fix: resolve 14 critical and high-severity issues across C JNI layer, Android, Flutter, CI, and React Native by Copilot · Pull Request #1 · priyanshu-simformsolutions/ffmpeg-kit

Copilot · 2026-04-30T07:42:28Z

Description

Fixes a collection of crash-risk, memory-leak, portability, and compatibility issues spanning the JNI C layer, Android Java, Flutter Dart, Gradle build files, GitHub Actions CI, and React Native dev tooling. Additional hardening was applied to JNI string handling based on review feedback, and accidentally committed Gradle build artifacts were removed.

C / JNI (`android/ffmpeg-kit-android-lib/src/main/cpp/ffmpegkit.c`)

Memory leak: registerNewNativeFFmpegPipe called GetStringUTFChars but returned without ReleaseStringUTFChars, leaking a pinned string on every pipe creation. Now stores the pointer, calls mkfifo, releases the string, then returns. Also guards against GetStringUTFChars returning NULL (OOM/pending exception) — returns -1 early in that case and skips mkfifo and ReleaseStringUTFChars.
UB / null-ptr crash: nativeFFmpegExecute left argv[i+1] uninitialized when GetObjectArrayElement returned NULL; the cleanup loop then called ReleaseStringUTFChars(env, NULL, <uninit>). Fixed by initializing argv[i+1] = NULL and guarding the release with both tempArray[i] != NULL and argv[i + 1] != NULL (the latter protecting against GetStringUTFChars failure setting argv[i+1] to NULL).
Null env dereference: saf_open/saf_close ignored the return value of GetEnv() and dereferenced env unconditionally. Now checks for failure and returns 0 with a log.
Non-portable mutex type: PTHREAD_MUTEX_RECURSIVE_NP (Linux-only) replaced with POSIX PTHREAD_MUTEX_RECURSIVE.

Android Java

Cursor.getColumnIndex() crash: Result was passed directly to getString() without checking for -1 (column not found → IllegalArgumentException). Now stored and guarded.
Dead code: Pre-API-21 branch in NativeLoader.getDeviceDebugInformation() using deprecated Build.CPU_ABI/CPU_ABI2 is unreachable with minSdk=24. Removed along with the @SuppressWarnings annotation.

Android Gradle

SDK level: compileSdk/targetSdk bumped 33→34 in all three build.gradle files (Play Store has required API 34 since August 2024).
Deprecated DSL: lintOptions {} renamed to lint {} (AGP 7+ deprecation) in Flutter and React Native Android build files.
Jetifier: Removed android.enableJetifier=true from gradle.properties; all dependencies are AndroidX-native.

Flutter

Dart 3 compatibility: ffmpeg_kit_flutter_platform_interface had sdk: ">=2.12.0 <3.0.0", blocking all Dart 3 projects. Updated to <4.0.0.
Production logging: Replaced all print() calls in ffmpeg_kit_config.dart and ffmpeg_kit_flutter_initializer.dart with debugPrint() (debug-only, Flutter-aware). Added flutter/foundation.dart import; converted StackTrace arguments to .toString() since debugPrint requires String.

CI (GitHub Actions)

actions/setup-java@v3 → @v4
distribution: 'adopt' → 'temurin' (AdoptOpenJDK is EOL)
runs-on: macos-12 → macos-13 across all Apple and Android workflow files

React Native

Dev deps updated: react-native ^0.63.4→**^0.73.0**, react/@types/react ^16→**^18.2.0**.
Removed deprecated @types/react-native (types bundled in react-native since v0.65).

Repository hygiene

Committed build artifacts removed: tools/android/.gradle/, tools/android/gradlew, tools/android/gradle/, and flutter/flutter/android/gradlew were accidentally committed in a previous revision. These have been removed from the repository.
.gitignore updated: Added .gradle/ rule to the root .gitignore to prevent Gradle cache directories from being committed in future.

