From: Sebastian Ramacher via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>
To: ffmpeg-devel@ffmpeg.org
Cc: Sebastian Ramacher <code@ffmpeg.org>
Subject: [FFmpeg-devel] [PATCH] configure: unbreak glslang build (PR #21054)
Date: Sun, 30 Nov 2025 09:57:13 -0000
Message-ID: <176449663490.39.9923581798435465624@2cb04c0e5124> (raw)
PR #21054 opened by Sebastian Ramacher (sebastinas)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21054
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21054.patch
Same as #20902 but for 7.1
From f459c56b0fe3b35f1e21951791df0f111d1dbbcf Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Tue, 24 Sep 2024 18:21:05 +0200
Subject: [PATCH 001/434] tests/fate/hevc: use bitexact scaling flags for
fate-hevc-mv-switch
Makes the results consistent across platforms.
(cherry picked from commit 9dc0edd4546bebfa451233b12548a8caa4a399ab)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
tests/fate/hevc.mak | 2 +-
tests/ref/fate/hevc-mv-switch | 296 +++++++++++++++++-----------------
2 files changed, 149 insertions(+), 149 deletions(-)
diff --git a/tests/fate/hevc.mak b/tests/fate/hevc.mak
index 6d8865ea66..7f7ec43902 100644
--- a/tests/fate/hevc.mak
+++ b/tests/fate/hevc.mak
@@ -283,7 +283,7 @@ $(TARGET_SAMPLES)/hevc-conformance/LS_A_Orange_2.bit|$\
$(TARGET_SAMPLES)/hevc/mv_nuh_layer_id.bit|$\
$(TARGET_SAMPLES)/hevc-conformance/NoOutPrior_B_Qualcomm_1.bit|$\
$(TARGET_SAMPLES)/hevc-conformance/MVHEVCS_A.bit
-fate-hevc-mv-switch: CMD = framecrc -i "concat:$(INPUT)" -fps_mode passthrough -map 0:vidx:0 -map 0:vidx:1
+fate-hevc-mv-switch: CMD = framecrc -i "concat:$(INPUT)" -fps_mode passthrough -map 0:vidx:0 -map 0:vidx:1 -sws_flags +accurate_rnd+bitexact
FATE_HEVC-$(call FRAMECRC, HEVC, HEVC, CONCAT_PROTOCOL) += fate-hevc-mv-switch
# multiview stream, select view by position
diff --git a/tests/ref/fate/hevc-mv-switch b/tests/ref/fate/hevc-mv-switch
index 0fc3630637..40d7f29ad2 100644
--- a/tests/ref/fate/hevc-mv-switch
+++ b/tests/ref/fate/hevc-mv-switch
@@ -17,156 +17,156 @@
0, 6, 6, 1, 149760, 0x2eacf616
0, 7, 7, 1, 149760, 0x06322ce2
0, 8, 8, 1, 149760, 0xf14aa104
-0, 9, 9, 1, 149760, 0xc948dcba
+0, 9, 9, 1, 149760, 0x9e1cf00a
1, 10, 10, 1, 24576, 0xf8f638da
-0, 11, 11, 1, 149760, 0x674e34b1
+0, 11, 11, 1, 149760, 0x6d584d2c
1, 12, 12, 1, 24576, 0xd22675a4
-0, 13, 13, 1, 149760, 0x41d3acd6
+0, 13, 13, 1, 149760, 0x8b21be89
1, 14, 14, 1, 24576, 0x60da42e6
-0, 15, 15, 1, 149760, 0x55a5b835
+0, 15, 15, 1, 149760, 0x3946d0ec
1, 16, 16, 1, 24576, 0xe0577f6e
-0, 17, 17, 1, 149760, 0xc6958049
+0, 17, 17, 1, 149760, 0x70859214
1, 18, 18, 1, 24576, 0x8d9944bd
-0, 19, 19, 1, 149760, 0x94b37050
-0, 20, 20, 1, 149760, 0xed72a560
-0, 21, 21, 1, 149760, 0xd0ccac61
-0, 22, 22, 1, 149760, 0x6cc2d7fa
-0, 23, 23, 1, 149760, 0x3a02b5ba
-0, 24, 24, 1, 149760, 0xce7ef09c
-0, 25, 25, 1, 149760, 0xa518fc05
-0, 26, 26, 1, 149760, 0x01d238fe
-0, 27, 27, 1, 149760, 0x5f5012fa
-0, 28, 28, 1, 149760, 0x5b8e7405
-0, 29, 29, 1, 149760, 0xcc2e5b33
-0, 30, 30, 1, 149760, 0x590a6890
-0, 31, 31, 1, 149760, 0x9c7b189f
-0, 32, 32, 1, 149760, 0xd0752ef4
-0, 33, 33, 1, 149760, 0x367513ce
-0, 34, 34, 1, 149760, 0xb64c209d
-0, 35, 35, 1, 149760, 0x6e50994c
-0, 36, 36, 1, 149760, 0x8276cce4
-0, 37, 37, 1, 149760, 0xb292ac8f
-0, 38, 38, 1, 149760, 0x57de9d2c
-0, 39, 39, 1, 149760, 0xe8533f38
-0, 40, 40, 1, 149760, 0xde9b536d
-0, 41, 41, 1, 149760, 0x83173b1d
-0, 42, 42, 1, 149760, 0x853a83a4
-0, 43, 43, 1, 149760, 0x481af1bf
-0, 44, 44, 1, 149760, 0x27221abb
-0, 45, 45, 1, 149760, 0x094eac00
-0, 46, 46, 1, 149760, 0x3f3a27c8
-0, 47, 47, 1, 149760, 0x8f19b2af
-0, 48, 48, 1, 149760, 0x93e7e591
-0, 49, 49, 1, 149760, 0x0c531ab8
-0, 50, 50, 1, 149760, 0x3456ef8a
-0, 51, 51, 1, 149760, 0xfee2ec1e
-0, 52, 52, 1, 149760, 0x76b4b750
-0, 53, 53, 1, 149760, 0xa48bb670
-0, 54, 54, 1, 149760, 0x3dee7cac
-0, 55, 55, 1, 149760, 0x2b20561d
-0, 56, 56, 1, 149760, 0xd3c5bf9f
-0, 57, 57, 1, 149760, 0x2e87d747
-0, 58, 58, 1, 149760, 0x9952760b
-0, 59, 59, 1, 149760, 0xa3f5cbda
-0, 60, 60, 1, 149760, 0x56e3f94d
-0, 61, 61, 1, 149760, 0x902f743f
-0, 62, 62, 1, 149760, 0xeffcfd85
-0, 63, 63, 1, 149760, 0xe7fc31b2
-0, 64, 64, 1, 149760, 0x2e876286
-0, 65, 65, 1, 149760, 0x6358b0b2
-0, 66, 66, 1, 149760, 0x3e569a4d
-1, 67, 67, 1, 24576, 0xa18c481f
-0, 68, 68, 1, 149760, 0x641cbce0
-1, 69, 69, 1, 24576, 0x9ee94df2
-0, 70, 70, 1, 149760, 0x0357d35c
-1, 71, 71, 1, 24576, 0x60c55365
-0, 72, 72, 1, 149760, 0xe9b5b077
-1, 73, 73, 1, 24576, 0x8951536a
-0, 74, 74, 1, 149760, 0x3b9c605f
-1, 75, 75, 1, 24576, 0xfea04ba5
-0, 76, 76, 1, 149760, 0x16d7028b
-1, 77, 77, 1, 24576, 0x78094226
-0, 78, 78, 1, 149760, 0xf4896eff
-1, 79, 79, 1, 24576, 0xacf9314e
-0, 80, 80, 1, 149760, 0xc90de4b9
-1, 81, 81, 1, 24576, 0x6a6b1c87
-0, 82, 82, 1, 149760, 0x2ec258ad
-1, 83, 83, 1, 24576, 0x9f360661
-0, 84, 84, 1, 149760, 0x3bf720ef
-1, 85, 85, 1, 24576, 0x52e80514
-0, 86, 86, 1, 149760, 0x67eab73f
-1, 87, 87, 1, 24576, 0xe10df48c
-0, 88, 88, 1, 149760, 0x020e17ce
-1, 89, 89, 1, 24576, 0x71fbdd03
-0, 90, 90, 1, 149760, 0xcd677640
-1, 91, 91, 1, 24576, 0x1d08c3f6
-0, 92, 92, 1, 149760, 0x194cfbc1
-1, 93, 93, 1, 24576, 0x4b93b6ca
-0, 94, 94, 1, 149760, 0x740f6261
-1, 95, 95, 1, 24576, 0x0dea9c12
-0, 96, 96, 1, 149760, 0x104b3175
-1, 97, 97, 1, 24576, 0x195a92da
-0, 98, 98, 1, 149760, 0xc8fd17d1
-1, 99, 99, 1, 24576, 0x55dd870b
-0, 100, 100, 1, 149760, 0x6f4e7787
-1, 101, 101, 1, 24576, 0x7e6b905b
-0, 102, 102, 1, 149760, 0xe853418e
-1, 103, 103, 1, 24576, 0x0f3fad1d
-0, 104, 104, 1, 149760, 0x3dba3e4e
-1, 105, 105, 1, 24576, 0xe724d536
-0, 106, 106, 1, 149760, 0xba0b4c38
-1, 107, 107, 1, 24576, 0xb212fed4
-0, 108, 108, 1, 149760, 0x28f8ef1d
-1, 109, 109, 1, 24576, 0x3bb423ce
-0, 110, 110, 1, 149760, 0xb5d92e4e
-1, 111, 111, 1, 24576, 0x20f432db
-0, 112, 112, 1, 149760, 0xbaa0d0a2
-1, 113, 113, 1, 24576, 0x27412981
-0, 114, 114, 1, 149760, 0x0acde200
-1, 115, 115, 1, 24576, 0xb7f70143
-0, 116, 116, 1, 149760, 0x7388aad3
-1, 117, 117, 1, 24576, 0xf31acffb
-0, 118, 118, 1, 149760, 0xbac95723
-1, 119, 119, 1, 24576, 0x283d8c2c
-0, 120, 120, 1, 149760, 0x7633d4af
-1, 121, 121, 1, 24576, 0x9fb08184
-0, 122, 122, 1, 149760, 0x836e54fc
-1, 123, 123, 1, 24576, 0x09696ad1
-0, 124, 124, 1, 149760, 0x49096e63
-1, 125, 125, 1, 24576, 0x034e69c2
-0, 126, 126, 1, 149760, 0x98e14158
-1, 127, 127, 1, 24576, 0x1ce4882c
-0, 128, 128, 1, 149760, 0x955a43e4
-1, 129, 129, 1, 24576, 0x490fda13
-0, 130, 130, 1, 149760, 0x3a76c087
-1, 131, 131, 1, 24576, 0x4c2e1c09
-0, 132, 132, 1, 149760, 0xa221e763
-1, 133, 133, 1, 24576, 0x82dd5f8b
-0, 134, 134, 1, 149760, 0x1eb33f17
-1, 135, 135, 1, 24576, 0xcfb07d6b
-0, 136, 136, 1, 149760, 0x13ef3914
-1, 137, 137, 1, 24576, 0xef468129
-0, 138, 138, 1, 149760, 0x2521b880
-1, 139, 139, 1, 24576, 0x24c970fa
-0, 140, 140, 1, 149760, 0x78a4faf0
-1, 141, 141, 1, 24576, 0x6df14e99
-0, 142, 142, 1, 149760, 0xc5f71d65
-1, 143, 143, 1, 24576, 0x78f44854
-0, 144, 144, 1, 149760, 0x5dbc0a9f
-1, 145, 145, 1, 24576, 0x5a7269fd
-0, 146, 146, 1, 149760, 0x8ebfd7c3
-1, 147, 147, 1, 24576, 0xb1fd8924
-0, 148, 148, 1, 149760, 0xb45f0581
-1, 149, 149, 1, 24576, 0xa165b829
-0, 150, 150, 1, 149760, 0x3b84540b
-1, 151, 151, 1, 24576, 0x694cf0e5
-0, 152, 152, 1, 149760, 0xec921f35
-1, 153, 153, 1, 24576, 0x2fef157b
-0, 154, 154, 1, 149760, 0x7b23826a
-1, 155, 155, 1, 24576, 0x62ea25dd
-0, 156, 156, 1, 149760, 0x518d1f11
-1, 157, 157, 1, 24576, 0xfc02365e
-0, 158, 158, 1, 149760, 0xc5e694a4
-1, 159, 159, 1, 24576, 0x073b3ebd
-0, 160, 160, 1, 149760, 0xeb79c961
-1, 161, 161, 1, 24576, 0x5ee13be2
+0, 19, 19, 1, 149760, 0xd60e93f1
+0, 20, 20, 1, 149760, 0xb07cc873
+0, 21, 21, 1, 149760, 0x86eacff5
+0, 22, 22, 1, 149760, 0x259afb24
+0, 23, 23, 1, 149760, 0x225dd819
+0, 24, 24, 1, 149760, 0xfc47134c
+0, 25, 25, 1, 149760, 0x15da1ece
+0, 26, 26, 1, 149760, 0xb2ec5b6f
+0, 27, 27, 1, 149760, 0xa18f35c6
+0, 28, 28, 1, 149760, 0x8fa8970f
+0, 29, 29, 1, 149760, 0x25a87e60
+0, 30, 30, 1, 149760, 0x77c88c93
+0, 31, 31, 1, 149760, 0xcb673be3
+0, 32, 32, 1, 149760, 0x219f51e6
+0, 33, 33, 1, 149760, 0x59ea3783
+0, 34, 34, 1, 149760, 0x837644b5
+0, 35, 35, 1, 149760, 0x9b62bc7c
+0, 36, 36, 1, 149760, 0xbb32efa8
+0, 37, 37, 1, 149760, 0x1a1bcf3f
+0, 38, 38, 1, 149760, 0x9673c0e1
+0, 39, 39, 1, 149760, 0x7c6461e2
+0, 40, 40, 1, 149760, 0x0551768c
+0, 41, 41, 1, 149760, 0xa5ce5d3a
+0, 42, 42, 1, 149760, 0xe9caa587
+0, 43, 43, 1, 149760, 0xf38613ea
+0, 44, 44, 1, 149760, 0x02083cce
+0, 45, 45, 1, 149760, 0xd5f0ce4e
+0, 46, 46, 1, 149760, 0xb9ed49cd
+0, 47, 47, 1, 149760, 0xdbe0d518
+0, 48, 48, 1, 149760, 0x80f607ca
+0, 49, 49, 1, 149760, 0x9f7e3d36
+0, 50, 50, 1, 149760, 0x7f73121f
+0, 51, 51, 1, 149760, 0x4cff0e8b
+0, 52, 52, 1, 149760, 0x638dd91d
+0, 53, 53, 1, 149760, 0xe28dd86b
+0, 54, 54, 1, 149760, 0xc2b89e3a
+0, 55, 55, 1, 149760, 0xe8b67842
+0, 56, 56, 1, 149760, 0xc69fe16f
+0, 57, 57, 1, 149760, 0xb8b5f913
+0, 58, 58, 1, 149760, 0x5fac972a
+0, 59, 59, 1, 149760, 0x0306ed25
+0, 60, 60, 1, 149760, 0x94271af0
+0, 61, 61, 1, 149760, 0x11b795df
+0, 62, 62, 1, 149760, 0x8f651e3e
+0, 63, 63, 1, 149760, 0xdfb452f9
+0, 64, 64, 1, 149760, 0x686e83ff
+0, 65, 65, 1, 149760, 0x56ced1b4
+0, 66, 66, 1, 149760, 0x8df69755
+1, 67, 67, 1, 24576, 0xa82c4bc6
+0, 68, 68, 1, 149760, 0x5245b9f0
+1, 69, 69, 1, 24576, 0x2d9451db
+0, 70, 70, 1, 149760, 0x957cd0e6
+1, 71, 71, 1, 24576, 0x8b4b56c9
+0, 72, 72, 1, 149760, 0x1b01adc7
+1, 73, 73, 1, 24576, 0x4664573a
+0, 74, 74, 1, 149760, 0xea035d18
+1, 75, 75, 1, 24576, 0x3f3d4f5a
+0, 76, 76, 1, 149760, 0x965affa4
+1, 77, 77, 1, 24576, 0xaf034600
+0, 78, 78, 1, 149760, 0xa1456bd2
+1, 79, 79, 1, 24576, 0x7f5d3504
+0, 80, 80, 1, 149760, 0x5291e254
+1, 81, 81, 1, 24576, 0x59562099
+0, 82, 82, 1, 149760, 0xd97f564a
+1, 83, 83, 1, 24576, 0xd8a609de
+0, 84, 84, 1, 149760, 0x91a61e7f
+1, 85, 85, 1, 24576, 0xcf5008ca
+0, 86, 86, 1, 149760, 0xa268b503
+1, 87, 87, 1, 24576, 0x2c4af809
+0, 88, 88, 1, 149760, 0xd01c152d
+1, 89, 89, 1, 24576, 0x8366e0e1
+0, 90, 90, 1, 149760, 0xbe51742d
+1, 91, 91, 1, 24576, 0x381cc7e9
+0, 92, 92, 1, 149760, 0x15d4f93b
+1, 93, 93, 1, 24576, 0x576bbadd
+0, 94, 94, 1, 149760, 0x4a755f1b
+1, 95, 95, 1, 24576, 0x3516a052
+0, 96, 96, 1, 149760, 0x630d2e54
+1, 97, 97, 1, 24576, 0xd9489703
+0, 98, 98, 1, 149760, 0x1c4c14cd
+1, 99, 99, 1, 24576, 0xa84f8afa
+0, 100, 100, 1, 149760, 0x831a7510
+1, 101, 101, 1, 24576, 0x4d32945c
+0, 102, 102, 1, 149760, 0x9aac3ee7
+1, 103, 103, 1, 24576, 0x6b14b0d7
+0, 104, 104, 1, 149760, 0xd50d3baa
+1, 105, 105, 1, 24576, 0xb05dd8b6
+0, 106, 106, 1, 149760, 0x92d549c6
+1, 107, 107, 1, 24576, 0xfd9a02ca
+0, 108, 108, 1, 149760, 0x2232ec60
+1, 109, 109, 1, 24576, 0xa5b92802
+0, 110, 110, 1, 149760, 0x78092c24
+1, 111, 111, 1, 24576, 0x385e36de
+0, 112, 112, 1, 149760, 0xe5c7cead
+1, 113, 113, 1, 24576, 0xd4072d1a
+0, 114, 114, 1, 149760, 0x1bf8dfd0
+1, 115, 115, 1, 24576, 0x43b30476
+0, 116, 116, 1, 149760, 0x117aa880
+1, 117, 117, 1, 24576, 0x79afd3bf
+0, 118, 118, 1, 149760, 0xf4ee5505
+1, 119, 119, 1, 24576, 0x8d538ff9
+0, 120, 120, 1, 149760, 0x7b2bd220
+1, 121, 121, 1, 24576, 0x187a8509
+0, 122, 122, 1, 149760, 0xdbaf519b
+1, 123, 123, 1, 24576, 0xd97f6ec7
+0, 124, 124, 1, 149760, 0x1a386b01
+1, 125, 125, 1, 24576, 0x13e16de1
+0, 126, 126, 1, 149760, 0xf0bc3e7d
+1, 127, 127, 1, 24576, 0x27628c3b
+0, 128, 128, 1, 149760, 0xb2ba417b
+1, 129, 129, 1, 24576, 0x260eddf8
+0, 130, 130, 1, 149760, 0xb18ebdb9
+1, 131, 131, 1, 24576, 0x47291ff7
+0, 132, 132, 1, 149760, 0x57c7e50f
+1, 133, 133, 1, 24576, 0x6ed4630e
+0, 134, 134, 1, 149760, 0xc0d53c18
+1, 135, 135, 1, 24576, 0x56f98141
+0, 136, 136, 1, 149760, 0x94fb35f1
+1, 137, 137, 1, 24576, 0x62c48555
+0, 138, 138, 1, 149760, 0x0cc9b521
+1, 139, 139, 1, 24576, 0x059a7505
+0, 140, 140, 1, 149760, 0xd618f78f
+1, 141, 141, 1, 24576, 0x99c752c9
+0, 142, 142, 1, 149760, 0x12d119cb
+1, 143, 143, 1, 24576, 0x84c94c61
+0, 144, 144, 1, 149760, 0x479a07b2
+1, 145, 145, 1, 24576, 0xdac16dba
+0, 146, 146, 1, 149760, 0x5009d4fe
+1, 147, 147, 1, 24576, 0xc3c98ceb
+0, 148, 148, 1, 149760, 0x31ce0337
+1, 149, 149, 1, 24576, 0x44afbc11
+0, 150, 150, 1, 149760, 0x72e850bb
+1, 151, 151, 1, 24576, 0x1ed6f485
+0, 152, 152, 1, 149760, 0x25cd1c68
+1, 153, 153, 1, 24576, 0x14a91968
+0, 154, 154, 1, 149760, 0x6f0e7fa8
+1, 155, 155, 1, 24576, 0x398a29a7
+0, 156, 156, 1, 149760, 0x12b61c36
+1, 157, 157, 1, 24576, 0xe7c43a2d
+0, 158, 158, 1, 149760, 0xcfd5918d
+1, 159, 159, 1, 24576, 0x417c42a9
+0, 160, 160, 1, 149760, 0x08b1c6f2
+1, 161, 161, 1, 24576, 0x1a273fff
--
2.49.1
From 00ce36d037b28ead77271c4d0fd8a6247d9c0b47 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 27 Aug 2024 09:52:36 -0300
Subject: [PATCH 002/434] avcodec/cbs_h265: fix valid range for
{left,right}_view_id
view_id_len in VPS is 4 bits, so view_id values can be up to 15 bits long.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/cbs_h265.h | 4 ++--
libavcodec/cbs_h265_syntax_template.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavcodec/cbs_h265.h b/libavcodec/cbs_h265.h
index 26a5a34fe9..580c6cd4f4 100644
--- a/libavcodec/cbs_h265.h
+++ b/libavcodec/cbs_h265.h
@@ -725,8 +725,8 @@ typedef struct H265RawSEI3DReferenceDisplaysInfo {
uint8_t ref_viewing_distance_flag;
uint8_t prec_ref_viewing_dist;
uint8_t num_ref_displays_minus1;
- uint8_t left_view_id[31];
- uint8_t right_view_id[31];
+ uint16_t left_view_id[31];
+ uint16_t right_view_id[31];
uint8_t exponent_ref_display_width[31];
uint8_t mantissa_ref_display_width[31];
uint8_t exponent_ref_viewing_distance[31];
diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c
index 1c11514435..e976c38b8d 100644
--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -2299,8 +2299,8 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext
ue(prec_ref_viewing_dist, 0, 31);
ue(num_ref_displays_minus1, 0, 31);
for (i = 0; i <= current->num_ref_displays_minus1; i++) {
- ues(left_view_id[i], 0, UINT8_MAX, 1, i);
- ues(right_view_id[i], 0, UINT8_MAX, 1, i);
+ ues(left_view_id[i], 0, MAX_UINT_BITS(15), 1, i);
+ ues(right_view_id[i], 0, MAX_UINT_BITS(15), 1, i);
us(6, exponent_ref_display_width[i], 0, 62, 1, i);
if (!current->exponent_ref_display_width[i])
length = FFMAX(0, (int)current->prec_ref_display_width - 30);
--
2.49.1
From a6a346e154442254ee02dde44c7b25da8010668b Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 24 Sep 2024 15:04:01 -0300
Subject: [PATCH 003/434] avcodec/cbs_h265: num_ref_displays can be up to 32
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/cbs_h265.h | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/libavcodec/cbs_h265.h b/libavcodec/cbs_h265.h
index 580c6cd4f4..bb7a29c2e5 100644
--- a/libavcodec/cbs_h265.h
+++ b/libavcodec/cbs_h265.h
@@ -725,14 +725,14 @@ typedef struct H265RawSEI3DReferenceDisplaysInfo {
uint8_t ref_viewing_distance_flag;
uint8_t prec_ref_viewing_dist;
uint8_t num_ref_displays_minus1;
- uint16_t left_view_id[31];
- uint16_t right_view_id[31];
- uint8_t exponent_ref_display_width[31];
- uint8_t mantissa_ref_display_width[31];
- uint8_t exponent_ref_viewing_distance[31];
- uint8_t mantissa_ref_viewing_distance[31];
- uint8_t additional_shift_present_flag[31];
- uint16_t num_sample_shift_plus512[31];
+ uint16_t left_view_id[32];
+ uint16_t right_view_id[32];
+ uint8_t exponent_ref_display_width[32];
+ uint8_t mantissa_ref_display_width[32];
+ uint8_t exponent_ref_viewing_distance[32];
+ uint8_t mantissa_ref_viewing_distance[32];
+ uint8_t additional_shift_present_flag[32];
+ uint16_t num_sample_shift_plus512[32];
uint8_t three_dimensional_reference_displays_extension_flag;
} H265RawSEI3DReferenceDisplaysInfo;
--
2.49.1
From 2db706374e54d77f93492e5b58074341c815f47a Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 24 Sep 2024 15:04:12 -0300
Subject: [PATCH 004/434] avcodec/hevc/sei: num_ref_displays can be up to 32
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/hevc/sei.h | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/libavcodec/hevc/sei.h b/libavcodec/hevc/sei.h
index a9d6a52080..806540fac6 100644
--- a/libavcodec/hevc/sei.h
+++ b/libavcodec/hevc/sei.h
@@ -84,14 +84,14 @@ typedef struct HEVCSEITDRDI {
uint8_t ref_viewing_distance_flag;
uint8_t prec_ref_viewing_dist;
uint8_t num_ref_displays;
- uint16_t left_view_id[31];
- uint16_t right_view_id[31];
- uint8_t exponent_ref_display_width[31];
- uint8_t mantissa_ref_display_width[31];
- uint8_t exponent_ref_viewing_distance[31];
- uint8_t mantissa_ref_viewing_distance[31];
- uint8_t additional_shift_present_flag[31];
- int16_t num_sample_shift[31];
+ uint16_t left_view_id[32];
+ uint16_t right_view_id[32];
+ uint8_t exponent_ref_display_width[32];
+ uint8_t mantissa_ref_display_width[32];
+ uint8_t exponent_ref_viewing_distance[32];
+ uint8_t mantissa_ref_viewing_distance[32];
+ uint8_t additional_shift_present_flag[32];
+ int16_t num_sample_shift[32];
uint8_t three_dimensional_reference_displays_extension_flag;
} HEVCSEITDRDI;
--
2.49.1
From f7643454aad674fd4f53cb605555eadd56b0fd96 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 24 Sep 2024 16:08:29 -0300
Subject: [PATCH 005/434] avfilter/vf_showinfo: add missing break to ViewID
case
Missed in 6940a6de2f047ceae414ddebaab30cd9fe35b020.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fd6cc18d60cd1b61380324c13050b04285eb1fb4)
---
libavfilter/vf_showinfo.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavfilter/vf_showinfo.c b/libavfilter/vf_showinfo.c
index 77082505f5..1c9cf6c6a1 100644
--- a/libavfilter/vf_showinfo.c
+++ b/libavfilter/vf_showinfo.c
@@ -859,6 +859,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
break;
case AV_FRAME_DATA_VIEW_ID:
av_log(ctx, AV_LOG_INFO, "view id: %d\n", *(int*)sd->data);
+ break;
default:
if (name)
av_log(ctx, AV_LOG_INFO,
--
2.49.1
From cb2327562326773bb4d497df8514ff25eba0f37c Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 24 Sep 2024 21:08:23 -0300
Subject: [PATCH 006/434] tests/fate/mov: fix rules for some tests
This was broken in 2fb2cd5c79fc0a01539e826530a195c3d6b78a17 and
74553f0026941de88286e821c9e0973206bdb1b5, making a simple make fate-mov fail
and most of the test not run with a simple make fate.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8b4e32f30bd28222c45128a9935ed483ac90f414)
---
tests/fate/mov.mak | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tests/fate/mov.mak b/tests/fate/mov.mak
index 682997f7fe..1200c77560 100644
--- a/tests/fate/mov.mak
+++ b/tests/fate/mov.mak
@@ -33,8 +33,8 @@ FATE_MOV_FFPROBE-$(call FRAMEMD5, MOV) = fate-mov-neg-firstpts-discard \
FATE_MOV_FASTSTART = fate-mov-faststart-4gb-overflow \
-FATE_SAMPLES_AVCONV += $(FATE_MOV)
-FATE_SAMPLES_FFPROBE += $(FATE_MOV_FFPROBE)
+FATE_SAMPLES_FFMPEG += $(FATE_MOV-yes)
+FATE_SAMPLES_FFPROBE += $(FATE_MOV_FFPROBE-yes)
FATE_SAMPLES_FASTSTART += $(FATE_MOV_FASTSTART)
# Make sure we handle edit lists correctly in normal cases.
@@ -281,4 +281,4 @@ fate-mov-mp4-iamf-ambisonic_1: CMD = transcode wav $(SRC) mp4 "-auto_conversion_
FATE_FFMPEG += $(FATE_MOV_FFMPEG-yes)
FATE_FFMPEG_FFPROBE += $(FATE_MOV_FFMPEG_FFPROBE-yes)
-fate-mov: $(FATE_MOV-yes) $(FATE_MOV_FFMPEG-yes) $(FATE_MOV_FFMPEG_FFPROBE-yes) $(FATE_MOV_FFPROBE) $(FATE_MOV_FASTSTART) $(FATE_MOV_FFMPEG_SAMPLES-yes) $(FATE_MOV_FFMPEG_FFPROBE_SAMPLES-yes)
+fate-mov: $(FATE_MOV-yes) $(FATE_MOV_FFMPEG-yes) $(FATE_MOV_FFMPEG_FFPROBE-yes) $(FATE_MOV_FFPROBE-yes) $(FATE_MOV_FASTSTART) $(FATE_MOV_FFMPEG_SAMPLES-yes) $(FATE_MOV_FFMPEG_FFPROBE_SAMPLES-yes)
--
2.49.1
From c21472ec31bb999b1960cf0ce9f93932b4939018 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 26 Sep 2024 16:38:24 -0300
Subject: [PATCH 007/434] avutil/iamf: fix doxygen
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d55ab2ba9b16cabf1a069bcd6784e8d4906fc859)
---
libavutil/iamf.h | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libavutil/iamf.h b/libavutil/iamf.h
index 93785d9fec..1fa73893cd 100644
--- a/libavutil/iamf.h
+++ b/libavutil/iamf.h
@@ -37,20 +37,29 @@
#include "rational.h"
/**
+ * @defgroup lavu_iamf Immersive Audio Model and Formats
+ * @ingroup lavu_audio
+ *
+ * Immersive Audio Model and Formats related functions and defines
+ *
* @defgroup lavu_iamf_params Parameter Definition
+ * @ingroup lavu_iamf
* @{
* Parameters as defined in section 3.6.1 and 3.8 of IAMF.
* @}
+ *
* @defgroup lavu_iamf_audio Audio Element
+ * @ingroup lavu_iamf
* @{
* Audio Elements as defined in section 3.6 of IAMF.
* @}
+ *
* @defgroup lavu_iamf_mix Mix Presentation
+ * @ingroup lavu_iamf
* @{
* Mix Presentations as defined in section 3.7 of IAMF.
* @}
*
- * @}
* @addtogroup lavu_iamf_params
* @{
*/
@@ -673,6 +682,7 @@ AVIAMFSubmixLayout *av_iamf_submix_add_layout(AVIAMFSubmix *submix);
* upon return, *mix_presentation will be set to NULL.
*/
void av_iamf_mix_presentation_free(AVIAMFMixPresentation **mix_presentation);
+
/**
* @}
*/
--
2.49.1
From 0482410818e0fcff0e77f2d2813d391809f52ce4 Mon Sep 17 00:00:00 2001
From: Lynne <dev@lynne.ee>
Date: Fri, 27 Sep 2024 09:49:35 +0200
Subject: [PATCH 008/434] vulkan_encode_h264: fix rate control VBV values
The values must be in milliseconds, not bytes.
(cherry picked from commit 934be0ff50fbe58aa44bc8a876f07195846d15ea)
---
libavcodec/vulkan_encode_h264.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vulkan_encode_h264.c b/libavcodec/vulkan_encode_h264.c
index 9964ba5b8b..a0a00a3db2 100644
--- a/libavcodec/vulkan_encode_h264.c
+++ b/libavcodec/vulkan_encode_h264.c
@@ -130,12 +130,12 @@ static int init_pic_rc(AVCodecContext *avctx, FFHWBaseEncodePicture *pic,
.consecutiveBFrameCount = FFMAX(ctx->base.b_per_p - 1, 0),
.temporalLayerCount = 0,
};
-
rc_info->pNext = &hp->vkrc_info;
- rc_info->virtualBufferSizeInMs = enc->unit_opts.hrd_buffer_size;
- rc_info->initialVirtualBufferSizeInMs = enc->unit_opts.initial_buffer_fullness;
if (rc_info->rateControlMode > VK_VIDEO_ENCODE_RATE_CONTROL_MODE_DISABLED_BIT_KHR) {
+ rc_info->virtualBufferSizeInMs = (enc->unit_opts.hrd_buffer_size * 1000LL) / avctx->bit_rate;
+ rc_info->initialVirtualBufferSizeInMs = (enc->unit_opts.initial_buffer_fullness * 1000LL) / avctx->bit_rate;
+
hp->vkrc_layer_info = (VkVideoEncodeH264RateControlLayerInfoKHR) {
.sType = VK_STRUCTURE_TYPE_VIDEO_ENCODE_H264_RATE_CONTROL_LAYER_INFO_KHR,
--
2.49.1
From 9ada04faa3780c6360ffc6f354374e06bca00a8a Mon Sep 17 00:00:00 2001
From: Lynne <dev@lynne.ee>
Date: Fri, 27 Sep 2024 09:52:14 +0200
Subject: [PATCH 009/434] vulkan_encode_h265: fix rate control VBV values
The values written were placeholder values.
(cherry picked from commit 81c6e6c9eeb2ced02654631dbe83d342e6b59505)
---
libavcodec/vulkan_encode_h265.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vulkan_encode_h265.c b/libavcodec/vulkan_encode_h265.c
index 54bf071d78..6aadbc93fc 100644
--- a/libavcodec/vulkan_encode_h265.c
+++ b/libavcodec/vulkan_encode_h265.c
@@ -124,12 +124,12 @@ static int init_pic_rc(AVCodecContext *avctx, FFHWBaseEncodePicture *pic,
.consecutiveBFrameCount = FFMAX(ctx->base.b_per_p - 1, 0),
.subLayerCount = 0,
};
-
rc_info->pNext = &hp->vkrc_info;
- rc_info->virtualBufferSizeInMs = 1000;
- rc_info->initialVirtualBufferSizeInMs = 500;
if (rc_info->rateControlMode > VK_VIDEO_ENCODE_RATE_CONTROL_MODE_DISABLED_BIT_KHR) {
+ rc_info->virtualBufferSizeInMs = (enc->hrd_buffer_size * 1000LL) / avctx->bit_rate;
+ rc_info->initialVirtualBufferSizeInMs = (enc->initial_buffer_fullness * 1000LL) / avctx->bit_rate;
+
hp->vkrc_layer_info = (VkVideoEncodeH265RateControlLayerInfoKHR) {
.sType = VK_STRUCTURE_TYPE_VIDEO_ENCODE_H265_RATE_CONTROL_LAYER_INFO_KHR,
--
2.49.1
From 55d0c353fe745c762a9ff0a69c97e11522a6d1e7 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Wed, 25 Sep 2024 20:49:47 +0200
Subject: [PATCH 010/434] lavu/opt: add missing 'else'
(cherry picked from commit 9b764e9b491747aa85c47ecd210551ab001ca977)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavutil/opt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavutil/opt.c b/libavutil/opt.c
index 45db4f484f..02ed9d9fe9 100644
--- a/libavutil/opt.c
+++ b/libavutil/opt.c
@@ -2362,7 +2362,7 @@ int av_opt_set_array(void *obj, const char *name, int search_flags,
ret = opt_set_elem(obj, target_obj, o, *(const char **)src, dst);
if (ret < 0)
goto fail;
- } if (val_type == AV_OPT_TYPE_INT ||
+ } else if (val_type == AV_OPT_TYPE_INT ||
val_type == AV_OPT_TYPE_INT64 ||
val_type == AV_OPT_TYPE_FLOAT ||
val_type == AV_OPT_TYPE_DOUBLE ||
--
2.49.1
From d5c308fcc5576861e42aa0c8897e3a0271a86ff7 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Thu, 26 Sep 2024 18:08:04 +0200
Subject: [PATCH 011/434] lavu/opt: avoid accidentally propagating spurious
errors
An error from read_number() is non-fatal here and should not be
forwarded.
(cherry picked from commit 505fea34e53e0459d1ca6604a3f4737f0b90902c)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavutil/opt.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavutil/opt.c b/libavutil/opt.c
index 02ed9d9fe9..93f2bb1320 100644
--- a/libavutil/opt.c
+++ b/libavutil/opt.c
@@ -2343,13 +2343,15 @@ int av_opt_set_array(void *obj, const char *name, int search_flags,
int64_t intnum = 1;
if (val_type == TYPE_BASE(o->type)) {
+ int err;
+
ret = opt_copy_elem(obj, val_type, dst, src);
if (ret < 0)
goto fail;
// validate the range for numeric options
- ret = read_number(o, dst, &num, &den, &intnum);
- if (ret >= 0 && TYPE_BASE(o->type) != AV_OPT_TYPE_FLAGS &&
+ err = read_number(o, dst, &num, &den, &intnum);
+ if (err >= 0 && TYPE_BASE(o->type) != AV_OPT_TYPE_FLAGS &&
(!den || o->max * den < num * intnum || o->min * den > num * intnum)) {
num = den ? num * intnum / den : (num && intnum ? INFINITY : NAN);
av_log(obj, AV_LOG_ERROR, "Cannot set array element %u for "
--
2.49.1
From 05ff3eb9f2b9321e4314e7d84fe67557bd809307 Mon Sep 17 00:00:00 2001
From: Brad Smith <brad@comstyle.com>
Date: Sat, 21 Sep 2024 05:00:41 -0400
Subject: [PATCH 012/434] ppc: Recognize the PPC VSX and Power8 CPU flags
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit 6ec6b0790021c5871016f57ac33d54bb6cab7a7d)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/cpu.c | 2 ++
libavutil/tests/cpu.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/libavutil/cpu.c b/libavutil/cpu.c
index df00bd541f..44cbb9e9ff 100644
--- a/libavutil/cpu.c
+++ b/libavutil/cpu.c
@@ -120,6 +120,8 @@ int av_parse_cpu_caps(unsigned *flags, const char *s)
{ "flags" , NULL, 0, AV_OPT_TYPE_FLAGS, { .i64 = 0 }, INT64_MIN, INT64_MAX, .unit = "flags" },
#if ARCH_PPC
{ "altivec" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_ALTIVEC }, .unit = "flags" },
+ { "vsx" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_VSX }, .unit = "flags" },
+ { "power8" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_POWER8 }, .unit = "flags" },
#elif ARCH_X86
{ "mmx" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_MMX }, .unit = "flags" },
{ "mmx2" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_MMX2 }, .unit = "flags" },
diff --git a/libavutil/tests/cpu.c b/libavutil/tests/cpu.c
index 0a459c1d9e..53e9f99950 100644
--- a/libavutil/tests/cpu.c
+++ b/libavutil/tests/cpu.c
@@ -51,6 +51,8 @@ static const struct {
{ AV_CPU_FLAG_SETEND, "setend" },
#elif ARCH_PPC
{ AV_CPU_FLAG_ALTIVEC, "altivec" },
+ { AV_CPU_FLAG_VSX, "vsx" },
+ { AV_CPU_FLAG_POWER8, "power8" },
#elif ARCH_MIPS
{ AV_CPU_FLAG_MMI, "mmi" },
{ AV_CPU_FLAG_MSA, "msa" },
--
2.49.1
From 963145483cd0234cd0fac1b51f2410b5274b5f2d Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Thu, 12 Sep 2024 04:52:43 +0200
Subject: [PATCH 013/434] avdevice/decklink_dec: fix leak on error
In the early return when both draw_bars and signal_loss_action
options are used, the context allocated previously was not
properly freed.
Introduced in 9bcb86b0fa58f1a5a2a8613065349e26abadb329
Fixes CID1619296
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 7554346cb5cf6e8863da12f9d56e300b08d6cc23)
---
libavdevice/decklink_dec.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavdevice/decklink_dec.cpp b/libavdevice/decklink_dec.cpp
index 54d698bc12..9a817daf18 100644
--- a/libavdevice/decklink_dec.cpp
+++ b/libavdevice/decklink_dec.cpp
@@ -1098,6 +1098,7 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx)
}
if (!ctx->draw_bars && ctx->signal_loss_action != SIGNAL_LOSS_NONE) {
av_log(avctx, AV_LOG_ERROR, "options draw_bars and signal_loss_action are mutually exclusive\n");
+ av_freep(&ctx);
return AVERROR(EINVAL);
}
ctx->audio_depth = cctx->audio_depth;
--
2.49.1
From ebd0ca9fee85891262979b2c9d320ff69abdc104 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Thu, 12 Sep 2024 04:58:38 +0200
Subject: [PATCH 014/434] avdevice/decklink_dec: fix leaks on error
In case of errors in this function, the allocated context
was not properly freed in several cases.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 8e76c993013d6dd9382774d1716d8fe2421c42bd)
---
libavdevice/decklink_dec.cpp | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/libavdevice/decklink_dec.cpp b/libavdevice/decklink_dec.cpp
index 9a817daf18..418701e4e0 100644
--- a/libavdevice/decklink_dec.cpp
+++ b/libavdevice/decklink_dec.cpp
@@ -1114,7 +1114,8 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx)
break;
default:
av_log(avctx, AV_LOG_ERROR, "Value of channels option must be one of 2, 8 or 16\n");
- return AVERROR(EINVAL);
+ ret = AVERROR(EINVAL);
+ goto error;
}
/* Check audio bit depth option for valid values: 16 or 32 */
@@ -1124,18 +1125,20 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx)
break;
default:
av_log(avctx, AV_LOG_ERROR, "Value for audio bit depth option must be either 16 or 32\n");
- return AVERROR(EINVAL);
+ ret = AVERROR(EINVAL);
+ goto error;
}
/* List available devices. */
if (ctx->list_devices) {
ff_decklink_list_devices_legacy(avctx, 1, 0);
- return AVERROR_EXIT;
+ ret = AVERROR_EXIT;
+ goto error;
}
ret = ff_decklink_init_device(avctx, avctx->url);
if (ret < 0)
- return ret;
+ goto error;
/* Get input device. */
if (ctx->dl->QueryInterface(IID_IDeckLinkInput, (void **) &ctx->dli) != S_OK) {
@@ -1336,6 +1339,7 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx)
error:
ff_decklink_cleanup(avctx);
+ av_freep(&cctx->ctx);
return ret;
}
--
2.49.1
From 09e9d61d0a12dee0272966c4f82d0a65ad696d42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Thu, 26 Sep 2024 13:13:46 +0300
Subject: [PATCH 015/434] checkasm/sw_rgb: Revert test additions from
e18b46d95fadcbaaf450bda9f1871849f2b0c586
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The unaligned width test cases fail on i386; we have an assembly
function of rgb24toyv12 which is enabled only within
"#if ARCH_X86_32 && HAVE_7REGS", which seems to fail these new
test cases for unaligned widths.
As that assembly function has existed for a long time in that form,
the issue probably isn't very recent, thus skip testing these cases
for now.
Once the assembly function has been fixed, these test cases can
be readded.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 157ce21939771a8054b5effc05381fa30b825c1f)
Signed-off-by: Martin Storsjö <martin@martin.st>
---
tests/checkasm/sw_rgb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/checkasm/sw_rgb.c b/tests/checkasm/sw_rgb.c
index 7a6d621375..af9434073a 100644
--- a/tests/checkasm/sw_rgb.c
+++ b/tests/checkasm/sw_rgb.c
@@ -129,7 +129,7 @@ static int cmp_off_by_n(const uint8_t *ref, const uint8_t *test, size_t n, int a
static void check_rgb24toyv12(struct SwsContext *ctx)
{
- static const int input_sizes[] = {2, 16, 128, 540, MAX_LINE_SIZE, -MAX_LINE_SIZE};
+ static const int input_sizes[] = {16, 128, 512, MAX_LINE_SIZE, -MAX_LINE_SIZE};
LOCAL_ALIGNED_32(uint8_t, src, [BUFSIZE * 3]);
LOCAL_ALIGNED_32(uint8_t, buf_y_0, [BUFSIZE]);
--
2.49.1
From 0bad953cc54905d1147309cc45feffb17d7b02a6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 24 Sep 2024 23:43:09 +0200
Subject: [PATCH 016/434] avcodec/ffv1enc: Fix >8bit context size
Fixes: Ticket5405
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9c83e43f2fc9128e20851291b0270add1a6b95f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 1c37f61ada..a6f405289e 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -724,19 +724,21 @@ static av_cold int encode_init(AVCodecContext *avctx)
s->quant_tables[1][2][i]= 11*11*quant5 [i];
s->quant_tables[1][3][i]= 5*11*11*quant5 [i];
s->quant_tables[1][4][i]= 5*5*11*11*quant5 [i];
+ s->context_count[0] = (11 * 11 * 11 + 1) / 2;
+ s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2;
} else {
s->quant_tables[0][0][i]= quant9_10bit[i];
- s->quant_tables[0][1][i]= 11*quant9_10bit[i];
- s->quant_tables[0][2][i]= 11*11*quant9_10bit[i];
+ s->quant_tables[0][1][i]= 9*quant9_10bit[i];
+ s->quant_tables[0][2][i]= 9*9*quant9_10bit[i];
s->quant_tables[1][0][i]= quant9_10bit[i];
- s->quant_tables[1][1][i]= 11*quant9_10bit[i];
- s->quant_tables[1][2][i]= 11*11*quant5_10bit[i];
- s->quant_tables[1][3][i]= 5*11*11*quant5_10bit[i];
- s->quant_tables[1][4][i]= 5*5*11*11*quant5_10bit[i];
+ s->quant_tables[1][1][i]= 9*quant9_10bit[i];
+ s->quant_tables[1][2][i]= 9*9*quant5_10bit[i];
+ s->quant_tables[1][3][i]= 5*9*9*quant5_10bit[i];
+ s->quant_tables[1][4][i]= 5*5*9*9*quant5_10bit[i];
+ s->context_count[0] = (9 * 9 * 9 + 1) / 2;
+ s->context_count[1] = (9 * 9 * 5 * 5 * 5 + 1) / 2;
}
}
- s->context_count[0] = (11 * 11 * 11 + 1) / 2;
- s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2;
if ((ret = ff_ffv1_allocate_initial_states(s)) < 0)
return ret;
--
2.49.1
From 69cf68f5a0999b50aa595a92ba8e212ea997c4e5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 29 Sep 2024 18:41:14 +0200
Subject: [PATCH 017/434] Update for 7.1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
RELEASE | 2 +-
doc/Doxyfile | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RELEASE b/RELEASE
index 72ec89de30..0f0fefae5a 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-7.0.git
+7.1
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 572c532da5..c6dc306197 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
-PROJECT_NUMBER =
+PROJECT_NUMBER = 7.1
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
--
2.49.1
From b08d7969c550a804a59511c7b83f2dd8cc0499b8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 2 Nov 2018 01:36:21 +0100
Subject: [PATCH 018/434] RELEASE_NOTES: Based on the version from 5.1
Name suggested by 3 people on ML
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
RELEASE_NOTES | 15 +++++++++++++++
1 file changed, 15 insertions(+)
create mode 100644 RELEASE_NOTES
diff --git a/RELEASE_NOTES b/RELEASE_NOTES
new file mode 100644
index 0000000000..851701a735
--- /dev/null
+++ b/RELEASE_NOTES
@@ -0,0 +1,15 @@
+
+ ┌──────────────────────────────────────┐
+ │ RELEASE NOTES for FFmpeg 7.1 "Péter" │
+ └──────────────────────────────────────┘
+
+ The FFmpeg Project proudly presents FFmpeg 7.1 "Péter", about 6
+ months after the release of FFmpeg 7.0.
+
+ A complete Changelog is available at the root of the project, and the
+ complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git
+
+ We hope you will like this release as much as we enjoyed working on it, and
+ as usual, if you have any questions about it, or any FFmpeg related topic,
+ feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
+ on the mailing-lists.
--
2.49.1
From 12682eba2ef6047f58cb34c07726126025b6e752 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 30 Sep 2024 10:59:02 -0300
Subject: [PATCH 019/434] avformat/mov: don't return the latest stream when an
item stream is expected
Otherwise, things like ICC profiles as read from the colr box meant for an item
with no stream (like a grid) may end up being added to the wrong stream.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 04182b55494b44152146e6a6bcd5eb9403f00625)
---
libavformat/mov.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index a2333ac1fd..5b0b23ffc1 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -188,6 +188,10 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len,
return p - dst;
}
+/**
+ * Get the current stream in the parsing process. This can either be the
+ * latest stream added to the context, or the stream referenced by an item.
