3.5.0 - FFmpeg n8.1.3

Rebuilds every slice on FFmpeg n8.1.3 (2026-09-20, 268 commits over n8.1.2). dav1d 1.5.4, zimg 3.0.6 and libzvbi 0.2.45 are unchanged, they are already the newest upstream releases. The component set, the six local patches and the deployment targets are unchanged.

Security

• VP9 keeps references alive across a flush (3b9725696e). vp9_decode_flush() released s->s.frames[], s->s.refs[] and s->s.ref_frames[] but left s->next_refs[] referenced. Under frame threading vp9_decode_update_thread_context() seeds a worker's refs[] from the source worker's next_refs[], so pre-flush references survived and an inter frame after the flush could decode against frames that no longer existed: a heap out-of-bounds read and write after avcodec_flush_buffers(). Found by Mozilla's bugmon automation. Any consumer that decodes VP9 in software and flushes on a seek reaches this, which is the normal shape of a player.

• Dolby Vision RPU partition counts are bounded (1f46ec7612). num_x_partitions / num_y_partitions were read without a bound, giving an out-of-array access on a crafted RPU. The HEVC and AV1 decoders both select dovi_rpudec, so this sits on the path of every Dolby Vision file, not behind an optional component.

Fixed

• Dolby Vision metadata survives zero padding again (cc971e5cf1). ef167512ab (in n8.1.2) parses an RPU as far forward as it can but stopped trimming trailing zero padding, so the extension block size check could reject a heavily padded RPU and the file lost its dynamic metadata. The trailing zero strip is back and the remaining-size check is down to the minimum a zero-sized block needs. Upstream issue 24428.

• VC-1 no longer drops the last macroblock of a picture (a996d156da). The per-macroblock guards added in 2a8785966c (also in n8.1.2) bail out to error concealment at get_bits_left() <= 1, but a skipped P or B macroblock can legitimately cost exactly one bit, and a Simple or Main profile picture is byte-aligned with no stop bit. A picture ending on such a macroblock lost it.

• The dca_core bitstream filter clears its profile on init() (7ba069f4f1). The filter strips the extension substreams, so a declared input profile such as DTS-HD MA no longer describes what comes out of it. Upstream issue 24388.

• A container channel layout survives a failed decoder open (8bf82c567a). avformat_find_stream_info() copies codec parameters back from the decoder context even when avcodec_open2() failed, and a failed open zeroes ch_layout, so the layout the demuxer had read from the container was overwritten with nothing.

• Plus upstream hardening across components this build ships: seven mov fixes (trun sample counts, sgpd and iref entry counts bounded by their atom size, current_dts overflow), mpegts, hls, oggdec, swscale and cbs_h265. matroskadec.c has no commits in this range.

Note for consumers

This is a minor rather than a patch because decoder behaviour changes: a VP9 stream that previously decoded against stale references after a seek now decodes correctly, a padded Dolby Vision RPU keeps its metadata, and a VC-1 picture keeps its last macroblock. Nothing in the API moved, the soname majors are the same as n8.1.2 (libavcodec 62, libavformat 62, libavutil 60).

None of the six local patches were made redundant by this release: they all still apply and were each verified against the n8.1.3 tree before the build.

swift test: 24 tests in 7 suites pass against the rebuilt binaries, including the three suites that pin local patches (PGSMissingPaletteTests, VC1ParserExtradataTests, Dav1CodecTagTests).