Skip to content

Ffmpeg7#3

Open
sasilevi wants to merge 10000 commits into
masterfrom
ffmpeg7
Open

Ffmpeg7#3
sasilevi wants to merge 10000 commits into
masterfrom
ffmpeg7

Conversation

@sasilevi

@sasilevi sasilevi commented Jan 9, 2025

Copy link
Copy Markdown

No description provided.

jamrial and others added 30 commits January 21, 2026 00:02
…n layout

Exporting unknown layouts as unspec type is pointless in a format that expects
the user to remix the channels in location specific ways.
This simplifies assumptions and reduces the chances of heap buffer overflows.

Fixes: heap-buffer-overflow
Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6363647720095744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
Files with multiple consecutive ID3v2 tags were getting low probe
scores (1) because av_probe_input_format3 only skipped the first tag,
leaving subsequent tags to be treated as non-audio data.

Fix by looping to skip all consecutive ID3v2 tags before probing.

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
The ICE handshake actually finished after recieve
and handle binding request from peer when the peer
is not ice lite mode.

Log the ice status when it really done.

Signed-off-by: Jack Lau <jacklau1222@qq.com>
Signed-off-by: Jack Lau <jacklau1222@qq.com>
Correct the log level to AV_LOG_ERROR when dtls fails

Signed-off-by: Jack Lau <jacklau1222@qq.com>
DTLS handshake already force set BLOCK mode.

Signed-off-by: Jack Lau <jacklau1222@qq.com>
In early code, the BUNDLE always has two stream
id "a=group:BUNDLE 0 1" even though there's only
one stream.

This patch aims to dynamically set BUNDLE value.

Signed-off-by: Jack Lau <jacklau1222@qq.com>
The spec says:
   pMiColStarts is a pointer to an array of TileCols number
   of unsigned integers that corresponds to MiColStarts
   defined in section 6.8.14 of the [AV1 Specification]

And the unit of MiColStarts is MI(mode info).

So is pMiRowStarts.
Can this cursed extension ever bloody ever even work!?!
It allows controlling the background of a transparent video. Default is a
checker board pattern.

Signed-off-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Marton Balint <cus@passwd.hu>
… in histogram and vectorscrope

Signed-off-by: Marton Balint <cus@passwd.hu>
This reverts commit fcc33ad.

It breaks playback of files with changing aspect ratio in ffplay, such as [1],
because the filter chain is initialized with the initial aspect ratio, so any
change is overwritten.

[1] https://samples.ffmpeg.org/archive/container/mpegts/mpegts+mpeg2video+mp2++aspect.ts
if shaderc is not installed and --glslc is not set
Signed-off-by: James Almer <jamrial@gmail.com>
…ecision initialization

Move motion estimation precision check from standalone
`d3d12va_encode_init_motion_estimation_precision()` function into each
codec's init_sequence_params() to reuse existing feature support
queries.

 - fixes AV1 using wrong support structure (SUPPORT instead of SUPPORT1)
 - eliminates duplicate setup code
 - removes redundant CheckFeatureSupport API call
 - no intended functional changes other than bug fix
This issue hid under the radar since the codebooks between coupling
modes very often result in identical bit counts regardless of the encoded
data, leading to no frame-level bitstream desyncs except in rare cases.

AAC Mps212 data is parsed immediately after the SBR data, where a loss
of sync in SBR will result in Mps212 being wildly different.
… directly

Fixes: multiple integer overflows
Fixes: out of array access

Regression since: a408d03

The PoC modifies filter parameters generally inaccessable to an attacker

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: multiple integer overflows
Fixes: out of array access

The PoC modifies filter parameters generally inaccessable to an attacker

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Christopher Degawa <ccom@randomderp.com>
Signed-off-by: James Almer <jamrial@gmail.com>
…ameters

Replace generic format functions with type-safe variants to prevent undefined
behavior with -fshort-enums compiler flag.

- 44/20 filters: ff_set_common_formats_from_list2 -> ff_set_*_formats_from_list2 (sample/pixel)
- 16/41 filters: ff_make_format_list → ff_make_*_format_list (sample/pixel)

Signed-off-by: niyinghao <niyinghao@xiaomi.com>
Add chroma_location option so that, in the subsampled-to-subsampled case, the destination's chroma siting can be changed from the source's without having to use other filters. Useful, for example, when converting BT.2020 to BT.709, where the former customarily uses "top left" and the latter "left."