+ */
static AVStream *get_curr_st(MOVContext *c)
{
AVStream *st = NULL;
@@ -206,7 +210,7 @@ static AVStream *get_curr_st(MOVContext *c)
st = item->st;
break;
}
- if (!st)
+ if (!st && c->cur_item_id == -1)
st = c->fc->streams[c->fc->nb_streams-1];
return st;
--
2.49.1
From ff93c1898d4b1807f4ac0d59897891c5d342a865 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Mon, 23 Sep 2024 23:14:19 +0800
Subject: [PATCH 020/434] avformat/internal: Add ff_get_frame_filename
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
It's similar to av_get_frame_filename2 but with int64_t number
support. Make av_get_frame_filename* a wrapper over
ff_get_frame_filename.
Co-authored-by: Filip Mašić <shoutplenty@gmail.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit a2d9663241908d6f558b8e6b24bd42f2aaebc144)
---
libavformat/internal.h | 16 ++++++++++++++++
libavformat/utils.c | 11 ++++++++---
2 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/libavformat/internal.h b/libavformat/internal.h
index 8e8971bfeb..6c026f08a0 100644
--- a/libavformat/internal.h
+++ b/libavformat/internal.h
@@ -745,6 +745,22 @@ void ff_format_set_url(AVFormatContext *s, char *url);
*/
int ff_match_url_ext(const char *url, const char *extensions);
+/**
+ * Return in 'buf' the path with '%d' replaced by a number.
+ *
+ * Also handles the '%0nd' format where 'n' is the total number
+ * of digits and '%%'.
+ *
+ * @param buf destination buffer
+ * @param buf_size destination buffer size
+ * @param path path with substitution template
+ * @param number the number to substitute
+ * @param flags AV_FRAME_FILENAME_FLAGS_*
+ * @return 0 if OK, -1 on format error
+ */
+int ff_get_frame_filename(char *buf, int buf_size, const char *path,
+ int64_t number, int flags);
+
struct FFOutputFormat;
struct FFInputFormat;
void avpriv_register_devices(const struct FFOutputFormat * const o[],
diff --git a/libavformat/utils.c b/libavformat/utils.c
index e9ded627ad..e892e8bde7 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -280,7 +280,7 @@ uint64_t ff_parse_ntp_time(uint64_t ntp_ts)
return (sec * 1000000) + usec;
}
-int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number, int flags)
+int ff_get_frame_filename(char *buf, int buf_size, const char *path, int64_t number, int flags)
{
const char *p;
char *q, buf1[20], c;
@@ -313,7 +313,7 @@ int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number
percentd_found = 1;
if (number < 0)
nd += 1;
- snprintf(buf1, sizeof(buf1), "%0*d", nd, number);
+ snprintf(buf1, sizeof(buf1), "%0*" PRId64, nd, number);
len = strlen(buf1);
if ((q - buf + len) > buf_size - 1)
goto fail;
@@ -338,9 +338,14 @@ fail:
return -1;
}
+int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number, int flags)
+{
+ return ff_get_frame_filename(buf, buf_size, path, number, flags);
+}
+
int av_get_frame_filename(char *buf, int buf_size, const char *path, int number)
{
- return av_get_frame_filename2(buf, buf_size, path, number, 0);
+ return ff_get_frame_filename(buf, buf_size, path, number, 0);
}
void av_url_split(char *proto, int proto_size,
--
2.49.1
From 8be6e56a536e978d77640dadc7c00861b19c0ee5 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Tue, 24 Sep 2024 00:16:13 +0800
Subject: [PATCH 021/434] avformat/img2enc: Fix integer truncation when
frame_pts is enabled
Fix #11194
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit f56a54387b9cea884ca139e9cb993ff6989b8def)
---
libavformat/img2enc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c
index 526a11e5ee..41638d92b8 100644
--- a/libavformat/img2enc.c
+++ b/libavformat/img2enc.c
@@ -160,13 +160,13 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
return AVERROR(EINVAL);
}
} else if (img->frame_pts) {
- if (av_get_frame_filename2(filename, sizeof(filename), s->url, pkt->pts, AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) {
+ if (ff_get_frame_filename(filename, sizeof(filename), s->url, pkt->pts, AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) {
av_log(s, AV_LOG_ERROR, "Cannot write filename by pts of the frames.");
return AVERROR(EINVAL);
}
- } else if (av_get_frame_filename2(filename, sizeof(filename), s->url,
- img->img_number,
- AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) {
+ } else if (ff_get_frame_filename(filename, sizeof(filename), s->url,
+ img->img_number,
+ AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) {
if (img->img_number == img->start_img_number) {
av_log(s, AV_LOG_WARNING, "The specified filename '%s' does not contain an image sequence pattern or a pattern is invalid.\n", s->url);
av_log(s, AV_LOG_WARNING,
--
2.49.1
From 4c0ef3bfae1473902f8ec8ee0a1a95607827b390 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 4 Oct 2024 01:30:57 +0800
Subject: [PATCH 022/434] avcodec/mediacodecenc: Fix access of uninitialized
value
When crop is skipped, av_strlcatf will access `str` which isn't
initialized properly.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit eff9ed7bff45998ea370e3d6f627529ad47e2e74)
---
libavcodec/mediacodecenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mediacodecenc.c b/libavcodec/mediacodecenc.c
index 6ca3968a24..e76ea81236 100644
--- a/libavcodec/mediacodecenc.c
+++ b/libavcodec/mediacodecenc.c
@@ -134,7 +134,7 @@ static int extract_extradata_support(AVCodecContext *avctx)
static int mediacodec_init_bsf(AVCodecContext *avctx)
{
MediaCodecEncContext *s = avctx->priv_data;
- char str[128];
+ char str[128] = {0};
int ret;
int crop_right = s->width - avctx->width;
int crop_bottom = s->height - avctx->height;
--
2.49.1
From e14a3a4b116122899dc8d251d6b890ae378f9802 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Tue, 1 Oct 2024 02:57:11 +0200
Subject: [PATCH 023/434] fftools: do not access out of bounds filtergraph
The log message was logged for `filtergraphs[j]` which would cause a
heap buffer overflow in certain circumstances.
Correctly it should be logged for the current filtergraph, so just
use `fg` here.
(cherry picked from commit 5beeb3a1f97d8f6d4076fe83aaf5e2e5871f945e)
---
fftools/ffmpeg_filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c
index 7ec328e04e..2f2b297932 100644
--- a/fftools/ffmpeg_filter.c
+++ b/fftools/ffmpeg_filter.c
@@ -1408,7 +1408,7 @@ int fg_finalise_bindings(void)
for (int j = 0; j < fg->nb_outputs; j++) {
OutputFilter *output = fg->outputs[j];
if (!output->bound) {
- av_log(filtergraphs[j], AV_LOG_FATAL,
+ av_log(fg, AV_LOG_FATAL,
"Filter %s has an unconnected output\n", output->name);
return AVERROR(EINVAL);
}
--
2.49.1
From 9b061291ad3c38944ab628be52e9338090d2f3a7 Mon Sep 17 00:00:00 2001
From: Marvin Scholz <epirat07@gmail.com>
Date: Tue, 1 Oct 2024 03:20:04 +0200
Subject: [PATCH 024/434] fftools: log unconnected filter output label
(cherry picked from commit f25c9cc213c7e3eb585d3339eb775b16921c4d98)
---
fftools/ffmpeg_filter.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c
index 2f2b297932..4e3a47e3b6 100644
--- a/fftools/ffmpeg_filter.c
+++ b/fftools/ffmpeg_filter.c
@@ -1409,7 +1409,9 @@ int fg_finalise_bindings(void)
OutputFilter *output = fg->outputs[j];
if (!output->bound) {
av_log(fg, AV_LOG_FATAL,
- "Filter %s has an unconnected output\n", output->name);
+ "Filter '%s' has output %d (%s) unconnected\n",
+ output->name, j,
+ output->linklabel ? (const char *)output->linklabel : "unlabeled");
return AVERROR(EINVAL);
}
}
--
2.49.1
From 63f5c007a7da69248f664c988398204c21eac7cf Mon Sep 17 00:00:00 2001
From: Gyan Doshi <ffmpeg@gyani.pro>
Date: Sat, 5 Oct 2024 10:08:31 +0530
Subject: [PATCH 025/434] avcodec/libx265: unbreak build for X265_BUILD >= 213
Earlier, x265 made an API change to support alpha and
other multiple layer pictures. We added guards to accommodate
that in 1f801dfdb5
They have now reverted that API change in
https://bitbucket.org/multicoreware/x265_git/commits/78e5b703b1
Updated our wrapper guards to unbreak build again.
---
libavcodec/libx265.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/libx265.c b/libavcodec/libx265.c
index 513f473307..63cc497f83 100644
--- a/libavcodec/libx265.c
+++ b/libavcodec/libx265.c
@@ -661,7 +661,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
{
libx265Context *ctx = avctx->priv_data;
x265_picture x265pic;
-#if X265_BUILD >= 210
+#if (X265_BUILD >= 210) && (X265_BUILD < 213)
x265_picture x265pic_layers_out[MAX_SCALABLE_LAYERS];
x265_picture* x265pic_lyrptr_out[MAX_SCALABLE_LAYERS];
#else
@@ -805,7 +805,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
#endif
}
-#if X265_BUILD >= 210
+#if (X265_BUILD >= 210) && (X265_BUILD < 213)
for (i = 0; i < MAX_SCALABLE_LAYERS; i++)
x265pic_lyrptr_out[i] = &x265pic_layers_out[i];
@@ -844,7 +844,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
pkt->flags |= AV_PKT_FLAG_KEY;
}
-#if X265_BUILD >= 210
+#if (X265_BUILD >= 210) && (X265_BUILD < 213)
x265pic_out = x265pic_lyrptr_out[0];
#else
x265pic_out = &x265pic_solo_out;
--
2.49.1
From 794245fa715493e0275c190d0c3917deccf2d7a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Fri, 4 Oct 2024 00:30:24 +0300
Subject: [PATCH 026/434] arm: Consistently use proper interworking function
returns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Use "bx lr", or "pop {lr}", which do proper mode switching
between thumb and arm modes. A plain "mov pc, lr" does not switch
from thumb mode to arm mode (while in arm mode, it does switch
mode for a thumb caller).
This is normally not an issue, as CONFIG_THUMB only is enabled if
the C compiler defaults to thumb; but stick to patterns that can
do mode switching if needed, for consistency.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 77e6293735262b20a86b5047b77991a86cf4e9e1)
---
libswresample/arm/resample.S | 8 ++++----
libswscale/arm/hscale.S | 3 +--
libswscale/arm/output.S | 3 +--
libswscale/arm/yuv2rgb_neon.S | 3 +--
4 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/libswresample/arm/resample.S b/libswresample/arm/resample.S
index 3ce7623246..791f4cc016 100644
--- a/libswresample/arm/resample.S
+++ b/libswresample/arm/resample.S
@@ -30,7 +30,7 @@ function ff_resample_common_apply_filter_x4_float_neon, export=1
vpadd.f32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values
vpadd.f32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values
vst1.32 {d0[0]}, [r0] @ write accumulator
- mov pc, lr
+ bx lr
endfunc
function ff_resample_common_apply_filter_x8_float_neon, export=1
@@ -46,7 +46,7 @@ function ff_resample_common_apply_filter_x8_float_neon, export=1
vpadd.f32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values
vpadd.f32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values
vst1.32 {d0[0]}, [r0] @ write accumulator
- mov pc, lr
+ bx lr
endfunc
function ff_resample_common_apply_filter_x4_s16_neon, export=1
@@ -59,7 +59,7 @@ function ff_resample_common_apply_filter_x4_s16_neon, export=1
vpadd.s32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values
vpadd.s32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values
vst1.32 {d0[0]}, [r0] @ write accumulator
- mov pc, lr
+ bx lr
endfunc
function ff_resample_common_apply_filter_x8_s16_neon, export=1
@@ -73,5 +73,5 @@ function ff_resample_common_apply_filter_x8_s16_neon, export=1
vpadd.s32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values
vpadd.s32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values
vst1.32 {d0[0]}, [r0] @ write accumulator
- mov pc, lr
+ bx lr
endfunc
diff --git a/libswscale/arm/hscale.S b/libswscale/arm/hscale.S
index dd4d453957..5c3551a0f1 100644
--- a/libswscale/arm/hscale.S
+++ b/libswscale/arm/hscale.S
@@ -65,6 +65,5 @@ function ff_hscale_8_to_15_neon, export=1
subs r2, #2 @ dstW -= 2
bgt 1b @ loop until end of line
vpop {q4-q7}
- pop {r4-r12, lr}
- mov pc, lr
+ pop {r4-r12, pc}
endfunc
diff --git a/libswscale/arm/output.S b/libswscale/arm/output.S
index 70846dee1f..5f10585f81 100644
--- a/libswscale/arm/output.S
+++ b/libswscale/arm/output.S
@@ -73,6 +73,5 @@ function ff_yuv2planeX_8_neon, export=1
subs r4, r4, #8 @ dstW -= 8
bgt 2b @ loop until width is consumed
vpop {q4-q7}
- pop {r4-r12, lr}
- mov pc, lr
+ pop {r4-r12, pc}
endfunc
diff --git a/libswscale/arm/yuv2rgb_neon.S b/libswscale/arm/yuv2rgb_neon.S
index 474465427d..6777d625f9 100644
--- a/libswscale/arm/yuv2rgb_neon.S
+++ b/libswscale/arm/yuv2rgb_neon.S
@@ -262,8 +262,7 @@ function ff_\ifmt\()_to_\ofmt\()_neon, export=1
increment_and_test_\ifmt
bgt 1b
vpop {q4-q7}
- pop {r4-r12, lr}
- mov pc, lr
+ pop {r4-r12, pc}
endfunc
.endm
--
2.49.1
From c0d19c640a00ef1899f6201c659d30ae430692df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Fri, 4 Oct 2024 10:22:57 +0300
Subject: [PATCH 027/434] checkasm: lls: Use relative tolerances rather than
absolute ones
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Depending on the magnitude of the output values, the potential
errors can be larger.
This fixes errors in the lls tests on x86_32 for some seeds,
observed with GCC 11 (on Ubuntu 22.04, with the distro compiler,
with -m32).
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6668268e16b6d1a6992840dccb12effece2e7202)
---
tests/checkasm/lls.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/tests/checkasm/lls.c b/tests/checkasm/lls.c
index 1e0b56974c..4251032e02 100644
--- a/tests/checkasm/lls.c
+++ b/tests/checkasm/lls.c
@@ -46,28 +46,32 @@ static void test_update(LLSModel *lls, const double *var)
call_new(lls, var);
for (size_t i = 0; i < lls->indep_count; i++)
- for (size_t j = i; j < lls->indep_count; j++)
+ for (size_t j = i; j < lls->indep_count; j++) {
+ double eps = FFMAX(2 * DBL_EPSILON * fabs(refcovar[i][j]),
+ 8 * DBL_EPSILON);
if (!double_near_abs_eps(refcovar[i][j], lls->covariance[i][j],
- 8 * DBL_EPSILON)) {
+ eps)) {
fprintf(stderr, "%zu, %zu: %- .12f - %- .12f = % .12g\n", i, j,
refcovar[i][j], lls->covariance[i][j],
refcovar[i][j] - lls->covariance[i][j]);
fail();
}
+ }
bench_new(lls, var);
}
-#define EPS 0.2
static void test_evaluate(LLSModel *lls, const double *param, int order)
{
- double refprod, newprod;
+ double refprod, newprod, eps;
declare_func_float(double, LLSModel *, const double *, int);
refprod = call_ref(lls, param, order);
newprod = call_new(lls, param, order);
- if (!double_near_abs_eps(refprod, newprod, EPS)) {
+ eps = FFMAX(2 * DBL_EPSILON * fabs(refprod), 0.2);
+
+ if (!double_near_abs_eps(refprod, newprod, eps)) {
fprintf(stderr, "%- .12f - %- .12f = % .12g\n",
refprod, newprod, refprod - newprod);
fail();
--
2.49.1
From 0b5559378b1e9c309ef876ae309a61b23398355b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Tue, 1 Oct 2024 23:59:41 +0300
Subject: [PATCH 028/434] libavcodec: x86: Remove an explicit include of
config.asm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This file is never included explicitly anywhere else, it's only
included implicitly by passing -Pconfig.asm on the command line.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5c4ede6b4ff6fa8818f0ca3f686aa54c1c2092b8)
---
libavcodec/x86/celt_pvq_search.asm | 1 -
1 file changed, 1 deletion(-)
diff --git a/libavcodec/x86/celt_pvq_search.asm b/libavcodec/x86/celt_pvq_search.asm
index e9bff02650..3c6974d370 100644
--- a/libavcodec/x86/celt_pvq_search.asm
+++ b/libavcodec/x86/celt_pvq_search.asm
@@ -20,7 +20,6 @@
;* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
;******************************************************************************
-%include "config.asm"
%include "libavutil/x86/x86util.asm"
%ifdef __NASM_VER__
--
2.49.1
From 5c59d97e8ab90daefa198dcfb0ee4fdf9c57e37f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ingo=20Br=C3=BCckl?= <ib@oddnet.de>
Date: Wed, 9 Oct 2024 04:43:01 +0200
Subject: [PATCH 029/434] avcodec/vaapi_encode: fix compilation without
CONFIG_VAAPI_1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This adds VAAPIEncodeContext *ctx that has been removed
in aa82340b0ccdde4955fba41b8de5e45348ecd11d.
Signed-off-by: Ingo Brückl <ib@oddnet.de>
(cherry picked from commit 5557c673ea783a48e8b97c2b740b22eeeca6399b)
---
libavcodec/vaapi_encode_h264.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/vaapi_encode_h264.c b/libavcodec/vaapi_encode_h264.c
index fb87b68bec..ed20b9cd24 100644
--- a/libavcodec/vaapi_encode_h264.c
+++ b/libavcodec/vaapi_encode_h264.c
@@ -406,6 +406,9 @@ static int vaapi_encode_h264_init_picture_params(AVCodecContext *avctx,
FFHWBaseEncodePicture *pic)
{
FFHWBaseEncodeContext *base_ctx = avctx->priv_data;
+#if !CONFIG_VAAPI_1
+ VAAPIEncodeContext *ctx = avctx->priv_data;
+#endif
VAAPIEncodeH264Context *priv = avctx->priv_data;
VAAPIEncodePicture *vaapi_pic = pic->priv;
VAAPIEncodeH264Picture *hpic = pic->codec_priv;
--
2.49.1
From 32d3e677171e46828c2bf585fa25ae733ace6d0e Mon Sep 17 00:00:00 2001
From: Nicolas Gaullier <nicolas.gaullier@cji.paris>
Date: Fri, 4 Oct 2024 11:02:49 +0200
Subject: [PATCH 030/434] avfilter/framesync: fix forward EOF pts
Note1: when the EOF pts is not accurate enough, the last frame
can be dropped by vf_fps with default rounding.
Note2: vf_scale use framesync since e82a3997cdd6c0894869b33ba42430ac3,
so this is a very commonplace scenario.
For example:
./ffprobe -f lavfi testsrc=d=1,scale,fps -of flat \
-count_frames -show_entries stream=nb_read_frames
Before:
streams.stream.0.nb_read_frames="24"
After:
streams.stream.0.nb_read_frames="25"
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit de976eaf30df33e86c58c8c9af9905c1d8441934)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavfilter/framesync.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/libavfilter/framesync.c b/libavfilter/framesync.c
index 8e06e0e700..0d5779f830 100644
--- a/libavfilter/framesync.c
+++ b/libavfilter/framesync.c
@@ -103,14 +103,14 @@ int ff_framesync_init(FFFrameSync *fs, AVFilterContext *parent, unsigned nb_in)
return 0;
}
-static void framesync_eof(FFFrameSync *fs)
+static void framesync_eof(FFFrameSync *fs, int64_t pts)
{
fs->eof = 1;
fs->frame_ready = 0;
- ff_outlink_set_status(fs->parent->outputs[0], AVERROR_EOF, AV_NOPTS_VALUE);
+ ff_outlink_set_status(fs->parent->outputs[0], AVERROR_EOF, pts);
}
-static void framesync_sync_level_update(FFFrameSync *fs)
+static void framesync_sync_level_update(FFFrameSync *fs, int64_t eof_pts)
{
unsigned i, level = 0;
@@ -131,7 +131,7 @@ static void framesync_sync_level_update(FFFrameSync *fs)
if (level)
fs->sync_level = level;
else
- framesync_eof(fs);
+ framesync_eof(fs, eof_pts);
}
int ff_framesync_configure(FFFrameSync *fs)
@@ -179,7 +179,7 @@ int ff_framesync_configure(FFFrameSync *fs)
for (i = 0; i < fs->nb_in; i++)
fs->in[i].pts = fs->in[i].pts_next = AV_NOPTS_VALUE;
fs->sync_level = UINT_MAX;
- framesync_sync_level_update(fs);
+ framesync_sync_level_update(fs, AV_NOPTS_VALUE);
return 0;
}
@@ -200,7 +200,7 @@ static int framesync_advance(FFFrameSync *fs)
if (fs->in[i].have_next && fs->in[i].pts_next < pts)
pts = fs->in[i].pts_next;
if (pts == INT64_MAX) {
- framesync_eof(fs);
+ framesync_eof(fs, AV_NOPTS_VALUE);
break;
}
for (i = 0; i < fs->nb_in; i++) {
@@ -222,7 +222,7 @@ static int framesync_advance(FFFrameSync *fs)
fs->frame_ready = 1;
if (fs->in[i].state == STATE_EOF &&
fs->in[i].after == EXT_STOP)
- framesync_eof(fs);
+ framesync_eof(fs, AV_NOPTS_VALUE);
}
}
if (fs->frame_ready)
@@ -255,15 +255,14 @@ static void framesync_inject_frame(FFFrameSync *fs, unsigned in, AVFrame *frame)
fs->in[in].have_next = 1;
}
-static void framesync_inject_status(FFFrameSync *fs, unsigned in, int status, int64_t pts)
+static void framesync_inject_status(FFFrameSync *fs, unsigned in, int status, int64_t eof_pts)
{
av_assert0(!fs->in[in].have_next);
- pts = fs->in[in].state != STATE_RUN || fs->in[in].after == EXT_INFINITY
- ? INT64_MAX : framesync_pts_extrapolate(fs, in, fs->in[in].pts);
fs->in[in].sync = 0;
- framesync_sync_level_update(fs);
+ framesync_sync_level_update(fs, status == AVERROR_EOF ? eof_pts : AV_NOPTS_VALUE);
fs->in[in].frame_next = NULL;
- fs->in[in].pts_next = pts;
+ fs->in[in].pts_next = fs->in[in].state != STATE_RUN || fs->in[in].after == EXT_INFINITY
+ ? INT64_MAX : framesync_pts_extrapolate(fs, in, fs->in[in].pts);
fs->in[in].have_next = 1;
}
--
2.49.1
From 020d9f2b4886aa620252da4db7a4936378d6eb3a Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Sun, 13 Oct 2024 14:11:39 +0200
Subject: [PATCH 031/434] lavc/avcodec: fix global/private option precendence
Broken after 7753a9d62725d5bd8313e2d249acbe1c8af79ab1. Apply only the
whitelist early, and the rest with a single call to av_opt_set_dict2()
with AV_OPT_SEARCH_CHILDREN, which should be equivalent to the original
behaviour.
Reported-by: Cameron Gutman <aicommander@gmail.com>
(cherry picked from commit 9ce63e65d65b303813d4ae677228226d7cd232b9)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavcodec/avcodec.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/libavcodec/avcodec.c b/libavcodec/avcodec.c
index d1daf47611..1fa8704c9d 100644
--- a/libavcodec/avcodec.c
+++ b/libavcodec/avcodec.c
@@ -145,6 +145,7 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
int ret = 0;
AVCodecInternal *avci;
const FFCodec *codec2;
+ const AVDictionaryEntry *e;
if (avcodec_is_open(avctx))
return 0;
@@ -175,8 +176,14 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
if (avctx->extradata_size < 0 || avctx->extradata_size >= FF_MAX_EXTRADATA_SIZE)
return AVERROR(EINVAL);
- if ((ret = av_opt_set_dict(avctx, options)) < 0)
- return ret;
+ // set the whitelist from provided options dict,
+ // so we can check it immediately
+ e = options ? av_dict_get(*options, "codec_whitelist", NULL, 0) : NULL;
+ if (e) {
+ ret = av_opt_set(avctx, e->key, e->value, 0);
+ if (ret < 0)
+ return ret;
+ }
if (avctx->codec_whitelist && av_match_list(codec->name, avctx->codec_whitelist, ',') <= 0) {
av_log(avctx, AV_LOG_ERROR, "Codec (%s) not on whitelist \'%s\'\n", codec->name, avctx->codec_whitelist);
@@ -211,12 +218,14 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
av_opt_set_defaults(avctx->priv_data);
}
}
- if (codec->priv_class && (ret = av_opt_set_dict(avctx->priv_data, options)) < 0)
- goto free_and_end;
} else {
avctx->priv_data = NULL;
}
+ ret = av_opt_set_dict2(avctx, options, AV_OPT_SEARCH_CHILDREN);
+ if (ret < 0)
+ goto free_and_end;
+
// only call ff_set_dimensions() for non H.264/VP6F/DXV codecs so as not to overwrite previously setup dimensions
if (!(avctx->coded_width && avctx->coded_height && avctx->width && avctx->height &&
(avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id == AV_CODEC_ID_VP6F || avctx->codec_id == AV_CODEC_ID_DXV))) {
--
2.49.1
From 87ccf995cb855f0baced9916928b7b48d8b6ed9d Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Sat, 12 Oct 2024 19:08:55 +0200
Subject: [PATCH 032/434] fftools/ffmpeg_filter: treat apad filter as a source
Ideally lavfi should have a dedicated API for detecting this.
Fixes #11168 and #11061
(cherry picked from commit 9e2a231236428c4682c77858c6aabfd74f459b17)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
fftools/ffmpeg_filter.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c
index 4e3a47e3b6..38c7676a7e 100644
--- a/fftools/ffmpeg_filter.c
+++ b/fftools/ffmpeg_filter.c
@@ -1101,8 +1101,9 @@ int fg_create(FilterGraph **pfg, char *graph_desc, Scheduler *sch)
for (unsigned i = 0; i < graph->nb_filters; i++) {
const AVFilter *f = graph->filters[i]->filter;
- if (!avfilter_filter_pad_count(f, 0) &&
- !(f->flags & AVFILTER_FLAG_DYNAMIC_INPUTS)) {
+ if ((!avfilter_filter_pad_count(f, 0) &&
+ !(f->flags & AVFILTER_FLAG_DYNAMIC_INPUTS)) ||
+ !strcmp(f->name, "apad")) {
fgp->have_sources = 1;
break;
}
@@ -1497,7 +1498,7 @@ static int insert_filter(AVFilterContext **last_filter, int *pad_idx,
return 0;
}
-static int configure_output_video_filter(FilterGraph *fg, AVFilterGraph *graph,
+static int configure_output_video_filter(FilterGraphPriv *fgp, AVFilterGraph *graph,
OutputFilter *ofilter, AVFilterInOut *out)
{
OutputFilterPriv *ofp = ofp_from_ofilter(ofilter);
@@ -1576,7 +1577,7 @@ static int configure_output_video_filter(FilterGraph *fg, AVFilterGraph *graph,
return 0;
}
-static int configure_output_audio_filter(FilterGraph *fg, AVFilterGraph *graph,
+static int configure_output_audio_filter(FilterGraphPriv *fgp, AVFilterGraph *graph,
OutputFilter *ofilter, AVFilterInOut *out)
{
OutputFilterPriv *ofp = ofp_from_ofilter(ofilter);
@@ -1641,8 +1642,10 @@ static int configure_output_audio_filter(FilterGraph *fg, AVFilterGraph *graph,
pad_idx = 0;
}
- if (ofilter->apad)
+ if (ofilter->apad) {
AUTO_INSERT_FILTER("-apad", "apad", ofilter->apad);
+ fgp->have_sources = 1;
+ }
snprintf(name, sizeof(name), "trim for output %s", ofp->name);
ret = insert_trim(ofp->trim_start_us, ofp->trim_duration_us,
@@ -1658,12 +1661,12 @@ fail:
return ret;
}
-static int configure_output_filter(FilterGraph *fg, AVFilterGraph *graph,
+static int configure_output_filter(FilterGraphPriv *fgp, AVFilterGraph *graph,
OutputFilter *ofilter, AVFilterInOut *out)
{
switch (ofilter->type) {
- case AVMEDIA_TYPE_VIDEO: return configure_output_video_filter(fg, graph, ofilter, out);
- case AVMEDIA_TYPE_AUDIO: return configure_output_audio_filter(fg, graph, ofilter, out);
+ case AVMEDIA_TYPE_VIDEO: return configure_output_video_filter(fgp, graph, ofilter, out);
+ case AVMEDIA_TYPE_AUDIO: return configure_output_audio_filter(fgp, graph, ofilter, out);
default: av_assert0(0); return 0;
}
}
@@ -1940,7 +1943,7 @@ static int configure_filtergraph(FilterGraph *fg, FilterGraphThread *fgt)
avfilter_inout_free(&inputs);
for (cur = outputs, i = 0; cur; cur = cur->next, i++) {
- ret = configure_output_filter(fg, fgt->graph, fg->outputs[i], cur);
+ ret = configure_output_filter(fgp, fgt->graph, fg->outputs[i], cur);
if (ret < 0) {
avfilter_inout_free(&outputs);
goto fail;
--
2.49.1
From 9fbbd924f2863312b41303a48705b252b7ee1193 Mon Sep 17 00:00:00 2001
From: Emily <hello@emily.moe>
Date: Mon, 7 Oct 2024 00:04:56 +0100
Subject: [PATCH 033/434] fate/ffmpeg: add samples dependency to
fate-ffmpeg-spec-disposition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This test utilizes an MPEG-TS sample from FATE suite, yet was
marked as not requiring samples.
Reviewed-by: Jan Ekström <jeebjp@gmail.com>
(cherry picked from commit 3565903c638fb77d600d2983701b12300e695a5d)
---
tests/fate/ffmpeg.mak | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/fate/ffmpeg.mak b/tests/fate/ffmpeg.mak
index 869376dd18..d9348ee837 100644
--- a/tests/fate/ffmpeg.mak
+++ b/tests/fate/ffmpeg.mak
@@ -266,4 +266,4 @@ FATE_FFMPEG-$(call ENCDEC2, MPEG2VIDEO, FFV1, NUT, HSTACK_FILTER PIPE_PROTOCOL F
# test matching by stream disposition
fate-ffmpeg-spec-disposition: CMD = framecrc -i $(TARGET_SAMPLES)/mpegts/pmtchange.ts -map '0:disp:visual_impaired+descriptions:1' -c copy
-FATE_FFMPEG-$(call FRAMECRC, MPEGTS,,) += fate-ffmpeg-spec-disposition
+FATE_SAMPLES_FFMPEG-$(call FRAMECRC, MPEGTS,,) += fate-ffmpeg-spec-disposition
--
2.49.1
From 15035aaec0b5d86ea063b8b3d46d13ed1ee9bed2 Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Tue, 22 Oct 2024 19:49:16 +0200
Subject: [PATCH 034/434] avutil/wchar_filename: re-introduce explicit cast of
void* to char*
Fixes compile error on windows with decklink:
In file included from ./libavformat/os_support.h:175,
from ./libavformat/internal.h:30,
from libavdevice/decklink_common.cpp:25:
./libavutil/wchar_filename.h: In function 'int wchartocp(unsigned int, const wchar_t*, char**)':
./libavutil/wchar_filename.h:59:32: error: invalid conversion from 'void*' to 'char*' [-fpermissive]
59 | *filename = av_malloc_array(num_chars, sizeof **filename);
| ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| void*
Regression since e9e8bea2e79bc3c481a6f81f75f6c871e3e0f367.
Fixes ticket #11103.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 9b0128aa766221f8a32e13cf3c1d3e6d75a2d829)
---
libavutil/wchar_filename.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavutil/wchar_filename.h b/libavutil/wchar_filename.h
index 23cc92aa2d..1370a084c9 100644
--- a/libavutil/wchar_filename.h
+++ b/libavutil/wchar_filename.h
@@ -57,7 +57,7 @@ static inline int wchartocp(unsigned int code_page, const wchar_t *filename_w,
errno = EINVAL;
return -1;
}
- *filename = av_malloc_array(num_chars, sizeof **filename);
+ *filename = (char *)av_malloc_array(num_chars, sizeof **filename);
if (!*filename) {
errno = ENOMEM;
return -1;
--
2.49.1
From 367b7b546f0e012eadcbcf88fe28c6ebf8d16d8e Mon Sep 17 00:00:00 2001
From: Leandro Santiago <leandrosansilva@gmail.com>
Date: Thu, 31 Oct 2024 21:50:45 +0100
Subject: [PATCH 035/434] fftools/ffplay: fix crash when vk renderer is null
When vulkan rendering is requested by the user and fails, ffplay should
exit graciously instead of crash due to a null pointer deref.
Signed-off-by: Leandro Santiago <leandrosansilva@gmail.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit fd0cacc4720c68c58f86e41153444252dbd4e5b6)
---
fftools/ffplay.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fftools/ffplay.c b/fftools/ffplay.c
index 60d8874eab..96b0b614b9 100644
--- a/fftools/ffplay.c
+++ b/fftools/ffplay.c
@@ -2607,6 +2607,11 @@ static int create_hwaccel(AVBufferRef **device_ctx)
if (type == AV_HWDEVICE_TYPE_NONE)
return AVERROR(ENOTSUP);
+ if (!vk_renderer) {
+ av_log(NULL, AV_LOG_ERROR, "Vulkan renderer is not available\n");
+ return AVERROR(ENOTSUP);
+ }
+
ret = vk_renderer_get_hw_dev(vk_renderer, &vk_dev);
if (ret < 0)
return ret;
--
2.49.1
From 5120d30890838f71de723f2318de23b363989834 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Sat, 26 Oct 2024 11:48:48 +0200
Subject: [PATCH 036/434] Document stream specifier syntax change from
46cbe4ab5c
Fixes #11248.
(cherry picked from commit 9e68b26765ca8396050f4b58d4b4fdc53943d35f)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
Changelog | 9 +++++++++
doc/ffmpeg.texi | 2 +-
doc/fftools-common-opts.texi | 3 ++-
3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/Changelog b/Changelog
index 0c05ad2946..17bec3ceee 100644
--- a/Changelog
+++ b/Changelog
@@ -27,6 +27,15 @@ version 7.1:
- LCEVC enhancement data exporting in H.26x and MP4/ISOBMFF
- LCEVC filter
- MV-HEVC decoding
+- minor stream specifier syntax changes:
+ - when matching by metadata (:m:<key>:<val>), the colon character
+ in keys or values now has to be backslash-escaped
+ - in optional maps (-map ....?) with a metadata-matching stream specifier,
+ the value has to be separated from the question mark by a colon, i.e.
+ -map ....:m:<key>:<val>:? (otherwise it would be ambiguous whether the
+ question mark is a part of <val> or not)
+ - multiple stream types in a single specifier (e.g. :s:s:0) now cause an
+ error, as such a specifier makes no sense
version 7.0:
diff --git a/doc/ffmpeg.texi b/doc/ffmpeg.texi
index 34007f7ea2..013f5f4dab 100644
--- a/doc/ffmpeg.texi
+++ b/doc/ffmpeg.texi
@@ -1799,7 +1799,7 @@ Set the size of the canvas used to render subtitles.
@section Advanced options
@table @option
-@item -map [-]@var{input_file_id}[:@var{stream_specifier}][:@var{view_specifier}][?] | @var{[linklabel]} (@emph{output})
+@item -map [-]@var{input_file_id}[:@var{stream_specifier}][:@var{view_specifier}][:?] | @var{[linklabel]} (@emph{output})
Create one or more streams in the output file. This option has two forms for
specifying the data source(s): the first selects one or more streams from some
diff --git a/doc/fftools-common-opts.texi b/doc/fftools-common-opts.texi
index 4e48789def..8b0931a86d 100644
--- a/doc/fftools-common-opts.texi
+++ b/doc/fftools-common-opts.texi
@@ -78,7 +78,8 @@ Match the stream by stream id (e.g. PID in MPEG-TS container).
@item m:@var{key}[:@var{value}]
Matches streams with the metadata tag @var{key} having the specified value. If
@var{value} is not given, matches streams that contain the given tag with any
-value.
+value. The colon character ':' in @var{key} or @var{value} needs to be
+backslash-escaped.
@item disp:@var{dispositions}[:@var{additional_stream_specifier}]
Matches streams with the given disposition(s). @var{dispositions} is a list of
one or more dispositions (as printed by the @option{-dispositions} option)
--
2.49.1
From baef55364f3aec557c460621ca3e98b74646ebd4 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 10 Nov 2024 16:46:31 -0300
Subject: [PATCH 037/434] avcodec/x86/vvc: add prototypes for OF functions
And wrap the implemtation in preprocessor checks.
Should fix ticket #11282.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9ec042c1aaa64b5f6dff8be263feff4288c1844e)
---
libavcodec/x86/vvc/vvcdsp_init.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/libavcodec/x86/vvc/vvcdsp_init.c b/libavcodec/x86/vvc/vvcdsp_init.c
index f3e2e3a27b..3a128b21ed 100644
--- a/libavcodec/x86/vvc/vvcdsp_init.c
+++ b/libavcodec/x86/vvc/vvcdsp_init.c
@@ -102,19 +102,29 @@ DMVR_PROTOTYPES( 8, avx2)
DMVR_PROTOTYPES(10, avx2)
DMVR_PROTOTYPES(12, avx2)
+#define OF_PROTOTYPES(bd, opt) \
+void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \
+ const int16_t *src0, const int16_t *src1, int w, int h); \
+
+OF_PROTOTYPES( 8, avx2)
+OF_PROTOTYPES(10, avx2)
+OF_PROTOTYPES(12, avx2)
+
+#if ARCH_X86_64 && HAVE_AVX2_EXTERNAL
void ff_vvc_apply_bdof_avx2(uint8_t *dst, ptrdiff_t dst_stride, \
const int16_t *src0, const int16_t *src1, int w, int h, int pixel_max); \
-#define OF_PROTOTYPES(bd, opt) \
-static void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \
+#define OF_FUNC(bd, opt) \
+void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \
const int16_t *src0, const int16_t *src1, int w, int h) \
{ \
ff_vvc_apply_bdof##_##opt(dst, dst_stride, src0, src1, w, h, (1 << bd) - 1); \
} \
-OF_PROTOTYPES( 8, avx2)
-OF_PROTOTYPES(10, avx2)
-OF_PROTOTYPES(12, avx2)
+OF_FUNC( 8, avx2)
+OF_FUNC(10, avx2)
+OF_FUNC(12, avx2)
+#endif
#define ALF_BPC_PROTOTYPES(bpc, opt) \
void BF(ff_vvc_alf_filter_luma, bpc, opt)(uint8_t *dst, ptrdiff_t dst_stride, \
--
2.49.1
From 1b1ba7d4f20c14d084b5304b39d45c8a6c80013b Mon Sep 17 00:00:00 2001
From: Nuo Mi <nuomi2021@gmail.com>
Date: Sun, 10 Nov 2024 14:20:24 +0800
Subject: [PATCH 038/434] avcodec/cbs_h266: Fix regression in DVB clip
introduced by 93281630a71c06642adfebebb0d4b105a4e02e91
This commit introduced a regression to VVC_HDR_UHDTV1_OpenGOP_3840x2160_50fps_HLG10_mosaic.ts.
Root Cause:
The AV_CEIL_RSHIFT(a, b) macro uses bit tricks that work only when -a is a negative value.
However, due to integer promotion rules, this behavior does not extend to the unsigned int type.
See "6.3.1.1 Boolean, characters, and integers" in the "ISO/IEC 9899" for details.
Reported-by: Frank Plowman <post@frankplowman.com>
(cherry picked from commit c49001e338feb9d8537bb00de33b2a5725ea6028)
---
libavcodec/cbs_h266_syntax_template.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index b4165b43b3..d33629b06c 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1162,7 +1162,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
for (i = 1; i <= current->sps_num_subpics_minus1; i++) {
if (!current->sps_subpic_same_size_flag) {
if (current->sps_pic_width_max_in_luma_samples > ctb_size_y) {
- const unsigned int win_right_edge =
+ const int win_right_edge =
current->sps_pic_width_max_in_luma_samples
- current->sps_conf_win_right_offset * sub_width_c;
us(wlen, sps_subpic_ctu_top_left_x[i], 0,
@@ -1172,7 +1172,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
infer(sps_subpic_ctu_top_left_x[i], 0);
if (current->sps_pic_height_max_in_luma_samples >
ctb_size_y) {
- const unsigned int win_bottom_edge =
+ const int win_bottom_edge =
current->sps_pic_height_max_in_luma_samples
- current->sps_conf_win_bottom_offset * sub_height_c;
us(hlen, sps_subpic_ctu_top_left_y[i], 0,
@@ -1183,9 +1183,9 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
if (i < current->sps_num_subpics_minus1 &&
current->sps_pic_width_max_in_luma_samples >
ctb_size_y) {
- const unsigned int win_left_edge =
+ const int win_left_edge =
current->sps_conf_win_left_offset * sub_width_c;
- const unsigned int win_left_edge_ctus =
+ const int win_left_edge_ctus =
AV_CEIL_RSHIFT(win_left_edge, ctb_log2_size_y);
us(wlen, sps_subpic_width_minus1[i],
win_left_edge_ctus > current->sps_subpic_ctu_top_left_x[i]
@@ -1200,9 +1200,9 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
if (i < current->sps_num_subpics_minus1 &&
current->sps_pic_height_max_in_luma_samples >
ctb_size_y) {
- const unsigned int win_top_edge =
+ const int win_top_edge =
current->sps_conf_win_top_offset * sub_height_c;
- const unsigned int win_top_edge_ctus =
+ const int win_top_edge_ctus =
AV_CEIL_RSHIFT(win_top_edge, ctb_log2_size_y);
us(hlen, sps_subpic_height_minus1[i],
win_top_edge_ctus > current->sps_subpic_ctu_top_left_y[i]
--
2.49.1
From 03ffd4b3b36535833ba179823dc26e811650581d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Fri, 1 Nov 2024 13:50:38 +0100
Subject: [PATCH 039/434] avcodec/jpegxl_parser: check
entropy_decoder_read_symbol return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Found by OSS-Fuzz.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
---
libavcodec/jpegxl_parser.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 8c45e1a1b7..746c429b9c 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
// permuted toc
if (get_bits1(gb)) {
JXLEntropyDecoder dec;
- uint32_t end, lehmer = 0;
+ int64_t end, lehmer = 0;
ret = entropy_decoder_init(avctx, gb, &dec, 8);
if (ret < 0)
return ret;
@@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
return AVERROR_BUFFER_TOO_SMALL;
}
end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count));
- if (end > toc_count) {
+ if (end < 0 || end > toc_count) {
entropy_decoder_close(&dec);
return AVERROR_INVALIDDATA;
}
for (uint32_t i = 0; i < end; i++) {
lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer));
- if (get_bits_left(gb) < 0) {
+ if (lehmer < 0 || get_bits_left(gb) < 0) {
entropy_decoder_close(&dec);
return AVERROR_BUFFER_TOO_SMALL;
}
--
2.49.1
From 11e8319b8ef0015e248ff3a400457ebdc0eb77b2 Mon Sep 17 00:00:00 2001
From: Leo Izen <leo.izen@gmail.com>
Date: Thu, 7 Nov 2024 11:31:49 -0500
Subject: [PATCH 040/434] avcodec/jpegxl_parser: fix reading lz77-pair as
initial entropy symbol
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The JPEG XL parser has an entropy decoder inside, which supports LZ77
length-distance pairs. If the first symbol from the entropy stream is an
LZ77 pair, the bitstream is invalid, so we should abort immediately rather
than attempt to read it anyway (which would read from the uninitialized
starting window).
Reported-by: Kacper Michajłow <kasper93@gmail.com>
Found-by: ossfuzz
Fixes: 368725676/clusterfuzz-testcase-minimized-fuzzer_protocol_file-6022251122589696-cut
Fixes: 42537758/clusterfuzz-testcase-minimized-fuzzer_protocol_file-5818969469026304-cut
Signed-off-by: Leo Izen <leo.izen@gmail.com>
---
libavcodec/jpegxl_parser.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 746c429b9c..76122af54a 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -352,6 +352,8 @@ static int decode_hybrid_varlen_uint(GetBitContext *gb, JXLEntropyDecoder *dec,
if (bundle->lz77_enabled && token >= bundle->lz77_min_symbol) {
const JXLSymbolDistribution *lz77dist = &bundle->dists[bundle->cluster_map[bundle->num_dist - 1]];
+ if (!dec->num_decoded)
+ return AVERROR_INVALIDDATA;
ret = read_hybrid_uint(gb, &bundle->lz_len_conf, token - bundle->lz77_min_symbol, &dec->num_to_copy);
if (ret < 0)
return ret;
@@ -531,6 +533,7 @@ static int read_dist_clustering(GetBitContext *gb, JXLEntropyDecoder *dec, JXLDi
dec->state = -1;
/* it's not going to necessarily be zero after reading */
dec->num_to_copy = 0;
+ dec->num_decoded = 0;
dist_bundle_close(&nested);
if (use_mtf) {
uint8_t mtf[256];
--
2.49.1
From 4ea558152f05e41f15a548e2aab8e5d40546af5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= <remi@remlab.net>
Date: Sat, 16 Nov 2024 08:57:54 +0200
Subject: [PATCH 041/434] lavc/h264dsp: move RISC-V fn pointers to .data.rel.ro
This should fix PIC builds.
---
libavcodec/riscv/h264dsp_rvv.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/riscv/h264dsp_rvv.S b/libavcodec/riscv/h264dsp_rvv.S
index 422ac02222..97c6708309 100644
--- a/libavcodec/riscv/h264dsp_rvv.S
+++ b/libavcodec/riscv/h264dsp_rvv.S
@@ -176,7 +176,7 @@ endfunc
.global ff_h264_weight_funcs_8_rvv
.hidden ff_h264_weight_funcs_8_rvv
-const ff_h264_weight_funcs_8_rvv
+const ff_h264_weight_funcs_8_rvv, relocate=1
.irp w, 16, 8, 4, 2
#if __riscv_xlen == 32
.word ff_h264_weight_pixels\w\()_8_rvv
--
2.49.1
From f686cf77db3d3d556072c8b557deca366ccfe7dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= <remi@remlab.net>
Date: Sat, 16 Nov 2024 16:22:49 +0200
Subject: [PATCH 042/434] lavc/h264idct: fix RISC-V group multiplier
After the branch, the expected SEW/LMUL ratio is 1 byte/vector.
So we have to set the same ratio before branching (QEMU does not care,
but real hardware does).
(cherry picked from commit bbb0fdedb78c289f1d3ce3fccb000f031ccfa748)
---
libavcodec/riscv/h264idct_rvv.S | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavcodec/riscv/h264idct_rvv.S b/libavcodec/riscv/h264idct_rvv.S
index d2f77a5b47..b1e06d93f7 100644
--- a/libavcodec/riscv/h264idct_rvv.S
+++ b/libavcodec/riscv/h264idct_rvv.S
@@ -644,7 +644,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x
sd a4, 24(sp)
ld a0, 0(a0) # dest[0]
addi a1, a1, 16 * 4 # &block_offset[16]
- vsetivli zero, 4, e8, mf4, ta, ma
+ vsetivli zero, 4, e8, m1, ta, ma
jal .Lidct4_add4_\depth\()_rvv
ld a4, 24(sp) # nnzc
@@ -655,7 +655,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x
ld a0, 8(a0) # dest[1]
lla t0, ff_h264_scan8 + 32
.ifc \type, 8_422
- vsetivli zero, 4, e8, mf4, ta, ma
+ vsetivli zero, 4, e8, m1, ta, ma
jal .Lidct4_add4_\depth\()_rvv
ld a4, 24(sp) # nnzc
@@ -665,7 +665,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x
addi a1, t5, (-8 - 4) * 4 # &block_offset[24]
ld a0, 0(a0) # dest[0]
lla t0, ff_h264_scan8 + 24
- vsetivli zero, 4, e8, mf4, ta, ma
+ vsetivli zero, 4, e8, m1, ta, ma
jal .Lidct4_add4_\depth\()_rvv
ld a4, 24(sp) # nnzc
@@ -679,7 +679,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x
ld ra, 8(sp)
ld s0, 0(sp)
addi sp, sp, 32
- vsetivli zero, 4, e8, mf4, ta, ma
+ vsetivli zero, 4, e8, m1, ta, ma
j .Lidct4_add4_\depth\()_rvv
endfunc
.endm
--
2.49.1
From 779b0fe015b166f83a607e4126d1c55810c46855 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 30 Sep 2024 13:43:23 -0300
Subject: [PATCH 043/434] avformat/mov: factorize getting the current item
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 58c265d956f4ce2efb0004c398e2c1f030f9398a)
---
libavformat/mov.c | 45 ++++++++++++++++++++++++++++-----------------
1 file changed, 28 insertions(+), 17 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 5b0b23ffc1..75951d6b4c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -188,6 +188,24 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len,
return p - dst;
}
+/**
+ * Get the current item in the parsing process.
