Release 1.18.41.18.4

5 files changed, 240 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index 9073ffa..0a5fa96 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,63 @@
+=== release 1.18.4 ===
+
+2021-03-15 17:49:43 +0000  Tim-Philipp Müller <tim@centricular.com>
+
+	* ChangeLog:
+	* NEWS:
+	* RELEASE:
+	* gst-libav.doap:
+	* meson.build:
+	  Release 1.18.4
+
+2021-03-03 10:51:04 +0200  Sebastian Dröge <sebastian@centricular.com>
+
+	* ext/libav/gstavcodecmap.c:
+	  avcodecmap: Don't try converting channel layouts with more than 64 channels
+	  We only support up to 64 channels in GStreamer with a specific layout so
+	  it's safe to assume a NONE layout in this case.
+	  Also the arrays of channel positions are allocated everywhere with 64
+	  elements so don't try setting more than 64 to NONE as that will cause
+	  stack corruptions and similar memory safety issues.
+	  Thanks to Natalie Silvanovich for reporting this issue.
+	  Fixes https://gitlab.freedesktop.org/gstreamer/gst-libav/-/issues/92
+	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-libav/-/merge_requests/121>
+
+2020-12-02 15:43:15 +1100  Matthew Waters <matthew@centricular.com>
+
+	* ext/libav/gstavviddec.c:
+	  avviddec: take the maximum of the height/coded_height
+	  Otherwise, some h.264 streams (particularly with cropping information)
+	  may cause memory corruption after a renegotiation to a smaller size when
+	  decoded and then ffmpeg writes past the end of the buffer.
+	  Fixes: https://gitlab.freedesktop.org/gstreamer/gst-libav/-/issues/80
+	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-libav/-/merge_requests/118>
+
+2021-01-28 06:11:14 +0000  Matthew Waters <matthew@centricular.com>
+
+	* ext/libav/gstavviddec.c:
+	  viddec: don't configure and incorrect buffer pool when receiving a gap event
+	  Scenario is this:
+	  1. libav receives enough data to want a buffer with get_buffer2()
+	  which wants a buffer pool with a certain format, say Y42B but does
+	  not negotiate and therefore GstVideoDecoder does not have any output
+	  state configured
+	  2. A gap event is received which GstVideoDecoder wants to forward.  It
+	  needs caps to forward the gap event so attempts to negotiate with some
+	  default information which chooses e.g. I420 and overwrites the
+	  previously configured bufferpool decided on by get_buffer2()
+	  3. There is a mismatch between what ensure_internal_pool() check for
+	  consistency and what decide_allocation() sets when overriding the
+	  internal pool with the downstream pool.
+	  4. FFMpeg then requests a Y42B buffer from an I420 pool and predictably
+	  crashes writing past the contents of the buffer
+	  This is fixed by keeping track of the internal pool states correctly.
+	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-libav/-/merge_requests/117>
+
+2021-01-14 02:17:38 +0000  Tim-Philipp Müller <tim@centricular.com>
+
+	* meson.build:
+	  Back to development
+
 === release 1.18.3 ===
 
 2021-01-13 21:11:49 +0000  Tim-Philipp Müller <tim@centricular.com>
diff --git a/NEWS b/NEWS
index 1ac82bd..3ada886 100644
--- a/NEWS
+++ b/NEWS
@@ -2,13 +2,13 @@ GStreamer 1.18 Release Notes
 
 GStreamer 1.18.0 was originally released on 8 September 2020.
 
-The latest bug-fix release in the 1.18 series is 1.18.3 and was released
-on 13 January 2021.
+The latest bug-fix release in the 1.18 series is 1.18.4 and was released
+on 15 March 2021.
 
 See https://gstreamer.freedesktop.org/releases/1.18/ for the latest
 version of this document.
 
