[FFmpeg-devel] [PATCH 1/3] avformat/tmv: Check video chunk size

[FFmpeg-devel] [PATCH 1/3] avformat/tmv: Check video chunk size

[Michael Niedermayer]

This check matches the audio chunk check

Fixes: Timeout
Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/tmv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/tmv.c b/libavformat/tmv.c
index ea39954190..18105f764e 100644
--- a/libavformat/tmv.c
+++ b/libavformat/tmv.c
@@ -103,6 +103,10 @@ static int tmv_read_header(AVFormatContext *s)
     char_cols = avio_r8(pb);
     char_rows = avio_r8(pb);
     tmv->video_chunk_size = char_cols * char_rows * 2;
+    if (!tmv->video_chunk_size) {
+        av_log(s, AV_LOG_ERROR, "invalid video chunk size\n");
+        return AVERROR_INVALIDDATA;
+    }
 
     features  = avio_r8(pb);
     if (features & ~(TMV_PADDING | TMV_STEREO)) {
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avformat/jacosubdec: clarify code

[Michael Niedermayer]

add comments, rename variables and indent things differently

Is it clearer now ?

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/jacosubdec.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libavformat/jacosubdec.c b/libavformat/jacosubdec.c
index c6e5b4aa6d..60fe72d5d7 100644
--- a/libavformat/jacosubdec.c
+++ b/libavformat/jacosubdec.c
@@ -127,28 +127,28 @@ shift_and_ret:
 static int get_shift(unsigned timeres, const char *buf)
 {
     int sign = 1;
-    int a = 0, b = 0, c = 0, d = 0;
+    int h = 0, m = 0, s = 0, d = 0;
     int64_t ret;
 #define SSEP "%*1[.:]"
-    int n = sscanf(buf, "%d"SSEP"%d"SSEP"%d"SSEP"%d", &a, &b, &c, &d);
+    int n = sscanf(buf, "%d"SSEP"%d"SSEP"%d"SSEP"%d", &h, &m, &s, &d);
 #undef SSEP
 
-    if (a == INT_MIN)
+    if (h == INT_MIN)
         return 0;
 
-    if (*buf == '-' || a < 0) {
+    if (*buf == '-' || h < 0) {
         sign = -1;
-        a = FFABS(a);
+        h = FFABS(h);
     }
 
     ret = 0;
     switch (n) {
-    case 1:                      a = 0;
-    case 2:        c = b; b = a; a = 0;
-    case 3: d = c; c = b; b = a; a = 0;
+    case 1:        h = 0;                   //clear all in case of a single parameter
+    case 2: s = m; m = h; h = 0;            //shift into second subsecondd
+    case 3: d = s; s = m; m = h; h = 0;     //shift into minute second subsecond
     }
 
-    ret = (int64_t)a*3600 + (int64_t)b*60 + c;
+    ret = (int64_t)h*3600 + (int64_t)m*60 + s;
     if (FFABS(ret) > (INT64_MAX - FFABS(d)) / timeres)
         return 0;
     ret = sign * (ret * timeres + d);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/3] avformat/jacosubdec: clarify code

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 682 bytes --]

On Wed, Oct 11, 2023 at 08:10:14PM +0200, Michael Niedermayer wrote:
> add comments, rename variables and indent things differently
> 
> Is it clearer now ?
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/jacosubdec.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If the United States is serious about tackling the national security threats 
related to an insecure 5G network, it needs to rethink the extent to which it
values corporate profits and government espionage over security.-Bruce Schneier

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Michael Niedermayer]

This explains how to request refunds and what can be funded by SPI
---
 doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 doc/spi.txt