+ */
+static HEIFItem *heif_cur_item(MOVContext *c)
+{
+ HEIFItem *item = NULL;
+
+ for (int i = 0; i < c->nb_heif_item; i++) {
+ if (c->heif_item[i].item_id != c->cur_item_id)
+ continue;
+
+ item = &c->heif_item[i];
+ break;
+ }
+
+ return item;
+}
+
/**
* Get the current stream in the parsing process. This can either be the
* latest stream added to the context, or the stream referenced by an item.
@@ -195,23 +213,17 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len,
static AVStream *get_curr_st(MOVContext *c)
{
AVStream *st = NULL;
+ HEIFItem *item;
if (c->fc->nb_streams < 1)
return NULL;
- for (int i = 0; i < c->nb_heif_item; i++) {
- HEIFItem *item = &c->heif_item[i];
-
- if (!item->st)
- continue;
- if (item->st->id != c->cur_item_id)
- continue;
+ if (c->cur_item_id == -1)
+ return c->fc->streams[c->fc->nb_streams-1];
+ item = heif_cur_item(c);
+ if (item)
st = item->st;
- break;
- }
- if (!st && c->cur_item_id == -1)
- st = c->fc->streams[c->fc->nb_streams-1];
return st;
}
@@ -8912,6 +8924,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
+ HEIFItem *item;
uint32_t width, height;
avio_r8(pb); /* version */
@@ -8922,12 +8935,10 @@ static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_log(c->fc, AV_LOG_TRACE, "ispe: item_id %d, width %u, height %u\n",
c->cur_item_id, width, height);
- for (int i = 0; i < c->nb_heif_item; i++) {
- if (c->heif_item[i].item_id == c->cur_item_id) {
- c->heif_item[i].width = width;
- c->heif_item[i].height = height;
- break;
- }
+ item = heif_cur_item(c);
+ if (item) {
+ item->width = width;
+ item->height = height;
}
return 0;
--
2.49.1
From 23697c3f02c43ef8135357eda5b58e884e7ccf45 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 5 Oct 2024 10:32:14 -0300
Subject: [PATCH 044/434] avformat/mov: split off heif item initialization to
its own function
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d5eb0e7fb334b83849a8515d83f8a3acb5a762c6)
---
libavformat/mov.c | 98 ++++++++++++++++++++++++++---------------------
1 file changed, 55 insertions(+), 43 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 75951d6b4c..11ee8b8d7f 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10072,6 +10072,58 @@ static int mov_parse_tiles(AVFormatContext *s)
return 0;
}
+static int mov_parse_heif_items(AVFormatContext *s)
+{
+ MOVContext *mov = s->priv_data;
+ int err;
+
+ for (int i = 0; i < mov->nb_heif_item; i++) {
+ HEIFItem *item = &mov->heif_item[i];
+ MOVStreamContext *sc;
+ AVStream *st;
+ int64_t offset = 0;
+
+ if (!item->st) {
+ if (item->item_id == mov->thmb_item_id) {
+ av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n");
+ return AVERROR_INVALIDDATA;
+ }
+ continue;
+ }
+ if (item->is_idat_relative) {
+ if (!mov->idat_offset) {
+ av_log(s, AV_LOG_ERROR, "Missing idat box for item %d\n", item->item_id);
+ return AVERROR_INVALIDDATA;
+ }
+ offset = mov->idat_offset;
+ }
+
+ st = item->st;
+ sc = st->priv_data;
+ st->codecpar->width = item->width;
+ st->codecpar->height = item->height;
+
+ if (sc->sample_count != 1 || sc->chunk_count != 1)
+ return AVERROR_INVALIDDATA;
+
+ sc->sample_sizes[0] = item->extent_length;
+ sc->chunk_offsets[0] = item->extent_offset + offset;
+
+ if (item->item_id == mov->primary_item_id)
+ st->disposition |= AV_DISPOSITION_DEFAULT;
+
+ mov_build_index(mov, st);
+ }
+
+ if (mov->nb_heif_grid) {
+ err = mov_parse_tiles(s);
+ if (err < 0)
+ return err;
+ }
+
+ return 0;
+}
+
static AVStream *mov_find_reference_track(AVFormatContext *s, AVStream *st,
int first_index)
{
@@ -10129,49 +10181,9 @@ static int mov_read_header(AVFormatContext *s)
av_log(mov->fc, AV_LOG_TRACE, "on_parse_exit_offset=%"PRId64"\n", avio_tell(pb));
if (mov->found_iloc && mov->found_iinf) {
- for (i = 0; i < mov->nb_heif_item; i++) {
- HEIFItem *item = &mov->heif_item[i];
- MOVStreamContext *sc;
- AVStream *st;
- int64_t offset = 0;
-
- if (!item->st) {
- if (item->item_id == mov->thmb_item_id) {
- av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n");
- return AVERROR_INVALIDDATA;
- }
- continue;
- }
- if (item->is_idat_relative) {
- if (!mov->idat_offset) {
- av_log(s, AV_LOG_ERROR, "Missing idat box for item %d\n", item->item_id);
- return AVERROR_INVALIDDATA;
- }
- offset = mov->idat_offset;
- }
-
- st = item->st;
- sc = st->priv_data;
- st->codecpar->width = item->width;
- st->codecpar->height = item->height;
-
- if (sc->sample_count != 1 || sc->chunk_count != 1)
- return AVERROR_INVALIDDATA;
-
- sc->sample_sizes[0] = item->extent_length;
- sc->chunk_offsets[0] = item->extent_offset + offset;
-
- if (item->item_id == mov->primary_item_id)
- st->disposition |= AV_DISPOSITION_DEFAULT;
-
- mov_build_index(mov, st);
- }
-
- if (mov->nb_heif_grid) {
- err = mov_parse_tiles(s);
- if (err < 0)
- return err;
- }
+ err = mov_parse_heif_items(s);
+ if (err < 0)
+ return err;
}
// prevent iloc and iinf boxes from being parsed while reading packets.
// this is needed because an iinf box may have been parsed but ignored
--
2.49.1
From f8fcebae95f711ce980c954eb41d2e2e703d5e14 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 8 Nov 2024 20:43:39 -0300
Subject: [PATCH 045/434] avformat/mov: use an array of pointers for heif_item
Pointers to specific entries in the array are stored in other structs, so
in the scenario where heif_item was reallocated when parsing an iloc box after
and iinf one, the pointers may end up referencing freed memory.
Fixes use-after-free with such samples.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavformat/isom.h | 2 +-
libavformat/mov.c | 93 +++++++++++++++++++++++++++++-----------------
2 files changed, 60 insertions(+), 35 deletions(-)
diff --git a/libavformat/isom.h b/libavformat/isom.h
index 4723397048..ffabc01a2d 100644
--- a/libavformat/isom.h
+++ b/libavformat/isom.h
@@ -355,7 +355,7 @@ typedef struct MOVContext {
uint32_t max_stts_delta;
int primary_item_id;
int cur_item_id;
- HEIFItem *heif_item;
+ HEIFItem **heif_item;
int nb_heif_item;
HEIFGrid *heif_grid;
int nb_heif_grid;
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 11ee8b8d7f..54f8594f67 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -196,10 +196,10 @@ static HEIFItem *heif_cur_item(MOVContext *c)
HEIFItem *item = NULL;
for (int i = 0; i < c->nb_heif_item; i++) {
- if (c->heif_item[i].item_id != c->cur_item_id)
+ if (!c->heif_item[i] || c->heif_item[i]->item_id != c->cur_item_id)
continue;
- item = &c->heif_item[i];
+ item = c->heif_item[i];
break;
}
@@ -8612,7 +8612,7 @@ static int mov_read_idat(MOVContext *c, AVIOContext *pb, MOVAtom atom)
static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
- HEIFItem *heif_item;
+ HEIFItem **heif_item;
int version, offset_size, length_size, base_offset_size, index_size;
int item_count, extent_count;
int64_t base_offset, extent_offset, extent_length;
@@ -8643,12 +8643,13 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
return AVERROR(ENOMEM);
c->heif_item = heif_item;
if (item_count > c->nb_heif_item)
- memset(c->heif_item + c->nb_heif_item, 0,
+ memset(&c->heif_item[c->nb_heif_item], 0,
sizeof(*c->heif_item) * (item_count - c->nb_heif_item));
c->nb_heif_item = FFMAX(c->nb_heif_item, item_count);
av_log(c->fc, AV_LOG_TRACE, "iloc: item_count %d\n", item_count);
for (int i = 0; i < item_count; i++) {
+ HEIFItem *item = c->heif_item[i];
int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb);
int offset_type = (version > 0) ? avio_rb16(pb) & 0xf : 0;
@@ -8658,7 +8659,6 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avpriv_report_missing_feature(c->fc, "iloc offset type %d", offset_type);
return AVERROR_PATCHWELCOME;
}
- c->heif_item[i].item_id = item_id;
avio_rb16(pb); // data_reference_index.
if (rb_size(pb, &base_offset, base_offset_size) < 0)
@@ -8669,19 +8669,26 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avpriv_report_missing_feature(c->fc, "iloc: extent_count > 1");
return AVERROR_PATCHWELCOME;
}
- for (int j = 0; j < extent_count; j++) {
- if (rb_size(pb, &extent_offset, offset_size) < 0 ||
- rb_size(pb, &extent_length, length_size) < 0 ||
- base_offset > INT64_MAX - extent_offset)
- return AVERROR_INVALIDDATA;
- if (offset_type == 1)
- c->heif_item[i].is_idat_relative = 1;
- c->heif_item[i].extent_length = extent_length;
- c->heif_item[i].extent_offset = base_offset + extent_offset;
- av_log(c->fc, AV_LOG_TRACE, "iloc: item_idx %d, offset_type %d, "
- "extent_offset %"PRId64", extent_length %"PRId64"\n",
- i, offset_type, c->heif_item[i].extent_offset, c->heif_item[i].extent_length);
- }
+
+ if (rb_size(pb, &extent_offset, offset_size) < 0 ||
+ rb_size(pb, &extent_length, length_size) < 0 ||
+ base_offset > INT64_MAX - extent_offset)
+ return AVERROR_INVALIDDATA;
+
+ if (!item)
+ item = c->heif_item[i] = av_mallocz(sizeof(*item));
+ if (!item)
+ return AVERROR(ENOMEM);
+
+ item->item_id = item_id;
+
+ if (offset_type == 1)
+ item->is_idat_relative = 1;
+ item->extent_length = extent_length;
+ item->extent_offset = base_offset + extent_offset;
+ av_log(c->fc, AV_LOG_TRACE, "iloc: item_idx %d, offset_type %d, "
+ "extent_offset %"PRId64", extent_length %"PRId64"\n",
+ i, offset_type, item->extent_offset, item->extent_length);
}
c->found_iloc = 1;
@@ -8690,6 +8697,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom)
static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
{
+ HEIFItem *item;
AVBPrint item_name;
int64_t size = atom.size;
uint32_t item_type;
@@ -8729,15 +8737,21 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
if (size > 0)
avio_skip(pb, size);
+ item = c->heif_item[idx];
+ if (!item)
+ item = c->heif_item[idx] = av_mallocz(sizeof(*item));
+ if (!item)
+ return AVERROR(ENOMEM);
+
if (ret)
- av_bprint_finalize(&item_name, &c->heif_item[idx].name);
- c->heif_item[idx].item_id = item_id;
- c->heif_item[idx].type = item_type;
+ av_bprint_finalize(&item_name, &c->heif_item[idx]->name);
+ c->heif_item[idx]->item_id = item_id;
+ c->heif_item[idx]->type = item_type;
switch (item_type) {
case MKTAG('a','v','0','1'):
case MKTAG('h','v','c','1'):
- ret = heif_add_stream(c, &c->heif_item[idx]);
+ ret = heif_add_stream(c, c->heif_item[idx]);
if (ret < 0)
return ret;
break;
@@ -8748,7 +8762,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
- HEIFItem *heif_item;
+ HEIFItem **heif_item;
int entry_count;
int version, got_stream = 0, ret, i;
@@ -8766,15 +8780,17 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
return AVERROR(ENOMEM);
c->heif_item = heif_item;
if (entry_count > c->nb_heif_item)
- memset(c->heif_item + c->nb_heif_item, 0,
+ memset(&c->heif_item[c->nb_heif_item], 0,
sizeof(*c->heif_item) * (entry_count - c->nb_heif_item));
c->nb_heif_item = FFMAX(c->nb_heif_item, entry_count);
for (i = 0; i < entry_count; i++) {
MOVAtom infe;
- if (avio_feof(pb))
- return AVERROR_INVALIDDATA;
+ if (avio_feof(pb)) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
infe.size = avio_rb32(pb) - 8;
infe.type = avio_rl32(pb);
ret = mov_read_infe(c, pb, infe, i);
@@ -8788,7 +8804,10 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
return 0;
fail:
for (; i >= 0; i--) {
- HEIFItem *item = &c->heif_item[i];
+ HEIFItem *item = c->heif_item[i];
+
+ if (!item)
+ continue;
av_freep(&item->name);
if (!item->st)
@@ -8816,9 +8835,9 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version)
}
}
for (int i = 0; i < c->nb_heif_item; i++) {
- if (c->heif_item[i].item_id != from_item_id)
+ if (!c->heif_item[i] || c->heif_item[i]->item_id != from_item_id)
continue;
- item = &c->heif_item[i];
+ item = c->heif_item[i];
switch (item->type) {
case MKTAG('g','r','i','d'):
@@ -9692,8 +9711,12 @@ static int mov_read_close(AVFormatContext *s)
av_freep(&mov->aes_decrypt);
av_freep(&mov->chapter_tracks);
- for (i = 0; i < mov->nb_heif_item; i++)
- av_freep(&mov->heif_item[i].name);
+ for (i = 0; i < mov->nb_heif_item; i++) {
+ if (!mov->heif_item[i])
+ continue;
+ av_freep(&mov->heif_item[i]->name);
+ av_freep(&mov->heif_item[i]);
+ }
av_freep(&mov->heif_item);
for (i = 0; i < mov->nb_heif_grid; i++) {
av_freep(&mov->heif_grid[i].tile_id_list);
@@ -10009,10 +10032,10 @@ static int mov_parse_tiles(AVFormatContext *s)
int k;
for (k = 0; k < mov->nb_heif_item; k++) {
- HEIFItem *item = &mov->heif_item[k];
+ HEIFItem *item = mov->heif_item[k];
AVStream *st = item->st;
- if (item->item_id != tile_id)
+ if (!item || item->item_id != tile_id)
continue;
if (!st) {
av_log(s, AV_LOG_WARNING, "HEIF item id %d from grid id %d doesn't "
@@ -10078,11 +10101,13 @@ static int mov_parse_heif_items(AVFormatContext *s)
int err;
for (int i = 0; i < mov->nb_heif_item; i++) {
- HEIFItem *item = &mov->heif_item[i];
+ HEIFItem *item = mov->heif_item[i];
MOVStreamContext *sc;
AVStream *st;
int64_t offset = 0;
+ if (!item)
+ continue;
if (!item->st) {
if (item->item_id == mov->thmb_item_id) {
av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n");
--
2.49.1
From 5f8b02a9ffc233f962dd6b267f5ae377eca22571 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 24 Oct 2024 23:09:23 -0300
Subject: [PATCH 046/434] avcodec/aom_film_grain: allocate film grain metadata
dynamically
This removes the ABI breaking use of sizeof(AVFilmGrainParams), and achieves the
same size reduction to decoder structs as 08b1bffa49715a9615acc025dfbea252d8409e1f.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fd4a2c9b026d8e23301854a500fdfc7bd4a4cbc6)
---
libavcodec/aom_film_grain.c | 49 +++++++++++++++++++++++++++++--------
libavcodec/aom_film_grain.h | 6 ++++-
libavcodec/h2645_sei.c | 12 ++++++++-
libavcodec/hevc/hevcdec.c | 1 -
4 files changed, 55 insertions(+), 13 deletions(-)
diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c
index e302567ba5..1b1693dcd9 100644
--- a/libavcodec/aom_film_grain.c
+++ b/libavcodec/aom_film_grain.c
@@ -26,7 +26,9 @@
*/
#include "libavutil/avassert.h"
+#include "libavutil/buffer.h"
#include "libavutil/imgutils.h"
+#include "libavutil/mem.h"
#include "aom_film_grain.h"
#include "get_bits.h"
@@ -124,7 +126,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
{
GetBitContext gbc, *gb = &gbc;
AVFilmGrainAOMParams *aom;
- AVFilmGrainParams *fgp, *ref = NULL;
+ AVFilmGrainParams *fgp = NULL, *ref = NULL;
int ret, num_sets, n, i, uv, num_y_coeffs, update_grain, luma_only;
ret = init_get_bits8(gb, payload, payload_size);
@@ -135,28 +137,38 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
if (!s->enable)
return 0;
+ for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++)
+ av_buffer_unref(&s->sets[i]);
+
skip_bits(gb, 4); // reserved
num_sets = get_bits(gb, 3) + 1;
for (n = 0; n < num_sets; n++) {
int payload_4byte, payload_size, set_idx, apply_units_log2, vsc_flag;
int predict_scaling, predict_y_scaling, predict_uv_scaling[2];
int payload_bits, start_position;
+ size_t fgp_size;
start_position = get_bits_count(gb);
payload_4byte = get_bits1(gb);
payload_size = get_bits(gb, payload_4byte ? 2 : 8);
set_idx = get_bits(gb, 3);
- fgp = &s->sets[set_idx];
+ fgp = av_film_grain_params_alloc(&fgp_size);
+ if (!fgp)
+ goto error;
aom = &fgp->codec.aom;
fgp->type = get_bits1(gb) ? AV_FILM_GRAIN_PARAMS_AV1 : AV_FILM_GRAIN_PARAMS_NONE;
- if (!fgp->type)
+ if (!fgp->type) {
+ av_freep(&fgp);
continue;
+ }
fgp->seed = get_bits(gb, 16);
update_grain = get_bits1(gb);
- if (!update_grain)
+ if (!update_grain) {
+ av_freep(&fgp);
continue;
+ }
apply_units_log2 = get_bits(gb, 4);
fgp->width = get_bits(gb, 12) << apply_units_log2;
@@ -330,32 +342,49 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
if (payload_bits > payload_size * 8)
goto error;
skip_bits(gb, payload_size * 8 - payload_bits);
+
+ av_buffer_unref(&s->sets[set_idx]);
+ s->sets[set_idx] = av_buffer_create((uint8_t *)fgp, fgp_size, NULL, NULL, 0);
+ if (!s->sets[set_idx])
+ goto error;
}
return 0;
error:
- memset(s, 0, sizeof(*s));
+ av_free(fgp);
+ ff_aom_uninit_film_grain_params(s);
return AVERROR_INVALIDDATA;
}
int ff_aom_attach_film_grain_sets(const AVFilmGrainAFGS1Params *s, AVFrame *frame)
{
- AVFilmGrainParams *fgp;
if (!s->enable)
return 0;
for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++) {
- if (s->sets[i].type != AV_FILM_GRAIN_PARAMS_AV1)
+ AVBufferRef *buf;
+
+ if (!s->sets[i])
continue;
- fgp = av_film_grain_params_create_side_data(frame);
- if (!fgp)
+
+ buf = av_buffer_ref(s->sets[i]);
+ if (!buf || !av_frame_new_side_data_from_buf(frame,
+ AV_FRAME_DATA_FILM_GRAIN_PARAMS, buf)) {
+ av_buffer_unref(&buf);
return AVERROR(ENOMEM);
- memcpy(fgp, &s->sets[i], sizeof(*fgp));
+ }
}
return 0;
}
+void ff_aom_uninit_film_grain_params(AVFilmGrainAFGS1Params *s)
+{
+ for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++)
+ av_buffer_unref(&s->sets[i]);
+ s->enable = 0;
+}
+
// Taken from the AV1 spec. Range is [-2048, 2047], mean is 0 and stddev is 512
static const int16_t gaussian_sequence[2048] = {
56, 568, -180, 172, 124, -84, 172, -64, -900, 24, 820,
diff --git a/libavcodec/aom_film_grain.h b/libavcodec/aom_film_grain.h
index 1f8c78f657..97c33deb47 100644
--- a/libavcodec/aom_film_grain.h
+++ b/libavcodec/aom_film_grain.h
@@ -28,11 +28,12 @@
#ifndef AVCODEC_AOM_FILM_GRAIN_H
#define AVCODEC_AOM_FILM_GRAIN_H
+#include "libavutil/buffer.h"
#include "libavutil/film_grain_params.h"
typedef struct AVFilmGrainAFGS1Params {
int enable;
- AVFilmGrainParams sets[8];
+ AVBufferRef *sets[8];
} AVFilmGrainAFGS1Params;
// Synthesizes film grain on top of `in` and stores the result to `out`. `out`
@@ -48,4 +49,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s,
// Attach all valid film grain param sets to `frame`.
int ff_aom_attach_film_grain_sets(const AVFilmGrainAFGS1Params *s, AVFrame *frame);
+// Free all allocations in `s` and zero the entire struct.
+void ff_aom_uninit_film_grain_params(AVFilmGrainAFGS1Params *s);
+
#endif /* AVCODEC_AOM_FILM_GRAIN_H */
diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c
index c46a563308..15e867b5ed 100644
--- a/libavcodec/h2645_sei.c
+++ b/libavcodec/h2645_sei.c
@@ -26,6 +26,7 @@
#include "config_components.h"
#include "libavutil/ambient_viewing_environment.h"
+#include "libavutil/buffer.h"
#include "libavutil/display.h"
#include "libavutil/hdr_dynamic_metadata.h"
#include "libavutil/film_grain_params.h"
@@ -542,6 +543,14 @@ int ff_h2645_sei_ctx_replace(H2645SEI *dst, const H2645SEI *src)
}
}
+ for (unsigned i = 0; i < FF_ARRAY_ELEMS(dst->aom_film_grain.sets); i++) {
+ ret = av_buffer_replace(&dst->aom_film_grain.sets[i],
+ src->aom_film_grain.sets[i]);
+ if (ret < 0)
+ return ret;
+ }
+ dst->aom_film_grain.enable = src->aom_film_grain.enable;
+
return 0;
}
@@ -913,5 +922,6 @@ void ff_h2645_sei_reset(H2645SEI *s)
s->ambient_viewing_environment.present = 0;
s->mastering_display.present = 0;
s->content_light.present = 0;
- s->aom_film_grain.enable = 0;
+
+ ff_aom_uninit_film_grain_params(&s->aom_film_grain);
}
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 0dc24f82f8..7f1079c669 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -3969,7 +3969,6 @@ static int hevc_update_thread_context(AVCodecContext *dst,
s->sei.common.alternative_transfer = s0->sei.common.alternative_transfer;
s->sei.common.mastering_display = s0->sei.common.mastering_display;
s->sei.common.content_light = s0->sei.common.content_light;
- s->sei.common.aom_film_grain = s0->sei.common.aom_film_grain;
s->sei.tdrdi = s0->sei.tdrdi;
return 0;
--
2.49.1
From b9abdd9eaa4ae7fe7c2d3512444bf9bd7a56e138 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 25 Oct 2024 12:49:11 -0300
Subject: [PATCH 047/434] avcodec/h2645_sei: use the RefStruct API for
film_grain_characteristics
And ensure the buffer is synced between threads.
Based on a patch by Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e33b162c7d8bbbb4838a2af3685fad2bb1ac774a)
---
libavcodec/h2645_sei.c | 15 ++++++++++++---
libavcodec/h2645_sei.h | 4 +++-
libavcodec/h264_sei.c | 1 -
libavcodec/h264_slice.c | 5 ++++-
libavcodec/hevc/hevcdec.c | 9 +++++----
5 files changed, 24 insertions(+), 10 deletions(-)
diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c
index 15e867b5ed..62369dd37f 100644
--- a/libavcodec/h2645_sei.c
+++ b/libavcodec/h2645_sei.c
@@ -42,6 +42,7 @@
#include "golomb.h"
#include "h2645_sei.h"
#include "itut35.h"
+#include "refstruct.h"
#define IS_H264(codec_id) (CONFIG_H264_SEI && CONFIG_HEVC_SEI ? codec_id == AV_CODEC_ID_H264 : CONFIG_H264_SEI)
#define IS_HEVC(codec_id) (CONFIG_H264_SEI && CONFIG_HEVC_SEI ? codec_id == AV_CODEC_ID_HEVC : CONFIG_HEVC_SEI)
@@ -495,7 +496,11 @@ int ff_h2645_sei_message_decode(H2645SEI *h, enum SEIType type,
case SEI_TYPE_DISPLAY_ORIENTATION:
return decode_display_orientation(&h->display_orientation, gb);
case SEI_TYPE_FILM_GRAIN_CHARACTERISTICS:
- return decode_film_grain_characteristics(&h->film_grain_characteristics, codec_id, gb);
+ ff_refstruct_unref(&h->film_grain_characteristics);
+ h->film_grain_characteristics = ff_refstruct_allocz(sizeof(*h->film_grain_characteristics));
+ if (!h->film_grain_characteristics)
+ return AVERROR(ENOMEM);
+ return decode_film_grain_characteristics(h->film_grain_characteristics, codec_id, gb);
case SEI_TYPE_FRAME_PACKING_ARRANGEMENT:
return decode_frame_packing_arrangement(&h->frame_packing, gb, codec_id);
case SEI_TYPE_ALTERNATIVE_TRANSFER_CHARACTERISTICS:
@@ -551,6 +556,9 @@ int ff_h2645_sei_ctx_replace(H2645SEI *dst, const H2645SEI *src)
}
dst->aom_film_grain.enable = src->aom_film_grain.enable;
+ ff_refstruct_replace(&dst->film_grain_characteristics,
+ src->film_grain_characteristics);
+
return 0;
}
@@ -820,8 +828,8 @@ int ff_h2645_sei_to_frame(AVFrame *frame, H2645SEI *sei,
return ret;
}
- if (sei->film_grain_characteristics.present) {
- H2645SEIFilmGrainCharacteristics *fgc = &sei->film_grain_characteristics;
+ if (sei->film_grain_characteristics && sei->film_grain_characteristics->present) {
+ H2645SEIFilmGrainCharacteristics *fgc = sei->film_grain_characteristics;
AVFilmGrainParams *fgp = av_film_grain_params_create_side_data(frame);
AVFilmGrainH274Params *h274;
@@ -923,5 +931,6 @@ void ff_h2645_sei_reset(H2645SEI *s)
s->mastering_display.present = 0;
s->content_light.present = 0;
+ ff_refstruct_unref(&s->film_grain_characteristics);
ff_aom_uninit_film_grain_params(&s->aom_film_grain);
}
diff --git a/libavcodec/h2645_sei.h b/libavcodec/h2645_sei.h
index 598f78b585..abc49760d9 100644
--- a/libavcodec/h2645_sei.h
+++ b/libavcodec/h2645_sei.h
@@ -135,11 +135,13 @@ typedef struct H2645SEI {
H2645SEIFramePacking frame_packing;
H2645SEIDisplayOrientation display_orientation;
H2645SEIAlternativeTransfer alternative_transfer;
- H2645SEIFilmGrainCharacteristics film_grain_characteristics;
H2645SEIAmbientViewingEnvironment ambient_viewing_environment;
H2645SEIMasteringDisplay mastering_display;
H2645SEIContentLight content_light;
AVFilmGrainAFGS1Params aom_film_grain;
+
+ // Dynamic allocations due to large size.
+ H2645SEIFilmGrainCharacteristics *film_grain_characteristics;
} H2645SEI;
enum {
diff --git a/libavcodec/h264_sei.c b/libavcodec/h264_sei.c
index 8d6dc77943..15a5232209 100644
--- a/libavcodec/h264_sei.c
+++ b/libavcodec/h264_sei.c
@@ -55,7 +55,6 @@ void ff_h264_sei_uninit(H264SEIContext *h)
h->picture_timing.present = 0;
h->buffering_period.present = 0;
h->common.frame_packing.present = 0;
- h->common.film_grain_characteristics.present = 0;
h->common.display_orientation.present = 0;
h->common.afd.present = 0;
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index a66b75ca80..84595b1a8b 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -516,7 +516,10 @@ static int h264_frame_start(H264Context *h)
pic->f->crop_top = h->crop_top;
pic->f->crop_bottom = h->crop_bottom;
- pic->needs_fg = h->sei.common.film_grain_characteristics.present && !h->avctx->hwaccel &&
+ pic->needs_fg =
+ h->sei.common.film_grain_characteristics &&
+ h->sei.common.film_grain_characteristics->present &&
+ !h->avctx->hwaccel &&
!(h->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN);
if ((ret = alloc_picture(h, pic)) < 0)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 7f1079c669..5dc605f91f 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -411,7 +411,7 @@ static int export_stream_params_from_sei(HEVCContext *s)
avctx->color_trc = s->sei.common.alternative_transfer.preferred_transfer_characteristics;
}
- if (s->sei.common.film_grain_characteristics.present ||
+ if ((s->sei.common.film_grain_characteristics && s->sei.common.film_grain_characteristics->present) ||
s->sei.common.aom_film_grain.enable)
avctx->properties |= FF_CODEC_PROPERTY_FILM_GRAIN;
@@ -3236,7 +3236,8 @@ static int hevc_frame_start(HEVCContext *s, HEVCLayerContext *l,
else
s->cur_frame->f->flags &= ~AV_FRAME_FLAG_KEY;
- s->cur_frame->needs_fg = (s->sei.common.film_grain_characteristics.present ||
+ s->cur_frame->needs_fg = ((s->sei.common.film_grain_characteristics &&
+ s->sei.common.film_grain_characteristics->present) ||
s->sei.common.aom_film_grain.enable) &&
!(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
!s->avctx->hwaccel;
@@ -3246,8 +3247,8 @@ static int hevc_frame_start(HEVCContext *s, HEVCLayerContext *l,
goto fail;
if (s->cur_frame->needs_fg &&
- (s->sei.common.film_grain_characteristics.present &&
- !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
+ (s->sei.common.film_grain_characteristics && s->sei.common.film_grain_characteristics->present &&
+ !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics->model_id,
s->cur_frame->f->format) ||
!av_film_grain_params_select(s->cur_frame->f))) {
av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown,
--
2.49.1
From fa15e3839dae0139ffc13fa02a41ff87065096e5 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 9 Nov 2024 11:20:59 -0300
Subject: [PATCH 048/434] avfilter/framepool: align the frame buffers
And not just the linesizes. Use the extra align bytes allocated for this purpose.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit f15fc27db5b30365f2aec474bae9b8095d6d2197)
---
libavfilter/framepool.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/libavfilter/framepool.c b/libavfilter/framepool.c
index e8621e07ac..1a1fc0de1e 100644
--- a/libavfilter/framepool.c
+++ b/libavfilter/framepool.c
@@ -139,7 +139,9 @@ FFFramePool *ff_frame_pool_audio_init(AVBufferRef* (*alloc)(size_t size),
if (ret < 0)
goto fail;
- pool->pools[0] = av_buffer_pool_init(pool->linesize[0], NULL);
+ if (pool->linesize[0] > SIZE_MAX - align)
+ goto fail;
+ pool->pools[0] = av_buffer_pool_init(pool->linesize[0] + align, NULL);
if (!pool->pools[0])
goto fail;
@@ -219,7 +221,7 @@ AVFrame *ff_frame_pool_get(FFFramePool *pool)
if (!frame->buf[i])
goto fail;
- frame->data[i] = frame->buf[i]->data;
+ frame->data[i] = (uint8_t *)FFALIGN((uintptr_t)frame->buf[i]->data, pool->align);
}
if (desc->flags & AV_PIX_FMT_FLAG_PAL) {
@@ -256,13 +258,15 @@ AVFrame *ff_frame_pool_get(FFFramePool *pool)
frame->buf[i] = av_buffer_pool_get(pool->pools[0]);
if (!frame->buf[i])
goto fail;
- frame->extended_data[i] = frame->data[i] = frame->buf[i]->data;
+ frame->extended_data[i] = frame->data[i] =
+ (uint8_t *)FFALIGN((uintptr_t)frame->buf[i]->data, pool->align);
}
for (i = 0; i < frame->nb_extended_buf; i++) {
frame->extended_buf[i] = av_buffer_pool_get(pool->pools[0]);
if (!frame->extended_buf[i])
goto fail;
- frame->extended_data[i + AV_NUM_DATA_POINTERS] = frame->extended_buf[i]->data;
+ frame->extended_data[i + AV_NUM_DATA_POINTERS] =
+ (uint8_t *)FFALIGN((uintptr_t)frame->extended_buf[i]->data, pool->align);
}
break;
--
2.49.1
From 85f389520dbda5054d1379e7270f302ff1eb3b5e Mon Sep 17 00:00:00 2001
From: Pavel Koshevoy <pkoshevoy@gmail.com>
Date: Sat, 9 Nov 2024 10:05:16 -0700
Subject: [PATCH 049/434] lavfi/vf_zscale: fix tmp buffer ptr alignment for
zimg_filter_graph_process
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7b302f4db7d335f4dd42cffb461b2b0db6c00749)
---
libavfilter/vf_zscale.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c
index b0316f5bb8..d561466c56 100644
--- a/libavfilter/vf_zscale.c
+++ b/libavfilter/vf_zscale.c
@@ -626,9 +626,12 @@ static int graphs_build(AVFrame *in, AVFrame *out, const AVPixFmtDescriptor *des
if (ret)
return print_zimg_error(ctx);
+ if (size > (SIZE_MAX - ZIMG_ALIGNMENT))
+ return AVERROR(ENOMEM);
+
if (s->tmp[job_nr])
av_freep(&s->tmp[job_nr]);
- s->tmp[job_nr] = av_calloc(size, 1);
+ s->tmp[job_nr] = av_mallocz(size + ZIMG_ALIGNMENT);
if (!s->tmp[job_nr])
return AVERROR(ENOMEM);
@@ -748,7 +751,9 @@ static int filter_slice(AVFilterContext *ctx, void *data, int job_nr, int n_jobs
}
if (!s->graph[job_nr])
return AVERROR(EINVAL);
- ret = zimg_filter_graph_process(s->graph[job_nr], &src_buf, &dst_buf, s->tmp[job_nr], 0, 0, 0, 0);
+ ret = zimg_filter_graph_process(s->graph[job_nr], &src_buf, &dst_buf,
+ (uint8_t *)FFALIGN((uintptr_t)s->tmp[job_nr], ZIMG_ALIGNMENT),
+ 0, 0, 0, 0);
if (ret)
return print_zimg_error(ctx);
@@ -763,7 +768,9 @@ static int filter_slice(AVFilterContext *ctx, void *data, int job_nr, int n_jobs
if (!s->alpha_graph[job_nr])
return AVERROR(EINVAL);
- ret = zimg_filter_graph_process(s->alpha_graph[job_nr], &src_buf, &dst_buf, s->tmp[job_nr], 0, 0, 0, 0);
+ ret = zimg_filter_graph_process(s->alpha_graph[job_nr], &src_buf, &dst_buf,
+ (uint8_t *)FFALIGN((uintptr_t)s->tmp[job_nr], ZIMG_ALIGNMENT),
+ 0, 0, 0, 0);
if (ret)
return print_zimg_error(ctx);
}
--
2.49.1
From 5b461ffb041e0e24fdf14e36dfc857ae44bed249 Mon Sep 17 00:00:00 2001
From: Pavel Koshevoy <pkoshevoy@gmail.com>
Date: Sat, 9 Nov 2024 09:08:26 -0700
Subject: [PATCH 050/434] lavfi/vf_zscale: fix call to av_pix_fmt_count_planes
realign_frame called av_pix_fmt_count_planes with incorrect parameter.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 00cf3df03f66dca44568b5b5d3e9da35d3597470)
---
libavfilter/vf_zscale.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c
index d561466c56..a35cd1cdf7 100644
--- a/libavfilter/vf_zscale.c
+++ b/libavfilter/vf_zscale.c
@@ -664,7 +664,7 @@ static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int ne
int ret = 0, plane, planes;
/* Realign any unaligned input frame. */
- planes = av_pix_fmt_count_planes(desc->nb_components);
+ planes = av_pix_fmt_count_planes((*frame)->format);
for (plane = 0; plane < planes; plane++) {
int p = desc->comp[plane].plane;
if ((uintptr_t)(*frame)->data[p] % ZIMG_ALIGNMENT || (*frame)->linesize[p] % ZIMG_ALIGNMENT) {
--
2.49.1
From 99f6adce60727d8e4244d4871baf3907ac545111 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 9 Nov 2024 16:55:38 -0300
Subject: [PATCH 051/434] avfilter/vf_zscale: align the frame buffers
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c8e5c684b3db1a3131af5d05a3073114bd87477a)
---
libavfilter/vf_zscale.c | 23 ++++++-----------------
1 file changed, 6 insertions(+), 17 deletions(-)
diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c
index a35cd1cdf7..afd22ce6c6 100644
--- a/libavfilter/vf_zscale.c
+++ b/libavfilter/vf_zscale.c
@@ -658,7 +658,7 @@ static int graphs_build(AVFrame *in, AVFrame *out, const AVPixFmtDescriptor *des
return 0;
}
-static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int needs_copy)
+static int realign_frame(AVFilterLink *link, const AVPixFmtDescriptor *desc, AVFrame **frame, int needs_copy)
{
AVFrame *aligned = NULL;
int ret = 0, plane, planes;
@@ -668,17 +668,9 @@ static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int ne
for (plane = 0; plane < planes; plane++) {
int p = desc->comp[plane].plane;
if ((uintptr_t)(*frame)->data[p] % ZIMG_ALIGNMENT || (*frame)->linesize[p] % ZIMG_ALIGNMENT) {
- if (!(aligned = av_frame_alloc())) {
- ret = AVERROR(ENOMEM);
- goto fail;
- }
-
- aligned->format = (*frame)->format;
- aligned->width = (*frame)->width;
- aligned->height = (*frame)->height;
-
- if ((ret = av_frame_get_buffer(aligned, ZIMG_ALIGNMENT)) < 0)
- goto fail;
+ aligned = ff_default_get_video_buffer2(link, (*frame)->width, (*frame)->height, ZIMG_ALIGNMENT);
+ if (!aligned)
+ return AVERROR(ENOMEM);
if (needs_copy && (ret = av_frame_copy(aligned, *frame)) < 0)
goto fail;
@@ -807,20 +799,17 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
(s->src_format.pixel_type !=s->dst_format.pixel_type) ||
(s->src_format.transfer_characteristics !=s->dst_format.transfer_characteristics)
){
- out = ff_get_video_buffer(outlink, outlink->w, outlink->h);
+ out = ff_default_get_video_buffer2(outlink, outlink->w, outlink->h, ZIMG_ALIGNMENT);
if (!out) {
ret = AVERROR(ENOMEM);
goto fail;
}
- if ((ret = realign_frame(odesc, &out, 0)) < 0)
- goto fail;
-
av_frame_copy_props(out, in);
out->colorspace = outlink->colorspace;
out->color_range = outlink->color_range;
- if ((ret = realign_frame(desc, &in, 1)) < 0)
+ if ((ret = realign_frame(link, desc, &in, 1)) < 0)
goto fail;
snprintf(buf, sizeof(buf)-1, "%d", outlink->w);
--
2.49.1
From 0a58588ffb875066fc8d75ad9b5c93f3dd9e8c28 Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Sun, 3 Nov 2024 22:32:51 +0100
Subject: [PATCH 052/434] avfilter/f_loop: fix length of aloop leftover buffer
If the audio loop stops inside an audio frame, the leftover buffer contains the
end of the frame, which is not looped. The length supposed to be the part which
was not written to the loop buffer, so we need to drain exactly that number of
bytes from the leftover buffer.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit b33a59416072ad31a5840f33f9975d88acf45add)
---
libavfilter/f_loop.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/libavfilter/f_loop.c b/libavfilter/f_loop.c
index 9b01a85405..3372c77fee 100644
--- a/libavfilter/f_loop.c
+++ b/libavfilter/f_loop.c
@@ -170,14 +170,13 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame)
s->pts += av_rescale_q(s->start - s->ignored_samples, (AVRational){1, outlink->sample_rate}, outlink->time_base);
}
s->nb_samples += ret - drain;
- drain = frame->nb_samples - written;
- if (s->nb_samples == s->size && drain > 0) {
+ if (s->nb_samples == s->size && frame->nb_samples > written) {
int ret2;
ret2 = av_audio_fifo_write(s->left, (void **)frame->extended_data, frame->nb_samples);
if (ret2 < 0)
return ret2;
- av_audio_fifo_drain(s->left, drain);
+ av_audio_fifo_drain(s->left, written);
}
frame->nb_samples = ret;
s->pts += av_rescale_q(ret, (AVRational){1, outlink->sample_rate}, outlink->time_base);
--
2.49.1
From b016aae6627128b1657762c8aa4377e4144046fc Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Mon, 4 Nov 2024 00:43:06 +0100
Subject: [PATCH 053/434] avfilter/f_loop: fix aloop activate logic
The logic did not follow the documented behaviour and that caused skipping of
some audio in the loop and in the leftover buffer.
Example command line which should produce a smooth sine wave for the whole
duration of the output:
ffmpeg -f lavfi -i "sine=r=48000:f=480:d=4" -af "aloop=loop=4:start=48000:size=48000" out.wav
Fixes ticket #11283.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit fe18ed3f2a9221af0beaec7b04b7804849db1f2f)
---
libavfilter/f_loop.c | 70 ++++++++++++++++++--------------------------
1 file changed, 28 insertions(+), 42 deletions(-)
diff --git a/libavfilter/f_loop.c b/libavfilter/f_loop.c
index 3372c77fee..4e5e8d0e79 100644
--- a/libavfilter/f_loop.c
+++ b/libavfilter/f_loop.c
@@ -21,6 +21,7 @@
#include "config_components.h"
#include "libavutil/audio_fifo.h"
+#include "libavutil/avassert.h"
#include "libavutil/internal.h"
#include "libavutil/mem.h"
#include "libavutil/opt.h"
@@ -104,7 +105,7 @@ static av_cold void auninit(AVFilterContext *ctx)
av_audio_fifo_free(s->left);
}
-static int push_samples(AVFilterContext *ctx, int nb_samples)
+static int push_samples(AVFilterContext *ctx, int nb_samples, AVFrame **frame)
{
AVFilterLink *outlink = ctx->outputs[0];
LoopContext *s = ctx->priv;
@@ -126,9 +127,7 @@ static int push_samples(AVFilterContext *ctx, int nb_samples)
i += out->nb_samples;
s->current_sample += out->nb_samples;
- ret = ff_filter_frame(outlink, out);
- if (ret < 0)
- return ret;
+ *frame = out;
if (s->current_sample >= s->nb_samples) {
s->current_sample = 0;
@@ -136,6 +135,8 @@ static int push_samples(AVFilterContext *ctx, int nb_samples)
if (s->loop > 0)
s->loop--;
}
+
+ return 0;
}
return ret;
@@ -182,10 +183,7 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame)
s->pts += av_rescale_q(ret, (AVRational){1, outlink->sample_rate}, outlink->time_base);
ret = ff_filter_frame(outlink, frame);
} else {
- int nb_samples = frame->nb_samples;
-
- av_frame_free(&frame);
- ret = push_samples(ctx, nb_samples);
+ av_assert0(0);
}
} else {
s->ignored_samples += frame->nb_samples;
@@ -197,7 +195,7 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame)
return ret;
}
-static int arequest_frame(AVFilterLink *outlink)
+static int arequest_frame(AVFilterLink *outlink, AVFrame **frame)
{
AVFilterContext *ctx = outlink->src;
LoopContext *s = ctx->priv;
@@ -217,17 +215,11 @@ static int arequest_frame(AVFilterLink *outlink)
av_audio_fifo_read(s->left, (void **)out->extended_data, nb_samples);
out->pts = s->pts;
s->pts += av_rescale_q(nb_samples, (AVRational){1, outlink->sample_rate}, outlink->time_base);
- ret = ff_filter_frame(outlink, out);
- if (ret < 0)
- return ret;
+ *frame = out;
}
- ret = ff_request_frame(ctx->inputs[0]);
+ return 0;
} else {
- ret = push_samples(ctx, 1024);
- }
-
- if (s->eof && s->nb_samples > 0 && s->loop != 0) {
- ret = push_samples(ctx, 1024);
+ ret = push_samples(ctx, 1024, frame);
}
return ret;
@@ -245,37 +237,31 @@ static int aactivate(AVFilterContext *ctx)
update_time(ctx, inlink->time_base);
- if (!s->eof && (s->nb_samples < s->size || !s->loop || !s->size)) {
- const int in_nb_samples = FFMIN(1024, s->size - s->nb_samples);
- if (in_nb_samples == 0)
- ret = ff_inlink_consume_frame(inlink, &frame);
- else
- ret = ff_inlink_consume_samples(inlink, in_nb_samples, in_nb_samples, &frame);
- if (ret < 0)
- return ret;
- if (ret > 0)
- return afilter_frame(inlink, frame);
- }
+retry:
+ ret = arequest_frame(outlink, &frame);
+ if (ret < 0)
+ return ret;
+ if (frame)
+ return ff_filter_frame(outlink, frame);
- if (!s->eof && ff_inlink_acknowledge_status(inlink, &status, &s->eof_pts)) {
- if (status == AVERROR_EOF) {
+ ret = ff_inlink_consume_frame(inlink, &frame);
+ if (ret < 0)
+ return ret;
+ if (ret > 0)
+ return afilter_frame(inlink, frame);
+
+ ret = ff_inlink_acknowledge_status(inlink, &status, &s->eof_pts);
+ if (ret) {
+ if (status == AVERROR_EOF && !s->eof) {
s->size = s->nb_samples;
s->eof = 1;
+ goto retry;
}
- }
-
- if (s->eof && (!s->loop || !s->size)) {
- ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts + s->pts_offset);
+ ff_outlink_set_status(outlink, status, s->eof_pts);
return 0;
}
- if (!s->eof && (!s->size ||
- (s->nb_samples < s->size) ||
- (s->nb_samples >= s->size && s->loop == 0))) {
- FF_FILTER_FORWARD_WANTED(outlink, inlink);
- } else if (s->loop && s->nb_samples == s->size) {
- return arequest_frame(outlink);
- }
+ FF_FILTER_FORWARD_WANTED(outlink, inlink);
return FFERROR_NOT_READY;
}
--
2.49.1
From 20c8a3f5ff83e06fa6fc66dc18cedbc8f43d938b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= <remi@remlab.net>
Date: Sun, 17 Nov 2024 11:15:01 +0200
Subject: [PATCH 054/434] lavu/riscv: fix compilation without Vector support
The half-baked assembler in Clang 16 and earlier can't process our
RISC-V assembler. This adds yet another work around that.
If you must use Clang, please use version 17 or later.
(cherry picked from commit e29432e6bbb6184d3ff2c7d1e070e9424cb25fe6)
---
libavutil/riscv/cpu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavutil/riscv/cpu.h b/libavutil/riscv/cpu.h
index 191e4478c5..f2e6b7b430 100644
--- a/libavutil/riscv/cpu.h
+++ b/libavutil/riscv/cpu.h
@@ -56,7 +56,6 @@ static inline size_t ff_get_rv_vlenb(void)
".option pop\n" : "=r" (vlenb));
return vlenb;
}
-#endif
/**
* Checks that the vector bit-size is at least the given value.
@@ -78,3 +77,4 @@ static inline bool ff_rv_vlen_least(unsigned int bits)
return bits <= (8 * ff_get_rv_vlenb());
}
#endif
+#endif /* HAVE_RVV */
--
2.49.1
From ac4c725944d9923c3b696e6809c9da1d9d5df9fe Mon Sep 17 00:00:00 2001
From: Brad Smith <brad@comstyle.com>
Date: Mon, 21 Oct 2024 11:57:44 -0400
Subject: [PATCH 055/434] libavutil/ppc: Include the hardware feature flags
like the other archs
Also include the hardware feature flags like the other archs do and
clean up the code a bit.
Tested on Linux POWER9.
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit d6b2d08fc7283da7a5db7a64d9a3047ed1ba0de1)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/ppc/cpu.c | 35 +++++++++++++++++------------------
1 file changed, 17 insertions(+), 18 deletions(-)
diff --git a/libavutil/ppc/cpu.c b/libavutil/ppc/cpu.c
index 9381272175..62d495ec1d 100644
--- a/libavutil/ppc/cpu.c
+++ b/libavutil/ppc/cpu.c
@@ -46,6 +46,17 @@
#include "libavutil/cpu.h"
#include "libavutil/cpu_internal.h"
+#ifndef AT_HWCAP
+#define AT_HWCAP 16
+#endif
+#ifndef AT_HWCAP2
+#define AT_HWCAP2 26
+#endif
+
+#define HWCAP_PPC_VSX (1 << 7)
+#define HWCAP_PPC_ALTIVEC (1 << 28)
+#define HWCAP2_PPC_ARCH_2_07 (1 << 31)
+
/**
* This function MAY rely on signal() or fork() in order to make sure AltiVec
* is present.