-Last updated: Wednesday 13 January 2021, 20:00 UTC (log)
+Last updated: Monday 15 March 2021, 13:00 UTC (log)
 
 Introduction
 
@@ -2717,6 +2717,168 @@ List of merge requests and issues fixed in 1.18.3
 -   List of Merge Requests applied in 1.18.3
 -   List of Issues fixed in 1.18.3
 
+1.18.4
+
+The fourth 1.18 bug-fix release (1.18.4) was released on 15 March 2021.
+
+This release only contains bugfixes and security fixes and it should be
+safe to update from 1.18.x.
+
+Highlighted bugfixes in 1.18.4
+
+-   important security fixes for ID3 tag reading, matroska and realmedia
+    parsing, and gst-libav audio decoding
+-   audiomixer, audioaggregator: input buffer handling fixes
+-   decodebin3: improve stream-selection message handling
+-   uridecodebin3: make “caps” property work
+-   wavenc: fix writing of INFO chunks in some cases
+-   v4l2: bt601 colorimetry, allow encoder resolution changes, fix
+    decoder frame rate negotiation
+-   decklinkvideosink: fix auto format detection, and fixes for 29.97fps
+    framerate output
+-   mpeg-2 video handling fixes when seeking
+-   avviddec: fix bufferpool negotiation and possible memory corruption
+    when changing resolution
+-   various stability, performance and reliability improvements
+-   memory leak fixes
+-   build fixes: rpicamsrc, qt overlay example, d3d11videosink on UWP
+
+gstreamer
+
+-   info: Don’t leak log function user_data if the debug system is
+    compiled out
+-   task: Use SetThreadDescription() Win32 API for setting thread names,
+    which preserves thread names in dump files.
+-   buffer, memory: Mark info in map functions as caller-allocates and
+    pass allocation params as const pointers where possible
+-   clock: define AUTO_CLEANUP_FREE_FUNC for GstClockID
+
+gst-plugins-base
+
+-   tag: id3v2: fix frame size check and potential invalid reads
+-   audio: Fix gst_audio_buffer_truncate() meta handling for
+    non-interleaved audio
+-   audioresample: respect buffer layout when draining
+-   audioaggregator: fix input_buffer ownership
+-   decodebin3: change stream selection message owner, so that the app
+    sends the stream-selection event to the right element
+-   rtspconnection: correct data_size when tunneled mode
+-   uridecodebin3: make caps property work
+-   video-converter: Don’t upsample invalid lines
+-   videodecoder: Fix racy critical when pool negotiation occurs during
+    flush
+-   video: Convert gst_video_info_to_caps() to take self as const ptr
+-   examples: added qt core dependency for qt overlay example
+
+gst-plugins-good
+
+-   matroskademux: header parsing fixes
+-   rpicamsrc: depend on posix threads and vchiq_arm to fix build on
+    raspios again
+-   wavenc: Fixed INFO chunk corruption, caused by odd sized data not
+    being padded
+-   wavpackdec: Add floating point format support to fix distortions in
+    some cases
+-   v4l2: recognize V4L2 bt601 colorimetry again
+-   v4l2videoenc: support resolution change stream encode
+-   v4l2h265codec: fix HEVC profile string issue
+-   v4l2object: Need keep same transfer as input caps
+-   v4l2videodec: Fix vp8 and vp9 streams can’t play on board with
+    vendor bsp
+-   v4l2videodec: fix src side frame rate negotiation
+
+gst-plugins-bad
+
+-   avwait: Don’t post messages with the mutex locked
+-   d3d11h264dec: Reconfigure decoder object on DPB size change and keep
+    track of actually configured DPB size
+-   dashsink: fix double unref of sinkpad caps
+-   decklinkvideosink: Use correct numerator for 29.97fps
+-   decklinkvideosink: fix auto format detection
+-   decklinksrc: Use a more accurate capture time
+-   d3d11videosink: Fix build error on UWP
+-   interlace: negotiation and buffer leak fixes
+-   mpegvideoparse: do not clip, so decoder receives data from keyframe
+    even if it’s before the segment start
+-   mpegtsparse: Fix switched DTS/PTS when set-timestamps=false
+-   nvh264sldec: Reopen decoder object if larger DPB size is required
+-   sdpsrc: fix double free if sdp is provided as string via the
+    property
+-   vulkan: Fix elements long name.
+
+gst-plugins-ugly
+
+-   rmdemux: Make sure we have enough data available when parsing
+    audio/video packets
+
+gst-libav
+
+-   avviddec: take the maximum of the height/coded_height
+-   viddec: don’t configure an incorrect buffer pool when receiving a
+    gap event
+-   audiodec: fix stack overflow in gst_ffmpeg_channel_layout_to_gst()
+
+gst-rtsp-server
+
+-   rtspclientsink: fix deadlock on shutdown if no data has been
+    received yet
+-   rtspclientsink: fix leaks in unit tests
+-   rtsp-stream: avoid deadlock in send_func
+-   rtsp-client: cleanup transports during TEARDOWN
+
+gstreamer-vaapi
+
+-   h264 encoder: append encoder exposure to aud
+-   postproc: Fix a problem of propose_allocation when passthrough
+-   glx: Iterate over FBConfig and select 8 bit color size
+
+gstreamer-sharp
+
+-   no changes
+
+gst-omx
+
+-   no changes
+
+gst-python
+
+-   no changes
+
+gst-editing-services
+
+-   group: Use proper group constructor
+
+gst-integration-testsuites
+
+-   no changes
+
+gst-build
+
+-   no changes
+
+Cerbero build tool and packaging changes in 1.18.4
+
+-   macOS: more BigSur fixes
+-   glib: Backport patch to set thread names on Windows 10
+
+Contributors to 1.18.4
+
+Alicia Boya García, Ashley Brighthope, Bing Song, Branko Subasic, Edward
+Hervey, Guillaume Desmottes, Haihua Hu, He Junyan, Hou Qi, Jan Alexander
+Steffens (heftig), Jeongki Kim, Jordan Petridis, Knobe, Kristofer
+Björkström, Marijn Suijten, Matthew Waters, Paul Goulpié, Philipp Zabel,
+Rafał Dzięgiel, Sebastian Dröge, Seungha Yang, Staz M, Stéphane Cerveau,
+Thibault Saunier, Tim-Philipp Müller, Víctor Manuel Jáquez Leal, Vivia
+Nikolaidou, Vladimir Menshakov,
+
+… and many others who have contributed bug reports, translations, sent
+suggestions or helped testing. Thank you all!
+
+List of merge requests and issues fixed in 1.18.4
+
+-   List of Merge Requests applied in 1.18.4
+-   List of Issues fixed in 1.18.4
+
 Schedule for 1.20
 