Type of Change

Bug fix

Checks

Changes support all platforms (Android, iOS, Linux, macOS, tvOS)
Breaks existing functionality
Implementation is completed, not half-done
Is there another PR already created for this feature/bug fix

Tests

C layer: Changes are defensive null/error checks and resource-release correctness; verifiable by code inspection. The registerNewNativeFFmpegPipe leak is confirmed fixed by the paired ReleaseStringUTFChars call after mkfifo. NULL return from GetStringUTFChars is now handled with an early -1 return. The nativeFFmpegExecute cleanup is guarded by both tempArray[i] != NULL and argv[i + 1] != NULL to cover GetStringUTFChars failures.

Android Java: getSafParameter() behaviour is unchanged for valid cursors; the guard only prevents a crash when getColumnIndex() returns -1.

Flutter: debugPrint is a drop-in replacement for print in debug builds and a no-op in release builds — no behavioural change for callers.

Dart 3 / platform interface: Projects using Dart ≥3.0 that previously failed pub resolution will now resolve correctly.

Gradle / CI: Build and workflow changes are configuration-only; no logic altered.

Repository hygiene: Verified that removed files no longer appear in git status and that the .gradle/ gitignore rule prevents them from being re-staged.

Agent-Logs-Url: https://github.com/priyanshu-simformsolutions/ffmpeg-kit/sessions/05bd9acc-e49f-4304-8654-ff322aadcacf Co-authored-by: priyanshu-simformsolutions <155940495+priyanshu-simformsolutions@users.noreply.github.com>

…ializer Agent-Logs-Url: https://github.com/priyanshu-simformsolutions/ffmpeg-kit/sessions/05bd9acc-e49f-4304-8654-ff322aadcacf Co-authored-by: priyanshu-simformsolutions <155940495+priyanshu-simformsolutions@users.noreply.github.com>

Copilot

Pull request overview

This PR addresses a broad set of reliability and compatibility fixes across the Android JNI/C layer, Android/Flutter/React Native build tooling, Flutter logging behavior, and GitHub Actions CI configuration.

Changes:

Fix JNI/C-layer safety issues (mutex portability, JNI env retrieval checks, string lifetime management) and Android SAF cursor column handling.
Update Android/Flutter/React Native Gradle configs (compile/target SDK 34, lint DSL modernization, remove Jetifier).
Modernize tooling: Flutter Dart SDK constraint for Dart 3+, replace print() with debugPrint(), CI Java setup updates, and React Native dev dependency bumps.