@@ -65,20 +76,14 @@ int ff_get_cpu_flags_ppc(void)
int flags = 0;
unsigned long hwcap = ff_getauxval(AT_HWCAP);
-#ifdef PPC_FEATURE2_ARCH_2_07
unsigned long hwcap2 = ff_getauxval(AT_HWCAP2);
-#endif
- if (hwcap & PPC_FEATURE_HAS_ALTIVEC)
+ if (hwcap & HWCAP_PPC_ALTIVEC)
flags |= AV_CPU_FLAG_ALTIVEC;
-#ifdef PPC_FEATURE_HAS_VSX
- if (hwcap & PPC_FEATURE_HAS_VSX)
+ if (hwcap & HWCAP_PPC_VSX)
flags |= AV_CPU_FLAG_VSX;
-#endif
-#ifdef PPC_FEATURE2_ARCH_2_07
- if (hwcap2 & PPC_FEATURE2_ARCH_2_07)
+ if (hwcap2 & HWCAP2_PPC_ARCH_2_07)
flags |= AV_CPU_FLAG_POWER8;
-#endif
return flags;
#elif defined(__APPLE__) || defined(__NetBSD__) || defined(__OpenBSD__)
@@ -112,23 +117,17 @@ int ff_get_cpu_flags_ppc(void)
if (buf[i] == AT_NULL)
goto out;
if (buf[i] == AT_HWCAP) {
- if (buf[i + 1] & PPC_FEATURE_HAS_ALTIVEC)
+ if (buf[i + 1] & HWCAP_PPC_ALTIVEC)
ret = AV_CPU_FLAG_ALTIVEC;
-#ifdef PPC_FEATURE_HAS_VSX
- if (buf[i + 1] & PPC_FEATURE_HAS_VSX)
+ if (buf[i + 1] & HWCAP_PPC_VSX)
ret |= AV_CPU_FLAG_VSX;
-#endif
if (ret & AV_CPU_FLAG_VSX)
av_assert0(ret & AV_CPU_FLAG_ALTIVEC);
}
-#ifdef AT_HWCAP2 /* not introduced until glibc 2.18 */
else if (buf[i] == AT_HWCAP2) {
-#ifdef PPC_FEATURE2_ARCH_2_07
- if (buf[i + 1] & PPC_FEATURE2_ARCH_2_07)
+ if (buf[i + 1] & HWCAP2_PPC_ARCH_2_07)
ret |= AV_CPU_FLAG_POWER8;
-#endif
}
-#endif /* AT_HWCAP2 */
}
}
--
2.49.1
From 0c641ee6610ed3bc8a06040c32ea280649d427b0 Mon Sep 17 00:00:00 2001
From: Sean McGovern <gseanmcg@gmail.com>
Date: Sun, 3 Nov 2024 21:58:43 -0500
Subject: [PATCH 056/434] libavutil/ppc: defines involving bit shifts should be
unsigned
Otherwise, these can overflow at the boundaries of the integer type.
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit c325f9c619b38614ab6e339cefacd596266db471)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/ppc/cpu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavutil/ppc/cpu.c b/libavutil/ppc/cpu.c
index 62d495ec1d..9f9c073434 100644
--- a/libavutil/ppc/cpu.c
+++ b/libavutil/ppc/cpu.c
@@ -53,9 +53,9 @@
#define AT_HWCAP2 26
#endif
-#define HWCAP_PPC_VSX (1 << 7)
-#define HWCAP_PPC_ALTIVEC (1 << 28)
-#define HWCAP2_PPC_ARCH_2_07 (1 << 31)
+#define HWCAP_PPC_VSX (1U << 7)
+#define HWCAP_PPC_ALTIVEC (1U << 28)
+#define HWCAP2_PPC_ARCH_2_07 (1U << 31)
/**
* This function MAY rely on signal() or fork() in order to make sure AltiVec
--
2.49.1
From 64e2864cb983d30162dc9003b5aae81e89c929cd Mon Sep 17 00:00:00 2001
From: Brad Smith <brad-at-comstyle.com@ffmpeg.org>
Date: Sun, 17 Nov 2024 21:02:39 -0500
Subject: [PATCH 057/434] libavutil/riscv: Make use of elf_aux_info() on
FreeBSD / OpenBSD riscv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
libavutil/riscv: Make use of elf_aux_info() on FreeBSD / OpenBSD riscv
FreeBSD/OpenBSD riscv have elf_aux_info().
Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
(cherry picked from commit f3eca3f387092c596f035a126fba15a30c3a9499)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/riscv/cpu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavutil/riscv/cpu.c b/libavutil/riscv/cpu.c
index 4ec6d6c826..163e4fc14a 100644
--- a/libavutil/riscv/cpu.c
+++ b/libavutil/riscv/cpu.c
@@ -25,7 +25,7 @@
#include "libavutil/log.h"
#include "config.h"
-#if HAVE_GETAUXVAL
+#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
#include <sys/auxv.h>
#define HWCAP_RV(letter) (1ul << ((letter) - 'A'))
#endif
@@ -84,7 +84,7 @@ int ff_get_cpu_flags_riscv(void)
default:
}
}
-#elif HAVE_GETAUXVAL
+#elif HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
{
const unsigned long hwcap = ff_getauxval(AT_HWCAP);
--
2.49.1
From 3513ccccb650a920ea7da964f0415476c6525fb0 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 17 Nov 2024 23:01:37 -0300
Subject: [PATCH 058/434] avformat/movenc: don't write a calculated avgBitrate
when the provided one is unset
avgBitrate == 0 is used to signal a VBR track, so if that value is propagated by an
encoder, don't overwrite it with a calculated value based on track size.
Part of a fix for ticket #11303.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 944212acad7c2254d9dc14764b29e0023aaa645a)
---
libavformat/movenc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index d20e45cf81..a365ebe921 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -737,6 +737,9 @@ static struct mpeg4_bit_rate_values calculate_mpeg4_bit_rates(MOVTrack *track)
// utilize values from properties if we have them available
if (props) {
+ // no avg_bitrate signals that the track is VBR
+ if (!props->avg_bitrate)
+ bit_rates.avg_bit_rate = props->avg_bitrate;
bit_rates.max_bit_rate = FFMAX(bit_rates.max_bit_rate,
props->max_bitrate);
bit_rates.buffer_size = props->buffer_size / 8;
--
2.49.1
From cb997ccd09737b31220c7c2bc04934ceda9702e7 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 17 Nov 2024 23:01:38 -0300
Subject: [PATCH 059/434] avcodec/libfdk-aacenc: export CPB properties
Needed to signal the muxer that the stream is VBR.
Finishes fixing ticket #11303.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 46c6ca3ed1651c67faf899776f1922c108093a44)
---
libavcodec/libfdk-aacenc.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/libavcodec/libfdk-aacenc.c b/libavcodec/libfdk-aacenc.c
index 0f33cdb8c9..cc0ae0d8da 100644
--- a/libavcodec/libfdk-aacenc.c
+++ b/libavcodec/libfdk-aacenc.c
@@ -178,6 +178,7 @@ static av_cold int aac_encode_init(AVCodecContext *avctx)
AACContext *s = avctx->priv_data;
int ret = AVERROR(EINVAL);
AACENC_InfoStruct info = { 0 };
+ AVCPBProperties *cpb_props;
CHANNEL_MODE mode;
AACENC_ERROR err;
int aot = AV_PROFILE_AAC_LOW + 1;
@@ -438,6 +439,14 @@ static av_cold int aac_encode_init(AVCodecContext *avctx)
memcpy(avctx->extradata, info.confBuf, info.confSize);
}
+
+ cpb_props = ff_encode_add_cpb_side_data(avctx);
+ if (!cpb_props)
+ return AVERROR(ENOMEM);
+ cpb_props->max_bitrate =
+ cpb_props->min_bitrate =
+ cpb_props->avg_bitrate = avctx->bit_rate;
+
return 0;
error:
aac_encode_close(avctx);
--
2.49.1
From 8fa5fa1463025ca38fab3099fe5adb337727bdaa Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 15 Nov 2024 20:14:37 -0300
Subject: [PATCH 060/434] avformat/movenc: don't disable edit lists when
writing CMAF output
They are needed for audio tracks with priming samples, where negative CTS
offsets can't be used.
Fixes ticket #11031.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit ecc7d5db9c8a1aaccc876dc4b549558eadfe140a)
---
libavformat/movenc.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index a365ebe921..da58a7ab15 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -7666,19 +7666,11 @@ static int mov_init(AVFormatContext *s)
s->avoid_negative_ts == AVFMT_AVOID_NEG_TS_MAKE_ZERO)
mov->use_editlist = 0;
}
- if (mov->flags & FF_MOV_FLAG_CMAF) {
- // CMAF Track requires negative cts offsets without edit lists
- mov->use_editlist = 0;
- }
}
if (mov->flags & FF_MOV_FLAG_EMPTY_MOOV &&
!(mov->flags & FF_MOV_FLAG_DELAY_MOOV) && mov->use_editlist)
av_log(s, AV_LOG_WARNING, "No meaningful edit list will be written when using empty_moov without delay_moov\n");
- if (mov->flags & FF_MOV_FLAG_CMAF && mov->use_editlist) {
- av_log(s, AV_LOG_WARNING, "Edit list enabled; Assuming writing CMAF Track File\n");
- mov->flags &= ~FF_MOV_FLAG_NEGATIVE_CTS_OFFSETS;
- }
if (!mov->use_editlist && s->avoid_negative_ts == AVFMT_AVOID_NEG_TS_AUTO &&
!(mov->flags & FF_MOV_FLAG_NEGATIVE_CTS_OFFSETS))
s->avoid_negative_ts = AVFMT_AVOID_NEG_TS_MAKE_ZERO;
--
2.49.1
From e07d7c75dbfd1ef5c9233fea63bb29ddf567283f Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:44:46 -0300
Subject: [PATCH 061/434] avformat/spdifdec: parse headers for audio codecs
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 4e6d31755bf8d0355418d19725ee947e6c0536c0)
---
libavformat/spdifdec.c | 2 +
tests/ref/fate/spdif-dca-core-remux | 14 +-
tests/ref/fate/spdif-dca-master-core-remux | 2344 ++++++++++----------
3 files changed, 1181 insertions(+), 1179 deletions(-)
diff --git a/libavformat/spdifdec.c b/libavformat/spdifdec.c
index 6a01f2ba29..dcfe471f45 100644
--- a/libavformat/spdifdec.c
+++ b/libavformat/spdifdec.c
@@ -236,6 +236,8 @@ int ff_spdif_read_packet(AVFormatContext *s, AVPacket *pkt)
st->codecpar->codec_id = codec_id;
if (codec_id == AV_CODEC_ID_EAC3)
ffstream(st)->need_parsing = AVSTREAM_PARSE_FULL;
+ else
+ ffstream(st)->need_parsing = AVSTREAM_PARSE_HEADERS;
} else if (codec_id != s->streams[0]->codecpar->codec_id) {
avpriv_report_missing_feature(s, "Codec change in IEC 61937");
return AVERROR_PATCHWELCOME;
diff --git a/tests/ref/fate/spdif-dca-core-remux b/tests/ref/fate/spdif-dca-core-remux
index a74b8a41a9..4fcbf8c5d1 100644
--- a/tests/ref/fate/spdif-dca-core-remux
+++ b/tests/ref/fate/spdif-dca-core-remux
@@ -5,10 +5,10 @@ a4e739ebe07c75dd569156d5038696a9 *tests/data/fate/spdif-dca-core-remux.spdif
#codec_id 0: dts
#sample_rate 0: 48000
#channel_layout_name 0: 5.1(side)
-0, 0, 0, 0, 1024, 0x07b79d2a
-0, 0, 0, 0, 1024, 0x7eaaba77
-0, 0, 0, 0, 1024, 0xbed65c1d
-0, 0, 0, 0, 1024, 0x10bc6792
-0, 0, 0, 0, 1024, 0xf8436f6e
-0, 0, 0, 0, 1024, 0x4454a681
-0, 0, 0, 0, 1024, 0xda3ba189
+0, 0, 0, 960, 1024, 0x07b79d2a
+0, 960, 960, 960, 1024, 0x7eaaba77
+0, 1920, 1920, 960, 1024, 0xbed65c1d
+0, 2880, 2880, 960, 1024, 0x10bc6792
+0, 3840, 3840, 960, 1024, 0xf8436f6e
+0, 4800, 4800, 960, 1024, 0x4454a681
+0, 5760, 5760, 960, 1024, 0xda3ba189
diff --git a/tests/ref/fate/spdif-dca-master-core-remux b/tests/ref/fate/spdif-dca-master-core-remux
index de6f128186..d6cfeefb5a 100644
--- a/tests/ref/fate/spdif-dca-master-core-remux
+++ b/tests/ref/fate/spdif-dca-master-core-remux
@@ -5,1175 +5,1175 @@ c4f3f3c6ca73fcb7beac137105dadab4 *tests/data/fate/spdif-dca-master-core-remux.sp
#codec_id 0: dts
#sample_rate 0: 48000
#channel_layout_name 0: 5.1(side)
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xbe7b9e5e
-0, 0, 0, 0, 2012, 0x671dc73a
-0, 0, 0, 0, 2012, 0x7fd5b1d2
-0, 0, 0, 0, 2012, 0xa9259df1
-0, 0, 0, 0, 2012, 0x3e8c2b92
-0, 0, 0, 0, 2012, 0x4876a9ff
-0, 0, 0, 0, 2012, 0x7e469182
-0, 0, 0, 0, 2012, 0x10eba401
-0, 0, 0, 0, 2012, 0x51c68ed3
-0, 0, 0, 0, 2012, 0x3f52901b
-0, 0, 0, 0, 2012, 0x7bebacce
-0, 0, 0, 0, 2012, 0xcb94898d
-0, 0, 0, 0, 2012, 0x14e3ae70
-0, 0, 0, 0, 2012, 0x016893cb
-0, 0, 0, 0, 2012, 0x00739f0a
-0, 0, 0, 0, 2012, 0x834aba41
-0, 0, 0, 0, 2012, 0x6a92ac08
-0, 0, 0, 0, 2012, 0x09eda257
-0, 0, 0, 0, 2012, 0x81449e3f
-0, 0, 0, 0, 2012, 0xe6eb91d4
-0, 0, 0, 0, 2012, 0x51158c0e
-0, 0, 0, 0, 2012, 0x84e4a013
-0, 0, 0, 0, 2012, 0x4c48a0e6
-0, 0, 0, 0, 2012, 0xf54c9811
-0, 0, 0, 0, 2012, 0x62778edb
-0, 0, 0, 0, 2012, 0x7226a51b
-0, 0, 0, 0, 2012, 0x44b9aad8
-0, 0, 0, 0, 2012, 0x8aa6b380
-0, 0, 0, 0, 2012, 0xc88c99e6
-0, 0, 0, 0, 2012, 0xed5e93e2
-0, 0, 0, 0, 2012, 0xeb0b9755
-0, 0, 0, 0, 2012, 0xe5ba8ca9
-0, 0, 0, 0, 2012, 0x2fef9bcf
-0, 0, 0, 0, 2012, 0xf19c8749
-0, 0, 0, 0, 2012, 0x0feb94d0
-0, 0, 0, 0, 2012, 0x1f9194d1
-0, 0, 0, 0, 2012, 0x0cad9822
-0, 0, 0, 0, 2012, 0xe6f79152
-0, 0, 0, 0, 2012, 0x69e78955
-0, 0, 0, 0, 2012, 0x91dd8a1b
-0, 0, 0, 0, 2012, 0x63fe8eea
-0, 0, 0, 0, 2012, 0x8f6d90a2
-0, 0, 0, 0, 2012, 0xe3bf8626
-0, 0, 0, 0, 2012, 0xd08599db
-0, 0, 0, 0, 2012, 0xf556a282
-0, 0, 0, 0, 2012, 0x7f8c8f90
-0, 0, 0, 0, 2012, 0xa04493b9
-0, 0, 0, 0, 2012, 0x21a19b3a
-0, 0, 0, 0, 2012, 0x6ead9244
-0, 0, 0, 0, 2012, 0xe65290d7
-0, 0, 0, 0, 2012, 0x8ff58a8e
-0, 0, 0, 0, 2012, 0x24ada603
-0, 0, 0, 0, 2012, 0x79cb85c7
-0, 0, 0, 0, 2012, 0x63c0ac54
-0, 0, 0, 0, 2012, 0x7f719f83
-0, 0, 0, 0, 2012, 0x2eb69654
-0, 0, 0, 0, 2012, 0xf5149bc0
-0, 0, 0, 0, 2012, 0xd0d6a414
-0, 0, 0, 0, 2012, 0x4f4a8ed3
-0, 0, 0, 0, 2012, 0x20888cb5
-0, 0, 0, 0, 2012, 0x13439c86
-0, 0, 0, 0, 2012, 0xc8fc98e1
-0, 0, 0, 0, 2012, 0x14689766
-0, 0, 0, 0, 2012, 0x830293e4
-0, 0, 0, 0, 2012, 0xdd5bb8ce
-0, 0, 0, 0, 2012, 0x005ea280
-0, 0, 0, 0, 2012, 0x9b0581e2
-0, 0, 0, 0, 2012, 0x210f89b8
-0, 0, 0, 0, 2012, 0xb7c180bd
-0, 0, 0, 0, 2012, 0xe53c85e4
-0, 0, 0, 0, 2012, 0x1f689207
-0, 0, 0, 0, 2012, 0x5653813b
-0, 0, 0, 0, 2012, 0x1d278d66
-0, 0, 0, 0, 2012, 0xd94c9a83
-0, 0, 0, 0, 2012, 0x7af48548
-0, 0, 0, 0, 2012, 0x86209c99
-0, 0, 0, 0, 2012, 0x6e3b7fc9
-0, 0, 0, 0, 2012, 0x41c289e7
-0, 0, 0, 0, 2012, 0x8bea85db
-0, 0, 0, 0, 2012, 0x45c98c39
-0, 0, 0, 0, 2012, 0xee098755
-0, 0, 0, 0, 2012, 0x485d9ec1
-0, 0, 0, 0, 2012, 0x78819023
-0, 0, 0, 0, 2012, 0xf43377bd
-0, 0, 0, 0, 2012, 0x43fc9439
-0, 0, 0, 0, 2012, 0x045e9bf3
-0, 0, 0, 0, 2012, 0x0fc09f0c
-0, 0, 0, 0, 2012, 0x7ba69bf5
-0, 0, 0, 0, 2012, 0x4aa7aaf0
-0, 0, 0, 0, 2012, 0x620c85bf
-0, 0, 0, 0, 2012, 0xa6bb8a30
-0, 0, 0, 0, 2012, 0xfd10883c
-0, 0, 0, 0, 2012, 0x32037e17
-0, 0, 0, 0, 2012, 0xb18c9e01
-0, 0, 0, 0, 2012, 0xd8206ee5
-0, 0, 0, 0, 2012, 0xdbc49136
-0, 0, 0, 0, 2012, 0x650a785d
-0, 0, 0, 0, 2012, 0x9e107d61
-0, 0, 0, 0, 2012, 0xbf4eac50
-0, 0, 0, 0, 2012, 0x9d8f79b2
-0, 0, 0, 0, 2012, 0x252d8e8a
-0, 0, 0, 0, 2012, 0x00af8fd6
-0, 0, 0, 0, 2012, 0x9e388d3b
-0, 0, 0, 0, 2012, 0x75de7f56
-0, 0, 0, 0, 2012, 0xd502839c
-0, 0, 0, 0, 2012, 0x66709e03
-0, 0, 0, 0, 2012, 0x3e0a96ba
-0, 0, 0, 0, 2012, 0x0813ad4e
-0, 0, 0, 0, 2012, 0x799c90c5
-0, 0, 0, 0, 2012, 0x98a18bed
-0, 0, 0, 0, 2012, 0x8cd197d7
-0, 0, 0, 0, 2012, 0xf9ea8b22
-0, 0, 0, 0, 2012, 0x674f7cd2
-0, 0, 0, 0, 2012, 0xa5c39136
-0, 0, 0, 0, 2012, 0xe064ac30
-0, 0, 0, 0, 2012, 0x2af78c75
-0, 0, 0, 0, 2012, 0x43df9b19
-0, 0, 0, 0, 2012, 0x8d1a87d5
-0, 0, 0, 0, 2012, 0xd5be8d29
-0, 0, 0, 0, 2012, 0x43448bd4
-0, 0, 0, 0, 2012, 0xa128a30b
-0, 0, 0, 0, 2012, 0x6fc29902
-0, 0, 0, 0, 2012, 0x5854a24b
-0, 0, 0, 0, 2012, 0xb222958a
-0, 0, 0, 0, 2012, 0xfca39cce
-0, 0, 0, 0, 2012, 0xee0087f0
-0, 0, 0, 0, 2012, 0xd2d69b8c
-0, 0, 0, 0, 2012, 0xe2308f8d
-0, 0, 0, 0, 2012, 0x8dc4b09a
-0, 0, 0, 0, 2012, 0x14489aef
-0, 0, 0, 0, 2012, 0x900f9835
-0, 0, 0, 0, 2012, 0x0092a95f
-0, 0, 0, 0, 2012, 0xfd90b1bf
-0, 0, 0, 0, 2012, 0xb11ab5d5
-0, 0, 0, 0, 2012, 0xc802b908
-0, 0, 0, 0, 2012, 0xb12aa91e
-0, 0, 0, 0, 2012, 0xd173c2a9
-0, 0, 0, 0, 2012, 0xaeafb887
-0, 0, 0, 0, 2012, 0xeb7eb0d7
-0, 0, 0, 0, 2012, 0x9afbc56a
-0, 0, 0, 0, 2012, 0x2d78bc34
-0, 0, 0, 0, 2012, 0x6550aed1
-0, 0, 0, 0, 2012, 0xd514a55d
-0, 0, 0, 0, 2012, 0x9058c263
-0, 0, 0, 0, 2012, 0xf819b66a
-0, 0, 0, 0, 2012, 0x16a5c902
-0, 0, 0, 0, 2012, 0x602fc11b
-0, 0, 0, 0, 2012, 0xe3c6b177
-0, 0, 0, 0, 2012, 0xacc4cd06
-0, 0, 0, 0, 2012, 0xeb96addb
-0, 0, 0, 0, 2012, 0x1195cad3
-0, 0, 0, 0, 2012, 0x8e96ad7f
-0, 0, 0, 0, 2012, 0x31e592b7
-0, 0, 0, 0, 2012, 0xa0c5ccf0
-0, 0, 0, 0, 2012, 0x6e77c92b
-0, 0, 0, 0, 2012, 0xe87fa928
-0, 0, 0, 0, 2012, 0x4923bcdb
-0, 0, 0, 0, 2012, 0x3260b452
-0, 0, 0, 0, 2012, 0x62beafa0
-0, 0, 0, 0, 2012, 0x5a6fc18a
-0, 0, 0, 0, 2012, 0x9d05ae87
-0, 0, 0, 0, 2012, 0xb577a54e
-0, 0, 0, 0, 2012, 0xd66bc5ef
-0, 0, 0, 0, 2012, 0x40bec7bb
-0, 0, 0, 0, 2012, 0xedd3a1b9
-0, 0, 0, 0, 2012, 0xf6f49f83
-0, 0, 0, 0, 2012, 0x316fb06d
-0, 0, 0, 0, 2012, 0xc3f3a874
-0, 0, 0, 0, 2012, 0x3a96b3bd
-0, 0, 0, 0, 2012, 0x825aba30
-0, 0, 0, 0, 2012, 0x5b58ce66
-0, 0, 0, 0, 2012, 0x412dc092
-0, 0, 0, 0, 2012, 0xcb47bfa3
-0, 0, 0, 0, 2012, 0xe025bb79
-0, 0, 0, 0, 2012, 0x0042ba53
-0, 0, 0, 0, 2012, 0x7e9bba1d
-0, 0, 0, 0, 2012, 0x0058c99d
-0, 0, 0, 0, 2012, 0x47d2b590
-0, 0, 0, 0, 2012, 0xdf4ba9c6
-0, 0, 0, 0, 2012, 0xe671987c
-0, 0, 0, 0, 2012, 0x90dccc89
-0, 0, 0, 0, 2012, 0x012ccae9
-0, 0, 0, 0, 2012, 0x2eb5b83e
-0, 0, 0, 0, 2012, 0x3fecb7f4
-0, 0, 0, 0, 2012, 0x7955a464
-0, 0, 0, 0, 2012, 0xfe9eb3c3
-0, 0, 0, 0, 2012, 0x7457c904
-0, 0, 0, 0, 2012, 0xd23ea69d
-0, 0, 0, 0, 2012, 0xc497bf82
-0, 0, 0, 0, 2012, 0x15e5c241
-0, 0, 0, 0, 2012, 0x3dfea71f
-0, 0, 0, 0, 2012, 0x1e59c9c0
-0, 0, 0, 0, 2012, 0x1a34b927
-0, 0, 0, 0, 2012, 0xbf42b430
-0, 0, 0, 0, 2012, 0xf084c29f
-0, 0, 0, 0, 2012, 0x6443c44a
-0, 0, 0, 0, 2012, 0x7985a4a5
-0, 0, 0, 0, 2012, 0x27add059
-0, 0, 0, 0, 2012, 0x7f1faea4
-0, 0, 0, 0, 2012, 0x8d9dc732
-0, 0, 0, 0, 2012, 0xf272c32e
-0, 0, 0, 0, 2012, 0x4fa3ab11
-0, 0, 0, 0, 2012, 0x512e9887
-0, 0, 0, 0, 2012, 0xd478d55b
-0, 0, 0, 0, 2012, 0xa94a9d93
-0, 0, 0, 0, 2012, 0xff73d812
-0, 0, 0, 0, 2012, 0xd3a6b9ef
-0, 0, 0, 0, 2012, 0x7b4ebc1e
-0, 0, 0, 0, 2012, 0xcc7bba1a
-0, 0, 0, 0, 2012, 0x1aa7cd1a
-0, 0, 0, 0, 2012, 0xd707c202
-0, 0, 0, 0, 2012, 0xcb6ac18b
-0, 0, 0, 0, 2012, 0x1ccdcbd6
-0, 0, 0, 0, 2012, 0x700cb51e
-0, 0, 0, 0, 2012, 0x27b6a3e7
-0, 0, 0, 0, 2012, 0x8570b8cd
-0, 0, 0, 0, 2012, 0x22f2b2ed
-0, 0, 0, 0, 2012, 0x75edb63e
-0, 0, 0, 0, 2012, 0x8145b53f
-0, 0, 0, 0, 2012, 0x15efb8bc
-0, 0, 0, 0, 2012, 0x200bb5e6
-0, 0, 0, 0, 2012, 0xfa79b178
-0, 0, 0, 0, 2012, 0xbd39cdf4
-0, 0, 0, 0, 2012, 0x0970b0b2
-0, 0, 0, 0, 2012, 0x1acebe72
-0, 0, 0, 0, 2012, 0x1a26aa71
-0, 0, 0, 0, 2012, 0x8f71aa54
-0, 0, 0, 0, 2012, 0x0265c523
-0, 0, 0, 0, 2012, 0x2df0a53b
-0, 0, 0, 0, 2012, 0x59a7a37a
-0, 0, 0, 0, 2012, 0x9ad9acda
-0, 0, 0, 0, 2012, 0x738cbc6f
-0, 0, 0, 0, 2012, 0xc646a7ad
-0, 0, 0, 0, 2012, 0x7f25c19b
-0, 0, 0, 0, 2012, 0x1439bdb0
-0, 0, 0, 0, 2012, 0xa40cbef0
-0, 0, 0, 0, 2012, 0x9b09b99a
-0, 0, 0, 0, 2012, 0x5ff0bbde
-0, 0, 0, 0, 2012, 0x3981c2d6
-0, 0, 0, 0, 2012, 0xfa89b40d
-0, 0, 0, 0, 2012, 0x12e9a7b9
-0, 0, 0, 0, 2012, 0xc5faaac3
-0, 0, 0, 0, 2012, 0xe12bc3a9
-0, 0, 0, 0, 2012, 0x9c57b8f3
-0, 0, 0, 0, 2012, 0x4fd4b6c0
-0, 0, 0, 0, 2012, 0xb72cca50
-0, 0, 0, 0, 2012, 0xb4d4cbbb
-0, 0, 0, 0, 2012, 0x9399bfa1
-0, 0, 0, 0, 2012, 0x0abfb708
-0, 0, 0, 0, 2012, 0xd1d9acc0
-0, 0, 0, 0, 2012, 0x079ab5b2
-0, 0, 0, 0, 2012, 0x05a0be32
-0, 0, 0, 0, 2012, 0x445cc8db
-0, 0, 0, 0, 2012, 0xf9a3aa71
-0, 0, 0, 0, 2012, 0xd2e29eac
-0, 0, 0, 0, 2012, 0x391a9f20
-0, 0, 0, 0, 2012, 0x571eab4e
-0, 0, 0, 0, 2012, 0x6962bc96
-0, 0, 0, 0, 2012, 0x2f04b495
-0, 0, 0, 0, 2012, 0x7b66bab7
-0, 0, 0, 0, 2012, 0xa718b8c9
-0, 0, 0, 0, 2012, 0xb069a54e
-0, 0, 0, 0, 2012, 0xc052a1d2
-0, 0, 0, 0, 2012, 0x661ac62e
-0, 0, 0, 0, 2012, 0xc4ebb529
-0, 0, 0, 0, 2012, 0xf998b251
-0, 0, 0, 0, 2012, 0x0ee8bffa
-0, 0, 0, 0, 2012, 0x6e3fd984
-0, 0, 0, 0, 2012, 0x5825b63f
-0, 0, 0, 0, 2012, 0x9c79c561
-0, 0, 0, 0, 2012, 0x3470beb7
-0, 0, 0, 0, 2012, 0x9135bd9d
-0, 0, 0, 0, 2012, 0xd8e8bb7f
-0, 0, 0, 0, 2012, 0x322ea448
-0, 0, 0, 0, 2012, 0xe974b3ab
-0, 0, 0, 0, 2012, 0x4151c32d
-0, 0, 0, 0, 2012, 0x2b05bf7d
-0, 0, 0, 0, 2012, 0x4111c0d8
-0, 0, 0, 0, 2012, 0xff9ad574
-0, 0, 0, 0, 2012, 0xa55dced2
-0, 0, 0, 0, 2012, 0x11e6c0cb
-0, 0, 0, 0, 2012, 0x2478b998
-0, 0, 0, 0, 2012, 0xdc8abb54
-0, 0, 0, 0, 2012, 0xe16da510
-0, 0, 0, 0, 2012, 0xfc18b3db
-0, 0, 0, 0, 2012, 0x1426cd42
-0, 0, 0, 0, 2012, 0xb560a661
-0, 0, 0, 0, 2012, 0xc200aa4b
-0, 0, 0, 0, 2012, 0xea00af2a
-0, 0, 0, 0, 2012, 0x32bcbf84
-0, 0, 0, 0, 2012, 0x4c29cb2a
-0, 0, 0, 0, 2012, 0xe8a2aabc
-0, 0, 0, 0, 2012, 0x64bdb6cd
-0, 0, 0, 0, 2012, 0x3a80adbc
-0, 0, 0, 0, 2012, 0xa012b2c4
-0, 0, 0, 0, 2012, 0xac3ebce7
-0, 0, 0, 0, 2012, 0xfae1b2a7
-0, 0, 0, 0, 2012, 0x37b4ddae
-0, 0, 0, 0, 2012, 0x8ff9bd55
-0, 0, 0, 0, 2012, 0x16f6abeb
-0, 0, 0, 0, 2012, 0x5820badf
-0, 0, 0, 0, 2012, 0x7183b45e
-0, 0, 0, 0, 2012, 0xc0a6c826
-0, 0, 0, 0, 2012, 0x4c36bb02
-0, 0, 0, 0, 2012, 0xda46b854
-0, 0, 0, 0, 2012, 0xcc8accb6
-0, 0, 0, 0, 2012, 0xa6b2c3a2
-0, 0, 0, 0, 2012, 0x1c91cc00
-0, 0, 0, 0, 2012, 0xf33cd721
-0, 0, 0, 0, 2012, 0x7f86d2ed
-0, 0, 0, 0, 2012, 0x9fdabb1d
-0, 0, 0, 0, 2012, 0x33ebbbc4
-0, 0, 0, 0, 2012, 0x2741ba4f
-0, 0, 0, 0, 2012, 0x0d0dd107
-0, 0, 0, 0, 2012, 0xf1d5b551
-0, 0, 0, 0, 2012, 0xf47dbebc
-0, 0, 0, 0, 2012, 0xa955cea3
-0, 0, 0, 0, 2012, 0x51d6b407
-0, 0, 0, 0, 2012, 0xb7d3c2c0
-0, 0, 0, 0, 2012, 0xce3cc6ae
-0, 0, 0, 0, 2012, 0x782cc184
-0, 0, 0, 0, 2012, 0xf4cec2af
-0, 0, 0, 0, 2012, 0xa43eb295
-0, 0, 0, 0, 2012, 0xc74aa62d
-0, 0, 0, 0, 2012, 0xf9dfc11f
-0, 0, 0, 0, 2012, 0x3da1a319
-0, 0, 0, 0, 2012, 0xf613bd75
-0, 0, 0, 0, 2012, 0x10d9cda4
-0, 0, 0, 0, 2012, 0x08c9bcb3
-0, 0, 0, 0, 2012, 0x43b9d170
-0, 0, 0, 0, 2012, 0x1f0db940
-0, 0, 0, 0, 2012, 0x3c4ec614
-0, 0, 0, 0, 2012, 0xa94abaaa
-0, 0, 0, 0, 2012, 0x2557a922
-0, 0, 0, 0, 2012, 0x4245c4b4
-0, 0, 0, 0, 2012, 0x0cb1b06f
-0, 0, 0, 0, 2012, 0x778bbeab
-0, 0, 0, 0, 2012, 0x5ce4ca3b
-0, 0, 0, 0, 2012, 0xe70e9fd3
-0, 0, 0, 0, 2012, 0x28afbcbf
-0, 0, 0, 0, 2012, 0xc41fb9b2
-0, 0, 0, 0, 2012, 0xd60cbfae
-0, 0, 0, 0, 2012, 0x1087cb26
-0, 0, 0, 0, 2012, 0xc9face3b
-0, 0, 0, 0, 2012, 0x7403b314
-0, 0, 0, 0, 2012, 0xe034ba97
-0, 0, 0, 0, 2012, 0x15dcbc67
-0, 0, 0, 0, 2012, 0x20d3bcff
-0, 0, 0, 0, 2012, 0xc136a2ce
-0, 0, 0, 0, 2012, 0x038bb025
-0, 0, 0, 0, 2012, 0xd655cf84
-0, 0, 0, 0, 2012, 0xcf54c656
-0, 0, 0, 0, 2012, 0x3c77bb0d
-0, 0, 0, 0, 2012, 0xd765d7a7
-0, 0, 0, 0, 2012, 0x1a60b020
-0, 0, 0, 0, 2012, 0x83c8c2e9
-0, 0, 0, 0, 2012, 0x9b97c6e7
-0, 0, 0, 0, 2012, 0x3870ad63
-0, 0, 0, 0, 2012, 0x0e3ac67d
-0, 0, 0, 0, 2012, 0xeb53c935
-0, 0, 0, 0, 2012, 0xeeb0c3e1
-0, 0, 0, 0, 2012, 0x9cb5bdb9
-0, 0, 0, 0, 2012, 0x64b1afec
-0, 0, 0, 0, 2012, 0x57dcadbc
-0, 0, 0, 0, 2012, 0xed76c5fd
-0, 0, 0, 0, 2012, 0x0cb4cac5
-0, 0, 0, 0, 2012, 0xd30bbd06
-0, 0, 0, 0, 2012, 0xaee9c6c3
-0, 0, 0, 0, 2012, 0xe845c9b3
-0, 0, 0, 0, 2012, 0xc09cc7fc
-0, 0, 0, 0, 2012, 0xfdebaacb
-0, 0, 0, 0, 2012, 0x6f2db89f
-0, 0, 0, 0, 2012, 0x7d89bee7
-0, 0, 0, 0, 2012, 0x8699b8be
-0, 0, 0, 0, 2012, 0x57d6cc8a
-0, 0, 0, 0, 2012, 0xcdbcd246
-0, 0, 0, 0, 2012, 0x9057b285
-0, 0, 0, 0, 2012, 0x2ac9cc87
-0, 0, 0, 0, 2012, 0xeb20c421
-0, 0, 0, 0, 2012, 0x4789d11f
-0, 0, 0, 0, 2012, 0x55e7c9fe
-0, 0, 0, 0, 2012, 0xd81cb4c6
-0, 0, 0, 0, 2012, 0x2af0a88e
-0, 0, 0, 0, 2012, 0x7d96a4ee
-0, 0, 0, 0, 2012, 0xff7cc3ea
-0, 0, 0, 0, 2012, 0x2514d2a8
-0, 0, 0, 0, 2012, 0x7d2cccc3
-0, 0, 0, 0, 2012, 0x98dccbbf
-0, 0, 0, 0, 2012, 0x55f2bd3e
-0, 0, 0, 0, 2012, 0x0e58bbd7
-0, 0, 0, 0, 2012, 0x1520c45d
-0, 0, 0, 0, 2012, 0x3c60cede
-0, 0, 0, 0, 2012, 0xbfb2be6b
-0, 0, 0, 0, 2012, 0xa839c2d5
-0, 0, 0, 0, 2012, 0x7713bdba
-0, 0, 0, 0, 2012, 0xf16c9e95
-0, 0, 0, 0, 2012, 0x8e94caf1
-0, 0, 0, 0, 2012, 0x3915c673
-0, 0, 0, 0, 2012, 0x69afc76f
-0, 0, 0, 0, 2012, 0x3ebec514
-0, 0, 0, 0, 2012, 0x70c5dd9b
-0, 0, 0, 0, 2012, 0x6868b7d9
-0, 0, 0, 0, 2012, 0x9a31c801
-0, 0, 0, 0, 2012, 0x93c4b6ac
-0, 0, 0, 0, 2012, 0xb1aaca39
-0, 0, 0, 0, 2012, 0x8f67b9ed
-0, 0, 0, 0, 2012, 0x09adcf1f
-0, 0, 0, 0, 2012, 0xe172cb3c
-0, 0, 0, 0, 2012, 0x044bbdc5
-0, 0, 0, 0, 2012, 0x391cb3d9
-0, 0, 0, 0, 2012, 0x3bd1bc29
-0, 0, 0, 0, 2012, 0x8a78c5d2
-0, 0, 0, 0, 2012, 0xa46fce11
-0, 0, 0, 0, 2012, 0x4c13d9bc
-0, 0, 0, 0, 2012, 0x7f47ce4f
-0, 0, 0, 0, 2012, 0xa03ebcae
-0, 0, 0, 0, 2012, 0xf6f2b2c8
-0, 0, 0, 0, 2012, 0x7995be2a
-0, 0, 0, 0, 2012, 0x22d7b94a
-0, 0, 0, 0, 2012, 0x07bcc06a
-0, 0, 0, 0, 2012, 0x04adcb6d
-0, 0, 0, 0, 2012, 0x4aecc135
-0, 0, 0, 0, 2012, 0x8442dc6a
-0, 0, 0, 0, 2012, 0x9e67b826
-0, 0, 0, 0, 2012, 0xb1c4b235
-0, 0, 0, 0, 2012, 0x565ecaae
-0, 0, 0, 0, 2012, 0x34a2c877
-0, 0, 0, 0, 2012, 0x815eb148
-0, 0, 0, 0, 2012, 0x354eb4ce
-0, 0, 0, 0, 2012, 0xf74db8b1
-0, 0, 0, 0, 2012, 0x56f3b430
-0, 0, 0, 0, 2012, 0x39f9c72f
-0, 0, 0, 0, 2012, 0x83d1bfde
-0, 0, 0, 0, 2012, 0x2da1bf57
-0, 0, 0, 0, 2012, 0xd97fc933
-0, 0, 0, 0, 2012, 0x4b3edbfe
-0, 0, 0, 0, 2012, 0xb975d346
-0, 0, 0, 0, 2012, 0x856ac304
-0, 0, 0, 0, 2012, 0xb38dba2e
-0, 0, 0, 0, 2012, 0xbe14c822
-0, 0, 0, 0, 2012, 0xb848c927
-0, 0, 0, 0, 2012, 0x0a89c0e6
-0, 0, 0, 0, 2012, 0x44a3c3d5
-0, 0, 0, 0, 2012, 0x7af1c30c
-0, 0, 0, 0, 2012, 0xe928b619
-0, 0, 0, 0, 2012, 0xc9aeb012
-0, 0, 0, 0, 2012, 0xae02cfde
-0, 0, 0, 0, 2012, 0x0b42c3d9
-0, 0, 0, 0, 2012, 0xa5b7c1ed
-0, 0, 0, 0, 2012, 0xd2dcbcdc
-0, 0, 0, 0, 2012, 0x18cfbf55
-0, 0, 0, 0, 2012, 0x34f0c800
-0, 0, 0, 0, 2012, 0x2a80bdba
-0, 0, 0, 0, 2012, 0x5ef2b3a7
-0, 0, 0, 0, 2012, 0x35a6ba33
-0, 0, 0, 0, 2012, 0x1088bbf5
-0, 0, 0, 0, 2012, 0xaec0bedf
-0, 0, 0, 0, 2012, 0x769fb535
-0, 0, 0, 0, 2012, 0xfe11b979
-0, 0, 0, 0, 2012, 0xe856b37e
-0, 0, 0, 0, 2012, 0x36c3cffd
-0, 0, 0, 0, 2012, 0x4771db58
-0, 0, 0, 0, 2012, 0x5467d13e
-0, 0, 0, 0, 2012, 0xb405c1b5
-0, 0, 0, 0, 2012, 0x3cbdc145
-0, 0, 0, 0, 2012, 0xbb9ccdd7
-0, 0, 0, 0, 2012, 0xac25ce9e
-0, 0, 0, 0, 2012, 0x6d2ac82a
-0, 0, 0, 0, 2012, 0x1661ba50
-0, 0, 0, 0, 2012, 0xbc7ac82a
-0, 0, 0, 0, 2012, 0x020bb4de
-0, 0, 0, 0, 2012, 0x4e10cb93
-0, 0, 0, 0, 2012, 0x3dabc15f
-0, 0, 0, 0, 2012, 0x12acc64b
-0, 0, 0, 0, 2012, 0x9cecb51a
-0, 0, 0, 0, 2012, 0x959acb39
-0, 0, 0, 0, 2012, 0x3ee7c0e8
-0, 0, 0, 0, 2012, 0xde18c1df
-0, 0, 0, 0, 2012, 0x3c72c3cd
-0, 0, 0, 0, 2012, 0x1ac4bb5d
-0, 0, 0, 0, 2012, 0xb155c741
-0, 0, 0, 0, 2012, 0x5069c8aa
-0, 0, 0, 0, 2012, 0x610db0bc
-0, 0, 0, 0, 2012, 0xb82bc329
-0, 0, 0, 0, 2012, 0x8bd4c522
-0, 0, 0, 0, 2012, 0xd44bb865
-0, 0, 0, 0, 2012, 0xb51ac7dc
-0, 0, 0, 0, 2012, 0xfe2bc799
-0, 0, 0, 0, 2012, 0x8cd1bb53
-0, 0, 0, 0, 2012, 0xba13ca97
-0, 0, 0, 0, 2012, 0xf107bd51
-0, 0, 0, 0, 2012, 0xa04ece95
-0, 0, 0, 0, 2012, 0x4f4faa54
-0, 0, 0, 0, 2012, 0x5a74bfe1
-0, 0, 0, 0, 2012, 0xdafade5b
-0, 0, 0, 0, 2012, 0x738fba51
-0, 0, 0, 0, 2012, 0xe7b2b78e
-0, 0, 0, 0, 2012, 0x7685b6ce
-0, 0, 0, 0, 2012, 0xae45bd8a
-0, 0, 0, 0, 2012, 0xd52cc84e
-0, 0, 0, 0, 2012, 0x04abd773
-0, 0, 0, 0, 2012, 0x2badb0ff
-0, 0, 0, 0, 2012, 0x0eaec6b2
-0, 0, 0, 0, 2012, 0x7c1ec33f
-0, 0, 0, 0, 2012, 0x8773b925
-0, 0, 0, 0, 2012, 0x40bbc36d
-0, 0, 0, 0, 2012, 0x330bc288
-0, 0, 0, 0, 2012, 0x1659b6f5
-0, 0, 0, 0, 2012, 0x66eac162
-0, 0, 0, 0, 2012, 0xf3acdb3d
-0, 0, 0, 0, 2012, 0x465abb87
-0, 0, 0, 0, 2012, 0xe8e9bc16
-0, 0, 0, 0, 2012, 0x71eebbd9
-0, 0, 0, 0, 2012, 0x1f59cb2a
-0, 0, 0, 0, 2012, 0x53e3c9e7
-0, 0, 0, 0, 2012, 0xf410b939
-0, 0, 0, 0, 2012, 0xdb13d1b3
-0, 0, 0, 0, 2012, 0xcd26bf27
-0, 0, 0, 0, 2012, 0x707ecc9c
-0, 0, 0, 0, 2012, 0x3483b6bf
-0, 0, 0, 0, 2012, 0x4184d451
-0, 0, 0, 0, 2012, 0xcf6abfae
-0, 0, 0, 0, 2012, 0x5c9eb4ca
-0, 0, 0, 0, 2012, 0xf396be01
-0, 0, 0, 0, 2012, 0x06bfda38
-0, 0, 0, 0, 2012, 0x0e92bcf4
-0, 0, 0, 0, 2012, 0xaaa2b99d
-0, 0, 0, 0, 2012, 0xf112a9a9
-0, 0, 0, 0, 2012, 0x2844bdf1
-0, 0, 0, 0, 2012, 0xb96baf39
-0, 0, 0, 0, 2012, 0xd4f2d157
-0, 0, 0, 0, 2012, 0x7c74b149
-0, 0, 0, 0, 2012, 0xbd43d5f2
-0, 0, 0, 0, 2012, 0xaa10b2ba
-0, 0, 0, 0, 2012, 0x66e9b95f
-0, 0, 0, 0, 2012, 0x6f01abef
-0, 0, 0, 0, 2012, 0x1cb5c664
-0, 0, 0, 0, 2012, 0x5ee2afc5
-0, 0, 0, 0, 2012, 0xeb39d213
-0, 0, 0, 0, 2012, 0x1ffeaafc
-0, 0, 0, 0, 2012, 0x6bb4d548
-0, 0, 0, 0, 2012, 0xa045b23a
-0, 0, 0, 0, 2012, 0x17c3aa49
-0, 0, 0, 0, 2012, 0x2d47db7c
-0, 0, 0, 0, 2012, 0x07ddc9ac
-0, 0, 0, 0, 2012, 0xa386c99e
-0, 0, 0, 0, 2012, 0x0e0bae8a
-0, 0, 0, 0, 2012, 0x7d6fc419
-0, 0, 0, 0, 2012, 0x34a3c5a2
-0, 0, 0, 0, 2012, 0xda81c8e9
-0, 0, 0, 0, 2012, 0xde53bcd8
-0, 0, 0, 0, 2012, 0x372ac065
-0, 0, 0, 0, 2012, 0x6d07a95c
-0, 0, 0, 0, 2012, 0x296eb47f
-0, 0, 0, 0, 2012, 0x0f47be2a
-0, 0, 0, 0, 2012, 0x389ebaf6
-0, 0, 0, 0, 2012, 0x9746ba3b
-0, 0, 0, 0, 2012, 0x070e9aed
-0, 0, 0, 0, 2012, 0xa4abc798
-0, 0, 0, 0, 2012, 0xe55cac7b
-0, 0, 0, 0, 2012, 0x0c71ba45
-0, 0, 0, 0, 2012, 0x70fbb3c5
-0, 0, 0, 0, 2012, 0xa35ec30a
-0, 0, 0, 0, 2012, 0xf30ab935
-0, 0, 0, 0, 2012, 0x2cbb9b99
-0, 0, 0, 0, 2012, 0x6606c1bf
-0, 0, 0, 0, 2012, 0x41ccad5c
-0, 0, 0, 0, 2012, 0x352fc002
-0, 0, 0, 0, 2012, 0x1763bd10
-0, 0, 0, 0, 2012, 0xb54bcae6
-0, 0, 0, 0, 2012, 0x7374ab92
-0, 0, 0, 0, 2012, 0x2895a99a
-0, 0, 0, 0, 2012, 0x9f68b02f
-0, 0, 0, 0, 2012, 0xdfabbb76
-0, 0, 0, 0, 2012, 0x764ea6c5
-0, 0, 0, 0, 2012, 0x4e83c5a5
-0, 0, 0, 0, 2012, 0xf0e8c76a
-0, 0, 0, 0, 2012, 0xdc80b4ea
-0, 0, 0, 0, 2012, 0xcc53b0a5
-0, 0, 0, 0, 2012, 0x7893bc7f
-0, 0, 0, 0, 2012, 0x6965b355
-0, 0, 0, 0, 2012, 0x7f8fac00
-0, 0, 0, 0, 2012, 0x6c71c7b8
-0, 0, 0, 0, 2012, 0xa00ec367
-0, 0, 0, 0, 2012, 0x5f0fc50e
-0, 0, 0, 0, 2012, 0x1bd2ad87
-0, 0, 0, 0, 2012, 0xd054ba2d
-0, 0, 0, 0, 2012, 0xaf80a0d5
-0, 0, 0, 0, 2012, 0x2acac873
-0, 0, 0, 0, 2012, 0x260ca584
-0, 0, 0, 0, 2012, 0x4f98aa7c
-0, 0, 0, 0, 2012, 0x0254aa36
-0, 0, 0, 0, 2012, 0xe3c7c33a
-0, 0, 0, 0, 2012, 0x3b9ea70f
-0, 0, 0, 0, 2012, 0xe829b7e6
-0, 0, 0, 0, 2012, 0x9317a8d1
-0, 0, 0, 0, 2012, 0x88b3a98f
-0, 0, 0, 0, 2012, 0xa4a8c3bc
-0, 0, 0, 0, 2012, 0x95c9a869
-0, 0, 0, 0, 2012, 0x7f889fed
-0, 0, 0, 0, 2012, 0x5438c408
-0, 0, 0, 0, 2012, 0x3455a366
-0, 0, 0, 0, 2012, 0x5319b33d
-0, 0, 0, 0, 2012, 0xb19dc4f0
-0, 0, 0, 0, 2012, 0xf080b109
-0, 0, 0, 0, 2012, 0xef83d8e7
-0, 0, 0, 0, 2012, 0x237ac69c
-0, 0, 0, 0, 2012, 0xbb30b714
-0, 0, 0, 0, 2012, 0x8745ba54
-0, 0, 0, 0, 2012, 0x8588bd6c
-0, 0, 0, 0, 2012, 0xc580bdde
-0, 0, 0, 0, 2012, 0xb062baf1
-0, 0, 0, 0, 2012, 0xe014b082
-0, 0, 0, 0, 2012, 0x148bcb87
-0, 0, 0, 0, 2012, 0x554bc13d
-0, 0, 0, 0, 2012, 0xc410c270
-0, 0, 0, 0, 2012, 0xb2c8b65b
-0, 0, 0, 0, 2012, 0xa412b3f4
-0, 0, 0, 0, 2012, 0xbb52aa9a
-0, 0, 0, 0, 2012, 0x4005b527
-0, 0, 0, 0, 2012, 0x8c5eb055
-0, 0, 0, 0, 2012, 0x8622c142
-0, 0, 0, 0, 2012, 0x05a3b861
-0, 0, 0, 0, 2012, 0x9f6dbb4d
-0, 0, 0, 0, 2012, 0x033fb867
-0, 0, 0, 0, 2012, 0x243babd5
-0, 0, 0, 0, 2012, 0x8d6db83c
-0, 0, 0, 0, 2012, 0x3923b829
-0, 0, 0, 0, 2012, 0x69b6b587
-0, 0, 0, 0, 2012, 0xdda8d018
-0, 0, 0, 0, 2012, 0x54b1b2a4
-0, 0, 0, 0, 2012, 0x380eb1af
-0, 0, 0, 0, 2012, 0xec3cbdb4
-0, 0, 0, 0, 2012, 0x7ce9b4cf
-0, 0, 0, 0, 2012, 0xcf6cb99b
-0, 0, 0, 0, 2012, 0x7383ab97
-0, 0, 0, 0, 2012, 0xaa4cc068
-0, 0, 0, 0, 2012, 0x96d4c3db
-0, 0, 0, 0, 2012, 0xab8cb84f
-0, 0, 0, 0, 2012, 0x73dcacf9
-0, 0, 0, 0, 2012, 0xf61ca122
-0, 0, 0, 0, 2012, 0x9f1cbd5b
-0, 0, 0, 0, 2012, 0x1f84aa3f
-0, 0, 0, 0, 2012, 0xa003ad43
-0, 0, 0, 0, 2012, 0x6cffa4ef
-0, 0, 0, 0, 2012, 0x29559e1e
-0, 0, 0, 0, 2012, 0x7a79b059
-0, 0, 0, 0, 2012, 0xa1929c42
-0, 0, 0, 0, 2012, 0x52dead1c
-0, 0, 0, 0, 2012, 0x8f31b9f5
-0, 0, 0, 0, 2012, 0xb8a899ec
-0, 0, 0, 0, 2012, 0x7ca4b02d
-0, 0, 0, 0, 2012, 0x2c92ae1b
-0, 0, 0, 0, 2012, 0xe683a92f
-0, 0, 0, 0, 2012, 0xe9d5abcf
-0, 0, 0, 0, 2012, 0x757db377
-0, 0, 0, 0, 2012, 0xd4a8bbae
-0, 0, 0, 0, 2012, 0xeea5c4ee
-0, 0, 0, 0, 2012, 0xc37ca9a9
-0, 0, 0, 0, 2012, 0x8871bb51
-0, 0, 0, 0, 2012, 0x5dd8b3a2
-0, 0, 0, 0, 2012, 0xef0fae7f
-0, 0, 0, 0, 2012, 0xe7ecb23e
-0, 0, 0, 0, 2012, 0xc4f6d437
-0, 0, 0, 0, 2012, 0x0c74b81d
-0, 0, 0, 0, 2012, 0xee68b1ee
-0, 0, 0, 0, 2012, 0x46b4b4a8
-0, 0, 0, 0, 2012, 0x0526abca
-0, 0, 0, 0, 2012, 0x7695ba55
-0, 0, 0, 0, 2012, 0xc7f5ad90
