Skip to content

2.5.0 - zvbi security update, dav1d 1.5.4, no concat demuxer

Choose a tag to compare

View all tags
@superuser404notfound superuser404notfound released this 27 Aug 07:40
· 6 commits to main since this release
2.5.0
9932819

Rebuilds every slice on a refreshed dependency set and takes one demuxer out of the allowlist. FFmpeg stays on n8.1.2. Decoder count is unchanged at 46, parsers at 20; demuxers go from 25 to 24.

Security

  • libzvbi 0.2.44 to 0.2.45. Upstream advisory GHSA-86rm-g7qf-j2fh (2026-08-12, moderate, no CVE assigned) fixes an out-of-bounds read, an out-of-bounds write and an integer underflow. 0.2.44 was itself the release that fixed the previous set (CVE-2025-2173 through CVE-2025-2177), which is why it read as current until the advisory landed.

    This build enables libzvbi_teletext, so the affected code is reachable from a DVB teletext stream. Anyone consuming this package for live TV should take this release.

Changed

  • The concat demuxer is out of the allowlist. It is a script demuxer: a byte stream beginning ffconcat version 1.0 makes libavformat open the paths listed inside it through the file protocol. Nothing in the known consumers asks for it by name, so format probing was the only way to select it, and that made any stream handed to avformat_open_input a potential file-open primitive. Verified absent from the generated libavformat/demuxer_list.c of all ten slices.

    hls stays. It is a documented capability of this package, consumers rely on it, and it opens nothing on its own here: this build is configured --disable-network with only the file, pipe and data protocols.

  • The dash flag is removed because it never built anything. configure answered Disabled dash_demuxer because not all dependencies are satisfied: libxml2 on every slice, so the allowlist and the README both promised a capability the binaries never had. Nothing changes in what you get; the flag and the README row now match reality. DASH content still arrives through the mov and mpegts segment demuxers, which is how it always did.

Updated

  • dav1d 1.5.1 to 1.5.4. No advisory. 1.5.1 dated from January 2025 and the intervening releases are optimization and maintenance work. This is the only dependency whose binary grows measurably: Libdav1d on an arm64 device slice goes from 778,896 to 844,560 bytes (+64 KB).
  • zimg 3.0.5 to 3.0.6. No advisory, no measurable size change.

Size

Target FFmpeg dav1d zimg zvbi Total
iOS / tvOS / visionOS arm64 ~8.7 MB ~0.8 MB ~0.3 MB ~0.5 MB ~10.5 MB
macOS universal (arm64 + x86_64) ~18.3 MB ~2.5 MB ~0.9 MB ~1.0 MB ~22.7 MB

Note for consumers

concat leaving the allowlist is the reason this is a minor rather than a patch. If you relied on the concat demuxer, this release removes it; open an issue and say what for.

Build reproducibility

build.sh used to skip the clone whenever a source directory already existed, so changing a version string alone rebuilt the old source and produced a release in which nothing had changed. discard_stale_source now drops a tree whose checked-out tag is not the one requested. It fired on this build: dav1d, zimg and zvbi were re-cloned, FFmpeg was left alone. Worth knowing if you build this yourself and have a build/ directory from an earlier version.

Assets 2
Loading