Update documentation.

Closes: #21185
Fixes ticket #9468.

Signed-off-by: Carl Eugen Hoyos <ceffmpeg@gmail.com
In config_output() for direction=DU/RL, the position
is initialized to s->sono_size, which equals h or w
when bar=0. That position is later used as an
in-bounds pixel coordinate without clamping in draw(),
causing writes past the end of the output planes.

Repro:
ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \
  -filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \
  -map "[v]" -frames:v 1 -f null -

AddressSanitizer: heap-buffer-overflow ... WRITE of size 1

Initialize and wrap the DU/RL position to sono_size - 1
(or 0 when empty), preventing out-of-bounds row/column
writes when bar=0 while preserving existing slide behavior.
Previously x265 encoder used its default log level regardless of
FFmpeg's log level setting. Note the log level can be overwritten
by x265-params.

Fix #21462

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
Implement NEON optimization for HEVC dequant at 8-bit depth.

The NEON implementation uses srshr (Signed Rounding Shift Right) which
does both the add with offset and right shift in a single instruction.

Optimization details:
- 4x4 (16 coeffs): Single load-process-store sequence
- 8x8 (64 coeffs): Fully unrolled, no loop overhead
- 16x16 (256 coeffs): Pipelined load/compute/store to hide memory latency
- 32x32 (1024 coeffs): Pipelined with all available NEON registers

Performance benchmark on Apple M4:
./tests/checkasm/checkasm --test=hevc_dequant --bench
hevc_dequant_4x4_8_c:                                   11.3 ( 1.00x)
hevc_dequant_4x4_8_neon:                                 6.3 ( 1.78x)

hevc_dequant_8x8_8_c:                                   33.9 ( 1.00x)
hevc_dequant_8x8_8_neon:                                 6.6 ( 5.11x)

hevc_dequant_16x16_8_c:                                153.8 ( 1.00x)
hevc_dequant_16x16_8_neon:                               9.0 (17.02x)

hevc_dequant_32x32_8_c:                                 78.1 ( 1.00x)
hevc_dequant_32x32_8_neon:                              31.9 ( 2.45x)

Note on Performance Anomaly:
The observation that hevc_dequant_32x32_8_c is faster than 16x16 (78.1 vs 153.8)
is due to Clang auto-vectorizing only for sizes >= 32x32.
Compiler: Apple clang version 17.0.0 (clang-1700.6.3.2)

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
mkver and others added 30 commits February 13, 2026 09:21
Said function has presumably been added in order to check
that we have successfully reset the floating point state
after having violated the ABI/calling convention by not
issuing emms in our MMX DSP routines.

Yet the ability to check this should not have been made public,
because there is no external need for it and because the
function does not even always achieve what its documentation
claims to do: It only works when inline assembly is available.
It should have been implemented in emms.h like emms_c()
(which is where a replacement should be put if there is still
ABI-violating MMX code when av_assert0_fpu() is removed).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Forgotten in 2b94f23.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
There are no MMX functions left in all of libswresample, so checking
for it makes no sense. Notice that configure currently disables x86asm
if mmx is disabled, so the check is also redundant.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Forgotten in 5e332fe.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
The MMX code has been removed in 5ef613b
and MMX was not used for most cpus even before then.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This emms_c() has been superseded by the one added
a few lines above in 2c1d38d.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
ff_rate_control_init/uninit() are only called during
codec init or close and no DSP calls happen in these,
so there is no need to reset the floating point state.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Namely to one of the three callsites in snowenc.c.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Priming samples don't depend on the contents of the first frame passed to the
encoder but rather on encoder configuration, so use dummy vorbis_dsp_state and
vorbis_block with the main encoder vorbis_info to generate a packet we can then
parse to derive the initial padding.

Muxers will now be aware of the initial padding before receiving packets, which
will allow them to write proper container headers during init without any extra
considerations like having to do a second pass or rewrite during write_trailer.

Signed-off-by: James Almer <jamrial@gmail.com>
Based on code from libopus encoder wrapper.

Signed-off-by: James Almer <jamrial@gmail.com>
Initial checkin of OCIO filter.