-0, 0, 0, 0, 2012, 0x0522b9bc
-0, 0, 0, 0, 2012, 0x0eefc6ad
-0, 0, 0, 0, 2012, 0x340dae16
-0, 0, 0, 0, 2012, 0xea42bdc0
-0, 0, 0, 0, 2012, 0xe047abb6
-0, 0, 0, 0, 2012, 0x6da5c14f
-0, 0, 0, 0, 2012, 0x46d8c11d
-0, 0, 0, 0, 2012, 0x8f4d9f2f
-0, 0, 0, 0, 2012, 0x6d00d26c
-0, 0, 0, 0, 2012, 0x87fc9d1b
-0, 0, 0, 0, 2012, 0xbba5b763
-0, 0, 0, 0, 2012, 0xab58b853
-0, 0, 0, 0, 2012, 0x8180b863
-0, 0, 0, 0, 2012, 0x3684b3ba
-0, 0, 0, 0, 2012, 0xf1a4a806
-0, 0, 0, 0, 2012, 0x2826b48c
-0, 0, 0, 0, 2012, 0x1883af7f
-0, 0, 0, 0, 2012, 0x44c5c37a
-0, 0, 0, 0, 2012, 0xec33c3f1
-0, 0, 0, 0, 2012, 0xd67fb767
-0, 0, 0, 0, 2012, 0x03c2c219
-0, 0, 0, 0, 2012, 0x75a9b389
-0, 0, 0, 0, 2012, 0xe041ad88
-0, 0, 0, 0, 2012, 0x6bccb005
-0, 0, 0, 0, 2012, 0xd881c24a
-0, 0, 0, 0, 2012, 0x7dd0c302
-0, 0, 0, 0, 2012, 0x2ba8a649
-0, 0, 0, 0, 2012, 0x63e19eab
-0, 0, 0, 0, 2012, 0x1c0dafce
-0, 0, 0, 0, 2012, 0xf266bf47
-0, 0, 0, 0, 2012, 0x11beb4b1
-0, 0, 0, 0, 2012, 0xc6f6b2b5
-0, 0, 0, 0, 2012, 0x15d4b4d0
-0, 0, 0, 0, 2012, 0x08bfa1e7
-0, 0, 0, 0, 2012, 0x18dbb7b5
-0, 0, 0, 0, 2012, 0xc279cc67
-0, 0, 0, 0, 2012, 0xd236bf28
-0, 0, 0, 0, 2012, 0xc9d1b196
-0, 0, 0, 0, 2012, 0xb605983e
-0, 0, 0, 0, 2012, 0x8132c566
-0, 0, 0, 0, 2012, 0x6be4cd39
-0, 0, 0, 0, 2012, 0xce53c1f9
-0, 0, 0, 0, 2012, 0xe1efac0f
-0, 0, 0, 0, 2012, 0x3d60a57a
-0, 0, 0, 0, 2012, 0x1beda4b7
-0, 0, 0, 0, 2012, 0x34a4ac81
-0, 0, 0, 0, 2012, 0x30b0be4b
-0, 0, 0, 0, 2012, 0xc7ceaf45
-0, 0, 0, 0, 2012, 0xade0b6ec
-0, 0, 0, 0, 2012, 0xe00daf06
-0, 0, 0, 0, 2012, 0x04f79fe4
-0, 0, 0, 0, 2012, 0x8c59b7d9
-0, 0, 0, 0, 2012, 0x6f66b92a
-0, 0, 0, 0, 2012, 0x9b08b2c0
-0, 0, 0, 0, 2012, 0xa8c1b5c1
-0, 0, 0, 0, 2012, 0xe3aac0b0
-0, 0, 0, 0, 2012, 0x1622bdaf
-0, 0, 0, 0, 2012, 0x25e1a9ff
-0, 0, 0, 0, 2012, 0x5577ad82
-0, 0, 0, 0, 2012, 0xfe16a49b
-0, 0, 0, 0, 2012, 0xef7fc32a
-0, 0, 0, 0, 2012, 0xfe30c35d
-0, 0, 0, 0, 2012, 0x3adc9610
-0, 0, 0, 0, 2012, 0x36eeabdc
-0, 0, 0, 0, 2012, 0xde3fb56c
-0, 0, 0, 0, 2012, 0x5629bd82
-0, 0, 0, 0, 2012, 0xb099a61d
-0, 0, 0, 0, 2012, 0x3013b106
-0, 0, 0, 0, 2012, 0xc359aef3
-0, 0, 0, 0, 2012, 0xec01b3e1
-0, 0, 0, 0, 2012, 0x6e8ac0b1
-0, 0, 0, 0, 2012, 0x41e8b82d
-0, 0, 0, 0, 2012, 0x3a2fb38b
-0, 0, 0, 0, 2012, 0x7025aac9
-0, 0, 0, 0, 2012, 0xbb0eb094
-0, 0, 0, 0, 2012, 0xdc06c156
-0, 0, 0, 0, 2012, 0x4007cea4
-0, 0, 0, 0, 2012, 0x102ebe03
-0, 0, 0, 0, 2012, 0x6e8faae7
-0, 0, 0, 0, 2012, 0xa357aa0c
-0, 0, 0, 0, 2012, 0x07d2bf4d
-0, 0, 0, 0, 2012, 0xfb71b338
-0, 0, 0, 0, 2012, 0xd5f1be84
-0, 0, 0, 0, 2012, 0x2a7cb554
-0, 0, 0, 0, 2012, 0xfb03b8c3
-0, 0, 0, 0, 2012, 0x2ff1ca87
-0, 0, 0, 0, 2012, 0xeef2b7f3
-0, 0, 0, 0, 2012, 0x9377b15f
-0, 0, 0, 0, 2012, 0x370cb0c2
-0, 0, 0, 0, 2012, 0x5f78b118
-0, 0, 0, 0, 2012, 0x19afa87a
-0, 0, 0, 0, 2012, 0xc717ab0d
-0, 0, 0, 0, 2012, 0x3ca499f4
-0, 0, 0, 0, 2012, 0x9612b8e4
-0, 0, 0, 0, 2012, 0x32c0bb29
-0, 0, 0, 0, 2012, 0x7727beba
-0, 0, 0, 0, 2012, 0x8b60a4cb
-0, 0, 0, 0, 2012, 0xe899a9c8
-0, 0, 0, 0, 2012, 0x60f4b7fe
-0, 0, 0, 0, 2012, 0x544f9ecb
-0, 0, 0, 0, 2012, 0x34afcd71
-0, 0, 0, 0, 2012, 0x470eab55
-0, 0, 0, 0, 2012, 0xe4959f93
-0, 0, 0, 0, 2012, 0x69eeaf97
-0, 0, 0, 0, 2012, 0x0ec9aca3
-0, 0, 0, 0, 2012, 0x51e4b7f6
-0, 0, 0, 0, 2012, 0xf6c0a837
-0, 0, 0, 0, 2012, 0x3bdca59b
-0, 0, 0, 0, 2012, 0x14c59dfc
-0, 0, 0, 0, 2012, 0xa50ab23a
-0, 0, 0, 0, 2012, 0x8832b6e2
-0, 0, 0, 0, 2012, 0x3d699d1b
-0, 0, 0, 0, 2012, 0x751aa4b8
-0, 0, 0, 0, 2012, 0x59a9b98c
-0, 0, 0, 0, 2012, 0xb67c98cb
-0, 0, 0, 0, 2012, 0x0fd39ccd
-0, 0, 0, 0, 2012, 0x9980d1e1
-0, 0, 0, 0, 2012, 0xffd9a716
-0, 0, 0, 0, 2012, 0x7d2fbed1
-0, 0, 0, 0, 2012, 0x76e6b042
-0, 0, 0, 0, 2012, 0xe027a232
-0, 0, 0, 0, 2012, 0x7c6ca5ce
-0, 0, 0, 0, 2012, 0x5cf6bda4
-0, 0, 0, 0, 2012, 0x6075bd0d
-0, 0, 0, 0, 2012, 0xedc4abe9
-0, 0, 0, 0, 2012, 0xb8f7cc26
-0, 0, 0, 0, 2012, 0x2cbbb500
-0, 0, 0, 0, 2012, 0x1c34b04d
-0, 0, 0, 0, 2012, 0x5f18bea2
-0, 0, 0, 0, 2012, 0x94d0bb2b
-0, 0, 0, 0, 2012, 0x6899b78e
-0, 0, 0, 0, 2012, 0xc9aaa7a2
-0, 0, 0, 0, 2012, 0x298cbafa
-0, 0, 0, 0, 2012, 0x89d9ac80
-0, 0, 0, 0, 2012, 0xc6ffa7e6
-0, 0, 0, 0, 2012, 0xdcf7caf9
-0, 0, 0, 0, 2012, 0x26cfb4ee
-0, 0, 0, 0, 2012, 0xec70b09d
-0, 0, 0, 0, 2012, 0x65dca50f
-0, 0, 0, 0, 2012, 0xcdebc0b6
-0, 0, 0, 0, 2012, 0x9393a262
-0, 0, 0, 0, 2012, 0x34aab06d
-0, 0, 0, 0, 2012, 0x4800a550
-0, 0, 0, 0, 2012, 0x4d9aadec
-0, 0, 0, 0, 2012, 0x2cddabb6
-0, 0, 0, 0, 2012, 0x91a0c5b2
-0, 0, 0, 0, 2012, 0xd326bee1
-0, 0, 0, 0, 2012, 0xf76ab2d5
-0, 0, 0, 0, 2012, 0xcef99ade
-0, 0, 0, 0, 2012, 0x950dc76f
-0, 0, 0, 0, 2012, 0xb6aca7ad
-0, 0, 0, 0, 2012, 0x1aacb71c
-0, 0, 0, 0, 2012, 0x32389da0
-0, 0, 0, 0, 2012, 0x030cbcce
-0, 0, 0, 0, 2012, 0x0ec4b0cb
-0, 0, 0, 0, 2012, 0x6c0bb62e
-0, 0, 0, 0, 2012, 0xfadbb20d
-0, 0, 0, 0, 2012, 0x99c9c848
-0, 0, 0, 0, 2012, 0xe3e3b21a
-0, 0, 0, 0, 2012, 0x88d9a50b
-0, 0, 0, 0, 2012, 0xf4bbaf17
-0, 0, 0, 0, 2012, 0x49fea706
-0, 0, 0, 0, 2012, 0xafd0babf
-0, 0, 0, 0, 2012, 0x8970a8f3
-0, 0, 0, 0, 2012, 0x9223a553
-0, 0, 0, 0, 2012, 0x6ec2b2f9
-0, 0, 0, 0, 2012, 0x7960b759
-0, 0, 0, 0, 2012, 0x852891bf
-0, 0, 0, 0, 2012, 0x094ebbeb
-0, 0, 0, 0, 2012, 0xf9bab418
-0, 0, 0, 0, 2012, 0x010eae8c
-0, 0, 0, 0, 2012, 0x10baab3d
-0, 0, 0, 0, 2012, 0x2564b13f
-0, 0, 0, 0, 2012, 0xaec8ac22
-0, 0, 0, 0, 2012, 0xda0cbd4f
-0, 0, 0, 0, 2012, 0x97e1c075
-0, 0, 0, 0, 2012, 0x6731aca5
-0, 0, 0, 0, 2012, 0x2c1db696
-0, 0, 0, 0, 2012, 0x8ff7abbf
-0, 0, 0, 0, 2012, 0xf75ab3a2
-0, 0, 0, 0, 2012, 0x8683b824
-0, 0, 0, 0, 2012, 0x9668b354
-0, 0, 0, 0, 2012, 0x6e9aae04
-0, 0, 0, 0, 2012, 0xd8e9acd7
-0, 0, 0, 0, 2012, 0xa326c298
-0, 0, 0, 0, 2012, 0x6abcb409
-0, 0, 0, 0, 2012, 0x7eb3b549
-0, 0, 0, 0, 2012, 0xfc72ba6a
-0, 0, 0, 0, 2012, 0xed73b2e6
-0, 0, 0, 0, 2012, 0x07a6b0a9
-0, 0, 0, 0, 2012, 0x10a4aec4
-0, 0, 0, 0, 2012, 0xaac9a650
-0, 0, 0, 0, 2012, 0x848b9869
-0, 0, 0, 0, 2012, 0x1ddaafd6
-0, 0, 0, 0, 2012, 0xe291aaec
-0, 0, 0, 0, 2012, 0x8aa1aa4d
-0, 0, 0, 0, 2012, 0x9b69b94c
-0, 0, 0, 0, 2012, 0xe784bec0
-0, 0, 0, 0, 2012, 0x9305ba2d
-0, 0, 0, 0, 2012, 0x5616bb81
-0, 0, 0, 0, 2012, 0xea0facca
-0, 0, 0, 0, 2012, 0xe1b9991e
-0, 0, 0, 0, 2012, 0xded8bd59
-0, 0, 0, 0, 2012, 0xe79fb0ee
-0, 0, 0, 0, 2012, 0x1b8595a6
-0, 0, 0, 0, 2012, 0xb55ba336
-0, 0, 0, 0, 2012, 0xc552bc98
-0, 0, 0, 0, 2012, 0x2fe2c5ba
-0, 0, 0, 0, 2012, 0xe18aa5a6
-0, 0, 0, 0, 2012, 0xaa9bae1c
-0, 0, 0, 0, 2012, 0xd1ddb68d
-0, 0, 0, 0, 2012, 0x95bfb203
-0, 0, 0, 0, 2012, 0xeacab8b9
-0, 0, 0, 0, 2012, 0x5bfcb117
-0, 0, 0, 0, 2012, 0x1a9fa91c
-0, 0, 0, 0, 2012, 0xa285b180
-0, 0, 0, 0, 2012, 0xfd58a6e2
-0, 0, 0, 0, 2012, 0x394fc325
-0, 0, 0, 0, 2012, 0x0415a6aa
-0, 0, 0, 0, 2012, 0xf75fa5e0
-0, 0, 0, 0, 2012, 0x115cd11b
-0, 0, 0, 0, 2012, 0x6587b9e3
-0, 0, 0, 0, 2012, 0xce6bb7e6
-0, 0, 0, 0, 2012, 0xbaa2b409
-0, 0, 0, 0, 2012, 0x271bbb14
-0, 0, 0, 0, 2012, 0x4516c223
-0, 0, 0, 0, 2012, 0x4f6ab266
-0, 0, 0, 0, 2012, 0x244ba6fc
-0, 0, 0, 0, 2012, 0x60e0ae4e
-0, 0, 0, 0, 2012, 0xfc3cac80
-0, 0, 0, 0, 2012, 0x8465b287
-0, 0, 0, 0, 2012, 0xc683b070
-0, 0, 0, 0, 2012, 0x2901c8e7
-0, 0, 0, 0, 2012, 0x0622b1a1
-0, 0, 0, 0, 2012, 0xe002b34c
-0, 0, 0, 0, 2012, 0xf4969e79
-0, 0, 0, 0, 2012, 0x871cc453
-0, 0, 0, 0, 2012, 0x9a7daaf3
-0, 0, 0, 0, 2012, 0xba92a60a
-0, 0, 0, 0, 2012, 0xf464a0c4
-0, 0, 0, 0, 2012, 0x53bbb6cd
-0, 0, 0, 0, 2012, 0xb58a9d2a
-0, 0, 0, 0, 2012, 0x1e1fb830
-0, 0, 0, 0, 2012, 0xdc7eb93e
-0, 0, 0, 0, 2012, 0xe6ceaaf9
-0, 0, 0, 0, 2012, 0x8c7ea35d
-0, 0, 0, 0, 2012, 0x0b87ba04
-0, 0, 0, 0, 2012, 0xf516a700
-0, 0, 0, 0, 2012, 0xfaf19e13
-0, 0, 0, 0, 2012, 0x53cf9ed0
-0, 0, 0, 0, 2012, 0x2e25c2f9
-0, 0, 0, 0, 2012, 0x959aa1b8
-0, 0, 0, 0, 2012, 0x2a49a572
-0, 0, 0, 0, 2012, 0xf7a9b809
-0, 0, 0, 0, 2012, 0x44a9b879
-0, 0, 0, 0, 2012, 0xe428c0d4
-0, 0, 0, 0, 2012, 0xc258c2c6
-0, 0, 0, 0, 2012, 0xf7f3b794
-0, 0, 0, 0, 2012, 0xa8adbad9
-0, 0, 0, 0, 2012, 0xc2508e79
-0, 0, 0, 0, 2012, 0x1418ac76
-0, 0, 0, 0, 2012, 0xb28aadef
-0, 0, 0, 0, 2012, 0xda17bd03
-0, 0, 0, 0, 2012, 0xa92ab852
-0, 0, 0, 0, 2012, 0xc3cbcfa4
-0, 0, 0, 0, 2012, 0xf716bb5e
-0, 0, 0, 0, 2012, 0x6009a8af
-0, 0, 0, 0, 2012, 0x9e69bc81
-0, 0, 0, 0, 2012, 0x3aafc8cf
-0, 0, 0, 0, 2012, 0x03bccdab
-0, 0, 0, 0, 2012, 0xfdceb2d9
-0, 0, 0, 0, 2012, 0x68f7afb8
-0, 0, 0, 0, 2012, 0xb7bab330
-0, 0, 0, 0, 2012, 0x4976b125
-0, 0, 0, 0, 2012, 0x7c86ae12
-0, 0, 0, 0, 2012, 0x4ce4ca54
-0, 0, 0, 0, 2012, 0xf1f7b892
-0, 0, 0, 0, 2012, 0xf958abb1
-0, 0, 0, 0, 2012, 0x047accd0
-0, 0, 0, 0, 2012, 0x34a1c49c
-0, 0, 0, 0, 2012, 0x4b24a4ed
-0, 0, 0, 0, 2012, 0xea31b1bc
-0, 0, 0, 0, 2012, 0x8beaa3e3
-0, 0, 0, 0, 2012, 0x064caaf9
-0, 0, 0, 0, 2012, 0x56babf15
-0, 0, 0, 0, 2012, 0xd16fc6f4
-0, 0, 0, 0, 2012, 0x4ac2b78a
-0, 0, 0, 0, 2012, 0xba3aa509
-0, 0, 0, 0, 2012, 0xc103b074
-0, 0, 0, 0, 2012, 0x464aba98
-0, 0, 0, 0, 2012, 0xaacac5a3
-0, 0, 0, 0, 2012, 0x9cecbcfa
-0, 0, 0, 0, 2012, 0x8da0ab79
-0, 0, 0, 0, 2012, 0x85b2b023
-0, 0, 0, 0, 2012, 0x598abc91
-0, 0, 0, 0, 2012, 0x08c0a35c
-0, 0, 0, 0, 2012, 0x30e4a7cf
-0, 0, 0, 0, 2012, 0xf1e4a931
-0, 0, 0, 0, 2012, 0x8a4fb6c1
-0, 0, 0, 0, 2012, 0x126aac08
-0, 0, 0, 0, 2012, 0x537fa51b
-0, 0, 0, 0, 2012, 0x1e54ac5a
-0, 0, 0, 0, 2012, 0x7274bbd0
-0, 0, 0, 0, 2012, 0xd16bc2c2
-0, 0, 0, 0, 2012, 0x9236c1e3
-0, 0, 0, 0, 2012, 0x348aa7af
-0, 0, 0, 0, 2012, 0xa020be5e
-0, 0, 0, 0, 2012, 0x3cc5a4b8
-0, 0, 0, 0, 2012, 0x8b19b649
-0, 0, 0, 0, 2012, 0x554aa5ab
-0, 0, 0, 0, 2012, 0x35d6ac35
-0, 0, 0, 0, 2012, 0x64dba435
-0, 0, 0, 0, 2012, 0x6001bae2
-0, 0, 0, 0, 2012, 0x9220b599
-0, 0, 0, 0, 2012, 0xa3fdb899
-0, 0, 0, 0, 2012, 0x19a5abf4
-0, 0, 0, 0, 2012, 0xd857b8cf
-0, 0, 0, 0, 2012, 0x38d1b234
-0, 0, 0, 0, 2012, 0x69f4bfb8
-0, 0, 0, 0, 2012, 0xcc87a375
-0, 0, 0, 0, 2012, 0xc1cdd0c5
-0, 0, 0, 0, 2012, 0xba0ca3ee
-0, 0, 0, 0, 2012, 0x4d20c397
-0, 0, 0, 0, 2012, 0x825c9636
-0, 0, 0, 0, 2012, 0x7aa4ae53
-0, 0, 0, 0, 2012, 0xe970ae78
-0, 0, 0, 0, 2012, 0x5fb2ba59
-0, 0, 0, 0, 2012, 0xcd90a953
-0, 0, 0, 0, 2012, 0xf573ac40
-0, 0, 0, 0, 2012, 0x324cbd77
-0, 0, 0, 0, 2012, 0xece0a73d
-0, 0, 0, 0, 2012, 0x0dd1aefa
-0, 0, 0, 0, 2012, 0xe338c866
-0, 0, 0, 0, 2012, 0xfe71bffc
-0, 0, 0, 0, 2012, 0x61a5a810
-0, 0, 0, 0, 2012, 0x7c3ba074
-0, 0, 0, 0, 2012, 0x492f9d91
-0, 0, 0, 0, 2012, 0xa126a7b9
-0, 0, 0, 0, 2012, 0x7cf19a40
-0, 0, 0, 0, 2012, 0x1c2fbae6
-0, 0, 0, 0, 2012, 0x540accdf
-0, 0, 0, 0, 2012, 0x5908a938
-0, 0, 0, 0, 2012, 0xe7f8b501
-0, 0, 0, 0, 2012, 0x03a8b53e
-0, 0, 0, 0, 2012, 0xb4e3bdda
-0, 0, 0, 0, 2012, 0x9e86abe1
-0, 0, 0, 0, 2012, 0x3234b98d
-0, 0, 0, 0, 2012, 0x5caec781
-0, 0, 0, 0, 2012, 0x5c21a32e
-0, 0, 0, 0, 2012, 0x8b72c112
-0, 0, 0, 0, 2012, 0x2ec2bac3
-0, 0, 0, 0, 2012, 0xd9c4adaa
-0, 0, 0, 0, 2012, 0x2da1b496
-0, 0, 0, 0, 2012, 0x0a51b21e
-0, 0, 0, 0, 2012, 0x6414ab0d
-0, 0, 0, 0, 2012, 0x95c4b203
-0, 0, 0, 0, 2012, 0x98e0b4a2
-0, 0, 0, 0, 2012, 0x34369f5f
-0, 0, 0, 0, 2012, 0x9dffa40c
-0, 0, 0, 0, 2012, 0xf345b0e5
-0, 0, 0, 0, 2012, 0x6714bdbf
-0, 0, 0, 0, 2012, 0xc276c3d1
-0, 0, 0, 0, 2012, 0xf199b475
-0, 0, 0, 0, 2012, 0x3395cf3b
-0, 0, 0, 0, 2012, 0x4b52afb0
-0, 0, 0, 0, 2012, 0x3f74b217
-0, 0, 0, 0, 2012, 0xa25cad38
-0, 0, 0, 0, 2012, 0x3290a5b4
-0, 0, 0, 0, 2012, 0x2917b750
-0, 0, 0, 0, 2012, 0xeb3ec739
-0, 0, 0, 0, 2012, 0xbf9ea51d
-0, 0, 0, 0, 2012, 0x98e2a0c1
-0, 0, 0, 0, 2012, 0xa39ba7f2
-0, 0, 0, 0, 2012, 0x6df7a05c
-0, 0, 0, 0, 2012, 0x2c1bba28
-0, 0, 0, 0, 2012, 0x6099b1cd
-0, 0, 0, 0, 2012, 0x9366b9f2
-0, 0, 0, 0, 2012, 0x95899570
-0, 0, 0, 0, 2012, 0x6234a0c8
-0, 0, 0, 0, 2012, 0xec2cbcfc
-0, 0, 0, 0, 2012, 0x3ff7a9db
-0, 0, 0, 0, 2012, 0x4e44bad7
-0, 0, 0, 0, 2012, 0x1dbbbc39
-0, 0, 0, 0, 2012, 0xf9df99be
-0, 0, 0, 0, 2012, 0xa713b313
-0, 0, 0, 0, 2012, 0x8bbdbe51
-0, 0, 0, 0, 2012, 0x0d5bc786
-0, 0, 0, 0, 2012, 0x75d293f2
-0, 0, 0, 0, 2012, 0x4832b688
-0, 0, 0, 0, 2012, 0x71aba74c
-0, 0, 0, 0, 2012, 0x04d5abf2
-0, 0, 0, 0, 2012, 0xaa8fbd98
-0, 0, 0, 0, 2012, 0xd93eb6d4
-0, 0, 0, 0, 2012, 0x8fb6b5a8
-0, 0, 0, 0, 2012, 0x779a92f5
-0, 0, 0, 0, 2012, 0x35c8ab3d
-0, 0, 0, 0, 2012, 0x0017aaa5
-0, 0, 0, 0, 2012, 0xd6e7bafe
-0, 0, 0, 0, 2012, 0xe358b423
-0, 0, 0, 0, 2012, 0x3f74bfba
-0, 0, 0, 0, 2012, 0x0a5eb707
-0, 0, 0, 0, 2012, 0xedbfb0df
-0, 0, 0, 0, 2012, 0x2e71a26f
-0, 0, 0, 0, 2012, 0x214db1a8
-0, 0, 0, 0, 2012, 0xb632c275
-0, 0, 0, 0, 2012, 0xb597cf92
-0, 0, 0, 0, 2012, 0x18a8b508
-0, 0, 0, 0, 2012, 0x8267b4ff
-0, 0, 0, 0, 2012, 0x5a9ab8d6
-0, 0, 0, 0, 2012, 0x2037a2b6
+0, 0, 0, 960, 2012, 0x671dc73a
+0, 960, 960, 960, 2012, 0x7fd5b1d2
+0, 1920, 1920, 960, 2012, 0xbe7b9e5e
+0, 2880, 2880, 960, 2012, 0x671dc73a
+0, 3840, 3840, 960, 2012, 0x7fd5b1d2
+0, 4800, 4800, 960, 2012, 0xbe7b9e5e
+0, 5760, 5760, 960, 2012, 0x671dc73a
+0, 6720, 6720, 960, 2012, 0x7fd5b1d2
+0, 7680, 7680, 960, 2012, 0xbe7b9e5e
+0, 8640, 8640, 960, 2012, 0x671dc73a
+0, 9600, 9600, 960, 2012, 0x7fd5b1d2
+0, 10560, 10560, 960, 2012, 0xbe7b9e5e
+0, 11520, 11520, 960, 2012, 0x671dc73a
+0, 12480, 12480, 960, 2012, 0x7fd5b1d2
+0, 13440, 13440, 960, 2012, 0xbe7b9e5e
+0, 14400, 14400, 960, 2012, 0x671dc73a
+0, 15360, 15360, 960, 2012, 0x7fd5b1d2
+0, 16320, 16320, 960, 2012, 0xbe7b9e5e
+0, 17280, 17280, 960, 2012, 0x671dc73a
+0, 18240, 18240, 960, 2012, 0x7fd5b1d2
+0, 19200, 19200, 960, 2012, 0xbe7b9e5e
+0, 20160, 20160, 960, 2012, 0x671dc73a
+0, 21120, 21120, 960, 2012, 0x7fd5b1d2
+0, 22080, 22080, 960, 2012, 0xbe7b9e5e
+0, 23040, 23040, 960, 2012, 0x671dc73a
+0, 24000, 24000, 960, 2012, 0x7fd5b1d2
+0, 24960, 24960, 960, 2012, 0xbe7b9e5e
+0, 25920, 25920, 960, 2012, 0x671dc73a
+0, 26880, 26880, 960, 2012, 0x7fd5b1d2
+0, 27840, 27840, 960, 2012, 0xbe7b9e5e
+0, 28800, 28800, 960, 2012, 0x671dc73a
+0, 29760, 29760, 960, 2012, 0x7fd5b1d2
+0, 30720, 30720, 960, 2012, 0xbe7b9e5e
+0, 31680, 31680, 960, 2012, 0x671dc73a
+0, 32640, 32640, 960, 2012, 0x7fd5b1d2
+0, 33600, 33600, 960, 2012, 0xbe7b9e5e
+0, 34560, 34560, 960, 2012, 0x671dc73a
+0, 35520, 35520, 960, 2012, 0x7fd5b1d2
+0, 36480, 36480, 960, 2012, 0xbe7b9e5e
+0, 37440, 37440, 960, 2012, 0x671dc73a
+0, 38400, 38400, 960, 2012, 0x7fd5b1d2
+0, 39360, 39360, 960, 2012, 0xbe7b9e5e
+0, 40320, 40320, 960, 2012, 0x671dc73a
+0, 41280, 41280, 960, 2012, 0x7fd5b1d2
+0, 42240, 42240, 960, 2012, 0xbe7b9e5e
+0, 43200, 43200, 960, 2012, 0x671dc73a
+0, 44160, 44160, 960, 2012, 0x7fd5b1d2
+0, 45120, 45120, 960, 2012, 0xbe7b9e5e
+0, 46080, 46080, 960, 2012, 0x671dc73a
+0, 47040, 47040, 960, 2012, 0x7fd5b1d2
+0, 48000, 48000, 960, 2012, 0xbe7b9e5e
+0, 48960, 48960, 960, 2012, 0x671dc73a
+0, 49920, 49920, 960, 2012, 0x7fd5b1d2
+0, 50880, 50880, 960, 2012, 0xbe7b9e5e
+0, 51840, 51840, 960, 2012, 0x671dc73a
+0, 52800, 52800, 960, 2012, 0x7fd5b1d2
+0, 53760, 53760, 960, 2012, 0xbe7b9e5e
+0, 54720, 54720, 960, 2012, 0x671dc73a
+0, 55680, 55680, 960, 2012, 0x7fd5b1d2
+0, 56640, 56640, 960, 2012, 0xbe7b9e5e
+0, 57600, 57600, 960, 2012, 0x671dc73a
+0, 58560, 58560, 960, 2012, 0x7fd5b1d2
+0, 59520, 59520, 960, 2012, 0xbe7b9e5e
+0, 60480, 60480, 960, 2012, 0x671dc73a
+0, 61440, 61440, 960, 2012, 0x7fd5b1d2
+0, 62400, 62400, 960, 2012, 0xbe7b9e5e
+0, 63360, 63360, 960, 2012, 0x671dc73a
+0, 64320, 64320, 960, 2012, 0x7fd5b1d2
+0, 65280, 65280, 960, 2012, 0xbe7b9e5e
+0, 66240, 66240, 960, 2012, 0x671dc73a
+0, 67200, 67200, 960, 2012, 0x7fd5b1d2
+0, 68160, 68160, 960, 2012, 0xbe7b9e5e
+0, 69120, 69120, 960, 2012, 0x671dc73a
+0, 70080, 70080, 960, 2012, 0x7fd5b1d2
+0, 71040, 71040, 960, 2012, 0xbe7b9e5e
+0, 72000, 72000, 960, 2012, 0x671dc73a
+0, 72960, 72960, 960, 2012, 0x7fd5b1d2
+0, 73920, 73920, 960, 2012, 0xbe7b9e5e
+0, 74880, 74880, 960, 2012, 0x671dc73a
+0, 75840, 75840, 960, 2012, 0x7fd5b1d2
+0, 76800, 76800, 960, 2012, 0xbe7b9e5e
+0, 77760, 77760, 960, 2012, 0x671dc73a
+0, 78720, 78720, 960, 2012, 0x7fd5b1d2
+0, 79680, 79680, 960, 2012, 0xbe7b9e5e
+0, 80640, 80640, 960, 2012, 0x671dc73a
+0, 81600, 81600, 960, 2012, 0x7fd5b1d2
+0, 82560, 82560, 960, 2012, 0xbe7b9e5e
+0, 83520, 83520, 960, 2012, 0x671dc73a
+0, 84480, 84480, 960, 2012, 0x7fd5b1d2
+0, 85440, 85440, 960, 2012, 0xbe7b9e5e
+0, 86400, 86400, 960, 2012, 0x671dc73a
+0, 87360, 87360, 960, 2012, 0x7fd5b1d2
+0, 88320, 88320, 960, 2012, 0xbe7b9e5e
+0, 89280, 89280, 960, 2012, 0x671dc73a
+0, 90240, 90240, 960, 2012, 0x7fd5b1d2
+0, 91200, 91200, 960, 2012, 0xa9259df1
+0, 92160, 92160, 960, 2012, 0x3e8c2b92
+0, 93120, 93120, 960, 2012, 0x4876a9ff
+0, 94080, 94080, 960, 2012, 0x7e469182
+0, 95040, 95040, 960, 2012, 0x10eba401
+0, 96000, 96000, 960, 2012, 0x51c68ed3
+0, 96960, 96960, 960, 2012, 0x3f52901b
+0, 97920, 97920, 960, 2012, 0x7bebacce
+0, 98880, 98880, 960, 2012, 0xcb94898d
+0, 99840, 99840, 960, 2012, 0x14e3ae70
+0, 100800, 100800, 960, 2012, 0x016893cb
+0, 101760, 101760, 960, 2012, 0x00739f0a
+0, 102720, 102720, 960, 2012, 0x834aba41
+0, 103680, 103680, 960, 2012, 0x6a92ac08
+0, 104640, 104640, 960, 2012, 0x09eda257
+0, 105600, 105600, 960, 2012, 0x81449e3f
+0, 106560, 106560, 960, 2012, 0xe6eb91d4
+0, 107520, 107520, 960, 2012, 0x51158c0e
+0, 108480, 108480, 960, 2012, 0x84e4a013
+0, 109440, 109440, 960, 2012, 0x4c48a0e6
+0, 110400, 110400, 960, 2012, 0xf54c9811
+0, 111360, 111360, 960, 2012, 0x62778edb
+0, 112320, 112320, 960, 2012, 0x7226a51b
+0, 113280, 113280, 960, 2012, 0x44b9aad8
+0, 114240, 114240, 960, 2012, 0x8aa6b380
+0, 115200, 115200, 960, 2012, 0xc88c99e6
+0, 116160, 116160, 960, 2012, 0xed5e93e2
+0, 117120, 117120, 960, 2012, 0xeb0b9755
+0, 118080, 118080, 960, 2012, 0xe5ba8ca9
+0, 119040, 119040, 960, 2012, 0x2fef9bcf
+0, 120000, 120000, 960, 2012, 0xf19c8749
+0, 120960, 120960, 960, 2012, 0x0feb94d0
+0, 121920, 121920, 960, 2012, 0x1f9194d1
+0, 122880, 122880, 960, 2012, 0x0cad9822
+0, 123840, 123840, 960, 2012, 0xe6f79152
+0, 124800, 124800, 960, 2012, 0x69e78955
+0, 125760, 125760, 960, 2012, 0x91dd8a1b
+0, 126720, 126720, 960, 2012, 0x63fe8eea
+0, 127680, 127680, 960, 2012, 0x8f6d90a2
+0, 128640, 128640, 960, 2012, 0xe3bf8626
+0, 129600, 129600, 960, 2012, 0xd08599db
+0, 130560, 130560, 960, 2012, 0xf556a282
+0, 131520, 131520, 960, 2012, 0x7f8c8f90
+0, 132480, 132480, 960, 2012, 0xa04493b9
+0, 133440, 133440, 960, 2012, 0x21a19b3a
+0, 134400, 134400, 960, 2012, 0x6ead9244
+0, 135360, 135360, 960, 2012, 0xe65290d7
+0, 136320, 136320, 960, 2012, 0x8ff58a8e
+0, 137280, 137280, 960, 2012, 0x24ada603
+0, 138240, 138240, 960, 2012, 0x79cb85c7
+0, 139200, 139200, 960, 2012, 0x63c0ac54
+0, 140160, 140160, 960, 2012, 0x7f719f83
+0, 141120, 141120, 960, 2012, 0x2eb69654
+0, 142080, 142080, 960, 2012, 0xf5149bc0
+0, 143040, 143040, 960, 2012, 0xd0d6a414
+0, 144000, 144000, 960, 2012, 0x4f4a8ed3
+0, 144960, 144960, 960, 2012, 0x20888cb5
+0, 145920, 145920, 960, 2012, 0x13439c86
+0, 146880, 146880, 960, 2012, 0xc8fc98e1
+0, 147840, 147840, 960, 2012, 0x14689766
+0, 148800, 148800, 960, 2012, 0x830293e4
+0, 149760, 149760, 960, 2012, 0xdd5bb8ce
+0, 150720, 150720, 960, 2012, 0x005ea280
+0, 151680, 151680, 960, 2012, 0x9b0581e2
+0, 152640, 152640, 960, 2012, 0x210f89b8
+0, 153600, 153600, 960, 2012, 0xb7c180bd
+0, 154560, 154560, 960, 2012, 0xe53c85e4
+0, 155520, 155520, 960, 2012, 0x1f689207
+0, 156480, 156480, 960, 2012, 0x5653813b
+0, 157440, 157440, 960, 2012, 0x1d278d66
+0, 158400, 158400, 960, 2012, 0xd94c9a83
+0, 159360, 159360, 960, 2012, 0x7af48548
+0, 160320, 160320, 960, 2012, 0x86209c99
+0, 161280, 161280, 960, 2012, 0x6e3b7fc9
+0, 162240, 162240, 960, 2012, 0x41c289e7
+0, 163200, 163200, 960, 2012, 0x8bea85db
+0, 164160, 164160, 960, 2012, 0x45c98c39
+0, 165120, 165120, 960, 2012, 0xee098755
+0, 166080, 166080, 960, 2012, 0x485d9ec1
+0, 167040, 167040, 960, 2012, 0x78819023
+0, 168000, 168000, 960, 2012, 0xf43377bd
+0, 168960, 168960, 960, 2012, 0x43fc9439
+0, 169920, 169920, 960, 2012, 0x045e9bf3
+0, 170880, 170880, 960, 2012, 0x0fc09f0c
+0, 171840, 171840, 960, 2012, 0x7ba69bf5
+0, 172800, 172800, 960, 2012, 0x4aa7aaf0
+0, 173760, 173760, 960, 2012, 0x620c85bf
+0, 174720, 174720, 960, 2012, 0xa6bb8a30
+0, 175680, 175680, 960, 2012, 0xfd10883c
+0, 176640, 176640, 960, 2012, 0x32037e17
+0, 177600, 177600, 960, 2012, 0xb18c9e01
+0, 178560, 178560, 960, 2012, 0xd8206ee5
+0, 179520, 179520, 960, 2012, 0xdbc49136
+0, 180480, 180480, 960, 2012, 0x650a785d
+0, 181440, 181440, 960, 2012, 0x9e107d61
+0, 182400, 182400, 960, 2012, 0xbf4eac50
+0, 183360, 183360, 960, 2012, 0x9d8f79b2
+0, 184320, 184320, 960, 2012, 0x252d8e8a
+0, 185280, 185280, 960, 2012, 0x00af8fd6
+0, 186240, 186240, 960, 2012, 0x9e388d3b
+0, 187200, 187200, 960, 2012, 0x75de7f56
+0, 188160, 188160, 960, 2012, 0xd502839c
+0, 189120, 189120, 960, 2012, 0x66709e03
+0, 190080, 190080, 960, 2012, 0x3e0a96ba
+0, 191040, 191040, 960, 2012, 0x0813ad4e
+0, 192000, 192000, 960, 2012, 0x799c90c5
+0, 192960, 192960, 960, 2012, 0x98a18bed
+0, 193920, 193920, 960, 2012, 0x8cd197d7
+0, 194880, 194880, 960, 2012, 0xf9ea8b22
+0, 195840, 195840, 960, 2012, 0x674f7cd2
+0, 196800, 196800, 960, 2012, 0xa5c39136
+0, 197760, 197760, 960, 2012, 0xe064ac30
+0, 198720, 198720, 960, 2012, 0x2af78c75
+0, 199680, 199680, 960, 2012, 0x43df9b19
+0, 200640, 200640, 960, 2012, 0x8d1a87d5
+0, 201600, 201600, 960, 2012, 0xd5be8d29
+0, 202560, 202560, 960, 2012, 0x43448bd4
+0, 203520, 203520, 960, 2012, 0xa128a30b
+0, 204480, 204480, 960, 2012, 0x6fc29902
+0, 205440, 205440, 960, 2012, 0x5854a24b
+0, 206400, 206400, 960, 2012, 0xb222958a
+0, 207360, 207360, 960, 2012, 0xfca39cce
+0, 208320, 208320, 960, 2012, 0xee0087f0
+0, 209280, 209280, 960, 2012, 0xd2d69b8c
+0, 210240, 210240, 960, 2012, 0xe2308f8d
+0, 211200, 211200, 960, 2012, 0x8dc4b09a
+0, 212160, 212160, 960, 2012, 0x14489aef
+0, 213120, 213120, 960, 2012, 0x900f9835
+0, 214080, 214080, 960, 2012, 0x0092a95f
+0, 215040, 215040, 960, 2012, 0xfd90b1bf
+0, 216000, 216000, 960, 2012, 0xb11ab5d5
+0, 216960, 216960, 960, 2012, 0xc802b908
+0, 217920, 217920, 960, 2012, 0xb12aa91e
+0, 218880, 218880, 960, 2012, 0xd173c2a9
+0, 219840, 219840, 960, 2012, 0xaeafb887
+0, 220800, 220800, 960, 2012, 0xeb7eb0d7
+0, 221760, 221760, 960, 2012, 0x9afbc56a
+0, 222720, 222720, 960, 2012, 0x2d78bc34
+0, 223680, 223680, 960, 2012, 0x6550aed1
+0, 224640, 224640, 960, 2012, 0xd514a55d
+0, 225600, 225600, 960, 2012, 0x9058c263
+0, 226560, 226560, 960, 2012, 0xf819b66a
+0, 227520, 227520, 960, 2012, 0x16a5c902
+0, 228480, 228480, 960, 2012, 0x602fc11b
+0, 229440, 229440, 960, 2012, 0xe3c6b177
+0, 230400, 230400, 960, 2012, 0xacc4cd06
+0, 231360, 231360, 960, 2012, 0xeb96addb
+0, 232320, 232320, 960, 2012, 0x1195cad3
+0, 233280, 233280, 960, 2012, 0x8e96ad7f
+0, 234240, 234240, 960, 2012, 0x31e592b7
+0, 235200, 235200, 960, 2012, 0xa0c5ccf0
+0, 236160, 236160, 960, 2012, 0x6e77c92b
+0, 237120, 237120, 960, 2012, 0xe87fa928
+0, 238080, 238080, 960, 2012, 0x4923bcdb
+0, 239040, 239040, 960, 2012, 0x3260b452
+0, 240000, 240000, 960, 2012, 0x62beafa0
+0, 240960, 240960, 960, 2012, 0x5a6fc18a
+0, 241920, 241920, 960, 2012, 0x9d05ae87
+0, 242880, 242880, 960, 2012, 0xb577a54e
+0, 243840, 243840, 960, 2012, 0xd66bc5ef
+0, 244800, 244800, 960, 2012, 0x40bec7bb
+0, 245760, 245760, 960, 2012, 0xedd3a1b9
+0, 246720, 246720, 960, 2012, 0xf6f49f83
+0, 247680, 247680, 960, 2012, 0x316fb06d
+0, 248640, 248640, 960, 2012, 0xc3f3a874
+0, 249600, 249600, 960, 2012, 0x3a96b3bd
+0, 250560, 250560, 960, 2012, 0x825aba30
+0, 251520, 251520, 960, 2012, 0x5b58ce66
+0, 252480, 252480, 960, 2012, 0x412dc092
+0, 253440, 253440, 960, 2012, 0xcb47bfa3
+0, 254400, 254400, 960, 2012, 0xe025bb79
+0, 255360, 255360, 960, 2012, 0x0042ba53
+0, 256320, 256320, 960, 2012, 0x7e9bba1d
+0, 257280, 257280, 960, 2012, 0x0058c99d
+0, 258240, 258240, 960, 2012, 0x47d2b590
+0, 259200, 259200, 960, 2012, 0xdf4ba9c6
+0, 260160, 260160, 960, 2012, 0xe671987c
+0, 261120, 261120, 960, 2012, 0x90dccc89
+0, 262080, 262080, 960, 2012, 0x012ccae9
+0, 263040, 263040, 960, 2012, 0x2eb5b83e
+0, 264000, 264000, 960, 2012, 0x3fecb7f4
+0, 264960, 264960, 960, 2012, 0x7955a464
+0, 265920, 265920, 960, 2012, 0xfe9eb3c3
+0, 266880, 266880, 960, 2012, 0x7457c904
+0, 267840, 267840, 960, 2012, 0xd23ea69d
+0, 268800, 268800, 960, 2012, 0xc497bf82
+0, 269760, 269760, 960, 2012, 0x15e5c241
+0, 270720, 270720, 960, 2012, 0x3dfea71f
+0, 271680, 271680, 960, 2012, 0x1e59c9c0
+0, 272640, 272640, 960, 2012, 0x1a34b927
+0, 273600, 273600, 960, 2012, 0xbf42b430
+0, 274560, 274560, 960, 2012, 0xf084c29f
+0, 275520, 275520, 960, 2012, 0x6443c44a
+0, 276480, 276480, 960, 2012, 0x7985a4a5
+0, 277440, 277440, 960, 2012, 0x27add059
+0, 278400, 278400, 960, 2012, 0x7f1faea4
+0, 279360, 279360, 960, 2012, 0x8d9dc732
+0, 280320, 280320, 960, 2012, 0xf272c32e
+0, 281280, 281280, 960, 2012, 0x4fa3ab11
+0, 282240, 282240, 960, 2012, 0x512e9887
+0, 283200, 283200, 960, 2012, 0xd478d55b
+0, 284160, 284160, 960, 2012, 0xa94a9d93
+0, 285120, 285120, 960, 2012, 0xff73d812
+0, 286080, 286080, 960, 2012, 0xd3a6b9ef
+0, 287040, 287040, 960, 2012, 0x7b4ebc1e
+0, 288000, 288000, 960, 2012, 0xcc7bba1a
+0, 288960, 288960, 960, 2012, 0x1aa7cd1a
+0, 289920, 289920, 960, 2012, 0xd707c202
+0, 290880, 290880, 960, 2012, 0xcb6ac18b
+0, 291840, 291840, 960, 2012, 0x1ccdcbd6
+0, 292800, 292800, 960, 2012, 0x700cb51e
+0, 293760, 293760, 960, 2012, 0x27b6a3e7
+0, 294720, 294720, 960, 2012, 0x8570b8cd
+0, 295680, 295680, 960, 2012, 0x22f2b2ed
+0, 296640, 296640, 960, 2012, 0x75edb63e
+0, 297600, 297600, 960, 2012, 0x8145b53f
+0, 298560, 298560, 960, 2012, 0x15efb8bc
+0, 299520, 299520, 960, 2012, 0x200bb5e6
+0, 300480, 300480, 960, 2012, 0xfa79b178
+0, 301440, 301440, 960, 2012, 0xbd39cdf4
+0, 302400, 302400, 960, 2012, 0x0970b0b2
+0, 303360, 303360, 960, 2012, 0x1acebe72
+0, 304320, 304320, 960, 2012, 0x1a26aa71
+0, 305280, 305280, 960, 2012, 0x8f71aa54
+0, 306240, 306240, 960, 2012, 0x0265c523
+0, 307200, 307200, 960, 2012, 0x2df0a53b
+0, 308160, 308160, 960, 2012, 0x59a7a37a
+0, 309120, 309120, 960, 2012, 0x9ad9acda
+0, 310080, 310080, 960, 2012, 0x738cbc6f
+0, 311040, 311040, 960, 2012, 0xc646a7ad
+0, 312000, 312000, 960, 2012, 0x7f25c19b
+0, 312960, 312960, 960, 2012, 0x1439bdb0
+0, 313920, 313920, 960, 2012, 0xa40cbef0
+0, 314880, 314880, 960, 2012, 0x9b09b99a
+0, 315840, 315840, 960, 2012, 0x5ff0bbde
+0, 316800, 316800, 960, 2012, 0x3981c2d6
+0, 317760, 317760, 960, 2012, 0xfa89b40d
+0, 318720, 318720, 960, 2012, 0x12e9a7b9
+0, 319680, 319680, 960, 2012, 0xc5faaac3
+0, 320640, 320640, 960, 2012, 0xe12bc3a9
+0, 321600, 321600, 960, 2012, 0x9c57b8f3
+0, 322560, 322560, 960, 2012, 0x4fd4b6c0
+0, 323520, 323520, 960, 2012, 0xb72cca50
+0, 324480, 324480, 960, 2012, 0xb4d4cbbb
+0, 325440, 325440, 960, 2012, 0x9399bfa1
+0, 326400, 326400, 960, 2012, 0x0abfb708
+0, 327360, 327360, 960, 2012, 0xd1d9acc0
+0, 328320, 328320, 960, 2012, 0x079ab5b2
+0, 329280, 329280, 960, 2012, 0x05a0be32
+0, 330240, 330240, 960, 2012, 0x445cc8db
+0, 331200, 331200, 960, 2012, 0xf9a3aa71
+0, 332160, 332160, 960, 2012, 0xd2e29eac
+0, 333120, 333120, 960, 2012, 0x391a9f20
+0, 334080, 334080, 960, 2012, 0x571eab4e
+0, 335040, 335040, 960, 2012, 0x6962bc96
+0, 336000, 336000, 960, 2012, 0x2f04b495
+0, 336960, 336960, 960, 2012, 0x7b66bab7
+0, 337920, 337920, 960, 2012, 0xa718b8c9
+0, 338880, 338880, 960, 2012, 0xb069a54e
+0, 339840, 339840, 960, 2012, 0xc052a1d2
+0, 340800, 340800, 960, 2012, 0x661ac62e
+0, 341760, 341760, 960, 2012, 0xc4ebb529
+0, 342720, 342720, 960, 2012, 0xf998b251
+0, 343680, 343680, 960, 2012, 0x0ee8bffa
+0, 344640, 344640, 960, 2012, 0x6e3fd984
+0, 345600, 345600, 960, 2012, 0x5825b63f
+0, 346560, 346560, 960, 2012, 0x9c79c561
+0, 347520, 347520, 960, 2012, 0x3470beb7
+0, 348480, 348480, 960, 2012, 0x9135bd9d
+0, 349440, 349440, 960, 2012, 0xd8e8bb7f
+0, 350400, 350400, 960, 2012, 0x322ea448
+0, 351360, 351360, 960, 2012, 0xe974b3ab
+0, 352320, 352320, 960, 2012, 0x4151c32d
+0, 353280, 353280, 960, 2012, 0x2b05bf7d
+0, 354240, 354240, 960, 2012, 0x4111c0d8
+0, 355200, 355200, 960, 2012, 0xff9ad574
+0, 356160, 356160, 960, 2012, 0xa55dced2
+0, 357120, 357120, 960, 2012, 0x11e6c0cb
+0, 358080, 358080, 960, 2012, 0x2478b998
+0, 359040, 359040, 960, 2012, 0xdc8abb54
+0, 360000, 360000, 960, 2012, 0xe16da510
+0, 360960, 360960, 960, 2012, 0xfc18b3db
+0, 361920, 361920, 960, 2012, 0x1426cd42
+0, 362880, 362880, 960, 2012, 0xb560a661
+0, 363840, 363840, 960, 2012, 0xc200aa4b
+0, 364800, 364800, 960, 2012, 0xea00af2a
+0, 365760, 365760, 960, 2012, 0x32bcbf84
+0, 366720, 366720, 960, 2012, 0x4c29cb2a
+0, 367680, 367680, 960, 2012, 0xe8a2aabc
+0, 368640, 368640, 960, 2012, 0x64bdb6cd
+0, 369600, 369600, 960, 2012, 0x3a80adbc
+0, 370560, 370560, 960, 2012, 0xa012b2c4
+0, 371520, 371520, 960, 2012, 0xac3ebce7
+0, 372480, 372480, 960, 2012, 0xfae1b2a7
+0, 373440, 373440, 960, 2012, 0x37b4ddae
+0, 374400, 374400, 960, 2012, 0x8ff9bd55
+0, 375360, 375360, 960, 2012, 0x16f6abeb
+0, 376320, 376320, 960, 2012, 0x5820badf
+0, 377280, 377280, 960, 2012, 0x7183b45e
+0, 378240, 378240, 960, 2012, 0xc0a6c826
+0, 379200, 379200, 960, 2012, 0x4c36bb02
+0, 380160, 380160, 960, 2012, 0xda46b854
+0, 381120, 381120, 960, 2012, 0xcc8accb6
+0, 382080, 382080, 960, 2012, 0xa6b2c3a2
+0, 383040, 383040, 960, 2012, 0x1c91cc00
+0, 384000, 384000, 960, 2012, 0xf33cd721
+0, 384960, 384960, 960, 2012, 0x7f86d2ed
+0, 385920, 385920, 960, 2012, 0x9fdabb1d
+0, 386880, 386880, 960, 2012, 0x33ebbbc4
+0, 387840, 387840, 960, 2012, 0x2741ba4f
+0, 388800, 388800, 960, 2012, 0x0d0dd107
+0, 389760, 389760, 960, 2012, 0xf1d5b551
+0, 390720, 390720, 960, 2012, 0xf47dbebc
+0, 391680, 391680, 960, 2012, 0xa955cea3
+0, 392640, 392640, 960, 2012, 0x51d6b407
+0, 393600, 393600, 960, 2012, 0xb7d3c2c0
+0, 394560, 394560, 960, 2012, 0xce3cc6ae
+0, 395520, 395520, 960, 2012, 0x782cc184
+0, 396480, 396480, 960, 2012, 0xf4cec2af
+0, 397440, 397440, 960, 2012, 0xa43eb295
+0, 398400, 398400, 960, 2012, 0xc74aa62d
+0, 399360, 399360, 960, 2012, 0xf9dfc11f
+0, 400320, 400320, 960, 2012, 0x3da1a319
+0, 401280, 401280, 960, 2012, 0xf613bd75
+0, 402240, 402240, 960, 2012, 0x10d9cda4
+0, 403200, 403200, 960, 2012, 0x08c9bcb3
+0, 404160, 404160, 960, 2012, 0x43b9d170
+0, 405120, 405120, 960, 2012, 0x1f0db940
+0, 406080, 406080, 960, 2012, 0x3c4ec614