diff --git a/doc/spi.txt b/doc/spi.txt
new file mode 100644
index 0000000000..7d85de8f09
--- /dev/null
+++ b/doc/spi.txt
@@ -0,0 +1,50 @@
+How to request refunds from SPI:
+--------------------------------
+Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
+
+
+What can be payed by SPI:
+-------------------------
+FFmpeg money collected at SPI can be used for any purpose which is OK by
+501(c)3 nonprofit rules, and within our mission (Free & OSS software).
+
+In practice we frequently payed for Travel and Hardware.
+For other things, it is recommanded to disscuss them beforehand
+on ffmpeg-devel and if the community agrees to fund them, also with
+SPI through stefano before starting with anything.
+
+
+Is it possible to fund active development by SPI:
+(the texts below have been taken from multiple
+ replies FFmpeg has received from SPI, they have been edited
+ so that "I" was replaced by "SPI" in some cases.)
+-------------------------------------------------
+Paying for development *does* require substantial
+additional paperwork, but it is not prohibitied.
+
+Several SPI projects pay contractors for development
+efforts.  SPI needs a contract in place which describes the work to be
+done.  There are also various things SPI needs to check (e.g. are they a
+US person or not, as with GSoC mentor payments; are they really a
+contractor and not a employee).
+
+SPI can't deal with employment at the moment because that involves a
+lot of work, like health insurance, tax withholding, etc.  Contractors
+are easier because they have to take care of that themselves; Whether
+someone is a contractor vs employee depends on various factors (that
+of course are different in every country) and can be disputed (see
+e.g. the debate about whether Uber drivers are employees); SPI has a
+questionnaire about their circumstances.)
+
+Unfortunately, there's no one-size-fits all when dealing with contractors.
+As already mentioned, without knowing the contributor's country
+
+SPI does have templates, but they depend on the contractors country. If it's
+US, Australia, France and a couple others SPI could provide them next day,
+otherwise SPI would need to ask their attorney to draft one, which would
+take some time
+
+Also, SPI has two models, MSA (which transfers ownership) and CSA (which
+grants a license instead). SPI usually sends the MSA (it's better for most
+purposes), but for development purposes, some projects prefer that the
+contractor retain ownership rights.
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Steven Liu]

Michael Niedermayer <michael@niedermayer.cc> 于2023年10月12日周四 02:10写道：
>
> This explains how to request refunds and what can be funded by SPI
> ---
>  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 50 insertions(+)
>  create mode 100644 doc/spi.txt
>
> diff --git a/doc/spi.txt b/doc/spi.txt
> new file mode 100644
> index 0000000000..7d85de8f09
> --- /dev/null
> +++ b/doc/spi.txt
> @@ -0,0 +1,50 @@
> +How to request refunds from SPI:
> +--------------------------------
> +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
> +
> +
> +What can be payed by SPI:
> +-------------------------
> +FFmpeg money collected at SPI can be used for any purpose which is OK by
> +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
> +
> +In practice we frequently payed for Travel and Hardware.
> +For other things, it is recommanded to disscuss them beforehand
> +on ffmpeg-devel and if the community agrees to fund them, also with
> +SPI through stefano before starting with anything.
> +
> +
> +Is it possible to fund active development by SPI:
> +(the texts below have been taken from multiple
> + replies FFmpeg has received from SPI, they have been edited
> + so that "I" was replaced by "SPI" in some cases.)
> +-------------------------------------------------
> +Paying for development *does* require substantial
> +additional paperwork, but it is not prohibitied.
> +
> +Several SPI projects pay contractors for development
> +efforts.  SPI needs a contract in place which describes the work to be
> +done.  There are also various things SPI needs to check (e.g. are they a
> +US person or not, as with GSoC mentor payments; are they really a
> +contractor and not a employee).
> +
> +SPI can't deal with employment at the moment because that involves a
> +lot of work, like health insurance, tax withholding, etc.  Contractors
> +are easier because they have to take care of that themselves; Whether
> +someone is a contractor vs employee depends on various factors (that
> +of course are different in every country) and can be disputed (see
> +e.g. the debate about whether Uber drivers are employees); SPI has a
> +questionnaire about their circumstances.)
> +
> +Unfortunately, there's no one-size-fits all when dealing with contractors.
> +As already mentioned, without knowing the contributor's country
> +
> +SPI does have templates, but they depend on the contractors country. If it's
> +US, Australia, France and a couple others SPI could provide them next day,
> +otherwise SPI would need to ask their attorney to draft one, which would
> +take some time
> +
> +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
> +grants a license instead). SPI usually sends the MSA (it's better for most
> +purposes), but for development purposes, some projects prefer that the
> +contractor retain ownership rights.
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
This describe looks very clear.