Initial checkin of OCIO filter.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Change for the right C++ library, should work on linux too.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Adding inverse when using display/view.

Removed comments.

Removed code that was setting the CICP values. Hopefully this can be done through OCIO at some point.

Config cleanup - need a modified require_cpp to handle namespacing.

Switch to using require_cpp so that namespace can be used.

Adding documentation.

Sadly a bit of linting went in here, but more importantly added a threads option to split the image into horizontal tiles, since OCIO was running rather slow.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Adding context parameters.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Add the OCIO config parameter.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Make the min threads 1 for now, reserve 0 for later if we can automatically pick something.
Also added a few comments.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

This is using ffmpeg-slicing.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Adding OCIO filetransform.

Making sure everything is using av_log rather than std::cerr.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Updating the tests so they would work without additional files.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Adding the file-transform documentation.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Adding copyright/license info.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Removing tests, since this is optional code.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Code cleanup.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Typo.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

I went the wrong way, av_log is expecting \n

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Fix indenting to 4 spaces.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Fixing lint issues and a spelling mistake.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Code formatting cleanup to match conventions.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>

Whitespace removal.

Signed-off-by: Sam.Richards@taurich.org <Sam.Richards@taurich.org>
This patch allows to use pkgconfig cflags
for vulkan in check_cpp_condition as the vulkan
sdk might be installed in different place than
system wide.

See https://vulkan.lunarg.com/doc/sdk/latest/linux/getting_started.html
Also move some definitions around.

Signed-off-by: Valerii Zapodovnikov <val.zapod.vz@gmail.com>
Fixes: Timeout
Fixes: 471568865/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4864048211755008
Fixes: 471951381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_DEC_fuzzer-5069855998148608
Fixes: 471472005/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_DEC_fuzzer-4660042365468672
Fixes: 471591900/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5083936243122176
Fixes: 471593729/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-5401314998943744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
…ehavior

Fixes: passing zero to __builtin_clz(), which is not a valid argument
Fixes: 471569982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_RAW_DEC_fuzzer-5832576221904896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
…el 2

In this case an av_assert2 in lavu/softfloat.h pulls in
a dependency on av_log(), which is not available at all,
because the tablegen tools are created for and run on
the host, not the target. This leads to linking failures.

Fix this by undefining ASSERT_LEVEL before the inclusion
of avassert.h.

Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Should detect breakages like the one caused by commit
d8ffec5
(fixed in 1d47ae6).

Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Fixes: Assertion buf_size >= 0 failed
Fixes: 471553942/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5982849812725760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6718455383654400
Fixes: 471611870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer-6645447302381568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: Timeout
Fixes: 479872424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BMP_DEC_fuzzer-5311478919135232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
All callers in FFmpeg check this already, but it is a public
function that can plausibly be given more channels.
In which case out of array writes would occur

This is likely a regression from when channel layouts where extended
to support more than 64 channels

Found-by: 이동준 <ldj6192@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This way we can error out earlier

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 471591904/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5141341165387776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
AlphaMode should indicate whether the BlockAdditional Element with BlockAddID
of "1" contains Alpha data, as defined by to the Codec Mapping for the `CodecID`.

Only VP8 and VP9 Codec Mappings define this, so writing it for all codecs with
a pixel format of YUVA420P, or for codecs other than VP8/VP9 (if the alpha_mode
metadata entry was set) was wrong.

Signed-off-by: Marton Balint <cus@passwd.hu>
…formats with alpha

Let's check the pixel format descriptor flags instead of hardcoding a specific
pixel format.

Signed-off-by: Marton Balint <cus@passwd.hu>
…YUV420 with alpha

Signed-off-by: Marton Balint <cus@passwd.hu>
…ther than YUV 4:2:0.

I could not find any documentation which disallows the use of transparency for
pixel formats other than YUV 4:2:0, so this patch adds support for transparency
using 4:2:2, 4:4:4, RGB, and their high bit depth variants.

It is not quite clear if the alpha channel should be encoded using the
same pixel format as the normal channels, or it should be always YUV 4:2:0. I
sticked to 4:2:0.

Unfortunately the browsers I tested (chrome, firefox) only support 4:2:0
properly, so let's require an experimental flag to generate files with the new,
more exotic pixel formats.

Signed-off-by: Marton Balint <cus@passwd.hu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.