 Our next major feature release will be 1.20, and 1.19 will be the
@@ -2724,9 +2886,9 @@ unstable development version leading up to the stable 1.20 release. The
 development of 1.19/1.20 will happen in the git master branch.
 
 The plan for the 1.20 development cycle is yet to be confirmed, but it
-is now expected that feature freeze will take place some time in
-January/February 2021, with the first 1.20 stable release hopefully
-around February/March 2021.
+is now expected that feature freeze will take place some time in April
+2021, with the first 1.20 stable release hopefully around April/May
+2021.
 
 1.20 will be backwards-compatible to the stable 1.18, 1.16, 1.14, 1.12,
 1.10, 1.8, 1.6, 1.4, 1.2 and 1.0 release series.
diff --git a/RELEASE b/RELEASE
index 6c9895b..8168d1d 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1,4 +1,4 @@
-This is GStreamer gst-libav 1.18.3.
+This is GStreamer gst-libav 1.18.4.
 
 The GStreamer team is thrilled to announce a new major feature release
 of your favourite cross-platform multimedia framework!
diff --git a/gst-libav.doap b/gst-libav.doap
index 33b1b8d..0af66cf 100644
--- a/gst-libav.doap
+++ b/gst-libav.doap
@@ -34,6 +34,16 @@ colorspace conversion elements.
 
  <release>
   <Version>
+   <revision>1.18.4</revision>
+   <branch>1.18</branch>
+   <name></name>
+   <created>2021-03-15</created>
+   <file-release rdf:resource="https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-1.18.4.tar.xz" />
+  </Version>
+ </release>
+
+ <release>
+  <Version>
    <revision>1.18.3</revision>
    <branch>1.18</branch>
    <name></name>
diff --git a/meson.build b/meson.build
index 9be180f..7b55cb7 100644
--- a/meson.build
+++ b/meson.build
@@ -1,5 +1,5 @@
 project('gst-libav', 'c', 'cpp',
-  version : '1.18.3.1',
+  version : '1.18.4',
   meson_version : '>= 0.48.0',
   default_options : [ 'warning_level=1',
                       'buildtype=debugoptimized' ])