+0, 407040, 407040, 960, 2012, 0xa94abaaa
+0, 408000, 408000, 960, 2012, 0x2557a922
+0, 408960, 408960, 960, 2012, 0x4245c4b4
+0, 409920, 409920, 960, 2012, 0x0cb1b06f
+0, 410880, 410880, 960, 2012, 0x778bbeab
+0, 411840, 411840, 960, 2012, 0x5ce4ca3b
+0, 412800, 412800, 960, 2012, 0xe70e9fd3
+0, 413760, 413760, 960, 2012, 0x28afbcbf
+0, 414720, 414720, 960, 2012, 0xc41fb9b2
+0, 415680, 415680, 960, 2012, 0xd60cbfae
+0, 416640, 416640, 960, 2012, 0x1087cb26
+0, 417600, 417600, 960, 2012, 0xc9face3b
+0, 418560, 418560, 960, 2012, 0x7403b314
+0, 419520, 419520, 960, 2012, 0xe034ba97
+0, 420480, 420480, 960, 2012, 0x15dcbc67
+0, 421440, 421440, 960, 2012, 0x20d3bcff
+0, 422400, 422400, 960, 2012, 0xc136a2ce
+0, 423360, 423360, 960, 2012, 0x038bb025
+0, 424320, 424320, 960, 2012, 0xd655cf84
+0, 425280, 425280, 960, 2012, 0xcf54c656
+0, 426240, 426240, 960, 2012, 0x3c77bb0d
+0, 427200, 427200, 960, 2012, 0xd765d7a7
+0, 428160, 428160, 960, 2012, 0x1a60b020
+0, 429120, 429120, 960, 2012, 0x83c8c2e9
+0, 430080, 430080, 960, 2012, 0x9b97c6e7
+0, 431040, 431040, 960, 2012, 0x3870ad63
+0, 432000, 432000, 960, 2012, 0x0e3ac67d
+0, 432960, 432960, 960, 2012, 0xeb53c935
+0, 433920, 433920, 960, 2012, 0xeeb0c3e1
+0, 434880, 434880, 960, 2012, 0x9cb5bdb9
+0, 435840, 435840, 960, 2012, 0x64b1afec
+0, 436800, 436800, 960, 2012, 0x57dcadbc
+0, 437760, 437760, 960, 2012, 0xed76c5fd
+0, 438720, 438720, 960, 2012, 0x0cb4cac5
+0, 439680, 439680, 960, 2012, 0xd30bbd06
+0, 440640, 440640, 960, 2012, 0xaee9c6c3
+0, 441600, 441600, 960, 2012, 0xe845c9b3
+0, 442560, 442560, 960, 2012, 0xc09cc7fc
+0, 443520, 443520, 960, 2012, 0xfdebaacb
+0, 444480, 444480, 960, 2012, 0x6f2db89f
+0, 445440, 445440, 960, 2012, 0x7d89bee7
+0, 446400, 446400, 960, 2012, 0x8699b8be
+0, 447360, 447360, 960, 2012, 0x57d6cc8a
+0, 448320, 448320, 960, 2012, 0xcdbcd246
+0, 449280, 449280, 960, 2012, 0x9057b285
+0, 450240, 450240, 960, 2012, 0x2ac9cc87
+0, 451200, 451200, 960, 2012, 0xeb20c421
+0, 452160, 452160, 960, 2012, 0x4789d11f
+0, 453120, 453120, 960, 2012, 0x55e7c9fe
+0, 454080, 454080, 960, 2012, 0xd81cb4c6
+0, 455040, 455040, 960, 2012, 0x2af0a88e
+0, 456000, 456000, 960, 2012, 0x7d96a4ee
+0, 456960, 456960, 960, 2012, 0xff7cc3ea
+0, 457920, 457920, 960, 2012, 0x2514d2a8
+0, 458880, 458880, 960, 2012, 0x7d2cccc3
+0, 459840, 459840, 960, 2012, 0x98dccbbf
+0, 460800, 460800, 960, 2012, 0x55f2bd3e
+0, 461760, 461760, 960, 2012, 0x0e58bbd7
+0, 462720, 462720, 960, 2012, 0x1520c45d
+0, 463680, 463680, 960, 2012, 0x3c60cede
+0, 464640, 464640, 960, 2012, 0xbfb2be6b
+0, 465600, 465600, 960, 2012, 0xa839c2d5
+0, 466560, 466560, 960, 2012, 0x7713bdba
+0, 467520, 467520, 960, 2012, 0xf16c9e95
+0, 468480, 468480, 960, 2012, 0x8e94caf1
+0, 469440, 469440, 960, 2012, 0x3915c673
+0, 470400, 470400, 960, 2012, 0x69afc76f
+0, 471360, 471360, 960, 2012, 0x3ebec514
+0, 472320, 472320, 960, 2012, 0x70c5dd9b
+0, 473280, 473280, 960, 2012, 0x6868b7d9
+0, 474240, 474240, 960, 2012, 0x9a31c801
+0, 475200, 475200, 960, 2012, 0x93c4b6ac
+0, 476160, 476160, 960, 2012, 0xb1aaca39
+0, 477120, 477120, 960, 2012, 0x8f67b9ed
+0, 478080, 478080, 960, 2012, 0x09adcf1f
+0, 479040, 479040, 960, 2012, 0xe172cb3c
+0, 480000, 480000, 960, 2012, 0x044bbdc5
+0, 480960, 480960, 960, 2012, 0x391cb3d9
+0, 481920, 481920, 960, 2012, 0x3bd1bc29
+0, 482880, 482880, 960, 2012, 0x8a78c5d2
+0, 483840, 483840, 960, 2012, 0xa46fce11
+0, 484800, 484800, 960, 2012, 0x4c13d9bc
+0, 485760, 485760, 960, 2012, 0x7f47ce4f
+0, 486720, 486720, 960, 2012, 0xa03ebcae
+0, 487680, 487680, 960, 2012, 0xf6f2b2c8
+0, 488640, 488640, 960, 2012, 0x7995be2a
+0, 489600, 489600, 960, 2012, 0x22d7b94a
+0, 490560, 490560, 960, 2012, 0x07bcc06a
+0, 491520, 491520, 960, 2012, 0x04adcb6d
+0, 492480, 492480, 960, 2012, 0x4aecc135
+0, 493440, 493440, 960, 2012, 0x8442dc6a
+0, 494400, 494400, 960, 2012, 0x9e67b826
+0, 495360, 495360, 960, 2012, 0xb1c4b235
+0, 496320, 496320, 960, 2012, 0x565ecaae
+0, 497280, 497280, 960, 2012, 0x34a2c877
+0, 498240, 498240, 960, 2012, 0x815eb148
+0, 499200, 499200, 960, 2012, 0x354eb4ce
+0, 500160, 500160, 960, 2012, 0xf74db8b1
+0, 501120, 501120, 960, 2012, 0x56f3b430
+0, 502080, 502080, 960, 2012, 0x39f9c72f
+0, 503040, 503040, 960, 2012, 0x83d1bfde
+0, 504000, 504000, 960, 2012, 0x2da1bf57
+0, 504960, 504960, 960, 2012, 0xd97fc933
+0, 505920, 505920, 960, 2012, 0x4b3edbfe
+0, 506880, 506880, 960, 2012, 0xb975d346
+0, 507840, 507840, 960, 2012, 0x856ac304
+0, 508800, 508800, 960, 2012, 0xb38dba2e
+0, 509760, 509760, 960, 2012, 0xbe14c822
+0, 510720, 510720, 960, 2012, 0xb848c927
+0, 511680, 511680, 960, 2012, 0x0a89c0e6
+0, 512640, 512640, 960, 2012, 0x44a3c3d5
+0, 513600, 513600, 960, 2012, 0x7af1c30c
+0, 514560, 514560, 960, 2012, 0xe928b619
+0, 515520, 515520, 960, 2012, 0xc9aeb012
+0, 516480, 516480, 960, 2012, 0xae02cfde
+0, 517440, 517440, 960, 2012, 0x0b42c3d9
+0, 518400, 518400, 960, 2012, 0xa5b7c1ed
+0, 519360, 519360, 960, 2012, 0xd2dcbcdc
+0, 520320, 520320, 960, 2012, 0x18cfbf55
+0, 521280, 521280, 960, 2012, 0x34f0c800
+0, 522240, 522240, 960, 2012, 0x2a80bdba
+0, 523200, 523200, 960, 2012, 0x5ef2b3a7
+0, 524160, 524160, 960, 2012, 0x35a6ba33
+0, 525120, 525120, 960, 2012, 0x1088bbf5
+0, 526080, 526080, 960, 2012, 0xaec0bedf
+0, 527040, 527040, 960, 2012, 0x769fb535
+0, 528000, 528000, 960, 2012, 0xfe11b979
+0, 528960, 528960, 960, 2012, 0xe856b37e
+0, 529920, 529920, 960, 2012, 0x36c3cffd
+0, 530880, 530880, 960, 2012, 0x4771db58
+0, 531840, 531840, 960, 2012, 0x5467d13e
+0, 532800, 532800, 960, 2012, 0xb405c1b5
+0, 533760, 533760, 960, 2012, 0x3cbdc145
+0, 534720, 534720, 960, 2012, 0xbb9ccdd7
+0, 535680, 535680, 960, 2012, 0xac25ce9e
+0, 536640, 536640, 960, 2012, 0x6d2ac82a
+0, 537600, 537600, 960, 2012, 0x1661ba50
+0, 538560, 538560, 960, 2012, 0xbc7ac82a
+0, 539520, 539520, 960, 2012, 0x020bb4de
+0, 540480, 540480, 960, 2012, 0x4e10cb93
+0, 541440, 541440, 960, 2012, 0x3dabc15f
+0, 542400, 542400, 960, 2012, 0x12acc64b
+0, 543360, 543360, 960, 2012, 0x9cecb51a
+0, 544320, 544320, 960, 2012, 0x959acb39
+0, 545280, 545280, 960, 2012, 0x3ee7c0e8
+0, 546240, 546240, 960, 2012, 0xde18c1df
+0, 547200, 547200, 960, 2012, 0x3c72c3cd
+0, 548160, 548160, 960, 2012, 0x1ac4bb5d
+0, 549120, 549120, 960, 2012, 0xb155c741
+0, 550080, 550080, 960, 2012, 0x5069c8aa
+0, 551040, 551040, 960, 2012, 0x610db0bc
+0, 552000, 552000, 960, 2012, 0xb82bc329
+0, 552960, 552960, 960, 2012, 0x8bd4c522
+0, 553920, 553920, 960, 2012, 0xd44bb865
+0, 554880, 554880, 960, 2012, 0xb51ac7dc
+0, 555840, 555840, 960, 2012, 0xfe2bc799
+0, 556800, 556800, 960, 2012, 0x8cd1bb53
+0, 557760, 557760, 960, 2012, 0xba13ca97
+0, 558720, 558720, 960, 2012, 0xf107bd51
+0, 559680, 559680, 960, 2012, 0xa04ece95
+0, 560640, 560640, 960, 2012, 0x4f4faa54
+0, 561600, 561600, 960, 2012, 0x5a74bfe1
+0, 562560, 562560, 960, 2012, 0xdafade5b
+0, 563520, 563520, 960, 2012, 0x738fba51
+0, 564480, 564480, 960, 2012, 0xe7b2b78e
+0, 565440, 565440, 960, 2012, 0x7685b6ce
+0, 566400, 566400, 960, 2012, 0xae45bd8a
+0, 567360, 567360, 960, 2012, 0xd52cc84e
+0, 568320, 568320, 960, 2012, 0x04abd773
+0, 569280, 569280, 960, 2012, 0x2badb0ff
+0, 570240, 570240, 960, 2012, 0x0eaec6b2
+0, 571200, 571200, 960, 2012, 0x7c1ec33f
+0, 572160, 572160, 960, 2012, 0x8773b925
+0, 573120, 573120, 960, 2012, 0x40bbc36d
+0, 574080, 574080, 960, 2012, 0x330bc288
+0, 575040, 575040, 960, 2012, 0x1659b6f5
+0, 576000, 576000, 960, 2012, 0x66eac162
+0, 576960, 576960, 960, 2012, 0xf3acdb3d
+0, 577920, 577920, 960, 2012, 0x465abb87
+0, 578880, 578880, 960, 2012, 0xe8e9bc16
+0, 579840, 579840, 960, 2012, 0x71eebbd9
+0, 580800, 580800, 960, 2012, 0x1f59cb2a
+0, 581760, 581760, 960, 2012, 0x53e3c9e7
+0, 582720, 582720, 960, 2012, 0xf410b939
+0, 583680, 583680, 960, 2012, 0xdb13d1b3
+0, 584640, 584640, 960, 2012, 0xcd26bf27
+0, 585600, 585600, 960, 2012, 0x707ecc9c
+0, 586560, 586560, 960, 2012, 0x3483b6bf
+0, 587520, 587520, 960, 2012, 0x4184d451
+0, 588480, 588480, 960, 2012, 0xcf6abfae
+0, 589440, 589440, 960, 2012, 0x5c9eb4ca
+0, 590400, 590400, 960, 2012, 0xf396be01
+0, 591360, 591360, 960, 2012, 0x06bfda38
+0, 592320, 592320, 960, 2012, 0x0e92bcf4
+0, 593280, 593280, 960, 2012, 0xaaa2b99d
+0, 594240, 594240, 960, 2012, 0xf112a9a9
+0, 595200, 595200, 960, 2012, 0x2844bdf1
+0, 596160, 596160, 960, 2012, 0xb96baf39
+0, 597120, 597120, 960, 2012, 0xd4f2d157
+0, 598080, 598080, 960, 2012, 0x7c74b149
+0, 599040, 599040, 960, 2012, 0xbd43d5f2
+0, 600000, 600000, 960, 2012, 0xaa10b2ba
+0, 600960, 600960, 960, 2012, 0x66e9b95f
+0, 601920, 601920, 960, 2012, 0x6f01abef
+0, 602880, 602880, 960, 2012, 0x1cb5c664
+0, 603840, 603840, 960, 2012, 0x5ee2afc5
+0, 604800, 604800, 960, 2012, 0xeb39d213
+0, 605760, 605760, 960, 2012, 0x1ffeaafc
+0, 606720, 606720, 960, 2012, 0x6bb4d548
+0, 607680, 607680, 960, 2012, 0xa045b23a
+0, 608640, 608640, 960, 2012, 0x17c3aa49
+0, 609600, 609600, 960, 2012, 0x2d47db7c
+0, 610560, 610560, 960, 2012, 0x07ddc9ac
+0, 611520, 611520, 960, 2012, 0xa386c99e
+0, 612480, 612480, 960, 2012, 0x0e0bae8a
+0, 613440, 613440, 960, 2012, 0x7d6fc419
+0, 614400, 614400, 960, 2012, 0x34a3c5a2
+0, 615360, 615360, 960, 2012, 0xda81c8e9
+0, 616320, 616320, 960, 2012, 0xde53bcd8
+0, 617280, 617280, 960, 2012, 0x372ac065
+0, 618240, 618240, 960, 2012, 0x6d07a95c
+0, 619200, 619200, 960, 2012, 0x296eb47f
+0, 620160, 620160, 960, 2012, 0x0f47be2a
+0, 621120, 621120, 960, 2012, 0x389ebaf6
+0, 622080, 622080, 960, 2012, 0x9746ba3b
+0, 623040, 623040, 960, 2012, 0x070e9aed
+0, 624000, 624000, 960, 2012, 0xa4abc798
+0, 624960, 624960, 960, 2012, 0xe55cac7b
+0, 625920, 625920, 960, 2012, 0x0c71ba45
+0, 626880, 626880, 960, 2012, 0x70fbb3c5
+0, 627840, 627840, 960, 2012, 0xa35ec30a
+0, 628800, 628800, 960, 2012, 0xf30ab935
+0, 629760, 629760, 960, 2012, 0x2cbb9b99
+0, 630720, 630720, 960, 2012, 0x6606c1bf
+0, 631680, 631680, 960, 2012, 0x41ccad5c
+0, 632640, 632640, 960, 2012, 0x352fc002
+0, 633600, 633600, 960, 2012, 0x1763bd10
+0, 634560, 634560, 960, 2012, 0xb54bcae6
+0, 635520, 635520, 960, 2012, 0x7374ab92
+0, 636480, 636480, 960, 2012, 0x2895a99a
+0, 637440, 637440, 960, 2012, 0x9f68b02f
+0, 638400, 638400, 960, 2012, 0xdfabbb76
+0, 639360, 639360, 960, 2012, 0x764ea6c5
+0, 640320, 640320, 960, 2012, 0x4e83c5a5
+0, 641280, 641280, 960, 2012, 0xf0e8c76a
+0, 642240, 642240, 960, 2012, 0xdc80b4ea
+0, 643200, 643200, 960, 2012, 0xcc53b0a5
+0, 644160, 644160, 960, 2012, 0x7893bc7f
+0, 645120, 645120, 960, 2012, 0x6965b355
+0, 646080, 646080, 960, 2012, 0x7f8fac00
+0, 647040, 647040, 960, 2012, 0x6c71c7b8
+0, 648000, 648000, 960, 2012, 0xa00ec367
+0, 648960, 648960, 960, 2012, 0x5f0fc50e
+0, 649920, 649920, 960, 2012, 0x1bd2ad87
+0, 650880, 650880, 960, 2012, 0xd054ba2d
+0, 651840, 651840, 960, 2012, 0xaf80a0d5
+0, 652800, 652800, 960, 2012, 0x2acac873
+0, 653760, 653760, 960, 2012, 0x260ca584
+0, 654720, 654720, 960, 2012, 0x4f98aa7c
+0, 655680, 655680, 960, 2012, 0x0254aa36
+0, 656640, 656640, 960, 2012, 0xe3c7c33a
+0, 657600, 657600, 960, 2012, 0x3b9ea70f
+0, 658560, 658560, 960, 2012, 0xe829b7e6
+0, 659520, 659520, 960, 2012, 0x9317a8d1
+0, 660480, 660480, 960, 2012, 0x88b3a98f
+0, 661440, 661440, 960, 2012, 0xa4a8c3bc
+0, 662400, 662400, 960, 2012, 0x95c9a869
+0, 663360, 663360, 960, 2012, 0x7f889fed
+0, 664320, 664320, 960, 2012, 0x5438c408
+0, 665280, 665280, 960, 2012, 0x3455a366
+0, 666240, 666240, 960, 2012, 0x5319b33d
+0, 667200, 667200, 960, 2012, 0xb19dc4f0
+0, 668160, 668160, 960, 2012, 0xf080b109
+0, 669120, 669120, 960, 2012, 0xef83d8e7
+0, 670080, 670080, 960, 2012, 0x237ac69c
+0, 671040, 671040, 960, 2012, 0xbb30b714
+0, 672000, 672000, 960, 2012, 0x8745ba54
+0, 672960, 672960, 960, 2012, 0x8588bd6c
+0, 673920, 673920, 960, 2012, 0xc580bdde
+0, 674880, 674880, 960, 2012, 0xb062baf1
+0, 675840, 675840, 960, 2012, 0xe014b082
+0, 676800, 676800, 960, 2012, 0x148bcb87
+0, 677760, 677760, 960, 2012, 0x554bc13d
+0, 678720, 678720, 960, 2012, 0xc410c270
+0, 679680, 679680, 960, 2012, 0xb2c8b65b
+0, 680640, 680640, 960, 2012, 0xa412b3f4
+0, 681600, 681600, 960, 2012, 0xbb52aa9a
+0, 682560, 682560, 960, 2012, 0x4005b527
+0, 683520, 683520, 960, 2012, 0x8c5eb055
+0, 684480, 684480, 960, 2012, 0x8622c142
+0, 685440, 685440, 960, 2012, 0x05a3b861
+0, 686400, 686400, 960, 2012, 0x9f6dbb4d
+0, 687360, 687360, 960, 2012, 0x033fb867
+0, 688320, 688320, 960, 2012, 0x243babd5
+0, 689280, 689280, 960, 2012, 0x8d6db83c
+0, 690240, 690240, 960, 2012, 0x3923b829
+0, 691200, 691200, 960, 2012, 0x69b6b587
+0, 692160, 692160, 960, 2012, 0xdda8d018
+0, 693120, 693120, 960, 2012, 0x54b1b2a4
+0, 694080, 694080, 960, 2012, 0x380eb1af
+0, 695040, 695040, 960, 2012, 0xec3cbdb4
+0, 696000, 696000, 960, 2012, 0x7ce9b4cf
+0, 696960, 696960, 960, 2012, 0xcf6cb99b
+0, 697920, 697920, 960, 2012, 0x7383ab97
+0, 698880, 698880, 960, 2012, 0xaa4cc068
+0, 699840, 699840, 960, 2012, 0x96d4c3db
+0, 700800, 700800, 960, 2012, 0xab8cb84f
+0, 701760, 701760, 960, 2012, 0x73dcacf9
+0, 702720, 702720, 960, 2012, 0xf61ca122
+0, 703680, 703680, 960, 2012, 0x9f1cbd5b
+0, 704640, 704640, 960, 2012, 0x1f84aa3f
+0, 705600, 705600, 960, 2012, 0xa003ad43
+0, 706560, 706560, 960, 2012, 0x6cffa4ef
+0, 707520, 707520, 960, 2012, 0x29559e1e
+0, 708480, 708480, 960, 2012, 0x7a79b059
+0, 709440, 709440, 960, 2012, 0xa1929c42
+0, 710400, 710400, 960, 2012, 0x52dead1c
+0, 711360, 711360, 960, 2012, 0x8f31b9f5
+0, 712320, 712320, 960, 2012, 0xb8a899ec
+0, 713280, 713280, 960, 2012, 0x7ca4b02d
+0, 714240, 714240, 960, 2012, 0x2c92ae1b
+0, 715200, 715200, 960, 2012, 0xe683a92f
+0, 716160, 716160, 960, 2012, 0xe9d5abcf
+0, 717120, 717120, 960, 2012, 0x757db377
+0, 718080, 718080, 960, 2012, 0xd4a8bbae
+0, 719040, 719040, 960, 2012, 0xeea5c4ee
+0, 720000, 720000, 960, 2012, 0xc37ca9a9
+0, 720960, 720960, 960, 2012, 0x8871bb51
+0, 721920, 721920, 960, 2012, 0x5dd8b3a2
+0, 722880, 722880, 960, 2012, 0xef0fae7f
+0, 723840, 723840, 960, 2012, 0xe7ecb23e
+0, 724800, 724800, 960, 2012, 0xc4f6d437
+0, 725760, 725760, 960, 2012, 0x0c74b81d
+0, 726720, 726720, 960, 2012, 0xee68b1ee
+0, 727680, 727680, 960, 2012, 0x46b4b4a8
+0, 728640, 728640, 960, 2012, 0x0526abca
+0, 729600, 729600, 960, 2012, 0x7695ba55
+0, 730560, 730560, 960, 2012, 0xc7f5ad90
+0, 731520, 731520, 960, 2012, 0x0522b9bc
+0, 732480, 732480, 960, 2012, 0x0eefc6ad
+0, 733440, 733440, 960, 2012, 0x340dae16
+0, 734400, 734400, 960, 2012, 0xea42bdc0
+0, 735360, 735360, 960, 2012, 0xe047abb6
+0, 736320, 736320, 960, 2012, 0x6da5c14f
+0, 737280, 737280, 960, 2012, 0x46d8c11d
+0, 738240, 738240, 960, 2012, 0x8f4d9f2f
+0, 739200, 739200, 960, 2012, 0x6d00d26c
+0, 740160, 740160, 960, 2012, 0x87fc9d1b
+0, 741120, 741120, 960, 2012, 0xbba5b763
+0, 742080, 742080, 960, 2012, 0xab58b853
+0, 743040, 743040, 960, 2012, 0x8180b863
+0, 744000, 744000, 960, 2012, 0x3684b3ba
+0, 744960, 744960, 960, 2012, 0xf1a4a806
+0, 745920, 745920, 960, 2012, 0x2826b48c
+0, 746880, 746880, 960, 2012, 0x1883af7f
+0, 747840, 747840, 960, 2012, 0x44c5c37a
+0, 748800, 748800, 960, 2012, 0xec33c3f1
+0, 749760, 749760, 960, 2012, 0xd67fb767
+0, 750720, 750720, 960, 2012, 0x03c2c219
+0, 751680, 751680, 960, 2012, 0x75a9b389
+0, 752640, 752640, 960, 2012, 0xe041ad88
+0, 753600, 753600, 960, 2012, 0x6bccb005
+0, 754560, 754560, 960, 2012, 0xd881c24a
+0, 755520, 755520, 960, 2012, 0x7dd0c302
+0, 756480, 756480, 960, 2012, 0x2ba8a649
+0, 757440, 757440, 960, 2012, 0x63e19eab
+0, 758400, 758400, 960, 2012, 0x1c0dafce
+0, 759360, 759360, 960, 2012, 0xf266bf47
+0, 760320, 760320, 960, 2012, 0x11beb4b1
+0, 761280, 761280, 960, 2012, 0xc6f6b2b5
+0, 762240, 762240, 960, 2012, 0x15d4b4d0
+0, 763200, 763200, 960, 2012, 0x08bfa1e7
+0, 764160, 764160, 960, 2012, 0x18dbb7b5
+0, 765120, 765120, 960, 2012, 0xc279cc67
+0, 766080, 766080, 960, 2012, 0xd236bf28
+0, 767040, 767040, 960, 2012, 0xc9d1b196
+0, 768000, 768000, 960, 2012, 0xb605983e
+0, 768960, 768960, 960, 2012, 0x8132c566
+0, 769920, 769920, 960, 2012, 0x6be4cd39
+0, 770880, 770880, 960, 2012, 0xce53c1f9
+0, 771840, 771840, 960, 2012, 0xe1efac0f
+0, 772800, 772800, 960, 2012, 0x3d60a57a
+0, 773760, 773760, 960, 2012, 0x1beda4b7
+0, 774720, 774720, 960, 2012, 0x34a4ac81
+0, 775680, 775680, 960, 2012, 0x30b0be4b
+0, 776640, 776640, 960, 2012, 0xc7ceaf45
+0, 777600, 777600, 960, 2012, 0xade0b6ec
+0, 778560, 778560, 960, 2012, 0xe00daf06
+0, 779520, 779520, 960, 2012, 0x04f79fe4
+0, 780480, 780480, 960, 2012, 0x8c59b7d9
+0, 781440, 781440, 960, 2012, 0x6f66b92a
+0, 782400, 782400, 960, 2012, 0x9b08b2c0
+0, 783360, 783360, 960, 2012, 0xa8c1b5c1
+0, 784320, 784320, 960, 2012, 0xe3aac0b0
+0, 785280, 785280, 960, 2012, 0x1622bdaf
+0, 786240, 786240, 960, 2012, 0x25e1a9ff
+0, 787200, 787200, 960, 2012, 0x5577ad82
+0, 788160, 788160, 960, 2012, 0xfe16a49b
+0, 789120, 789120, 960, 2012, 0xef7fc32a
+0, 790080, 790080, 960, 2012, 0xfe30c35d
+0, 791040, 791040, 960, 2012, 0x3adc9610
+0, 792000, 792000, 960, 2012, 0x36eeabdc
+0, 792960, 792960, 960, 2012, 0xde3fb56c
+0, 793920, 793920, 960, 2012, 0x5629bd82
+0, 794880, 794880, 960, 2012, 0xb099a61d
+0, 795840, 795840, 960, 2012, 0x3013b106
+0, 796800, 796800, 960, 2012, 0xc359aef3
+0, 797760, 797760, 960, 2012, 0xec01b3e1
+0, 798720, 798720, 960, 2012, 0x6e8ac0b1
+0, 799680, 799680, 960, 2012, 0x41e8b82d
+0, 800640, 800640, 960, 2012, 0x3a2fb38b
+0, 801600, 801600, 960, 2012, 0x7025aac9
+0, 802560, 802560, 960, 2012, 0xbb0eb094
+0, 803520, 803520, 960, 2012, 0xdc06c156
+0, 804480, 804480, 960, 2012, 0x4007cea4
+0, 805440, 805440, 960, 2012, 0x102ebe03
+0, 806400, 806400, 960, 2012, 0x6e8faae7
+0, 807360, 807360, 960, 2012, 0xa357aa0c
+0, 808320, 808320, 960, 2012, 0x07d2bf4d
+0, 809280, 809280, 960, 2012, 0xfb71b338
+0, 810240, 810240, 960, 2012, 0xd5f1be84
+0, 811200, 811200, 960, 2012, 0x2a7cb554
+0, 812160, 812160, 960, 2012, 0xfb03b8c3
+0, 813120, 813120, 960, 2012, 0x2ff1ca87
+0, 814080, 814080, 960, 2012, 0xeef2b7f3
+0, 815040, 815040, 960, 2012, 0x9377b15f
+0, 816000, 816000, 960, 2012, 0x370cb0c2
+0, 816960, 816960, 960, 2012, 0x5f78b118
+0, 817920, 817920, 960, 2012, 0x19afa87a
+0, 818880, 818880, 960, 2012, 0xc717ab0d
+0, 819840, 819840, 960, 2012, 0x3ca499f4
+0, 820800, 820800, 960, 2012, 0x9612b8e4
+0, 821760, 821760, 960, 2012, 0x32c0bb29
+0, 822720, 822720, 960, 2012, 0x7727beba
+0, 823680, 823680, 960, 2012, 0x8b60a4cb
+0, 824640, 824640, 960, 2012, 0xe899a9c8
+0, 825600, 825600, 960, 2012, 0x60f4b7fe
+0, 826560, 826560, 960, 2012, 0x544f9ecb
+0, 827520, 827520, 960, 2012, 0x34afcd71
+0, 828480, 828480, 960, 2012, 0x470eab55
+0, 829440, 829440, 960, 2012, 0xe4959f93
+0, 830400, 830400, 960, 2012, 0x69eeaf97
+0, 831360, 831360, 960, 2012, 0x0ec9aca3
+0, 832320, 832320, 960, 2012, 0x51e4b7f6
+0, 833280, 833280, 960, 2012, 0xf6c0a837
+0, 834240, 834240, 960, 2012, 0x3bdca59b
+0, 835200, 835200, 960, 2012, 0x14c59dfc
+0, 836160, 836160, 960, 2012, 0xa50ab23a
+0, 837120, 837120, 960, 2012, 0x8832b6e2
+0, 838080, 838080, 960, 2012, 0x3d699d1b
+0, 839040, 839040, 960, 2012, 0x751aa4b8
+0, 840000, 840000, 960, 2012, 0x59a9b98c
+0, 840960, 840960, 960, 2012, 0xb67c98cb
+0, 841920, 841920, 960, 2012, 0x0fd39ccd
+0, 842880, 842880, 960, 2012, 0x9980d1e1
+0, 843840, 843840, 960, 2012, 0xffd9a716
+0, 844800, 844800, 960, 2012, 0x7d2fbed1
+0, 845760, 845760, 960, 2012, 0x76e6b042
+0, 846720, 846720, 960, 2012, 0xe027a232
+0, 847680, 847680, 960, 2012, 0x7c6ca5ce
+0, 848640, 848640, 960, 2012, 0x5cf6bda4
+0, 849600, 849600, 960, 2012, 0x6075bd0d
+0, 850560, 850560, 960, 2012, 0xedc4abe9
+0, 851520, 851520, 960, 2012, 0xb8f7cc26
+0, 852480, 852480, 960, 2012, 0x2cbbb500
+0, 853440, 853440, 960, 2012, 0x1c34b04d
+0, 854400, 854400, 960, 2012, 0x5f18bea2
+0, 855360, 855360, 960, 2012, 0x94d0bb2b
+0, 856320, 856320, 960, 2012, 0x6899b78e
+0, 857280, 857280, 960, 2012, 0xc9aaa7a2
+0, 858240, 858240, 960, 2012, 0x298cbafa
+0, 859200, 859200, 960, 2012, 0x89d9ac80
+0, 860160, 860160, 960, 2012, 0xc6ffa7e6
+0, 861120, 861120, 960, 2012, 0xdcf7caf9
+0, 862080, 862080, 960, 2012, 0x26cfb4ee
+0, 863040, 863040, 960, 2012, 0xec70b09d
+0, 864000, 864000, 960, 2012, 0x65dca50f
+0, 864960, 864960, 960, 2012, 0xcdebc0b6
+0, 865920, 865920, 960, 2012, 0x9393a262
+0, 866880, 866880, 960, 2012, 0x34aab06d
+0, 867840, 867840, 960, 2012, 0x4800a550
+0, 868800, 868800, 960, 2012, 0x4d9aadec
+0, 869760, 869760, 960, 2012, 0x2cddabb6
+0, 870720, 870720, 960, 2012, 0x91a0c5b2
+0, 871680, 871680, 960, 2012, 0xd326bee1
+0, 872640, 872640, 960, 2012, 0xf76ab2d5
+0, 873600, 873600, 960, 2012, 0xcef99ade
+0, 874560, 874560, 960, 2012, 0x950dc76f
+0, 875520, 875520, 960, 2012, 0xb6aca7ad
+0, 876480, 876480, 960, 2012, 0x1aacb71c
+0, 877440, 877440, 960, 2012, 0x32389da0
+0, 878400, 878400, 960, 2012, 0x030cbcce
+0, 879360, 879360, 960, 2012, 0x0ec4b0cb
+0, 880320, 880320, 960, 2012, 0x6c0bb62e
+0, 881280, 881280, 960, 2012, 0xfadbb20d
+0, 882240, 882240, 960, 2012, 0x99c9c848
+0, 883200, 883200, 960, 2012, 0xe3e3b21a
+0, 884160, 884160, 960, 2012, 0x88d9a50b
+0, 885120, 885120, 960, 2012, 0xf4bbaf17
+0, 886080, 886080, 960, 2012, 0x49fea706
+0, 887040, 887040, 960, 2012, 0xafd0babf
+0, 888000, 888000, 960, 2012, 0x8970a8f3
+0, 888960, 888960, 960, 2012, 0x9223a553
+0, 889920, 889920, 960, 2012, 0x6ec2b2f9
+0, 890880, 890880, 960, 2012, 0x7960b759
+0, 891840, 891840, 960, 2012, 0x852891bf
+0, 892800, 892800, 960, 2012, 0x094ebbeb
+0, 893760, 893760, 960, 2012, 0xf9bab418
+0, 894720, 894720, 960, 2012, 0x010eae8c
+0, 895680, 895680, 960, 2012, 0x10baab3d
+0, 896640, 896640, 960, 2012, 0x2564b13f
+0, 897600, 897600, 960, 2012, 0xaec8ac22
+0, 898560, 898560, 960, 2012, 0xda0cbd4f
+0, 899520, 899520, 960, 2012, 0x97e1c075
+0, 900480, 900480, 960, 2012, 0x6731aca5
+0, 901440, 901440, 960, 2012, 0x2c1db696
+0, 902400, 902400, 960, 2012, 0x8ff7abbf
+0, 903360, 903360, 960, 2012, 0xf75ab3a2
+0, 904320, 904320, 960, 2012, 0x8683b824
+0, 905280, 905280, 960, 2012, 0x9668b354
+0, 906240, 906240, 960, 2012, 0x6e9aae04
+0, 907200, 907200, 960, 2012, 0xd8e9acd7
+0, 908160, 908160, 960, 2012, 0xa326c298
+0, 909120, 909120, 960, 2012, 0x6abcb409
+0, 910080, 910080, 960, 2012, 0x7eb3b549
+0, 911040, 911040, 960, 2012, 0xfc72ba6a
+0, 912000, 912000, 960, 2012, 0xed73b2e6
+0, 912960, 912960, 960, 2012, 0x07a6b0a9
+0, 913920, 913920, 960, 2012, 0x10a4aec4
+0, 914880, 914880, 960, 2012, 0xaac9a650
+0, 915840, 915840, 960, 2012, 0x848b9869
+0, 916800, 916800, 960, 2012, 0x1ddaafd6
+0, 917760, 917760, 960, 2012, 0xe291aaec
+0, 918720, 918720, 960, 2012, 0x8aa1aa4d
+0, 919680, 919680, 960, 2012, 0x9b69b94c
+0, 920640, 920640, 960, 2012, 0xe784bec0
+0, 921600, 921600, 960, 2012, 0x9305ba2d
+0, 922560, 922560, 960, 2012, 0x5616bb81
+0, 923520, 923520, 960, 2012, 0xea0facca
+0, 924480, 924480, 960, 2012, 0xe1b9991e
+0, 925440, 925440, 960, 2012, 0xded8bd59
+0, 926400, 926400, 960, 2012, 0xe79fb0ee
+0, 927360, 927360, 960, 2012, 0x1b8595a6
+0, 928320, 928320, 960, 2012, 0xb55ba336
+0, 929280, 929280, 960, 2012, 0xc552bc98
+0, 930240, 930240, 960, 2012, 0x2fe2c5ba
+0, 931200, 931200, 960, 2012, 0xe18aa5a6
+0, 932160, 932160, 960, 2012, 0xaa9bae1c
+0, 933120, 933120, 960, 2012, 0xd1ddb68d
+0, 934080, 934080, 960, 2012, 0x95bfb203
+0, 935040, 935040, 960, 2012, 0xeacab8b9
+0, 936000, 936000, 960, 2012, 0x5bfcb117
+0, 936960, 936960, 960, 2012, 0x1a9fa91c
+0, 937920, 937920, 960, 2012, 0xa285b180
+0, 938880, 938880, 960, 2012, 0xfd58a6e2
+0, 939840, 939840, 960, 2012, 0x394fc325
+0, 940800, 940800, 960, 2012, 0x0415a6aa
+0, 941760, 941760, 960, 2012, 0xf75fa5e0
+0, 942720, 942720, 960, 2012, 0x115cd11b
+0, 943680, 943680, 960, 2012, 0x6587b9e3
+0, 944640, 944640, 960, 2012, 0xce6bb7e6
+0, 945600, 945600, 960, 2012, 0xbaa2b409
+0, 946560, 946560, 960, 2012, 0x271bbb14
+0, 947520, 947520, 960, 2012, 0x4516c223
+0, 948480, 948480, 960, 2012, 0x4f6ab266
+0, 949440, 949440, 960, 2012, 0x244ba6fc
+0, 950400, 950400, 960, 2012, 0x60e0ae4e
+0, 951360, 951360, 960, 2012, 0xfc3cac80
+0, 952320, 952320, 960, 2012, 0x8465b287
+0, 953280, 953280, 960, 2012, 0xc683b070
+0, 954240, 954240, 960, 2012, 0x2901c8e7
+0, 955200, 955200, 960, 2012, 0x0622b1a1
+0, 956160, 956160, 960, 2012, 0xe002b34c
+0, 957120, 957120, 960, 2012, 0xf4969e79
+0, 958080, 958080, 960, 2012, 0x871cc453
+0, 959040, 959040, 960, 2012, 0x9a7daaf3
+0, 960000, 960000, 960, 2012, 0xba92a60a
+0, 960960, 960960, 960, 2012, 0xf464a0c4
+0, 961920, 961920, 960, 2012, 0x53bbb6cd
+0, 962880, 962880, 960, 2012, 0xb58a9d2a
+0, 963840, 963840, 960, 2012, 0x1e1fb830
+0, 964800, 964800, 960, 2012, 0xdc7eb93e
+0, 965760, 965760, 960, 2012, 0xe6ceaaf9
+0, 966720, 966720, 960, 2012, 0x8c7ea35d
+0, 967680, 967680, 960, 2012, 0x0b87ba04
+0, 968640, 968640, 960, 2012, 0xf516a700
+0, 969600, 969600, 960, 2012, 0xfaf19e13
+0, 970560, 970560, 960, 2012, 0x53cf9ed0
+0, 971520, 971520, 960, 2012, 0x2e25c2f9
+0, 972480, 972480, 960, 2012, 0x959aa1b8
+0, 973440, 973440, 960, 2012, 0x2a49a572
+0, 974400, 974400, 960, 2012, 0xf7a9b809
+0, 975360, 975360, 960, 2012, 0x44a9b879
+0, 976320, 976320, 960, 2012, 0xe428c0d4
+0, 977280, 977280, 960, 2012, 0xc258c2c6
+0, 978240, 978240, 960, 2012, 0xf7f3b794
+0, 979200, 979200, 960, 2012, 0xa8adbad9
+0, 980160, 980160, 960, 2012, 0xc2508e79
+0, 981120, 981120, 960, 2012, 0x1418ac76
+0, 982080, 982080, 960, 2012, 0xb28aadef
+0, 983040, 983040, 960, 2012, 0xda17bd03
+0, 984000, 984000, 960, 2012, 0xa92ab852
+0, 984960, 984960, 960, 2012, 0xc3cbcfa4
+0, 985920, 985920, 960, 2012, 0xf716bb5e
+0, 986880, 986880, 960, 2012, 0x6009a8af
+0, 987840, 987840, 960, 2012, 0x9e69bc81
+0, 988800, 988800, 960, 2012, 0x3aafc8cf
+0, 989760, 989760, 960, 2012, 0x03bccdab
+0, 990720, 990720, 960, 2012, 0xfdceb2d9
+0, 991680, 991680, 960, 2012, 0x68f7afb8
+0, 992640, 992640, 960, 2012, 0xb7bab330
+0, 993600, 993600, 960, 2012, 0x4976b125
+0, 994560, 994560, 960, 2012, 0x7c86ae12
+0, 995520, 995520, 960, 2012, 0x4ce4ca54
+0, 996480, 996480, 960, 2012, 0xf1f7b892
+0, 997440, 997440, 960, 2012, 0xf958abb1
+0, 998400, 998400, 960, 2012, 0x047accd0
+0, 999360, 999360, 960, 2012, 0x34a1c49c
+0, 1000320, 1000320, 960, 2012, 0x4b24a4ed
+0, 1001280, 1001280, 960, 2012, 0xea31b1bc
+0, 1002240, 1002240, 960, 2012, 0x8beaa3e3
+0, 1003200, 1003200, 960, 2012, 0x064caaf9
+0, 1004160, 1004160, 960, 2012, 0x56babf15
+0, 1005120, 1005120, 960, 2012, 0xd16fc6f4
+0, 1006080, 1006080, 960, 2012, 0x4ac2b78a
+0, 1007040, 1007040, 960, 2012, 0xba3aa509
+0, 1008000, 1008000, 960, 2012, 0xc103b074
+0, 1008960, 1008960, 960, 2012, 0x464aba98
+0, 1009920, 1009920, 960, 2012, 0xaacac5a3
+0, 1010880, 1010880, 960, 2012, 0x9cecbcfa
+0, 1011840, 1011840, 960, 2012, 0x8da0ab79
+0, 1012800, 1012800, 960, 2012, 0x85b2b023
+0, 1013760, 1013760, 960, 2012, 0x598abc91
+0, 1014720, 1014720, 960, 2012, 0x08c0a35c
+0, 1015680, 1015680, 960, 2012, 0x30e4a7cf
+0, 1016640, 1016640, 960, 2012, 0xf1e4a931
+0, 1017600, 1017600, 960, 2012, 0x8a4fb6c1
+0, 1018560, 1018560, 960, 2012, 0x126aac08
+0, 1019520, 1019520, 960, 2012, 0x537fa51b
+0, 1020480, 1020480, 960, 2012, 0x1e54ac5a
+0, 1021440, 1021440, 960, 2012, 0x7274bbd0
+0, 1022400, 1022400, 960, 2012, 0xd16bc2c2
+0, 1023360, 1023360, 960, 2012, 0x9236c1e3
+0, 1024320, 1024320, 960, 2012, 0x348aa7af
+0, 1025280, 1025280, 960, 2012, 0xa020be5e
+0, 1026240, 1026240, 960, 2012, 0x3cc5a4b8
+0, 1027200, 1027200, 960, 2012, 0x8b19b649
+0, 1028160, 1028160, 960, 2012, 0x554aa5ab
+0, 1029120, 1029120, 960, 2012, 0x35d6ac35
+0, 1030080, 1030080, 960, 2012, 0x64dba435
+0, 1031040, 1031040, 960, 2012, 0x6001bae2
+0, 1032000, 1032000, 960, 2012, 0x9220b599
+0, 1032960, 1032960, 960, 2012, 0xa3fdb899
+0, 1033920, 1033920, 960, 2012, 0x19a5abf4
+0, 1034880, 1034880, 960, 2012, 0xd857b8cf
+0, 1035840, 1035840, 960, 2012, 0x38d1b234
+0, 1036800, 1036800, 960, 2012, 0x69f4bfb8
+0, 1037760, 1037760, 960, 2012, 0xcc87a375
+0, 1038720, 1038720, 960, 2012, 0xc1cdd0c5
+0, 1039680, 1039680, 960, 2012, 0xba0ca3ee
+0, 1040640, 1040640, 960, 2012, 0x4d20c397
+0, 1041600, 1041600, 960, 2012, 0x825c9636
+0, 1042560, 1042560, 960, 2012, 0x7aa4ae53
+0, 1043520, 1043520, 960, 2012, 0xe970ae78
+0, 1044480, 1044480, 960, 2012, 0x5fb2ba59
+0, 1045440, 1045440, 960, 2012, 0xcd90a953
+0, 1046400, 1046400, 960, 2012, 0xf573ac40
+0, 1047360, 1047360, 960, 2012, 0x324cbd77
+0, 1048320, 1048320, 960, 2012, 0xece0a73d
+0, 1049280, 1049280, 960, 2012, 0x0dd1aefa
+0, 1050240, 1050240, 960, 2012, 0xe338c866
+0, 1051200, 1051200, 960, 2012, 0xfe71bffc
+0, 1052160, 1052160, 960, 2012, 0x61a5a810
+0, 1053120, 1053120, 960, 2012, 0x7c3ba074
+0, 1054080, 1054080, 960, 2012, 0x492f9d91
+0, 1055040, 1055040, 960, 2012, 0xa126a7b9
+0, 1056000, 1056000, 960, 2012, 0x7cf19a40
+0, 1056960, 1056960, 960, 2012, 0x1c2fbae6
+0, 1057920, 1057920, 960, 2012, 0x540accdf
+0, 1058880, 1058880, 960, 2012, 0x5908a938
+0, 1059840, 1059840, 960, 2012, 0xe7f8b501
+0, 1060800, 1060800, 960, 2012, 0x03a8b53e
+0, 1061760, 1061760, 960, 2012, 0xb4e3bdda
+0, 1062720, 1062720, 960, 2012, 0x9e86abe1
+0, 1063680, 1063680, 960, 2012, 0x3234b98d
+0, 1064640, 1064640, 960, 2012, 0x5caec781
+0, 1065600, 1065600, 960, 2012, 0x5c21a32e
+0, 1066560, 1066560, 960, 2012, 0x8b72c112
+0, 1067520, 1067520, 960, 2012, 0x2ec2bac3
+0, 1068480, 1068480, 960, 2012, 0xd9c4adaa
+0, 1069440, 1069440, 960, 2012, 0x2da1b496
+0, 1070400, 1070400, 960, 2012, 0x0a51b21e
+0, 1071360, 1071360, 960, 2012, 0x6414ab0d
+0, 1072320, 1072320, 960, 2012, 0x95c4b203
+0, 1073280, 1073280, 960, 2012, 0x98e0b4a2
+0, 1074240, 1074240, 960, 2012, 0x34369f5f
+0, 1075200, 1075200, 960, 2012, 0x9dffa40c
+0, 1076160, 1076160, 960, 2012, 0xf345b0e5
+0, 1077120, 1077120, 960, 2012, 0x6714bdbf
+0, 1078080, 1078080, 960, 2012, 0xc276c3d1
+0, 1079040, 1079040, 960, 2012, 0xf199b475
+0, 1080000, 1080000, 960, 2012, 0x3395cf3b
+0, 1080960, 1080960, 960, 2012, 0x4b52afb0
+0, 1081920, 1081920, 960, 2012, 0x3f74b217
+0, 1082880, 1082880, 960, 2012, 0xa25cad38
+0, 1083840, 1083840, 960, 2012, 0x3290a5b4
+0, 1084800, 1084800, 960, 2012, 0x2917b750
