From 67358978f610feb4e8f0982653321364f2241cc6 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Wed, 12 Nov 2025 10:44:12 -0500
Subject: [PATCH 1/5] demux: ogg: fix leak on xiph_AppendHeaders error

Fixes #29448
Fixes https://issues.oss-fuzz.com/issues/456426262

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/vlc
(cherry picked from commit c10dde079c65799a58307fb6f23ee18275f0363f)
---
 modules/demux/ogg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/demux/ogg.c b/modules/demux/ogg.c
index f9784963e0..db1b404b4e 100644
--- a/modules/demux/ogg.c
+++ b/modules/demux/ogg.c
@@ -1362,6 +1362,7 @@ static void Ogg_DecodePacket( demux_t *p_demux,
         else if( xiph_AppendHeaders( &p_stream->i_headers, &p_stream->p_headers,
                                      p_oggpacket->bytes, p_oggpacket->packet ) )
         {
+            free(p_stream->p_headers);
             p_stream->i_headers = 0;
             p_stream->p_headers = NULL;
         }
-- 
2.52.0


From 20f35cc4f2414ca790bad42946fc065d5e1757b1 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Wed, 12 Nov 2025 10:50:03 -0500
Subject: [PATCH 2/5] codec: theora: fix leak on xiph_AppendHeaders error

(cherry picked from commit e18f719aca1e9aabb3f97457a3a0ca6e7f64b9c7)
---
 modules/codec/theora.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/codec/theora.c b/modules/codec/theora.c
index 91fceff374..b680ed42bc 100644
--- a/modules/codec/theora.c
+++ b/modules/codec/theora.c
@@ -800,6 +800,7 @@ static int OpenEncoder( vlc_object_t *p_this )
         if( xiph_AppendHeaders( &p_enc->fmt_out.i_extra, &p_enc->fmt_out.p_extra,
                                 header.bytes, header.packet ) )
         {
+            free(p_enc->fmt_out.p_extra);
             p_enc->fmt_out.i_extra = 0;
             p_enc->fmt_out.p_extra = NULL;
         }
-- 
2.52.0


From 02102a889082ffb3b5dff4710a7c3475923b79e1 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Wed, 12 Nov 2025 10:53:11 -0500
Subject: [PATCH 3/5] codec: vorbis: fix leak on xiph_AppendHeaders error

(cherry picked from commit 1efee9cd4463bc62e359cd5f43e1a560d4f3c292)
---
 modules/codec/vorbis.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/codec/vorbis.c b/modules/codec/vorbis.c
index 8cb1a2c2e4..818e9dae1c 100644
--- a/modules/codec/vorbis.c
+++ b/modules/codec/vorbis.c
@@ -862,6 +862,7 @@ static int OpenEncoder( vlc_object_t *p_this )
         if( xiph_AppendHeaders( &p_enc->fmt_out.i_extra, &p_enc->fmt_out.p_extra,
                                 header[i].bytes, header[i].packet ) )
         {
+            free(p_enc->fmt_out.p_extra);
             p_enc->fmt_out.i_extra = 0;
             p_enc->fmt_out.p_extra = NULL;
         }
-- 
2.52.0


From 11c94a529f084c7e1ba75f7ddefc74a14a74eae6 Mon Sep 17 00:00:00 2001
From: Johannes Kauffmann <johanneskauffmann@hotmail.com>
Date: Sat, 4 Oct 2025 21:42:56 +0200
Subject: [PATCH 4/5] canvas: fix fmt leak

(cherry picked from commit cc140332997025b835172c14adb020b8b7e42bf1)
edited:
- the filter_chain_Reset() signature is different on 3.0.x and caused
  a conflict
---
 modules/video_filter/canvas.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/video_filter/canvas.c b/modules/video_filter/canvas.c
index 032fd30479..52826449f6 100644
--- a/modules/video_filter/canvas.c
+++ b/modules/video_filter/canvas.c
@@ -329,6 +329,7 @@ static int Activate( vlc_object_t *p_this )
     fmt.video.i_height = p_filter->fmt_in.video.i_height * fmt.video.i_visible_height / p_filter->fmt_in.video.i_visible_height;
 
     filter_chain_Reset( p_sys->p_chain, &p_filter->fmt_in, &fmt );
+    es_format_Clean( &fmt );
     /* Append scaling module */
     if ( filter_chain_AppendConverter( p_sys->p_chain, NULL, NULL ) )
     {
-- 
2.52.0


From 00e55ee174d822e33804202449913d396ce104fa Mon Sep 17 00:00:00 2001
From: Joe Breuer <git@jmbreuer.net>
Date: Fri, 14 Nov 2025 09:46:55 +0100
Subject: [PATCH 5/5] dbus: fix unpause from KDE MPRIS

(cherry picked from commit c5513cf900aaf59b048c3404fd3662f9a301259f)
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
---
 modules/control/dbus/dbus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/control/dbus/dbus.c b/modules/control/dbus/dbus.c
index 4ec0f677d5..0faf07dd4a 100644
--- a/modules/control/dbus/dbus.c
+++ b/modules/control/dbus/dbus.c
@@ -659,6 +659,10 @@ static void ProcessEvents( intf_thread_t *p_intf,
             break;
         case SIGNAL_STATE:
             vlc_dictionary_insert( &player_properties, "PlaybackStatus", NULL );
+            if ( p_intf->p_sys->b_can_play )
+            {
+                vlc_dictionary_insert( &player_properties, "CanPlay", NULL );
+            }
             break;
         case SIGNAL_RATE:
             vlc_dictionary_insert( &player_properties, "Rate", NULL );
-- 
2.52.0