Reviewed changes

Copilot reviewed 21 out of 31 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tools/android/gradlew	Adds Gradle POSIX wrapper script under tools/android.
tools/android/gradle/wrapper/gradle-wrapper.properties	Adds Gradle wrapper configuration for tools/android.
tools/android/gradle/wrapper/gradle-wrapper.jar	Adds Gradle wrapper JAR for tools/android.
tools/android/.gradle/vcs-1/gc.properties	Adds Gradle cache artifact (should typically be ignored).
tools/android/.gradle/buildOutputCleanup/cache.properties	Adds Gradle cache artifact (should typically be ignored).
tools/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock	Adds Gradle cache lock artifact (should typically be ignored).
tools/android/.gradle/9.4.1/gc.properties	Adds Gradle cache artifact (should typically be ignored).
tools/android/.gradle/9.4.1/fileHashes/fileHashes.lock	Adds Gradle cache lock artifact (should typically be ignored).
tools/android/.gradle/9.4.1/fileHashes/fileHashes.bin	Adds Gradle cache binary artifact (should typically be ignored).
tools/android/.gradle/9.4.1/fileChanges/last-build.bin	Adds Gradle cache binary artifact (should typically be ignored).
tools/android/.gradle/9.4.1/checksums/sha1-checksums.bin	Adds Gradle cache binary artifact (should typically be ignored).
tools/android/.gradle/9.4.1/checksums/md5-checksums.bin	Adds Gradle cache binary artifact (should typically be ignored).
tools/android/.gradle/9.4.1/checksums/checksums.lock	Adds Gradle cache lock artifact (should typically be ignored).
react-native/package.json	Updates React/React Native dev dependencies and removes deprecated @types/react-native.
react-native/android/build.gradle	Bumps compile/target SDK to 34 and migrates `lintOptions` → `lint`.
flutter/flutter_platform_interface/pubspec.yaml	Expands Dart SDK upper bound to allow Dart 3+ (and up to <4.0.0).
flutter/flutter/lib/src/ffmpeg_kit_flutter_initializer.dart	Replaces `print()` with `debugPrint()` and updates stack trace logging.
flutter/flutter/lib/ffmpeg_kit_config.dart	Replaces `print()` with `debugPrint()` for plugin error logging.
flutter/flutter/android/gradlew	Adds Gradle POSIX wrapper script under Flutter Android.
flutter/flutter/android/build.gradle	Bumps compile/target SDK to 34 and migrates `lintOptions` → `lint`.
android/gradle.properties	Removes `android.enableJetifier=true`.
android/ffmpeg-kit-android-lib/src/main/java/com/arthenica/ffmpegkit/NativeLoader.java	Removes unreachable pre-API-21 ABI branch in debug info.
android/ffmpeg-kit-android-lib/src/main/java/com/arthenica/ffmpegkit/FFmpegKitConfig.java	Guards `Cursor.getColumnIndex()` result to avoid `IllegalArgumentException`.
android/ffmpeg-kit-android-lib/src/main/cpp/ffmpegkit.c	Fixes portability and JNI safety issues (mutex type, env checks, string release).
android/ffmpeg-kit-android-lib/build.gradle	Bumps compile/target SDK to 34.
.github/workflows/tvos-build-scripts.yml	Updates macOS runner version.
.github/workflows/periodic-builds-apple.yml	Updates macOS runner version across Apple periodic builds.
.github/workflows/periodic-builds-android.yml	Updates setup-java action and distribution (adopt → temurin).
.github/workflows/macos-build-scripts.yml	Updates macOS runner version.
.github/workflows/ios-build-scripts.yml	Updates macOS runner version.
.github/workflows/android-build-scripts.yml	Updates setup-java action/distribution and macOS runner version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-30T07:51:40Z

+#Thu Apr 30 07:36:06 UTC 2026
+gradle.version=9.4.1


The tools/android/.gradle/ directory contains local Gradle cache/lock artifacts (timestamps, locks, binary caches) and should not be committed. Please remove these files from the repo and add an ignore rule for tools/android/.gradle/ (or .gradle/) so they don’t get reintroduced.

Suggested change

#Thu Apr 30 07:36:06 UTC 2026

gradle.version=9.4.1

Copilot · 2026-04-30T07:51:40Z

    if (tempArray) {
        for (int i = 0; i < (argumentCount - 1); i++) {
-            (*env)->ReleaseStringUTFChars(env, tempArray[i], argv[i + 1]);
+            if (tempArray[i] != NULL) {


argv[i + 1] can still end up NULL if GetStringUTFChars fails (e.g., OOM/exception). In that case the cleanup path will call ReleaseStringUTFChars with a NULL pointer. Guard the release with argv[i + 1] != NULL (and consider checking/clearing a pending JNI exception after GetStringUTFChars).

Suggested change

if (tempArray[i] != NULL) {

if ((tempArray[i] != NULL) && (argv[i + 1] != NULL)) {

Copilot · 2026-04-30T07:51:40Z

    const char *ffmpegPipePathString = (*env)->GetStringUTFChars(env, ffmpegPipePath, 0);

-    return mkfifo(ffmpegPipePathString, S_IRWXU | S_IRWXG | S_IROTH);
+    int rc = mkfifo(ffmpegPipePathString, S_IRWXU | S_IRWXG | S_IROTH);
+
+    (*env)->ReleaseStringUTFChars(env, ffmpegPipePath, ffmpegPipePathString);
+


GetStringUTFChars may return NULL on failure; mkfifo would then dereference a NULL path. Add a NULL/exception check after GetStringUTFChars and return an error code (ensuring you only call ReleaseStringUTFChars when a non-NULL pointer was obtained).