Thanks
Steven
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Andreas Rheinhardt]

Michael Niedermayer:
> This explains how to request refunds and what can be funded by SPI
> ---
>  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 50 insertions(+)
>  create mode 100644 doc/spi.txt
> 
> diff --git a/doc/spi.txt b/doc/spi.txt
> new file mode 100644
> index 0000000000..7d85de8f09
> --- /dev/null
> +++ b/doc/spi.txt
> @@ -0,0 +1,50 @@
> +How to request refunds from SPI:
> +--------------------------------
> +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
> +
> +
> +What can be payed by SPI:
> +-------------------------
> +FFmpeg money collected at SPI can be used for any purpose which is OK by
> +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
> +
> +In practice we frequently payed for Travel and Hardware.
                                       ^          ^
                                       t          h

> +For other things, it is recommanded to disscuss them beforehand
                                 ^          ^
                                 e

> +on ffmpeg-devel and if the community agrees to fund them, also with
> +SPI through stefano before starting with anything.
               ^
               S

> +
> +
> +Is it possible to fund active development by SPI:
> +(the texts below have been taken from multiple
> + replies FFmpeg has received from SPI, they have been edited
> + so that "I" was replaced by "SPI" in some cases.)
> +-------------------------------------------------
> +Paying for development *does* require substantial
> +additional paperwork, but it is not prohibitied.
                                               ^

> +
> +Several SPI projects pay contractors for development
> +efforts.  SPI needs a contract in place which describes the work to be
> +done.  There are also various things SPI needs to check (e.g. are they a
> +US person or not, as with GSoC mentor payments; are they really a
> +contractor and not a employee).
> +
> +SPI can't deal with employment at the moment because that involves a
> +lot of work, like health insurance, tax withholding, etc.  Contractors
> +are easier because they have to take care of that themselves; Whether
> +someone is a contractor vs employee depends on various factors (that
> +of course are different in every country) and can be disputed (see
> +e.g. the debate about whether Uber drivers are employees); SPI has a
> +questionnaire about their circumstances.)
> +
> +Unfortunately, there's no one-size-fits all when dealing with contractors.
> +As already mentioned, without knowing the contributor's country
> +
> +SPI does have templates, but they depend on the contractors country. If it's
> +US, Australia, France and a couple others SPI could provide them next day,
> +otherwise SPI would need to ask their attorney to draft one, which would
> +take some time
> +
> +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
> +grants a license instead). SPI usually sends the MSA (it's better for most
> +purposes), but for development purposes, some projects prefer that the
> +contractor retain ownership rights.
                    ^
                    s

This should explain what the abbreviations stand for.

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 3832 bytes --]

On Thu, Oct 12, 2023 at 10:03:20AM +0200, Andreas Rheinhardt wrote:
> Michael Niedermayer:
> > This explains how to request refunds and what can be funded by SPI
> > ---
> >  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 50 insertions(+)
> >  create mode 100644 doc/spi.txt
> > 
> > diff --git a/doc/spi.txt b/doc/spi.txt
> > new file mode 100644
> > index 0000000000..7d85de8f09
> > --- /dev/null
> > +++ b/doc/spi.txt
> > @@ -0,0 +1,50 @@
> > +How to request refunds from SPI:
> > +--------------------------------
> > +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
> > +
> > +
> > +What can be payed by SPI:
> > +-------------------------
> > +FFmpeg money collected at SPI can be used for any purpose which is OK by
> > +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
> > +
> > +In practice we frequently payed for Travel and Hardware.
>                                        ^          ^
>                                        t          h
> 
> > +For other things, it is recommanded to disscuss them beforehand
>                                  ^          ^
>                                  e
> 
> > +on ffmpeg-devel and if the community agrees to fund them, also with
> > +SPI through stefano before starting with anything.
>                ^
>                S
> 
> > +
> > +
> > +Is it possible to fund active development by SPI:
> > +(the texts below have been taken from multiple
> > + replies FFmpeg has received from SPI, they have been edited
> > + so that "I" was replaced by "SPI" in some cases.)
> > +-------------------------------------------------
> > +Paying for development *does* require substantial
> > +additional paperwork, but it is not prohibitied.
>                                                ^
> 
> > +
> > +Several SPI projects pay contractors for development
> > +efforts.  SPI needs a contract in place which describes the work to be
> > +done.  There are also various things SPI needs to check (e.g. are they a
> > +US person or not, as with GSoC mentor payments; are they really a
> > +contractor and not a employee).
> > +
> > +SPI can't deal with employment at the moment because that involves a
> > +lot of work, like health insurance, tax withholding, etc.  Contractors
> > +are easier because they have to take care of that themselves; Whether
> > +someone is a contractor vs employee depends on various factors (that
> > +of course are different in every country) and can be disputed (see
> > +e.g. the debate about whether Uber drivers are employees); SPI has a
> > +questionnaire about their circumstances.)
> > +
> > +Unfortunately, there's no one-size-fits all when dealing with contractors.
> > +As already mentioned, without knowing the contributor's country
> > +
> > +SPI does have templates, but they depend on the contractors country. If it's
> > +US, Australia, France and a couple others SPI could provide them next day,
> > +otherwise SPI would need to ask their attorney to draft one, which would
> > +take some time
> > +
> > +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
> > +grants a license instead). SPI usually sends the MSA (it's better for most
> > +purposes), but for development purposes, some projects prefer that the
> > +contractor retain ownership rights.
>                     ^
>                     s
> 
> This should explain what the abbreviations stand for.

