Fixes: lcl-zlib-mt-shortlace.mkv
Found-by: Claude and Ada Logics
Out of array read Replicated through UnModified FFmpeg with ASAN
Exercise the short DVD PCM tail, one-sample TTA frame, early RoQ flush and mono Microsoft ADPCM trellis paths fixed by PR 25694. Existing audio round trips do not cover these boundaries.
Generate input with sine and atrim, and compare packets through the framecrc muxer. No new samples or bitstream generator are needed.
Assisted-by: Fairy
Fixes: signed integer overflow
Fixes: infinite loop
Fixes: dVqGncTUAyg9
Fixes: AISLE-2026-0150-00591
Signed integer overflow and infinite loop Replicated through API with UBSAN
Found-by: Joshua Rogers (AISLE)
Fixes: use of uninitialized memory
Fixes: 98u4sU59NEf4
Fixes: AISLE-2026-0150-00113
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers (AISLE)
Encode the buffered samples once and return no packet when the buffer
is empty.
Fixes: use of uninitialized memory
Fixes: X43TLCpjYK88
Fixes: AISLE-2026-0150-00397
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers (AISLE)
The fix was suggested in the report.
24 bit samples are stored in blocks of samples_per_block samples
and the sample count of a frame is rounded down to whole blocks. A last
frame with fewer samples than a block gives zero blocks, the do/while
loops still run and read past the frame until the block count wraps.
Return no packet for such a frame.
Fixes: out of array read
Fixes: ZplUzGvg2XP9
Fixes: AISLE-2026-0150-00112
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
Fixes: out of array read
Fixes: 2dyV2eNJkKBV
Fixes: AISLE-2026-0150-00092
Out of array read Replicated through API with ASAN
Found-by: Joshua Rogers (AISLE)
This is not a security issue: the leak needs the frame allocation to
fail.
Fixes: memleak
Fixes: 9UXawhjlJguX
Fixes: AISLE-2026-0150-00349
Memory leak Replicated through API with LSAN
Found-by: Joshua Rogers (AISLE)
Fixes: out of array write
Fixes: MymIHidCHVJu
Fixes: AISLE-2026-0150-00348
Out of array write Replicated through UnModified FFmpeg (32-bit) with ASAN
Found-by: Joshua Rogers (AISLE)
Fixes: out of array write
Fixes: fglxAK3pz5sP
Fixes: AISLE-2026-0150-00462
Out of array write Replicated through UnModified FFmpeg (32-bit) with ASAN
Found-by: Joshua Rogers (AISLE)
Fixes: out of array write
Fixes: GGsIHTeUwf0U
Fixes: AISLE-2026-0150-00642
Out of array write Replicated through API with ASAN
Found-by: Joshua Rogers (AISLE)
Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
Use of uninitialized memory Replicated through API with MSAN
Fixes: use of uninitialized memory
Fixes: ln0NC22XPto3
Fixes: AISLE-2026-0150-00420
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Use of uninitialized memory Replicated through UnModified FFmpeg with MSAN
Fixes: use of uninitialized memory
Fixes: aWhU4kuts0tn
Fixes: AISLE-2026-0150-00040
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Excessive memory allocation (peak RSS 2.58 GB from a 52 byte file)
Replicated through UnModified FFmpeg with ASAN
Fixes: out of memory
Fixes: 2cNjGsVIMOVX
Fixes: AISLE-2026-0150-00053
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Excessive memory allocation (peak RSS 2.3 GB from a 69 byte script)
Replicated through UnModified FFmpeg with ASAN
Fixes: out of memory
Fixes: 6m4Av2yQJEhE
Fixes: AISLE-2026-0150-00550
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Martin Mirchev