Copilot · 2026-04-30T07:51:41Z

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip


Consider pinning the Gradle distribution with distributionSha256Sum in the wrapper properties. Without it, builds that download the distribution rely solely on TLS/URL validation and are more exposed to supply-chain tampering.

Suggested change

distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip

distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip

distributionSha256Sum=<OFFICIAL_SHA256_FOR_gradle-9.4.1-bin.zip>

priyanshu-simformsolutions · 2026-05-18T07:21:06Z

@copilot fix above comments and use copilot memory

…leaseStringUTFChars nulls Agent-Logs-Url: https://github.com/priyanshu-simformsolutions/ffmpeg-kit/sessions/2ff60062-4d10-437d-af9d-50188085ec66 Co-authored-by: priyanshu-simformsolutions <155940495+priyanshu-simformsolutions@users.noreply.github.com>

Copilot · 2026-05-18T07:25:14Z

@copilot fix above comments and use copilot memory

All four PR review items addressed in commit 6f6fa70:

Gradle cache artifacts removed — tools/android/.gradle/, tools/android/gradlew, tools/android/gradle/, and flutter/flutter/android/gradlew removed from git tracking and deleted from disk. Added .gradle/ to the root .gitignore to prevent re-introduction.
registerNewNativeFFmpegPipe NULL guard — GetStringUTFChars can return NULL on OOM/exception. Now checks for NULL before calling mkfifo and returns -1 early (only calling ReleaseStringUTFChars when a valid pointer was obtained).
nativeFFmpegExecute cleanup double guard — The ReleaseStringUTFChars call is now guarded with both tempArray[i] != NULL and argv[i + 1] != NULL, protecting against GetStringUTFChars failures that leave argv[i+1] as NULL even when tempArray[i] is non-null.
Gradle SHA256 pinning — The tools/android/gradle/wrapper/gradle-wrapper.properties file is now removed entirely (it was an accidentally committed artifact), so the supply-chain concern is resolved by removal rather than pinning.

Copilot AI and others added 2 commits April 30, 2026 07:33

Copilot AI assigned Copilot and priyanshu-simformsolutions Apr 30, 2026

Copilot created this pull request from a session on behalf of priyanshu-simformsolutions April 30, 2026 07:42 View session

priyanshu-simformsolutions marked this pull request as ready for review April 30, 2026 07:48

Copilot AI review requested due to automatic review settings April 30, 2026 07:48

Copilot started reviewing on behalf of priyanshu-simformsolutions April 30, 2026 07:48 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

Copilot started work on behalf of priyanshu-simformsolutions May 18, 2026 07:21 View session

Copilot AI requested a review from priyanshu-simformsolutions May 18, 2026 07:26

Copilot finished work on behalf of priyanshu-simformsolutions May 18, 2026 07:26

Navigation Menu

fix: resolve 14 critical and high-severity issues across C JNI layer, Android, Flutter, CI, and React Native - #1

fix: resolve 14 critical and high-severity issues across C JNI layer, Android, Flutter, CI, and React Native#1
priyanshu-simformsolutions with Copilot wants to merge 3 commits into
mainfrom
copilot/explore-codebase-and-plan-fixes

Copilot AI commented Apr 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

priyanshu-simformsolutions commented May 18, 2026

Uh oh!

Copilot AI commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	if (tempArray[i] != NULL) {
	if ((tempArray[i] != NULL) && (argv[i + 1] != NULL)) {

	distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
	distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
	distributionSha256Sum=<OFFICIAL_SHA256_FOR_gradle-9.4.1-bin.zip>

Conversation

Copilot AI commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

C / JNI (android/ffmpeg-kit-android-lib/src/main/cpp/ffmpegkit.c)

Android Java

Android Gradle

Flutter

CI (GitHub Actions)

React Native

Repository hygiene

Type of Change

Checks

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

priyanshu-simformsolutions commented May 18, 2026

Uh oh!

Copilot AI commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 30, 2026 •

edited

Loading

C / JNI (`android/ffmpeg-kit-android-lib/src/main/cpp/ffmpegkit.c`)