I believe MSA stands for Master service agreement. I do not know what CSA stands for

all other things fixed

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Everything should be made as simple as possible, but not simpler.
-- Albert Einstein

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Lynne]

Oct 12, 2023, 19:37 by michael@niedermayer.cc:

> On Thu, Oct 12, 2023 at 10:03:20AM +0200, Andreas Rheinhardt wrote:
>
>> Michael Niedermayer:
>> > This explains how to request refunds and what can be funded by SPI
>> > ---
>> >  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
>> >  1 file changed, 50 insertions(+)
>> >  create mode 100644 doc/spi.txt
>> > 
>> > diff --git a/doc/spi.txt b/doc/spi.txt
>> > new file mode 100644
>> > index 0000000000..7d85de8f09
>> > --- /dev/null
>> > +++ b/doc/spi.txt
>> > @@ -0,0 +1,50 @@
>> > +How to request refunds from SPI:
>> > +--------------------------------
>> > +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
>> > +
>> > +
>> > +What can be payed by SPI:
>> > +-------------------------
>> > +FFmpeg money collected at SPI can be used for any purpose which is OK by
>> > +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
>> > +
>> > +In practice we frequently payed for Travel and Hardware.
>>  ^          ^
>>  t          h
>>
>> > +For other things, it is recommanded to disscuss them beforehand
>>  ^          ^
>>  e
>>
>> > +on ffmpeg-devel and if the community agrees to fund them, also with
>> > +SPI through stefano before starting with anything.
>>  ^
>>  S
>>
>> > +
>> > +
>> > +Is it possible to fund active development by SPI:
>> > +(the texts below have been taken from multiple
>> > + replies FFmpeg has received from SPI, they have been edited
>> > + so that "I" was replaced by "SPI" in some cases.)
>> > +-------------------------------------------------
>> > +Paying for development *does* require substantial
>> > +additional paperwork, but it is not prohibitied.
>>  ^
>>
>> > +
>> > +Several SPI projects pay contractors for development
>> > +efforts.  SPI needs a contract in place which describes the work to be
>> > +done.  There are also various things SPI needs to check (e.g. are they a
>> > +US person or not, as with GSoC mentor payments; are they really a
>> > +contractor and not a employee).
>> > +
>> > +SPI can't deal with employment at the moment because that involves a
>> > +lot of work, like health insurance, tax withholding, etc.  Contractors
>> > +are easier because they have to take care of that themselves; Whether
>> > +someone is a contractor vs employee depends on various factors (that
>> > +of course are different in every country) and can be disputed (see
>> > +e.g. the debate about whether Uber drivers are employees); SPI has a
>> > +questionnaire about their circumstances.)
>> > +
>> > +Unfortunately, there's no one-size-fits all when dealing with contractors.
>> > +As already mentioned, without knowing the contributor's country
>> > +
>> > +SPI does have templates, but they depend on the contractors country. If it's
>> > +US, Australia, France and a couple others SPI could provide them next day,
>> > +otherwise SPI would need to ask their attorney to draft one, which would
>> > +take some time
>> > +
>> > +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
>> > +grants a license instead). SPI usually sends the MSA (it's better for most
>> > +purposes), but for development purposes, some projects prefer that the
>> > +contractor retain ownership rights.
>>  ^
>>  s
>>
>> This should explain what the abbreviations stand for.
>>
>
> I believe MSA stands for Master service agreement. I do not know what CSA stands for
>
> all other things fixed
>

I think this belongs on the website, not in the source code.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Stefano Sabatini]

On date Wednesday 2023-10-11 20:10:15 +0200, Michael Niedermayer wrote:
> This explains how to request refunds and what can be funded by SPI
> ---
>  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 50 insertions(+)
>  create mode 100644 doc/spi.txt
> 
> diff --git a/doc/spi.txt b/doc/spi.txt
> new file mode 100644
> index 0000000000..7d85de8f09
> --- /dev/null
> +++ b/doc/spi.txt
> @@ -0,0 +1,50 @@

Add a short introduction about SPI here.

