On Fri, Aug 08, 2025 at 08:18:43PM -0300, James Almer wrote:
> On 8/8/2025 8:09 PM, Michael Niedermayer wrote:
> > git log --grep "Clear state on alloc" origin/master  --oneline
> > 85a2beaa811 avcodec/ffv1: Clear state on alloc
> > 70fc46d1856 avcodec/ffv1: Clear state on alloc
> 
> Yeah, that's not good. The second commit is an empty duplicate.

but how did this happen ?

the webpage lists 70fc46d185 (https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20134)
is this some sort multithreading feature where it spwns independant workers
for each and then maybe end up with 2 for one pr ? iam just speculating i have
not looked at one single line of forgejo code

if thats the case it should have stoped when it realized the comits are empty


> 
> > 
> > also not signed, not even with forgejos key:
> It only signs commits if they were signed in the PR prior to rebasing, i
> think.

git log fforge/pr/20134 -2 --show-signature
commit a99fa230adbe52504e6fadc1a3f85b5c30154349 (fforge/pr/20134, fforge-michaelni/ff-tmp-uninit-ut-vlc-ffv1)
gpg: Signature made Thu 07 Aug 2025 06:33:14 PM CEST
gpg:                using EDDSA key DD1EC9E8DE085C629B3E1846B18E8928B3948D64
gpg: Good signature from "Michael Niedermayer <michael-git@niedermayer.cc>" [ultimate]
gpg:                 aka "Michael Niedermayer (key used for git commits) <michael@niedermayer.cc>" [ultimate]
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Aug 6 13:36:06 2025 +0200

    avcodec/ffv1: Clear state on alloc

    Fixes: use of uninitialized memory
    Fixes: 428969823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-5909681623334912

    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

commit 006125030a0c360539c615fa6b5881c9bd78e637
gpg: Signature made Thu 07 Aug 2025 06:33:13 PM CEST
gpg:                using EDDSA key DD1EC9E8DE085C629B3E1846B18E8928B3948D64
gpg: Good signature from "Michael Niedermayer <michael-git@niedermayer.cc>" [ultimate]
gpg:                 aka "Michael Niedermayer (key used for git commits) <michael@niedermayer.cc>" [ultimate]
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Aug 6 13:09:26 2025 +0200

    avcodec/utvideodec: Set B for the width= 1 case

    Fixes: use of uninitialized meory
    Fixes: 428034093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-6195630160805888

    Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>



btw: (not sure thats the same issue or a genuine typo, its not empty seem like a genuine typo)
git log -2 8b5db38dc6d
commit 8b5db38dc6d0bec05ce7e4c1451986055032ed9c
Author: Kacper Michajłow <kasper93@gmail.com>
Date:   Sat Jul 26 05:00:11 2025 +0200

    avcodec/qcelpdec: set missing sample rate

    Commit f566032bfda2fee4fb6388d5906d1957a1ed868a added frame validation.
    Since then this decoder has been failing validation of sample rate
    value.

    Found by OSS-Fuzz.

    Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

commit 7f5db34f3b02ea5c1a951e65f04e313841ee888e
Author: Kacper Michajłow <kasper93@gmail.com>
Date:   Sat Jul 26 04:59:44 2025 +0200

    avcodec/qcelpdec: set missing sample rate

    Commit f566032bfda2fee4fb6388d5906d1957a1ed868a added frame validation.
    Since then this decoder has been failing validation of sample rate
    value.

    Found by OSS-Fuzz.

    Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

[...]


-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I am the wisest man alive, for I know one thing, and that is that I know
nothing. -- Socrates