6.1.6From commit messages
n6.1.6
Fixed 10
- avformat/dashdec, dashenc, hlsenc, and demux now respect io_open set in AVFormatContext and use correct close function for custom io.
- avformat/oggparsecelt bounded extra_headers to avoid an effectively infinite loop.
- avcodec/hdrdec fixed pixel count decrement in RLE decompress loop.
- avcodec/hevc limited missing-ref fill to coded planes and tightened sh_num_tiles_in_slice_minus1 upper bound.
- avformat issues including Wave unaligned metadata chunks, vividas misaligned access, rtpenc_aac small packets, rtpenc_xiph max payload underflow, ty rec_size check, hls url_offset and size validation, and hls TIME-OFFSET validation.
- avcodec issues including diracdec mctmp buffer size and edge_emu_buffer overflow, g2meet stack size, jpeg2000dec mask computation and header variables, magicyuv MEDIAN slices and interlaced slice-height checks, h264_slice chroma-width underflow, vorbisdsp inverse coupling, and various overflow and bounds checks in cook, on2avc, truespeech, agm, rv10, and rv34 decoders.
- avfilter issues including boxblur off-by-one errors, af_join buffer dedup use-after-free, and vf_drawtext pixel_mode checks and glyph memory management.
- avformat/ftp now rejects CR/LF in URL path and non-printable ASCII characters to prevent command injection.
- Multiple buffer overflow, integer overflow, and bounds-checking fixes across swscale, swresample, and avfilter components including rgb2rgb, ppc VSX path, resample, v360, showcwt, convolution, showspectrum, snowenc, and icecast metadata validation.
- tools/zmqsend now frees the AVBprint buffer after using it and target_dem_fuzzer no longer exits on io_buffer allocation failure.