SPI (Software in the Public Interest) is a non-profit corporation
registered in the state of New York founded to act as a fiscal sponsor
for organizations that develop open source software and hardware. For
details check here:
https://www.spi-inc.org/

FFmpeg is an SPI associated project and donations can be collected and
handled by SPI on behalf of FFmpeg. For details about the association
check here:
https://www.spi-inc.org/projects/ffmpeg/


> +How to request refunds from SPI:
> +--------------------------------
 > +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject

Expanding on this:

Send a mail to ffmpeg-devel with the [REFUND-REQUEST] tag and a short
description of the refund topic in the subject.

In the mail, you also need to provide the amount to be refunded, with
a short description of how the money was spent.

There is no need and is not recommeded to send receipts when sending
the refund request on the ffmpeg-devel mailing-list, but they are
usually needed later when the request is approved and the refund
request is sent to SPI:
https://www.spi-inc.org/treasurer/reimbursement-form/

> +
> +
> +What can be payed by SPI:
> +-------------------------

> +FFmpeg money collected at SPI can be used for any purpose which is OK by

OK => fine/compliant/in line with

> +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
> +
> +In practice we frequently payed for Travel and Hardware.

> +For other things, it is recommanded to disscuss them beforehand

recommended .. to discuss

> +on ffmpeg-devel and if the community agrees to fund them, also with
> +SPI through stefano before starting with anything.

My take on this:

For other refund expenses or sponsorships, it is recommended to
discuss them beforehand on ffmpeg-devel. If there is a community
agreement on their approval, the current FFmpeg liaison will followup
to get an approval on the SPI side.

> +
> +
> +Is it possible to fund active development by SPI:
> +(the texts below have been taken from multiple
> + replies FFmpeg has received from SPI, they have been edited
> + so that "I" was replaced by "SPI" in some cases.)
> +-------------------------------------------------
> +Paying for development *does* require substantial

> +additional paperwork, but it is not prohibitied.

prohibited

> +

> +Several SPI projects pay contractors for development
> +efforts.  SPI needs a contract in place which describes the work to be
> +done.  There are also various things SPI needs to check (e.g. are they a
> +US person or not, as with GSoC mentor payments; are they really a
> +contractor and not a employee).
> +
> +SPI can't deal with employment at the moment because that involves a
> +lot of work, like health insurance, tax withholding, etc.  Contractors
> +are easier because they have to take care of that themselves; Whether
> +someone is a contractor vs employee depends on various factors (that
> +of course are different in every country) and can be disputed (see
> +e.g. the debate about whether Uber drivers are employees); SPI has a
> +questionnaire about their circumstances.)
> +
> +Unfortunately, there's no one-size-fits all when dealing with contractors.
> +As already mentioned, without knowing the contributor's country
> +
> +SPI does have templates, but they depend on the contractors country. If it's
> +US, Australia, France and a couple others SPI could provide them next day,
> +otherwise SPI would need to ask their attorney to draft one, which would
> +take some time
> +
> +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
> +grants a license instead). SPI usually sends the MSA (it's better for most
> +purposes), but for development purposes, some projects prefer that the
> +contractor retain ownership rights.

This part is a useful resume of the past internal discussions, but at
the same time we never really went down to this road, so I'm not sure
moving this to the repo would be helpful from the operational point of
view. It's probably useful to clarify the current status quo with the
other developers though.

About the placement of the text, given that this is an internal memo
intended for developers probably it's better to keep it in the ffmpeg
repo rather than on the web one (as it was proposed in another reply).
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/3] doc: add spi.txt

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 5526 bytes --]

On Fri, Oct 13, 2023 at 12:53:34AM +0200, Stefano Sabatini wrote:
> On date Wednesday 2023-10-11 20:10:15 +0200, Michael Niedermayer wrote:
> > This explains how to request refunds and what can be funded by SPI
> > ---
> >  doc/spi.txt | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 50 insertions(+)
> >  create mode 100644 doc/spi.txt
> > 
> > diff --git a/doc/spi.txt b/doc/spi.txt
> > new file mode 100644
> > index 0000000000..7d85de8f09
> > --- /dev/null
> > +++ b/doc/spi.txt
> > @@ -0,0 +1,50 @@
> 
> Add a short introduction about SPI here.
> 
> SPI (Software in the Public Interest) is a non-profit corporation
> registered in the state of New York founded to act as a fiscal sponsor
> for organizations that develop open source software and hardware. For
> details check here:
> https://www.spi-inc.org/
> 
> FFmpeg is an SPI associated project and donations can be collected and
> handled by SPI on behalf of FFmpeg. For details about the association
> check here:
> https://www.spi-inc.org/projects/ffmpeg/
> 
> 
> > +How to request refunds from SPI:
> > +--------------------------------
>  > +Send a mail to ffmpeg-devel with [REFUND-REQUEST] in the subject
> 
> Expanding on this:
> 
> Send a mail to ffmpeg-devel with the [REFUND-REQUEST] tag and a short
> description of the refund topic in the subject.
> 
> In the mail, you also need to provide the amount to be refunded, with
> a short description of how the money was spent.
> 
> There is no need and is not recommeded to send receipts when sending
> the refund request on the ffmpeg-devel mailing-list, but they are
> usually needed later when the request is approved and the refund
> request is sent to SPI:
> https://www.spi-inc.org/treasurer/reimbursement-form/
> 
> > +
> > +
> > +What can be payed by SPI:
> > +-------------------------
> 
> > +FFmpeg money collected at SPI can be used for any purpose which is OK by
> 
> OK => fine/compliant/in line with
> 
> > +501(c)3 nonprofit rules, and within our mission (Free & OSS software).
> > +
> > +In practice we frequently payed for Travel and Hardware.
> 
> > +For other things, it is recommanded to disscuss them beforehand
> 
> recommended .. to discuss
> 
> > +on ffmpeg-devel and if the community agrees to fund them, also with
> > +SPI through stefano before starting with anything.
> 
> My take on this:
> 
> For other refund expenses or sponsorships, it is recommended to
> discuss them beforehand on ffmpeg-devel. If there is a community
> agreement on their approval, the current FFmpeg liaison will followup
> to get an approval on the SPI side.
> 
> > +
> > +
> > +Is it possible to fund active development by SPI:
> > +(the texts below have been taken from multiple
> > + replies FFmpeg has received from SPI, they have been edited
> > + so that "I" was replaced by "SPI" in some cases.)
> > +-------------------------------------------------
> > +Paying for development *does* require substantial
> 
> > +additional paperwork, but it is not prohibitied.
> 
> prohibited
> 
> > +
> 
> > +Several SPI projects pay contractors for development
> > +efforts.  SPI needs a contract in place which describes the work to be
> > +done.  There are also various things SPI needs to check (e.g. are they a
> > +US person or not, as with GSoC mentor payments; are they really a
> > +contractor and not a employee).
> > +
> > +SPI can't deal with employment at the moment because that involves a
> > +lot of work, like health insurance, tax withholding, etc.  Contractors
> > +are easier because they have to take care of that themselves; Whether
> > +someone is a contractor vs employee depends on various factors (that
> > +of course are different in every country) and can be disputed (see
> > +e.g. the debate about whether Uber drivers are employees); SPI has a
> > +questionnaire about their circumstances.)
> > +
> > +Unfortunately, there's no one-size-fits all when dealing with contractors.
> > +As already mentioned, without knowing the contributor's country
> > +
> > +SPI does have templates, but they depend on the contractors country. If it's
> > +US, Australia, France and a couple others SPI could provide them next day,
> > +otherwise SPI would need to ask their attorney to draft one, which would
> > +take some time
> > +
> > +Also, SPI has two models, MSA (which transfers ownership) and CSA (which
> > +grants a license instead). SPI usually sends the MSA (it's better for most
> > +purposes), but for development purposes, some projects prefer that the
> > +contractor retain ownership rights.
> 
> This part is a useful resume of the past internal discussions, but at
> the same time we never really went down to this road, so I'm not sure
> moving this to the repo would be helpful from the operational point of
> view. It's probably useful to clarify the current status quo with the
> other developers though.
> 
> About the placement of the text, given that this is an internal memo
> intended for developers probably it's better to keep it in the ffmpeg
> repo rather than on the web one (as it was proposed in another reply).

ill post a V2 with your suggested changes
it doesnt really matter where it is, important is that it is somewhere

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Democracy is the form of government in which you can choose your dictator

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] avformat/tmv: Check video chunk size

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 856 bytes --]

On Wed, Oct 11, 2023 at 08:10:13PM +0200, Michael Niedermayer wrote:
> This check matches the audio chunk check
> 
> Fixes: Timeout
> Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/tmv.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Any man who breaks a law that conscience tells him is unjust and willingly 
accepts the penalty by staying in jail in order to arouse the conscience of 
the community on the injustice of the law is at that moment expressing the 
very highest respect for law. - Martin Luther King Jr

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".