+0, 1085760, 1085760, 960, 2012, 0xeb3ec739
+0, 1086720, 1086720, 960, 2012, 0xbf9ea51d
+0, 1087680, 1087680, 960, 2012, 0x98e2a0c1
+0, 1088640, 1088640, 960, 2012, 0xa39ba7f2
+0, 1089600, 1089600, 960, 2012, 0x6df7a05c
+0, 1090560, 1090560, 960, 2012, 0x2c1bba28
+0, 1091520, 1091520, 960, 2012, 0x6099b1cd
+0, 1092480, 1092480, 960, 2012, 0x9366b9f2
+0, 1093440, 1093440, 960, 2012, 0x95899570
+0, 1094400, 1094400, 960, 2012, 0x6234a0c8
+0, 1095360, 1095360, 960, 2012, 0xec2cbcfc
+0, 1096320, 1096320, 960, 2012, 0x3ff7a9db
+0, 1097280, 1097280, 960, 2012, 0x4e44bad7
+0, 1098240, 1098240, 960, 2012, 0x1dbbbc39
+0, 1099200, 1099200, 960, 2012, 0xf9df99be
+0, 1100160, 1100160, 960, 2012, 0xa713b313
+0, 1101120, 1101120, 960, 2012, 0x8bbdbe51
+0, 1102080, 1102080, 960, 2012, 0x0d5bc786
+0, 1103040, 1103040, 960, 2012, 0x75d293f2
+0, 1104000, 1104000, 960, 2012, 0x4832b688
+0, 1104960, 1104960, 960, 2012, 0x71aba74c
+0, 1105920, 1105920, 960, 2012, 0x04d5abf2
+0, 1106880, 1106880, 960, 2012, 0xaa8fbd98
+0, 1107840, 1107840, 960, 2012, 0xd93eb6d4
+0, 1108800, 1108800, 960, 2012, 0x8fb6b5a8
+0, 1109760, 1109760, 960, 2012, 0x779a92f5
+0, 1110720, 1110720, 960, 2012, 0x35c8ab3d
+0, 1111680, 1111680, 960, 2012, 0x0017aaa5
+0, 1112640, 1112640, 960, 2012, 0xd6e7bafe
+0, 1113600, 1113600, 960, 2012, 0xe358b423
+0, 1114560, 1114560, 960, 2012, 0x3f74bfba
+0, 1115520, 1115520, 960, 2012, 0x0a5eb707
+0, 1116480, 1116480, 960, 2012, 0xedbfb0df
+0, 1117440, 1117440, 960, 2012, 0x2e71a26f
+0, 1118400, 1118400, 960, 2012, 0x214db1a8
+0, 1119360, 1119360, 960, 2012, 0xb632c275
+0, 1120320, 1120320, 960, 2012, 0xb597cf92
+0, 1121280, 1121280, 960, 2012, 0x18a8b508
+0, 1122240, 1122240, 960, 2012, 0x8267b4ff
+0, 1123200, 1123200, 960, 2012, 0x5a9ab8d6
+0, 1124160, 1124160, 960, 2012, 0x2037a2b6
--
2.49.1
From 33588a37497bb26598234fc745eda52089c26761 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:46:17 -0300
Subject: [PATCH 062/434] avformat/movenc: write stss boxes for xHE-AAC
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 23a1c021f299655d66bcfbd69ed0d6780f68c6fc)
---
libavformat/movenc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index da58a7ab15..d6effda6fa 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -3196,6 +3196,7 @@ static int mov_write_stbl_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContext
if ((track->par->codec_type == AVMEDIA_TYPE_VIDEO ||
track->par->codec_id == AV_CODEC_ID_TRUEHD ||
track->par->codec_id == AV_CODEC_ID_MPEGH_3D_AUDIO ||
+ (track->par->codec_id == AV_CODEC_ID_AAC && track->par->profile == AV_PROFILE_AAC_USAC) ||
track->par->codec_tag == MKTAG('r','t','p',' ')) &&
track->has_keyframes && track->has_keyframes < track->entry)
mov_write_stss_tag(pb, track, MOV_SYNC_SAMPLE);
--
2.49.1
From 13282e61b808121222b043c8b965a48ef801267b Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:47:43 -0300
Subject: [PATCH 063/434] avformat/test/movenc: set audio packets as key frames
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit f938b2b3f51f959de84bc22c75529b77626b2596)
---
libavformat/tests/movenc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/tests/movenc.c b/libavformat/tests/movenc.c
index 2fd5c67e76..23a827e97c 100644
--- a/libavformat/tests/movenc.c
+++ b/libavformat/tests/movenc.c
@@ -270,6 +270,7 @@ static void mux_frames(int n, int c)
pkt->dts = pkt->pts = audio_dts;
pkt->stream_index = 1;
pkt->duration = audio_duration;
+ pkt->flags |= AV_PKT_FLAG_KEY;
audio_dts += audio_duration;
} else {
if (frames == end_frames)
--
2.49.1
From f1592a7ff1d38e75bd97bc6c49961e6628924e07 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:49:17 -0300
Subject: [PATCH 064/434] avformat/matroskadec: set all frames in a keyframe
simple box as keyframes
And not just the first, as it was being done for lacing. The spec states that the
flag applies to everything inside the simple box.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit f656c00bd953b1dd84c58dfef5dd645db818ba3d)
---
libavformat/matroskadec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index c8741ff2af..a2947c97e7 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4224,7 +4224,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, AVBufferRef *buf
} else {
res = matroska_parse_frame(matroska, track, st, buf, out_data,
out_size, timecode, lace_duration,
- pos, !n ? is_keyframe : 0,
+ pos, is_keyframe,
blockmore, nb_blockmore,
discard_padding);
if (res)
--
2.49.1
From dc9d9b8636f1e71fb839aa25955122b608f6d98f Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:54:34 -0300
Subject: [PATCH 065/434] avformat/mov: don't unconditionally set all audio
packets in fragments as key frames
Some audio codecs, like TrueHD, have non key frames.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8ddbc26dedcf83962dd3aed90a6bb0a95847d386)
---
libavformat/mov.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 54f8594f67..9a9a2414e7 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5843,10 +5843,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
pts = AV_NOPTS_VALUE;
}
- if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO)
- keyframe = 1;
- else
- keyframe =
+ keyframe =
!(sample_flags & (MOV_FRAG_SAMPLE_FLAG_IS_NON_SYNC |
MOV_FRAG_SAMPLE_FLAG_DEPENDS_YES));
if (keyframe) {
--
2.49.1
From 075c6d325ac1e6b95840a72f133bac4aa8140215 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 17:56:14 -0300
Subject: [PATCH 066/434] avcodec/aac_parser: set key_frame and profile
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 64bb91fd3b5a00a8849531c7e8dd207f2a626096)
---
libavcodec/aac_ac3_parser.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c
index f45631d09f..e2361d3534 100644
--- a/libavcodec/aac_ac3_parser.c
+++ b/libavcodec/aac_ac3_parser.c
@@ -40,6 +40,8 @@ int ff_aac_ac3_parse(AVCodecParserContext *s1,
int new_frame_start;
int got_frame = 0;
+ s1->key_frame = -1;
+
if (s1->flags & PARSER_FLAG_COMPLETE_FRAMES) {
i = buf_size;
got_frame = 1;
@@ -145,10 +147,15 @@ get_next:
} else {
#if CONFIG_AAC_PARSER
AACADTSHeaderInfo hdr;
+ GetBitContext gb;
+ int profile;
+ init_get_bits8(&gb, buf, buf_size);
if (buf_size < AV_AAC_ADTS_HEADER_SIZE ||
- ff_adts_header_parse_buf(buf, &hdr) < 0)
+ ff_adts_header_parse(&gb, &hdr) < 0)
return i;
+ avctx->profile = hdr.object_type - 1;
+ s1->key_frame = (avctx->profile == AV_PROFILE_AAC_USAC) ? get_bits1(&gb) : 1;
bit_rate = hdr.bit_rate;
#endif
}
--
2.49.1
From 1b5bdce86a762815d2582c59c30e8f5c8f9140d3 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 20:28:38 -0300
Subject: [PATCH 067/434] avcodec/aac/aacdec: set keyframe flag in output
frames
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit faea08b722de716391c3f84a265060c643ad6c22)
---
libavcodec/aac/aacdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 4110bc40ca..038251d266 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -2194,6 +2194,7 @@ static int aac_decode_er_frame(AVCodecContext *avctx, AVFrame *frame,
ac->frame->nb_samples = samples;
ac->frame->sample_rate = avctx->sample_rate;
+ ac->frame->flags |= AV_FRAME_FLAG_KEY;
*got_frame_ptr = 1;
skip_bits_long(gb, get_bits_left(gb));
@@ -2354,6 +2355,7 @@ static int decode_frame_ga(AVCodecContext *avctx, AACDecContext *ac,
if (samples) {
ac->frame->nb_samples = samples;
ac->frame->sample_rate = avctx->sample_rate;
+ ac->frame->flags |= AV_FRAME_FLAG_KEY;
*got_frame_ptr = 1;
} else {
av_frame_unref(ac->frame);
--
2.49.1
From 302f1b3882536dcbd1185778a474bc5900a57153 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 20:29:38 -0300
Subject: [PATCH 068/434] avcodec/aacenc: set keyframe flag in output packets
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit ffdace5ad4736ea720f306392ce6bdcb2aea823a)
---
libavcodec/aacenc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/aacenc.c b/libavcodec/aacenc.c
index 88037c7f87..3ff61f788b 100644
--- a/libavcodec/aacenc.c
+++ b/libavcodec/aacenc.c
@@ -1177,6 +1177,8 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts,
&avpkt->duration);
+ avpkt->flags |= AV_PKT_FLAG_KEY;
+
*got_packet_ptr = 1;
return 0;
}
--
2.49.1
From 07a92c1a640de41422fd2581e996c26976b03a6a Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 24 Nov 2024 20:24:27 -0300
Subject: [PATCH 069/434] avcodec/audiotoolboxdec: set set keyframe flag in
output frames
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d3dd14bf5b4a7e5ead890b83fc905add9b261cf7)
---
libavcodec/audiotoolboxdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/audiotoolboxdec.c b/libavcodec/audiotoolboxdec.c
index 0f7ce8e4eb..08203c5310 100644
--- a/libavcodec/audiotoolboxdec.c
+++ b/libavcodec/audiotoolboxdec.c
@@ -542,6 +542,8 @@ static int ffat_decode(AVCodecContext *avctx, AVFrame *frame,
frame->nb_samples = avctx->frame_size;
+ frame->flags |= AV_FRAME_FLAG_KEY;
+
out_buffers.mBuffers[0].mData = at->decoded_data;
ret = AudioConverterFillComplexBuffer(at->converter, ffat_decode_callback, avctx,
--
2.49.1
From f7d59ab17a751105c399cc64beb66d5c7686dcab Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 24 Nov 2024 20:24:40 -0300
Subject: [PATCH 070/434] avcodec/audiotoolboxnec: set set keyframe flag in
output packets
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 495c891e3998bdee7e7680390d9aea2efb5c9a5d)
---
libavcodec/audiotoolboxenc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/audiotoolboxenc.c b/libavcodec/audiotoolboxenc.c
index ad2b863bb9..908b56055f 100644
--- a/libavcodec/audiotoolboxenc.c
+++ b/libavcodec/audiotoolboxenc.c
@@ -576,6 +576,7 @@ static int ffat_encode(AVCodecContext *avctx, AVPacket *avpkt,
avctx->frame_size,
&avpkt->pts,
&avpkt->duration);
+ avpkt->flags |= AV_PKT_FLAG_KEY;
} else if (ret && ret != 1) {
av_log(avctx, AV_LOG_ERROR, "Encode error: %i\n", ret);
return AVERROR_EXTERNAL;
--
2.49.1
From c13a0a2f59bd169b57ff0285e85acf4c00ab2896 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 17 Nov 2024 15:53:03 -0300
Subject: [PATCH 071/434] avcodec/libfdk-aacdec: set keyframe flag and profile
in output frames
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 281b7fc02e3158ee62c3c1d41267ddebb86578f0)
---
libavcodec/libfdk-aacdec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/libfdk-aacdec.c b/libavcodec/libfdk-aacdec.c
index 1324377fb4..ac221645f0 100644
--- a/libavcodec/libfdk-aacdec.c
+++ b/libavcodec/libfdk-aacdec.c
@@ -111,7 +111,7 @@ static const AVClass fdk_aac_dec_class = {
.version = LIBAVUTIL_VERSION_INT,
};
-static int get_stream_info(AVCodecContext *avctx)
+static int get_stream_info(AVCodecContext *avctx, AVFrame *frame)
{
FDKAACDecContext *s = avctx->priv_data;
CStreamInfo *info = aacDecoder_GetStreamInfo(s->handle);
@@ -130,6 +130,9 @@ static int get_stream_info(AVCodecContext *avctx)
}
avctx->sample_rate = info->sampleRate;
avctx->frame_size = info->frameSize;
+ avctx->profile = info->aot - 1;
+
+ frame->flags |= AV_FRAME_FLAG_KEY * !!(info->flags & AC_INDEP);
#if FDKDEC_VER_AT_LEAST(2, 5) // 2.5.10
if (!s->output_delay_set && info->outputDelay) {
// Set this only once.
@@ -413,7 +416,7 @@ static int fdk_aac_decode_frame(AVCodecContext *avctx, AVFrame *frame,
goto end;
}
- if ((ret = get_stream_info(avctx)) < 0)
+ if ((ret = get_stream_info(avctx, frame)) < 0)
goto end;
frame->nb_samples = avctx->frame_size;
--
2.49.1
From 26bc7827e4bed355cd197938a9ddbe107f11e8c6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 17 Nov 2024 16:03:18 -0300
Subject: [PATCH 072/434] avcodec/libfdk-aacenc: set keyframe in output packets
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 99f87251e0cc6bf8f2a7c21e1e72e6144e5a6701)
---
libavcodec/libfdk-aacenc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/libfdk-aacenc.c b/libavcodec/libfdk-aacenc.c
index cc0ae0d8da..4dcfb25db7 100644
--- a/libavcodec/libfdk-aacenc.c
+++ b/libavcodec/libfdk-aacenc.c
@@ -549,6 +549,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
}
avpkt->size = out_args.numOutBytes;
+ avpkt->flags |= AV_PKT_FLAG_KEY;
*got_packet_ptr = 1;
return 0;
}
--
2.49.1
From 4b801baa46731f0377cbabaf485fe5715a334d93 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 24 Nov 2024 20:25:09 -0300
Subject: [PATCH 073/434] avcodec/mediacodecdec: set set keyframe flag in
output frames
Don't depend on the generic code setting this.
This is in preparation for a following change.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8d2d2519e04418d8565e0d6ece662c01121a35e1)
---
libavcodec/mediacodecdec_common.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c
index b1ee8b609a..3770b4f3ae 100644
--- a/libavcodec/mediacodecdec_common.c
+++ b/libavcodec/mediacodecdec_common.c
@@ -416,6 +416,7 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx,
frame->pts = info->presentationTimeUs;
}
frame->pkt_dts = AV_NOPTS_VALUE;
+ frame->flags |= AV_FRAME_FLAG_KEY;
av_log(avctx, AV_LOG_TRACE,
"Frame: format=%d channels=%d sample_rate=%d nb_samples=%d",
--
2.49.1
From f265f9c9d04863180503707bfad285f48e6bf080 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 16 Nov 2024 20:32:02 -0300
Subject: [PATCH 074/434] avcodec/codec_desc: remove Intra Only prop for AAC
xHE-AAC is a profile where some frames depend on other key frames, named IPF.
By setting the codec as Intra Only, all frames output by decoders and all
packets output by encoders/demuxers will be unconditionally flaged as
keyframes, which is incorrect.
Should fix ticket #11272.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 40bd6d835575bb8176774be5824ef07b71623d1e)
---
libavcodec/codec_desc.c | 4 ++--
libavcodec/version.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/codec_desc.c b/libavcodec/codec_desc.c
index 03dea5751a..d58c3d889c 100644
--- a/libavcodec/codec_desc.c
+++ b/libavcodec/codec_desc.c
@@ -2697,7 +2697,7 @@ static const AVCodecDescriptor codec_descriptors[] = {
.type = AVMEDIA_TYPE_AUDIO,
.name = "aac",
.long_name = NULL_IF_CONFIG_SMALL("AAC (Advanced Audio Coding)"),
- .props = AV_CODEC_PROP_INTRA_ONLY | AV_CODEC_PROP_LOSSY,
+ .props = AV_CODEC_PROP_LOSSY,
.profiles = NULL_IF_CONFIG_SMALL(ff_aac_profiles),
},
{
@@ -3031,7 +3031,7 @@ static const AVCodecDescriptor codec_descriptors[] = {
.type = AVMEDIA_TYPE_AUDIO,
.name = "aac_latm",
.long_name = NULL_IF_CONFIG_SMALL("AAC LATM (Advanced Audio Coding LATM syntax)"),
- .props = AV_CODEC_PROP_INTRA_ONLY | AV_CODEC_PROP_LOSSY,
+ .props = AV_CODEC_PROP_LOSSY,
.profiles = NULL_IF_CONFIG_SMALL(ff_aac_profiles),
},
{
diff --git a/libavcodec/version.h b/libavcodec/version.h
index 4b7ec515fe..b6ca025fae 100644
--- a/libavcodec/version.h
+++ b/libavcodec/version.h
@@ -30,7 +30,7 @@
#include "version_major.h"
#define LIBAVCODEC_VERSION_MINOR 19
-#define LIBAVCODEC_VERSION_MICRO 100
+#define LIBAVCODEC_VERSION_MICRO 101
#define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \
LIBAVCODEC_VERSION_MINOR, \
--
2.49.1
From 364f6a5f118d35058a49eee3624c5d82435be443 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 24 Nov 2024 14:24:47 -0300
Subject: [PATCH 075/434] avcodec/ac3dec: fix downmix logic for eac3
Ensure downmixed is only set once during init, as it used to be.
Fixes a regression since acbb2777e28c.
Fixes ticket #11321
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0e07a70611dc109f4e84895ffc79827a91edc045)
---
libavcodec/ac3dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
index 0a4d3375ee..3cc20f32a9 100644
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -199,7 +199,6 @@ static void ac3_downmix(AVCodecContext *avctx)
av_channel_layout_uninit(&avctx->ch_layout);
avctx->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
}
- s->downmixed = 1;
}
/**
@@ -241,6 +240,7 @@ static av_cold int ac3_decode_init(AVCodecContext *avctx)
avctx->sample_fmt = AV_SAMPLE_FMT_FLTP;
ac3_downmix(avctx);
+ s->downmixed = 1;
for (i = 0; i < AC3_MAX_CHANNELS; i++) {
s->xcfptr[i] = s->transform_coeffs[i];
--
2.49.1
From 10aaf84f855dbcedb8ee2e3fce307e9b98320946 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Wed, 23 Oct 2024 14:44:11 +0300
Subject: [PATCH 076/434] checkasm: Print benchmarks of C-only functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This corresponds to commit 9278a14cf406f8edb5052c42b83750112bf5b515
in dav1d.
Omitting the C-only functions doesn't speed up benchmarking
anyway (as those has to be benchmarked before we know if we have
any corresponding assembly functions), and being able to benchmark
those functions without corresponding assembly can be valuable in
a number of cases.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4b524649ff96b25edd275ce1662f5839102aa0af)
---
tests/checkasm/checkasm.c | 48 +++++++++++++++++++--------------------
1 file changed, 23 insertions(+), 25 deletions(-)
diff --git a/tests/checkasm/checkasm.c b/tests/checkasm/checkasm.c
index 73a998ae3a..5b59cdf589 100644
--- a/tests/checkasm/checkasm.c
+++ b/tests/checkasm/checkasm.c
@@ -618,34 +618,32 @@ static inline double avg_cycles_per_call(const CheckasmPerf *const p)
static void print_benchs(CheckasmFunc *f)
{
if (f) {
+ CheckasmFuncVersion *v = &f->versions;
+ const CheckasmPerf *p = &v->perf;
+ const double baseline = avg_cycles_per_call(p);
+ double decicycles;
+
print_benchs(f->child[0]);
- /* Only print functions with at least one assembly version */
- if (f->versions.cpu || f->versions.next) {
- CheckasmFuncVersion *v = &f->versions;
- const CheckasmPerf *p = &v->perf;
- const double baseline = avg_cycles_per_call(p);
- double decicycles;
- do {
- if (p->iterations) {
- p = &v->perf;
- decicycles = avg_cycles_per_call(p);
- if (state.csv || state.tsv) {
- const char sep = state.csv ? ',' : '\t';
- printf("%s%c%s%c%.1f\n", f->name, sep,
- cpu_suffix(v->cpu), sep,
- decicycles / 10.0);
- } else {
- const int pad_length = 10 + 50 -
- printf("%s_%s:", f->name, cpu_suffix(v->cpu));
- const double ratio = decicycles ?
- baseline / decicycles : 0.0;
- printf("%*.1f (%5.2fx)\n", FFMAX(pad_length, 0),
- decicycles / 10.0, ratio);
- }
+ do {
+ if (p->iterations) {
+ p = &v->perf;
+ decicycles = avg_cycles_per_call(p);
+ if (state.csv || state.tsv) {
+ const char sep = state.csv ? ',' : '\t';
+ printf("%s%c%s%c%.1f\n", f->name, sep,
+ cpu_suffix(v->cpu), sep,
+ decicycles / 10.0);
+ } else {
+ const int pad_length = 10 + 50 -
+ printf("%s_%s:", f->name, cpu_suffix(v->cpu));
+ const double ratio = decicycles ?
+ baseline / decicycles : 0.0;
+ printf("%*.1f (%5.2fx)\n", FFMAX(pad_length, 0),
+ decicycles / 10.0, ratio);
}
- } while ((v = v->next));
- }
+ }
+ } while ((v = v->next));
print_benchs(f->child[1]);
}
--
2.49.1
From 88126fc4ecff16c8337bab0ff33bee858a18d555 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 29 Nov 2024 02:28:18 +0100
Subject: [PATCH 077/434] avformat/iamf_parse: reject ambisonics mode > 1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
ambisonics mode > 1 does not initialize any layer but layer 0
is unconditionally dereferenced
Fixes: poc-2024-11
Fixes: null pointer dereference
Found-by: 苏童 <220235212@seu.edu.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4cc1495aca45445181a107a682c32cfe31459929)
---
libavformat/iamf_parse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index e0a138a07d..decd4bc437 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -413,7 +413,7 @@ static int ambisonics_config(void *s, AVIOContext *pb,
ambisonics_mode = ffio_read_leb(pb);
if (ambisonics_mode > 1)
- return 0;
+ return AVERROR_INVALIDDATA;
output_channel_count = avio_r8(pb); // C
substream_count = avio_r8(pb); // N
--
2.49.1
From 888a6b54bcc8ab395ebc214d764ceefaa1232d87 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 11 Dec 2024 23:27:00 -0300
Subject: [PATCH 078/434] avformat/iamf_parse: add checks to parameter
definition durations
Section 3.6.1 of the IAMF spec states "When constant_subblock_duration is equal to 0, the summation of all
subblock_duration in this parameter block SHALL be equal to duration.".
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d38fc25519cf12a9212dadcba1258fc176ffbade)
---
libavformat/iamf_parse.c | 14 ++++++++++++--
libavformat/iamf_reader.c | 15 +++++++++++++--
2 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index decd4bc437..57ccf1c199 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -496,6 +496,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
AVIAMFParamDefinition *param;
unsigned int parameter_id, parameter_rate, mode;
unsigned int duration = 0, constant_subblock_duration = 0, nb_subblocks = 0;
+ unsigned int total_duration = 0;
size_t param_size;
parameter_id = ffio_read_leb(pb);
@@ -516,8 +517,10 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
constant_subblock_duration = ffio_read_leb(pb);
if (constant_subblock_duration == 0)
nb_subblocks = ffio_read_leb(pb);
- else
+ else {
nb_subblocks = duration / constant_subblock_duration;
+ total_duration = duration;
+ }
}
param = av_iamf_param_definition_alloc(type, nb_subblocks, ¶m_size);
@@ -528,8 +531,10 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
void *subblock = av_iamf_param_definition_get_subblock(param, i);
unsigned int subblock_duration = constant_subblock_duration;
- if (constant_subblock_duration == 0)
+ if (constant_subblock_duration == 0) {
subblock_duration = ffio_read_leb(pb);
+ total_duration += subblock_duration;
+ }
switch (type) {
case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: {
@@ -557,6 +562,11 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
}
}
+ if (!mode && !constant_subblock_duration && total_duration != duration) {
+ av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id);
+ return AVERROR_INVALIDDATA;
+ }
+
param->parameter_id = parameter_id;
param->parameter_rate = parameter_rate;
param->duration = duration;
diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c
index b00bb997ca..7ad61cb246 100644
--- a/libavformat/iamf_reader.c
+++ b/libavformat/iamf_reader.c
@@ -109,6 +109,7 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c,
AVIOContext *pb;
uint8_t *buf;
unsigned int duration, constant_subblock_duration;
+ unsigned int total_duration = 0;
unsigned int nb_subblocks;
unsigned int parameter_id;
size_t out_param_size;
@@ -147,8 +148,10 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c,
constant_subblock_duration = ffio_read_leb(pb);
if (constant_subblock_duration == 0)
nb_subblocks = ffio_read_leb(pb);
- else
+ else {
nb_subblocks = duration / constant_subblock_duration;
+ total_duration = duration;
+ }
} else {
duration = param->duration;
constant_subblock_duration = param->constant_subblock_duration;
@@ -172,8 +175,10 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c,
void *subblock = av_iamf_param_definition_get_subblock(out_param, i);
unsigned int subblock_duration = constant_subblock_duration;
- if (!param_definition->mode && !constant_subblock_duration)
+ if (!param_definition->mode && !constant_subblock_duration) {
subblock_duration = ffio_read_leb(pb);
+ total_duration += subblock_duration;
+ }
switch (param->type) {
case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: {
@@ -235,6 +240,12 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c,
av_log(s, level, "Underread in parameter_block_obu. %d bytes left at the end\n", len);
}
+ if (!param_definition->mode && !constant_subblock_duration && total_duration != duration) {
+ av_log(s, AV_LOG_ERROR, "Invalid duration in parameter block\n");
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
+
switch (param->type) {
case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN:
av_free(c->mix);
--
2.49.1
From 871c69a28bf4f34d7d4fe8c0c4a91c7ecffccc96 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 11 Dec 2024 23:34:32 -0300
Subject: [PATCH 079/434] avformat/iamf_parse: fix setting duration for the
last subblock in a parameter definition
When subblock durations are constant, the last block may be smaller and the
value needs to be calculated.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fb5e8ea9719c8afcd0d9e3a51e370c06c361d9ba)
---
libavformat/iamf_parse.c | 3 ++-
libavformat/iamf_reader.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 57ccf1c199..3486104aba 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -534,7 +534,8 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
if (constant_subblock_duration == 0) {
subblock_duration = ffio_read_leb(pb);
total_duration += subblock_duration;
- }
+ } else if (i == nb_subblocks - 1)
+ subblock_duration = duration - i * constant_subblock_duration;
switch (type) {
case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: {
diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c
index 7ad61cb246..9f3469b64f 100644
--- a/libavformat/iamf_reader.c
+++ b/libavformat/iamf_reader.c
@@ -178,7 +178,8 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c,
if (!param_definition->mode && !constant_subblock_duration) {
subblock_duration = ffio_read_leb(pb);
total_duration += subblock_duration;
- }
+ } else if (i == nb_subblocks - 1)
+ subblock_duration = duration - i * constant_subblock_duration;
switch (param->type) {
case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: {
--
2.49.1
From b168ed9b146337e7bd3c218c5d1c0f7e88bf1315 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 11 Dec 2024 13:30:23 -0300
Subject: [PATCH 080/434] avformat/iamf_writer: fix setting
num_samples_per_frame for OPUS
As per section 3.11.1 of the IAMF spec, the sample rate used in Codec Config
for Opus shall be 48kHz, regardless of the original sample rate used during
encoding.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 76049d1c4564a6a03c467b1f9b0bc853bc971769)
---
libavformat/iamf_writer.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c
index 1b620c38ee..0508c676d1 100644
--- a/libavformat/iamf_writer.c
+++ b/libavformat/iamf_writer.c
@@ -112,9 +112,17 @@ static int fill_codec_config(IAMFContext *iamf, const AVStreamGroup *stg,
int j, ret = 0;
codec_config->codec_id = st->codecpar->codec_id;
- codec_config->sample_rate = st->codecpar->sample_rate;
codec_config->codec_tag = st->codecpar->codec_tag;
- codec_config->nb_samples = st->codecpar->frame_size;
+ switch (codec_config->codec_id) {
+ case AV_CODEC_ID_OPUS:
+ codec_config->sample_rate = 48000;
+ codec_config->nb_samples = av_rescale(st->codecpar->frame_size, 48000, st->codecpar->sample_rate);
+ break;
+ default:
+ codec_config->sample_rate = st->codecpar->sample_rate;
+ codec_config->nb_samples = st->codecpar->frame_size;
+ break;
+ }
populate_audio_roll_distance(codec_config);
if (st->codecpar->extradata_size) {
codec_config->extradata = av_memdup(st->codecpar->extradata, st->codecpar->extradata_size);
@@ -183,9 +191,9 @@ static int add_param_definition(IAMFContext *iamf, AVIAMFParamDefinition *param,
}
if (codec_config) {
if (!param->duration)
- param->duration = codec_config->nb_samples;
+ param->duration = av_rescale(codec_config->nb_samples, param->parameter_rate, codec_config->sample_rate);
if (!param->constant_subblock_duration)
- param->constant_subblock_duration = codec_config->nb_samples;
+ param->constant_subblock_duration = av_rescale(codec_config->nb_samples, param->parameter_rate, codec_config->sample_rate);
}
param_definition = av_mallocz(sizeof(*param_definition));
--
2.49.1
From 4f5769e0526252fb80c3c5a1d46d0ea414643fd6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 27 Dec 2024 16:17:51 -0300
Subject: [PATCH 081/434] avformat/iamf_writer: ensure the stream groups are
not empty
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit cedd9151f863e3db9c325aff2f9375c39adbbec2)
---
libavformat/iamf_writer.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c
index 0508c676d1..27926f859a 100644
--- a/libavformat/iamf_writer.c
+++ b/libavformat/iamf_writer.c
@@ -217,6 +217,10 @@ int ff_iamf_add_audio_element(IAMFContext *iamf, const AVStreamGroup *stg, void
if (stg->type != AV_STREAM_GROUP_PARAMS_IAMF_AUDIO_ELEMENT)
return AVERROR(EINVAL);
+ if (!stg->nb_streams) {
+ av_log(log_ctx, AV_LOG_ERROR, "Audio Element id %"PRId64" has no streams\n", stg->id);
+ return AVERROR(EINVAL);
+ }
iamf_audio_element = stg->params.iamf_audio_element;
if (iamf_audio_element->audio_element_type == AV_IAMF_AUDIO_ELEMENT_TYPE_SCENE) {
@@ -381,6 +385,10 @@ int ff_iamf_add_mix_presentation(IAMFContext *iamf, const AVStreamGroup *stg, vo
if (stg->type != AV_STREAM_GROUP_PARAMS_IAMF_MIX_PRESENTATION)
return AVERROR(EINVAL);
+ if (!stg->nb_streams) {
+ av_log(log_ctx, AV_LOG_ERROR, "Mix Presentation id %"PRId64" has no streams\n", stg->id);
+ return AVERROR(EINVAL);
+ }
for (int i = 0; i < iamf->nb_mix_presentations; i++) {
if (stg->id == iamf->mix_presentations[i]->mix_presentation_id) {
--
2.49.1
From be26ee23abb4f0fd4784eb556db9329e067e96b6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 27 Dec 2024 19:11:47 -0300
Subject: [PATCH 082/434] avcodec/libdav1d: clear the buffered Dav1dData on
decoding failure
Should ensure avcodec_send_packet() doesn't return EAGAIN in scenarios where it's not
meant to (e.g., ffmpeg_dec.c where avcodec_receive_frame() is called in a loop to drain
all produced frames before trying to submit more packets).
Fixes ticket #11377.
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d1d9b0813a2a7e304cc29dba3b1380857d0f9816)
---
libavcodec/libdav1d.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c
index 546b42e9c6..ff67f44bd3 100644
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -372,9 +372,10 @@ static int libdav1d_receive_frame_internal(AVCodecContext *c, Dav1dPicture *p)
res = dav1d_get_picture(dav1d->c, p);
if (res < 0) {
- if (res == AVERROR(EINVAL))
+ if (res == AVERROR(EINVAL)) {
+ dav1d_data_unref(data);
res = AVERROR_INVALIDDATA;
- else if (res == AVERROR(EAGAIN))
+ } else if (res == AVERROR(EAGAIN))
res = c->internal->draining ? AVERROR_EOF : 1;
}
--
2.49.1
From 145a3a84550a1c3a3b848c12a64b53c3c41d2888 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 30 Dec 2024 00:25:41 -0300
Subject: [PATCH 083/434] avfilter/buffersrc: check for valid sample rate
A sample rate <= 0 is invalid.
Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
Fixes ticket #11385.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1446e37d3d032e1452844778b3e6ba2c20f0c322)
---
libavfilter/buffersrc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c
index b5682006f0..ec5898fcf9 100644
--- a/libavfilter/buffersrc.c
+++ b/libavfilter/buffersrc.c
@@ -414,6 +414,11 @@ static av_cold int init_audio(AVFilterContext *ctx)
av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf));
}
+ if (s->sample_rate <= 0) {
+ av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n");
+ return AVERROR(EINVAL);
+ }
+
if (!s->time_base.num)
s->time_base = (AVRational){1, s->sample_rate};
--
2.49.1
From e4538bc88825583cca9163ef1cd61b6d069a7a81 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 30 Sep 2024 23:42:50 +0200
Subject: [PATCH 084/434] avcodec/ffv1enc: 2Pass mode is not possible with
golomb coding
"Fixes" Ticket7063
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 417b163c00555ccda201a963e797bfa663a26ff5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index a6f405289e..3222496dac 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -528,6 +528,11 @@ static av_cold int encode_init(AVCodecContext *avctx)
avctx->slices > 1)
s->version = FFMAX(s->version, 2);
+ if ((avctx->flags & (AV_CODEC_FLAG_PASS1 | AV_CODEC_FLAG_PASS2)) && s->ac == AC_GOLOMB_RICE) {
+ av_log(avctx, AV_LOG_ERROR, "2 Pass mode is not possible with golomb coding\n");
+ return AVERROR(EINVAL);
+ }
+
// Unspecified level & slices, we choose version 1.2+ to ensure multithreaded decodability
if (avctx->slices == 0 && avctx->level < 0 && avctx->width * avctx->height > 720*576)
s->version = FFMAX(s->version, 2);
--
2.49.1
From 811fce437ecc1dbd92b46691d1fde8dc4609a7df Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 6 Oct 2023 22:23:33 +0200
Subject: [PATCH 085/434] avcodec/ffv1enc: Slice combination is unsupported
We always write minimal slices, the size calculation is wrong in some
corner cases but as its always 1x1 (minus1) we can for now just hard-code it
This helps with ticket 5548
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d514655bfa47c6e5cc1b81fbba8e750e368036e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 3222496dac..a216fb04c7 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -925,8 +925,8 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc)
put_symbol(c, state, (sc->slice_x +1)*f->num_h_slices / f->width , 0);
put_symbol(c, state, (sc->slice_y +1)*f->num_v_slices / f->height , 0);
- put_symbol(c, state, (sc->slice_width +1)*f->num_h_slices / f->width -1, 0);
- put_symbol(c, state, (sc->slice_height+1)*f->num_v_slices / f->height-1, 0);
+ put_symbol(c, state, 0, 0);
+ put_symbol(c, state, 0, 0);
for (j=0; j<f->plane_count; j++) {
put_symbol(c, state, sc->plane[j].quant_table_index, 0);
av_assert0(sc->plane[j].quant_table_index == f->context_model);
--
2.49.1
From 76ddc3f1e1e6a4cef8a7d04697c4b7f0d9cfe7d9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 7 Oct 2023 01:43:42 +0200
Subject: [PATCH 086/434] avcodec/ffv1: Store and reuse sx/sy
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7151081e33425010a53c7573e84b274c68ad8087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1.c | 2 ++
libavcodec/ffv1.h | 1 +
libavcodec/ffv1enc.c | 4 ++--
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index 333fb3d79b..56a36e479f 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -144,6 +144,8 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
sc->slice_height = sye - sys;
sc->slice_x = sxs;
sc->slice_y = sys;
+ sc->sx = sx;
+ sc->sy = sy;
sc->sample_buffer = av_malloc_array((f->width + 6), 3 * MAX_PLANES *
sizeof(*sc->sample_buffer));
diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h
index 9aa0452922..a35197964e 100644
--- a/libavcodec/ffv1.h
+++ b/libavcodec/ffv1.h
@@ -75,6 +75,7 @@ typedef struct FFV1SliceContext {
int slice_height;
int slice_x;
int slice_y;
+ int sx, sy;
int run_index;
int slice_coding_mode;
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index a216fb04c7..266ef13b24 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -923,8 +923,8 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc)
int j;
memset(state, 128, sizeof(state));
- put_symbol(c, state, (sc->slice_x +1)*f->num_h_slices / f->width , 0);
- put_symbol(c, state, (sc->slice_y +1)*f->num_v_slices / f->height , 0);
+ put_symbol(c, state, sc->sx, 0);
+ put_symbol(c, state, sc->sy, 0);
put_symbol(c, state, 0, 0);
put_symbol(c, state, 0, 0);
for (j=0; j<f->plane_count; j++) {
--
2.49.1
From 3f76a333172cc25277fe0859b487743a2fbabd61 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 1 Oct 2024 22:04:58 +0200
Subject: [PATCH 087/434] avcodec/ffv1enc: Correct error message about
unsupported version
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 556c767786e9e3c072f7666d60a68a31a3400438)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 266ef13b24..94d9830e07 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -557,7 +557,7 @@ static av_cold int encode_init(AVCodecContext *avctx)
s->version = FFMAX(s->version, 3);
if ((s->version == 2 || s->version>3) && avctx->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) {
- av_log(avctx, AV_LOG_ERROR, "Version 2 needed for requested features but version 2 is experimental and not enabled\n");
+ av_log(avctx, AV_LOG_ERROR, "Version 2 or 4 needed for requested features but version 2 or 4 is experimental and not enabled\n");
return AVERROR_INVALIDDATA;
}
--
2.49.1
From ba89c5d1ebc6f45068405ba578a86a325020c5f3 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 28 Jul 2024 20:53:49 +0200
Subject: [PATCH 088/434] avformat/mov: Avoid overflow in dts
This basically ignores the overflow without undefined behavior, alternatively we could detect and error out
Fixes: signed integer overflow: 6310596683470275584 + 7660622966157213696 cannot be represented in type 'long'
Fixes: 70433/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5483347233538048
Fixes: 369662284/clusterfuzz-testcase-minimized-media_metadata_parser_fuzzer-5327368763670528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 057b8c2066da3554072565744f4f00435cc3342b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 9a9a2414e7..fee1a9ad32 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3537,10 +3537,10 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
sc->stts_data[i].duration = 1;
corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count;
} else {
- corrected_dts += sample_duration * (int64_t)sample_count;
+ corrected_dts += sample_duration * (uint64_t)sample_count;
}
- current_dts += sc->stts_data[i].duration * (int64_t)sample_count;
+ current_dts += sc->stts_data[i].duration * (uint64_t)sample_count;
if (current_dts > corrected_dts) {
int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1);
--
2.49.1
From 631976108ca815d921f13dfc056e620835af70ef Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 28 Jul 2024 22:08:23 +0200
Subject: [PATCH 089/434] avformat/matroskadec: Check desc_bytes so bits fit in
64bit
Likely a tighter check can be done
Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long'
Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4122406f6d2726aea833480a2a8e345833dd881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/matroskadec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index a2947c97e7..0e150f9138 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4633,7 +4633,7 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset;
int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns;
double desc_sec, calc_bits_per_second, percent, mod_bits_per_second;
- if (desc_bytes <= 0)
+ if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8)
return -1;
desc_sec = desc_ns / nano_seconds_per_second;
--
2.49.1
From d870febf88c749e88fcc9b2276e9a16305c486bd Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 1 Oct 2024 22:06:40 +0200
Subject: [PATCH 090/434] avcodec/ffv1enc: Prevent generation of files with
broken slices
Fixes: Ticket5548
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7ff66a35804275b25c1176cad560540785e8750)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1.c | 7 +++++++
libavcodec/ffv1.h | 1 +
libavcodec/ffv1enc.c | 4 ++++
3 files changed, 12 insertions(+)
diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index 56a36e479f..2b8564c2f5 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -119,6 +119,13 @@ av_cold int ff_ffv1_init_slices_state(FFV1Context *f)
return 0;
}
+int ff_need_new_slices(int width, int num_h_slices, int chroma_shift) {
+ int mpw = 1<<chroma_shift;
+ int i = width * (int64_t)(num_h_slices - 1) / num_h_slices;
+
+ return width % mpw && (width - i) % mpw == 0;
+}
+
av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
{
int max_slice_count = f->num_h_slices * f->num_v_slices;
diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h
index a35197964e..e19c0df014 100644
--- a/libavcodec/ffv1.h
+++ b/libavcodec/ffv1.h
@@ -171,6 +171,7 @@ PlaneContext *ff_ffv1_planes_alloc(void);
int ff_ffv1_allocate_initial_states(FFV1Context *f);
void ff_ffv1_clear_slice_state(const FFV1Context *f, FFV1SliceContext *sc);
int ff_ffv1_close(AVCodecContext *avctx);
+int ff_need_new_slices(int width, int num_h_slices, int chroma_shift);
static av_always_inline int fold(int diff, int bits)
{
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 94d9830e07..56af7dc427 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -865,6 +865,10 @@ static av_cold int encode_init(AVCodecContext *avctx)
continue;
if (maxw * maxh * (int64_t)(s->bits_per_raw_sample+1) * plane_count > 8<<24)
continue;
+ if (s->version < 4)
+ if ( ff_need_new_slices(avctx->width , s->num_h_slices, s->chroma_h_shift)
+ ||ff_need_new_slices(avctx->height, s->num_v_slices, s->chroma_v_shift))
+ continue;
if (avctx->slices == s->num_h_slices * s->num_v_slices && avctx->slices <= MAX_SLICES || !avctx->slices)
goto slices_ok;
}
--
2.49.1
From 2a39eeb8deb3d46c75dea8250df8a70d2630dd32 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 10 Oct 2024 19:57:07 +0200
Subject: [PATCH 091/434] avcodec/ffv1enc: Move slice termination into threads
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e52b1525831987bcc389c89ccf53a76e7177fe1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 56af7dc427..96beb86cfa 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -1097,6 +1097,13 @@ retry:
ret = encode_rgb_frame(f, sc, planes, width, height, p->linesize);
}
+ if (f->ac != AC_GOLOMB_RICE) {
+ sc->ac_byte_count = ff_rac_terminate(&sc->c, 1);
+ } else {
+ flush_put_bits(&sc->pb); // FIXME: nicer padding
+ sc->ac_byte_count += put_bytes_output(&sc->pb);
+ }
+
if (ret < 0) {
av_assert0(sc->slice_coding_mode == 0);
if (f->version < 4 || !f->ac) {
@@ -1221,14 +1228,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
buf_p = pkt->data;
for (i = 0; i < f->slice_count; i++) {
FFV1SliceContext *sc = &f->slices[i];
- int bytes;
-
- if (f->ac != AC_GOLOMB_RICE) {
- bytes = ff_rac_terminate(&sc->c, 1);
- } else {
- flush_put_bits(&sc->pb); // FIXME: nicer padding
- bytes = sc->ac_byte_count + put_bytes_output(&sc->pb);
- }
+ int bytes = sc->ac_byte_count;
if (i > 0 || f->version > 2) {
av_assert0(bytes < pkt->size / f->slice_count);
memmove(buf_p, sc->c.bytestream_start, bytes);
--
2.49.1
From 26fc4bf42c19bcf1772516fc1a742fbf6e426ea4 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 10 Oct 2024 20:39:23 +0200
Subject: [PATCH 092/434] avcodec/ffv1dec: Fix end computation with ec=2
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10e5af15bf220d9da128ca12d2d474ff6ab0076e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 415c66be63..44b2085f78 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -347,7 +347,7 @@ static int decode_slice(AVCodecContext *c, void *arg)
if (f->ac != AC_GOLOMB_RICE && f->version > 2) {
int v;
get_rac(&sc->c, (uint8_t[]) { 129 });
- v = sc->c.bytestream_end - sc->c.bytestream - 2 - 5*f->ec;
+ v = sc->c.bytestream_end - sc->c.bytestream - 2 - 5*!!f->ec;
if (v) {
av_log(f->avctx, AV_LOG_ERROR, "bytestream end mismatching by %d\n", v);
slice_set_damaged(f, sc);
--
2.49.1
From 4ca3f5102f5d99b1d52b909b3d5d9b2d33c84d6b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 10 Oct 2024 22:14:41 +0200
Subject: [PATCH 093/434] avcodec/ffv1enc: Fix RCT with RGB64
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1edec3a24306f8fa31bebe67644183741cbf0e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 96beb86cfa..3e8f6ee445 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -980,6 +980,9 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc,
int x, y, i, p, best;
int16_t *sample[3];
int lbd = f->bits_per_raw_sample <= 8;
+ int packed = !src[1];
+ int transparency = f->transparency;
+ int packed_size = (3 + transparency)*2;
for (y = 0; y < h; y++) {
int lastr=0, lastg=0, lastb=0;
@@ -994,6 +997,11 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc,
b = v & 0xFF;
g = (v >> 8) & 0xFF;
r = (v >> 16) & 0xFF;
+ } else if (packed) {
+ const uint16_t *p = ((const uint16_t*)(src[0] + x*packed_size + stride[0]*y));
+ r = p[0];
+ g = p[1];
+ b = p[2];
} else {
b = *((const uint16_t*)(src[0] + x*2 + stride[0]*y));
g = *((const uint16_t*)(src[1] + x*2 + stride[1]*y));
--
2.49.1
From 7043ef6828548c64b8e75baa1f6d9ce6fa052a72 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 3 Oct 2024 01:49:09 +0200
Subject: [PATCH 094/434] avcodec/ffv1: RCT is only possible with RGB
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2542e9296c76524494a2d17a4423d756560b5273)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 2 +-
libavcodec/ffv1enc.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 44b2085f78..79374658ec 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -241,7 +241,7 @@ static int decode_slice_header(const FFV1Context *f,
if (f->version > 3) {
sc->slice_reset_contexts = get_rac(c, state);
sc->slice_coding_mode = get_symbol(c, state, 0);
- if (sc->slice_coding_mode != 1) {
+ if (sc->slice_coding_mode != 1 && f->colorspace == 1) {
sc->slice_rct_by_coef = get_symbol(c, state, 0);
sc->slice_rct_ry_coef = get_symbol(c, state, 0);
if ((uint64_t)sc->slice_rct_by_coef + (uint64_t)sc->slice_rct_ry_coef > 4) {
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 3e8f6ee445..8e436358ed 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -946,7 +946,7 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc)
if (sc->slice_coding_mode == 1)
ff_ffv1_clear_slice_state(f, sc);
put_symbol(c, state, sc->slice_coding_mode, 0);
- if (sc->slice_coding_mode != 1) {
+ if (sc->slice_coding_mode != 1 && f->colorspace == 1) {
put_symbol(c, state, sc->slice_rct_by_coef, 0);
put_symbol(c, state, sc->slice_rct_ry_coef, 0);
}
@@ -1062,7 +1062,7 @@ static int encode_slice(AVCodecContext *c, void *arg)
p->data[3] ? p->data[3] + ps*x + y*p->linesize[3] : NULL};
sc->slice_coding_mode = 0;
- if (f->version > 3) {
+ if (f->version > 3 && f->colorspace == 1) {
choose_rct_params(f, sc, planes, p->linesize, width, height);
} else {
sc->slice_rct_by_coef = 1;
--
2.49.1
From 9f8bd56e4f57115ef2650974ffe4d7d997788b1b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 15 Oct 2024 22:39:58 +0200
Subject: [PATCH 095/434] avcodec/ffv1: add a named constant for the quant
table size
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 81a360a5ed9e7dcc841e791c2779f09cbd99b5d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1.h | 4 +++-
libavcodec/ffv1_template.c | 18 +++++++++---------
libavcodec/ffv1enc.c | 6 +++---
3 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h
index e19c0df014..5c14907715 100644
--- a/libavcodec/ffv1.h
+++ b/libavcodec/ffv1.h
@@ -44,6 +44,8 @@
#define CONTEXT_SIZE 32
#define MAX_QUANT_TABLES 8
+#define MAX_QUANT_TABLE_SIZE 256
+#define MAX_QUANT_TABLE_MASK (MAX_QUANT_TABLE_SIZE - 1)
#define MAX_CONTEXT_INPUTS 5
#define AC_GOLOMB_RICE 0
@@ -123,7 +125,7 @@ typedef struct FFV1Context {
const AVFrame *cur_enc_frame;
int plane_count;
int ac; ///< 1=range coder <-> 0=golomb rice
- int16_t quant_tables[MAX_QUANT_TABLES][MAX_CONTEXT_INPUTS][256];
+ int16_t quant_tables[MAX_QUANT_TABLES][MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE];
int context_count[MAX_QUANT_TABLES];
uint8_t state_transition[256];
uint8_t (*initial_states[MAX_QUANT_TABLES])[32];
diff --git a/libavcodec/ffv1_template.c b/libavcodec/ffv1_template.c
index d15ad11021..abb90a12e4 100644
--- a/libavcodec/ffv1_template.c
+++ b/libavcodec/ffv1_template.c
@@ -29,7 +29,7 @@ static inline int RENAME(predict)(TYPE *src, TYPE *last)
return mid_pred(L, L + T - LT, T);
}
-static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPUTS][256],
+static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE],
TYPE *src, TYPE *last, TYPE *last2)
{
const int LT = last[-1];
@@ -40,14 +40,14 @@ static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPU
if (quant_table[3][127] || quant_table[4][127]) {
const int TT = last2[0];
const int LL = src[-2];
- return quant_table[0][(L - LT) & 0xFF] +
- quant_table[1][(LT - T) & 0xFF] +
- quant_table[2][(T - RT) & 0xFF] +
- quant_table[3][(LL - L) & 0xFF] +
- quant_table[4][(TT - T) & 0xFF];
+ return quant_table[0][(L - LT) & MAX_QUANT_TABLE_MASK] +
+ quant_table[1][(LT - T) & MAX_QUANT_TABLE_MASK] +
+ quant_table[2][(T - RT) & MAX_QUANT_TABLE_MASK] +
+ quant_table[3][(LL - L) & MAX_QUANT_TABLE_MASK] +
+ quant_table[4][(TT - T) & MAX_QUANT_TABLE_MASK];
} else
- return quant_table[0][(L - LT) & 0xFF] +
- quant_table[1][(LT - T) & 0xFF] +
- quant_table[2][(T - RT) & 0xFF];
+ return quant_table[0][(L - LT) & MAX_QUANT_TABLE_MASK] +
+ quant_table[1][(LT - T) & MAX_QUANT_TABLE_MASK] +
+ quant_table[2][(T - RT) & MAX_QUANT_TABLE_MASK];
}
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 8e436358ed..7dcecb5905 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -317,7 +317,7 @@ static void write_quant_table(RangeCoder *c, int16_t *quant_table)
uint8_t state[CONTEXT_SIZE];
memset(state, 128, sizeof(state));
- for (i = 1; i < 128; i++)
+ for (i = 1; i < MAX_QUANT_TABLE_SIZE/2; i++)
if (quant_table[i] != quant_table[i - 1]) {
put_symbol(c, state, i - last - 1, 0);
last = i;
@@ -326,7 +326,7 @@ static void write_quant_table(RangeCoder *c, int16_t *quant_table)
}
static void write_quant_tables(RangeCoder *c,
- int16_t quant_table[MAX_CONTEXT_INPUTS][256])
+ int16_t quant_table[MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE])
{
int i;
for (i = 0; i < 5; i++)
@@ -718,7 +718,7 @@ static av_cold int encode_init(AVCodecContext *avctx)
s->state_transition[i] = c.one_state[i];
}
- for (i = 0; i < 256; i++) {
+ for (i = 0; i < MAX_QUANT_TABLE_SIZE; i++) {
s->quant_table_count = 2;
if (s->bits_per_raw_sample <= 8) {
s->quant_tables[0][0][i]= quant11[i];
--
2.49.1
From a2666675bf74869233df6222bfb58d4e6c9e3af4 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 16 Oct 2024 14:39:20 +0200
Subject: [PATCH 096/434] avcodec/rangecoder: only perform renorm check/loop
for callers that need it
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d147b3d7ecba2bd40cb45284f920238da97a95ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/rangecoder.h | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/libavcodec/rangecoder.h b/libavcodec/rangecoder.h
index 89d178ac31..110908d6bd 100644
--- a/libavcodec/rangecoder.h
+++ b/libavcodec/rangecoder.h
@@ -62,7 +62,6 @@ void ff_build_rac_states(RangeCoder *c, int factor, int max_p);
static inline void renorm_encoder(RangeCoder *c)
{
// FIXME: optimize
- while (c->range < 0x100) {
if (c->outstanding_byte < 0) {
c->outstanding_byte = c->low >> 8;
} else if (c->low <= 0xFF00) {
@@ -81,7 +80,6 @@ static inline void renorm_encoder(RangeCoder *c)
c->low = (c->low & 0xFF) << 8;
c->range <<= 8;
- }
}
static inline int get_rac_count(RangeCoder *c)
@@ -108,7 +106,8 @@ static inline void put_rac(RangeCoder *c, uint8_t *const state, int bit)
*state = c->one_state[*state];
}
- renorm_encoder(c);
+ while (c->range < 0x100)
+ renorm_encoder(c);
}
static inline void refill(RangeCoder *c)
--
2.49.1
From 2ab2803944ca2aebdffde8555e49d8b266f5b918 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 9 Oct 2024 18:59:19 +0200
Subject: [PATCH 097/434] swscale/rgb2rgb_template: Fix ff_rgb24toyv12_c() with
odd height
Fixes: out of array access
Fixes: 368143798/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6475823425585152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 14f5d67be38dcdf04932e557b7f25975fc91c851)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/rgb2rgb_template.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libswscale/rgb2rgb_template.c b/libswscale/rgb2rgb_template.c
index 32d90d44fe..d4204153db 100644
--- a/libswscale/rgb2rgb_template.c
+++ b/libswscale/rgb2rgb_template.c
@@ -640,7 +640,7 @@ static inline void uyvytoyv12_c(const uint8_t *src, uint8_t *ydst,
}
/**
- * Height should be a multiple of 2 and width should be a multiple of 2.
+ * width should be a multiple of 2.
* (If this is a problem for anyone then tell me, and I will fix it.)
*/
void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst,
@@ -659,6 +659,11 @@ void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst,
for (y = 0; y < height; y += 2) {
int i;
+ if (y + 1 == height) {
+ ydst2 = ydst1;
+ src2 = src1;
+ }
+
for (i = 0; i < chromWidth; i++) {
unsigned int b11 = src1[6 * i + 0];
unsigned int g11 = src1[6 * i + 1];
--
2.49.1
From 562af93025dcbded930e02db6c427bcfbfa59356 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 9 Oct 2024 20:39:07 +0200
Subject: [PATCH 098/434] swscale/output: used unsigned for bit accumulation
Fixes: Integer overflow
Fixes: 368725672/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5009093023563776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fe3014405494503a03c2e6eff4743db91a21c00)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/output.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/libswscale/output.c b/libswscale/output.c
index 31921a3cce..ae9a50637a 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -664,7 +664,7 @@ yuv2mono_2_c_template(SwsContext *c, const int16_t *buf[2],
if (c->dither == SWS_DITHER_ED) {
int err = 0;
- int acc = 0;
+ unsigned acc = 0;
for (i = 0; i < dstW; i +=2) {
int Y;
@@ -686,7 +686,8 @@ yuv2mono_2_c_template(SwsContext *c, const int16_t *buf[2],
c->dither_error[0][i] = err;
} else {
for (i = 0; i < dstW; i += 8) {
- int Y, acc = 0;
+ int Y;
+ unsigned acc = 0;
Y = (buf0[i + 0] * yalpha1 + buf1[i + 0] * yalpha) >> 19;
accumulate_bit(acc, Y + d128[0]);
@@ -721,7 +722,7 @@ yuv2mono_1_c_template(SwsContext *c, const int16_t *buf0,
if (c->dither == SWS_DITHER_ED) {
int err = 0;
- int acc = 0;
+ unsigned acc = 0;
for (i = 0; i < dstW; i +=2) {
int Y;
@@ -743,7 +744,7 @@ yuv2mono_1_c_template(SwsContext *c, const int16_t *buf0,
c->dither_error[0][i] = err;
} else {
for (i = 0; i < dstW; i += 8) {
- int acc = 0;
+ unsigned acc = 0;
accumulate_bit(acc, ((buf0[i + 0] + 64) >> 7) + d128[0]);
accumulate_bit(acc, ((buf0[i + 1] + 64) >> 7) + d128[1]);
accumulate_bit(acc, ((buf0[i + 2] + 64) >> 7) + d128[2]);
--
2.49.1
From 6b0204781126b3f62a64e9b6896d04dd56f91c34 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 9 Oct 2024 20:47:34 +0200
Subject: [PATCH 099/434] avformat/mxfdec: Fix overflow in midpoint computation
Fixes: signed integer overflow: 4611686016549392399 + 9223372033098784800 cannot be represented in type 'long long'
Fixes: 368503277/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5928227458056192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23088a5ff2b549fa4fc037bb9ed833fffbc89ca0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 24f4ed1c33..2f8ab3890d 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -3832,7 +3832,7 @@ static int mxf_get_next_track_edit_unit(MXFContext *mxf, MXFTrack *track, int64_
a = -1;
b = track->original_duration;
while (b - 1 > a) {
- m = (a + b) >> 1;
+ m = (a + (uint64_t)b) >> 1;
if (mxf_edit_unit_absolute_offset(mxf, t, m, track->edit_rate, NULL, &offset, NULL, 0) < 0)
return -1;
if (offset < current_offset)
--
2.49.1
From 0288fedf181578970f9344eda0e66da9e030dc64 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 9 Oct 2024 23:44:00 +0200
Subject: [PATCH 100/434] avformat/mpegts: Initialize
predefined_SLConfigDescriptor_seen
Fixes: use of uninitialized variable
Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db7b4fc89fb18d5ff0a1426bd433c234555a3fff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mpegts.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 04565a2011..86b7c8e041 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -1672,6 +1672,8 @@ static int mp4_read_iods(AVFormatContext *s, const uint8_t *buf, unsigned size,
MP4DescrParseContext d;
int ret;
+ d.predefined_SLConfigDescriptor_seen = 0;
+
ret = init_MP4DescrParseContext(&d, s, buf, size, descr, max_descr_count);
if (ret < 0)
return ret;
--
2.49.1
From ded98a0919a09a7fa87763ceefc4468e6dbf5b50 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 2 Nov 2024 18:23:50 +0100
Subject: [PATCH 101/434] INSTALL: explain the circular dependency issue and
solution
Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df00705e0010cc2c53d17d51944f847c2c852189)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
INSTALL.md | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/INSTALL.md b/INSTALL.md
index 3b220bc6ff..bdf5814014 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -15,3 +15,11 @@ NOTICE
------
- Non system dependencies (e.g. libx264, libvpx) are disabled by default.
+
+NOTICE for Package Maintainers
+------------------------------
+
+ - It is recommended to build FFmpeg twice, first with minimal external dependencies so
+ that 3rd party packages, which depend on FFmpegs libavutil/libavfilter/libavcodec/libavformat
+ can then be built. And last build FFmpeg with full dependancies (which may in turn depend on
+ some of these 3rd party packages). This avoids circular dependencies during build.
--
2.49.1
From 241e87afa4c5bd70c3f360afa7425623d4d2218f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 20:08:07 +0100
Subject: [PATCH 102/434] avformat/rpl: check channels
Fixes: 42537199/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5447162658357248
Fixes: runtime error: signed integer overflow: -3330498059201358222 * 4 cannot be represented in type 'int64_t' (aka 'long')
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit beca13a42e9fb5341e8bd6356fd7d9c2d18aac9b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rpl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/rpl.c b/libavformat/rpl.c
index 32a762b60a..e971d0588f 100644
--- a/libavformat/rpl.c
+++ b/libavformat/rpl.c
@@ -205,6 +205,8 @@ static int rpl_read_header(AVFormatContext *s)
if (ast->codecpar->sample_rate < 0)
return AVERROR_INVALIDDATA;
channels = read_line_and_int(pb, &error); // number of audio channels
+ if (channels <= 0)
+ return AVERROR_INVALIDDATA;
error |= read_line(pb, line, sizeof(line));
ast->codecpar->bits_per_coded_sample = read_int(line, &endptr, &error); // audio bits per sample
av_strlcpy(audio_type, endptr, RPL_LINE_LENGTH);
--
2.49.1
From e2394166bfa981bdf02f02605dd76888e6932fbf Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 20:18:36 +0100
Subject: [PATCH 103/434] avformat/mccdec: Initialize and check rate.den
Fixes: Assertion c > 0 failed at libavutil/mathematics.c:61
Fixes: use-of-uninitialized-value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-5939605805793280
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf8e43083f68c383b9d905d2c8c791ac33ecc7bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mccdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/mccdec.c b/libavformat/mccdec.c
index 85bf93cd3b..8c0ea09b6b 100644
--- a/libavformat/mccdec.c
+++ b/libavformat/mccdec.c
@@ -93,7 +93,7 @@ static int mcc_read_header(AVFormatContext *s)
{
MCCContext *mcc = s->priv_data;
AVStream *st = avformat_new_stream(s, NULL);
- AVRational rate;
+ AVRational rate = {0};
int64_t ts, pos;
uint8_t out[4096];
char line[4096];
@@ -139,7 +139,7 @@ static int mcc_read_header(AVFormatContext *s)
continue;
}
- if (av_sscanf(line, "%d:%d:%d:%d", &hh, &mm, &ss, &fs) != 4)
+ if (av_sscanf(line, "%d:%d:%d:%d", &hh, &mm, &ss, &fs) != 4 || rate.den <= 0)
continue;
ts = av_sat_add64(av_rescale(hh * 3600LL + mm * 60LL + ss, rate.num, rate.den), fs);
--
2.49.1
From 1f1b309f9e18009f5957e69bf3575a8b93d9c1a8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 20:43:21 +0100
Subject: [PATCH 104/434] avformat/nistspheredec: Clear buffer
Fixes: use-of-uninitialized-value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 898f6582eb51bf77b1f88e8f55eab67ee6ee13b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/nistspheredec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/nistspheredec.c b/libavformat/nistspheredec.c
index 1e6c567e01..e624036149 100644
--- a/libavformat/nistspheredec.c
+++ b/libavformat/nistspheredec.c
@@ -35,7 +35,7 @@ static int nist_probe(const AVProbeData *p)
static int nist_read_header(AVFormatContext *s)
{
- char buffer[256], coding[32] = "pcm", format[32] = "01";
+ char buffer[256]= {0}, coding[32] = "pcm", format[32] = "01";
int bps = 0, be = 0;
int32_t header_size = -1;
AVStream *st;
--
2.49.1
From 445065e23a7aa9aa9fb1be705a253993479c089a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 20:47:07 +0100
Subject: [PATCH 105/434] avformat/ilbc: Check avio_read() for failure
Fixes: use of uninitialized value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e30d957a9bacf7f7307c640aa0bd1e70cb3bbe7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/ilbc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/ilbc.c b/libavformat/ilbc.c
index a24aa3da9d..6c441c21bf 100644
--- a/libavformat/ilbc.c
+++ b/libavformat/ilbc.c
@@ -61,7 +61,8 @@ static int ilbc_read_header(AVFormatContext *s)
AVStream *st;
uint8_t header[9];
- avio_read(pb, header, 9);
+ if (avio_read(pb, header, 9) != 9)
+ return AVERROR_INVALIDDATA;
st = avformat_new_stream(s, NULL);
if (!st)
--
2.49.1
From c7aa0c4ecd28590844ea5ca572391f909492ff19 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 20:54:29 +0100
Subject: [PATCH 106/434] avformat/vividas: Check avio_read() for failure
Fixes: use of uninitialized value (untested)
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5505802505355264
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96d45c3b212689f82bff2530c3637405df9e9369)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/vividas.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index 130b81ebbe..bec4ad7cec 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -567,7 +567,8 @@ static int viv_read_header(AVFormatContext *s)
v = avio_r8(pb);
avio_seek(pb, v, SEEK_CUR);
- avio_read(pb, keybuffer, 187);
+ if (avio_read(pb, keybuffer, 187) != 187)
+ return AVERROR_INVALIDDATA;
key = decode_key(keybuffer);
viv->sb_key = key;
--
2.49.1
From 4930dd91c6b4d47530ba3f16cc447687850b6ac7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 13 Nov 2024 19:28:15 +0100
Subject: [PATCH 107/434] doc/infra: Document gitolite
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07904231cb9730e09e2b7948e3977e7c2eafbb10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/infra.txt | 3 +++
1 file changed, 3 insertions(+)
diff --git a/doc/infra.txt b/doc/infra.txt
index 30a85dd5ce..aea3e93e13 100644
--- a/doc/infra.txt
+++ b/doc/infra.txt
@@ -65,6 +65,9 @@ Github mirrors are redundantly synced by multiple people
You need a new git repository related to FFmpeg ? contact root at ffmpeg.org
+git repositories are managed by gitolite, every change to permissions is
+logged, including when, what and by whom
+
Fate:
~~~~~
--
2.49.1
From f9901306ba433ad668fd72826eaa2b5c0065bbab Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 19 Nov 2024 23:18:31 +0100
Subject: [PATCH 108/434] doc/infra: Document trac backup system
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit edc4855f7710c4563e7cd5773598f8341f64e019)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/infra.txt | 2 ++
1 file changed, 2 insertions(+)
diff --git a/doc/infra.txt b/doc/infra.txt
index aea3e93e13..79d4e56719 100644
--- a/doc/infra.txt
+++ b/doc/infra.txt
@@ -23,6 +23,8 @@ Web, mail, and public facing git, also website git
fftrac VM:
----------
trac.ffmpeg.org Issue tracking
+gpg encrypted backups of the trac repositories are created once a day
+and can be downloaded by any of the admins.
ffaux VM:
--
2.49.1
From d9687e6156a8b044537dbe8ea4784a2fad19754a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 16 Nov 2024 21:32:53 +0100
Subject: [PATCH 109/434] doc/developer: Document relationship between git
accounts and MAINTAINERS
This should have been documented long ago and i thought it was
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7051825b0171bd5d566c5a5cc78852c5f3aa3072)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/developer.texi | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/doc/developer.texi b/doc/developer.texi
index 41b21938ef..dcfb64e07d 100644
--- a/doc/developer.texi
+++ b/doc/developer.texi
@@ -927,6 +927,25 @@ In case you need finer control over how valgrind is invoked, use the
@code{--target-exec='valgrind <your_custom_valgrind_options>} option in
your configure line instead.
+@anchor{Maintenance}
+@chapter Maintenance process
+
+@anchor{MAINTAINERS}
+@section MAINTAINERS
+
+The developers maintaining each part of the codebase are listed in @file{MAINTAINERS}.
+Being listed in @file{MAINTAINERS}, gives one the right to have git write access to
+the specific repository.
+
+@anchor{Becoming a maintainer}
+@section Becoming a maintainer
+
+People add themselves to @file{MAINTAINERS} by sending a patch like any other code
+change. These get reviewed by the community like any other patch. It is expected
+that, if someone has an objection to a new maintainer, she is willing to object
+in public with her full name and is willing to take over maintainership for the area.
+
+
@anchor{Release process}
@chapter Release process
--
2.49.1
From 3417e955c3c6ed426174bdeb46b490889df93a28 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Nov 2024 11:07:27 +0100
Subject: [PATCH 110/434] avformat/icodec: fix integer overflow with nb_pal
Fixes: runtime error: signed integer overflow
Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Tested-by: Kacper Michajlow
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 84569b6c22cb4eda9c682aabeb5f658112126780)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/icodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/icodec.c b/libavformat/icodec.c
index afd0c71b1f..b09d0060a6 100644
--- a/libavformat/icodec.c
+++ b/libavformat/icodec.c
@@ -198,7 +198,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
AV_WL32(buf + 32, image->nb_pal);
}
- if (image->nb_pal > INT_MAX / 4 - 14 - 40)
+ if (image->nb_pal > INT_MAX / 4 - 14 - 40U)
return AVERROR_INVALIDDATA;
AV_WL32(buf - 4, 14 + 40 + image->nb_pal * 4);
--
2.49.1
From 49e4c1717ffbbfab8315963139ba4c7ed395e004 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 18 Nov 2024 23:55:05 +0100
Subject: [PATCH 111/434] avcodec/mjpegdec: Disallow progressive bayer images
Fixes: Null pointer dereference
Fixes: sample1.dng
Found-by: South East <8billion.people@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d8285633d8965658dfa6cd0b201cca36184c467)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mjpegdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 86ec58713c..ef4fc075b2 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -468,6 +468,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
if (s->avctx->height <= 0)
return AVERROR_INVALIDDATA;
}
+ if (s->bayer && s->progressive) {
+ avpriv_request_sample(s->avctx, "progressively coded bayer picture");
+ return AVERROR_INVALIDDATA;
+ }
if (s->got_picture && s->interlaced && (s->bottom_field == !s->interlace_polarity)) {
if (s->progressive) {
--
2.49.1
From 8ac2375b71fa432c7ce2b750b73a339d9da20ea9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 24 Nov 2024 21:13:42 +0100
Subject: [PATCH 112/434] MAINTAINERS: Remove Guillaume Poirier and Romain
Dolbeau
Guillaume no longer has a PPC
Romain has no time
CC: Guillaume POIRIER <poirierg@gmail.com>
CC: Romain Dolbeau <romain@dolbeau.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 224b62489d314e3c9637397cb7b95505651349e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
MAINTAINERS | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 76651d5ff8..d1b3d993e5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -511,7 +511,7 @@ Operating systems / CPU architectures
Alpha [0]
MIPS Manojkumar Bhosale, Shiyou Yin
LoongArch [2] Shiyou Yin
-Mac OS X / PowerPC Romain Dolbeau, Guillaume Poirier
+Mac OS X / PowerPC [0]
Amiga / PowerPC Colin Ward
Linux / PowerPC Lauri Kasanen
RISC-V [2] Rémi Denis-Courmont
--
2.49.1
From 3c8b588f3c115beaff7f346f0faa7376b63506b0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 26 Nov 2024 20:38:01 +0100
Subject: [PATCH 113/434] MAINTAINERS: Lauri is still available but is really
low on time nowadays
CC: Lauri Kasanen <cand@gmx.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e531b3ff27fcfa9110e71ba291888778ecb3b0f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
MAINTAINERS | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index d1b3d993e5..8a2ee04aed 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -513,7 +513,7 @@ MIPS Manojkumar Bhosale, Shiyou Yin
LoongArch [2] Shiyou Yin
Mac OS X / PowerPC [0]
Amiga / PowerPC Colin Ward
-Linux / PowerPC Lauri Kasanen
+Linux / PowerPC [1] Lauri Kasanen
RISC-V [2] Rémi Denis-Courmont
Windows MinGW Alex Beregszaszi, Ramiro Polla
Windows Cygwin Victor Paesa
--
2.49.1
From 173a978b9d8cd4925a8d01c95ebbee0382543432 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 18 Nov 2024 03:22:27 +0100
Subject: [PATCH 114/434] avcodec/h2645_parse: Ignore NAL with nuh_layer_id ==
63
Comply with "For purposes other than determining the amount of data in the decoding units
of the bitstream, decoders shall ignore all data that follow the value 63 for nuh_layer_id in a NAL unit"
Rec. ITU-T H.265 v8 (08/2021) Page 67
Fixes: index 63 out of bounds for type 'const int8_t[63]' (aka 'const signed char[63]')
Fixes: clusterfuzz-testcase-fuzzer_loadfile-5109286752026624
Reported-by: Kacper Michajlow <kasper93@gmail.com>
Found-by: ossfuzz
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 360e7cafd0e65fdf4b186c95e2517a94b9f3fa4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/h2645_parse.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
index 7b48fcae17..82816999e8 100644
--- a/libavcodec/h2645_parse.c
+++ b/libavcodec/h2645_parse.c
@@ -581,9 +581,11 @@ int ff_h2645_packet_split(H2645Packet *pkt, const uint8_t *buf, int length,
if (codec_id == AV_CODEC_ID_VVC)
ret = vvc_parse_nal_header(nal, logctx);
- else if (codec_id == AV_CODEC_ID_HEVC)
+ else if (codec_id == AV_CODEC_ID_HEVC) {
ret = hevc_parse_nal_header(nal, logctx);
- else
+ if (nal->nuh_layer_id == 63)
+ continue;
+ } else
ret = h264_parse_nal_header(nal, logctx);
if (ret < 0) {
av_log(logctx, AV_LOG_WARNING, "Invalid NAL unit %d, skipping.\n",
--
2.49.1
From f9f4835731617b00d5c9a2eef2d5142d13c0a9c8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 19 Oct 2024 00:08:03 +0200
Subject: [PATCH 115/434] swscale/slice: clear allocated memory in
alloc_lines()
Fixes: use of uninitialized memory in hScale16To15_c()
Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aeec39f3c1be82863efe64ce95242de58e075e8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/slice.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libswscale/slice.c b/libswscale/slice.c
index 1cc3f6c405..951912fb75 100644
--- a/libswscale/slice.c
+++ b/libswscale/slice.c
@@ -60,7 +60,7 @@ static int alloc_lines(SwsSlice *s, int size, int width)
for (j = 0; j < n; ++j) {
// chroma plane line U and V are expected to be contiguous in memory
// by mmx vertical scaler code
- s->plane[i].line[j] = av_malloc(size * 2 + 32);
+ s->plane[i].line[j] = av_mallocz(size * 2 + 32);
if (!s->plane[i].line[j]) {
free_lines(s);
return AVERROR(ENOMEM);
--
2.49.1
From 851bc9927d98badf0b50753b0d3601ca1e915ba6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 19 Oct 2024 01:15:53 +0200
Subject: [PATCH 116/434] avformat/dxa: check bpc
Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e020f21413269418180eea7933a94ecb6bf2ef8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/dxa.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/dxa.c b/libavformat/dxa.c
index 813e665a27..56b19a7fca 100644
--- a/libavformat/dxa.c
+++ b/libavformat/dxa.c
@@ -120,6 +120,8 @@ static int dxa_read_header(AVFormatContext *s)
avio_skip(pb, fsize);
}
c->bpc = (fsize + (int64_t)c->frames - 1) / c->frames;
+ if (c->bpc < 0)
+ return AVERROR_INVALIDDATA;
if(ast->codecpar->block_align) {
if (c->bpc > INT_MAX - ast->codecpar->block_align + 1)
return AVERROR_INVALIDDATA;
--
2.49.1
From 048a545e316ea66badd03d45ce3b60a437245789 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 23 Sep 2024 20:52:02 +0200
Subject: [PATCH 117/434] avcodec/eatgq: Check bytestream2_get_buffer() for
failure
Fixes: Use of uninitialized memory
Fixes: 71546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-5607656650244096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4949e34d96cc751aedaace02123c2fb02b5ac174)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/eatgq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavcodec/eatgq.c b/libavcodec/eatgq.c
index d326c05390..c6fcb062d7 100644
--- a/libavcodec/eatgq.c
+++ b/libavcodec/eatgq.c
@@ -178,7 +178,8 @@ static int tgq_decode_mb(TgqContext *s, GetByteContext *gbyte,
dc[4] = bytestream2_get_byte(gbyte);
dc[5] = bytestream2_get_byte(gbyte);
} else if (mode == 6) {
- bytestream2_get_buffer(gbyte, dc, 6);
+ if (bytestream2_get_buffer(gbyte, dc, 6) != 6)
+ return AVERROR_INVALIDDATA;
} else if (mode == 12) {
for (i = 0; i < 6; i++) {
dc[i] = bytestream2_get_byte(gbyte);
--
2.49.1
From 9285b93143530f36a96ce1d855d51a5c54d868c9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 23 Sep 2024 20:55:17 +0200
Subject: [PATCH 118/434] avformat/qcp: Check for read failure in header
Fixes: Use of uninitialized value
Fixes: 71551/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-4647386712965120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f52b9d05837c23b0c55013551bc28dce4922de0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/qcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/qcp.c b/libavformat/qcp.c
index fdf18618d2..13a479a11e 100644
--- a/libavformat/qcp.c
+++ b/libavformat/qcp.c
@@ -105,7 +105,8 @@ static int qcp_read_header(AVFormatContext *s)
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_MONO;
- avio_read(pb, buf, 16);
+ if (avio_read(pb, buf, 16) != 16)
+ return AVERROR_INVALIDDATA;
if (is_qcelp_13k_guid(buf)) {
st->codecpar->codec_id = AV_CODEC_ID_QCELP;
} else if (!memcmp(buf, guid_evrc, 16)) {
--
2.49.1
From 82d45cb004a9343caa65cb56bfe30b77d4deac72 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 23 Sep 2024 21:21:40 +0200
Subject: [PATCH 119/434] avcodec/hevc/hevcdec: initialize qp_y_tab
This does not replicate on my setup, thus this is a blind fix based on ossfuzz trace
Fixes: use of uninitialized value
Fixes: 71747/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5427736120721408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4fc43e45f9e7ee50d8d244bcdea15b37b5614b9b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevc/hevcdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 5dc605f91f..6fe72bd297 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -128,7 +128,7 @@ static int pic_arrays_init(HEVCLayerContext *l, const HEVCSPS *sps)
l->filter_slice_edges = av_mallocz(ctb_count);
l->tab_slice_address = av_malloc_array(pic_size_in_ctb,
sizeof(*l->tab_slice_address));
- l->qp_y_tab = av_malloc_array(pic_size_in_ctb,
+ l->qp_y_tab = av_calloc(pic_size_in_ctb,
sizeof(*l->qp_y_tab));
if (!l->qp_y_tab || !l->filter_slice_edges || !l->tab_slice_address)
goto fail;
--
2.49.1
From 028391aa580979d8bd5d8bde68ccc6dc99820098 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 22 Sep 2024 23:00:52 +0200
Subject: [PATCH 120/434] swscale/swscale_unscaled: Fix odd height with
nv24_to_yuv420p_chroma()
Fixes: out of array read
Fixes: 71726/clusterfuzz-testcase-ffmpeg_SWS_fuzzer-5876893532880896
Fixes: 377735917/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6686071112400896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Approved-by: Ramiro Polla <ramiro.polla@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d32dcc07a762185c1213fc7485cedc22b2448887)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/swscale_unscaled.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c
index dc1d5f3593..d403c953cc 100644
--- a/libswscale/swscale_unscaled.c
+++ b/libswscale/swscale_unscaled.c
@@ -230,6 +230,8 @@ static void nv24_to_yuv420p_chroma(uint8_t *dst1, int dstStride1,
const uint8_t *src2 = src + srcStride;
// average 4 pixels into 1 (interleaved U and V)
for (int y = 0; y < h; y += 2) {
+ if (y + 1 == h)
+ src2 = src1;
for (int x = 0; x < w; x++) {
dst1[x] = (src1[4 * x + 0] + src1[4 * x + 2] +
src2[4 * x + 0] + src2[4 * x + 2]) >> 2;
--
2.49.1
From 886dd058fe133bcc227d291b4fbf99aaed9c9a45 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 23 Sep 2024 19:57:28 +0200
Subject: [PATCH 121/434] avcodec/ilbcdec: Initialize tempbuff2
Fixes: Use of uninitialized value
Fixes: 71350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4482218440534804d067de00ee1a4bc493c8b41d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ilbcdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c
index ba1da168bc..7fea39b43c 100644
--- a/libavcodec/ilbcdec.c
+++ b/libavcodec/ilbcdec.c
@@ -658,7 +658,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector *
int16_t k, base_size;
int16_t lag;
/* Stack based */
- int16_t tempbuff2[SUBL + 5];
+ int16_t tempbuff2[SUBL + 5] = {0};
/* Determine size of codebook sections */
base_size = lMem - cbveclen + 1;
--
2.49.1
From bc8248d07aa522c3743b1d15e0de5e7b22ca8748 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Aug 2024 16:00:01 +0200
Subject: [PATCH 122/434] avcodec/webp: Check ref_x/y
Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072
Fixes: use of uninintailized value
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c1e732ad2e240af5afe9ffea443c91bb233aa65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/webp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/webp.c b/libavcodec/webp.c
index 7c2a5f0111..b624458d67 100644
--- a/libavcodec/webp.c
+++ b/libavcodec/webp.c
@@ -704,6 +704,9 @@ static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
ref_x = FFMAX(0, ref_x);
ref_y = FFMAX(0, ref_y);
+ if (ref_y == y && ref_x >= x)
+ return AVERROR_INVALIDDATA;
+
/* copy pixels
* source and dest regions can overlap and wrap lines, so just
* copy per-pixel */
--
2.49.1
From 828569c0d0efaa2da23472b8391e2d251d2f8a71 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 31 Jul 2024 20:59:49 +0200
Subject: [PATCH 123/434] avcodec/aac/aacdec_usac: Clean ics2->max_sfb when
first SCE fails
Fixes: out of array access
Fixes: 70734/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4741427068731392
Fixes: 383194070/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5302387708854272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 682d710bcb8d21d8cda0182bb1725663dbbac7cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec_usac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index 1b79d19a30..5efa248238 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -917,8 +917,10 @@ static int decode_usac_stereo_info(AACDecContext *ac, AACUSACConfig *usac,
}
ret = setup_sce(ac, sce1, usac);
- if (ret < 0)
+ if (ret < 0) {
+ ics2->max_sfb = 0;
return ret;
+ }
ret = setup_sce(ac, sce2, usac);
if (ret < 0)
--
2.49.1
From b44488042243671ad62b69daa6633fa4b0e305c0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 31 Jul 2024 20:03:12 +0200
Subject: [PATCH 124/434] avcodec/aac/aacdec_usac: Dont leave type at a invalid
value
Fixes: Assertion 0 failed at libavcodec/aac/aacdec_usac.c:1646
Fixes: 70541/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5190889543106560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a518b5540de469ac5d4f96e820462e5ce519c2db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec_usac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index 5efa248238..2938e69387 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -265,6 +265,7 @@ static int decode_usac_extension(AACDecContext *ac, AACUsacElemConfig *e,
/* No configuration needed - fallthrough (len should be 0) */
default:
skip_bits(gb, 8*ext_config_len);
+ e->ext.type = ID_EXT_ELE_FILL;
break;
};
--
2.49.1
From 52461e7e8b54e408a81a7cf800073bec80961fe0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 22 Dec 2024 00:28:21 +0100
Subject: [PATCH 125/434] avutil/timecode: Avoid fps overflow in
av_timecode_get_smpte_from_framenum()
Fix from c94875471e3ba3dc396c6919ff3ec9b14539cd71
Found-by: Youngjae Choi <youngjaechoi@korea.ac.kr>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ba33b50f51b17eef0449f20b3524f174dc9c3cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavutil/timecode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavutil/timecode.c b/libavutil/timecode.c
index f40a10eb38..f454466f97 100644
--- a/libavutil/timecode.c
+++ b/libavutil/timecode.c
@@ -61,8 +61,8 @@ uint32_t av_timecode_get_smpte_from_framenum(const AVTimecode *tc, int framenum)
framenum = av_timecode_adjust_ntsc_framenum2(framenum, tc->fps);
ff = framenum % fps;
ss = framenum / fps % 60;
- mm = framenum / (fps*60) % 60;
- hh = framenum / (fps*3600) % 24;
+ mm = framenum / (fps*60LL) % 60;
+ hh = framenum / (fps*3600LL) % 24;
return av_timecode_get_smpte(tc->rate, drop, hh, mm, ss, ff);
}
--
2.49.1
From 63505308068a813d5846236aee95c837b4cc47fe Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 8 Dec 2024 00:32:38 +0100
Subject: [PATCH 126/434] tools/target_dec_fuzzer: Adjust Threshold for indeo5
Fixes: 379768251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5981329084186624
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89efc6c97c4faf97dfed558b7bce2f64f8bd61e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
tools/target_dec_fuzzer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 432e948816..48fa0e93a1 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -255,6 +255,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
case AV_CODEC_ID_HQ_HQA: maxpixels /= 128; break;
case AV_CODEC_ID_IFF_ILBM: maxpixels /= 4096; break;
case AV_CODEC_ID_INDEO4: maxpixels /= 128; break;
+ case AV_CODEC_ID_INDEO5: maxpixels /= 1024; break;
case AV_CODEC_ID_INTERPLAY_ACM: maxsamples /= 16384; break;
case AV_CODEC_ID_JPEG2000: maxpixels /= 16384; break;
case AV_CODEC_ID_LAGARITH: maxpixels /= 1024; break;
--
2.49.1
From 364eb21d2a3472c5b3468818a413f42ce19d06ca Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 8 Dec 2024 03:04:16 +0100
Subject: [PATCH 127/434] tools/target_dec_fuzzer: Adjust threshold for MVC1
Fixes: Timeout
Fixes: 378231213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVC1_fuzzer-6640960500465664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7230bc503a1180e6eb76f956e9c6b61352936e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
tools/target_dec_fuzzer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 48fa0e93a1..1f01819eb8 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -271,6 +271,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
case AV_CODEC_ID_MSZH: maxpixels /= 128; break;
case AV_CODEC_ID_MTS2: maxpixels /= 4096; break;
case AV_CODEC_ID_MV30: maxpixels /= 128; break;
+ case AV_CODEC_ID_MVC1: maxpixels /= 1024; break;
case AV_CODEC_ID_MVC2: maxpixels /= 128; break;
case AV_CODEC_ID_MVHA: maxpixels /= 16384; break;
case AV_CODEC_ID_MVDV: maxpixels /= 1024; break;
--
2.49.1
From 5e17ff811ae81b8ec743cb2030b877db77551e35 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 11 Dec 2024 21:24:00 +0100
Subject: [PATCH 128/434] tools/target_dec_fuzzer: Adjust threshold for EACMV
Fixes: Timeout
Fixes: 382988735/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EACMV_fuzzer-5278721465974784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f4eb0fe03aca552d375e2bce019a5da785f50d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
tools/target_dec_fuzzer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 1f01819eb8..6e6b10e138 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -237,6 +237,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
case AV_CODEC_ID_DVB_SUBTITLE: av_dict_set_int(&opts, "compute_clut", -2, 0); break;
case AV_CODEC_ID_DXA: maxpixels /= 32; break;
case AV_CODEC_ID_DXV: maxpixels /= 32; break;
+ case AV_CODEC_ID_CMV: maxpixels /= 256; break;
case AV_CODEC_ID_EXR: maxpixels /= 1024; break;
case AV_CODEC_ID_FFV1: maxpixels /= 32; break;
case AV_CODEC_ID_FFWAVESYNTH: maxsamples /= 16384; break;
--
2.49.1
From 1cb5caeb5be03358aa5b4c83e0f8667e46fcf016 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 11 Dec 2024 21:36:11 +0100
Subject: [PATCH 129/434] avformat/matroskadec: Check pre_ns for overflow
Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long'
Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 361d24e6d920e4f7e4e5fa1fd6fbb6922bff35f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/matroskadec.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 0e150f9138..efa3e44c85 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4618,9 +4618,10 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
// The prebuffer ends in the last Cue. Estimate how much data was
// prebuffered.
pre_bytes = desc_end.end_offset - desc_end.start_offset;
- pre_ns = desc_end.end_time_ns - desc_end.start_time_ns;
- if (pre_ns <= 0)
+ if (desc_end.end_time_ns <= desc_end.start_time_ns ||
+ desc_end.end_time_ns - (uint64_t)desc_end.start_time_ns > INT64_MAX)
return -1;
+ pre_ns = desc_end.end_time_ns - desc_end.start_time_ns;
pre_sec = pre_ns / nano_seconds_per_second;
prebuffer_bytes +=
pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / pre_sec);
--
2.49.1
From 8ae93fdc426a6fc4beb19dc728daae89477fb53a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 11 Dec 2024 22:37:07 +0100
Subject: [PATCH 130/434] avcodec/utils: Fix block align overflow for
ADPCM_IMA_WAV
Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int'
Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93270930798da368d5b1954a73ef7ff9dfa48f73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/utils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index d68e672e0a..a63ca71a44 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -723,7 +723,7 @@ static int get_audio_frame_duration(enum AVCodecID id, int sr, int ch, int ba,
case AV_CODEC_ID_ADPCM_IMA_WAV:
if (bps < 2 || bps > 5)
return 0;
- tmp = blocks * (1LL + (ba - 4 * ch) / (bps * ch) * 8);
+ tmp = blocks * (1LL + (ba - 4 * ch) / (bps * ch) * 8LL);
break;
case AV_CODEC_ID_ADPCM_IMA_DK3:
tmp = blocks * (((ba - 16LL) * 2 / 3 * 4) / ch);
--
2.49.1
From a5ce14389510f6bcd5eaa655668df8ac680a79cd Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 11 Dec 2024 23:26:02 +0100
Subject: [PATCH 131/434] avformat/mov: dereference pointer after null check
Fixes: null pointer dereference
Fixes: 383397479/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4776829338058752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 954d55c2a4244b366ae97d09546ba8ce2534892b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index fee1a9ad32..a4c5a2a93c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10030,10 +10030,11 @@ static int mov_parse_tiles(AVFormatContext *s)
for (k = 0; k < mov->nb_heif_item; k++) {
HEIFItem *item = mov->heif_item[k];
- AVStream *st = item->st;
+ AVStream *st;
if (!item || item->item_id != tile_id)
continue;
+ st = item->st;
if (!st) {
av_log(s, AV_LOG_WARNING, "HEIF item id %d from grid id %d doesn't "
"reference a stream\n",
--
2.49.1
From a82139d0e690a334ce2829b75590d10b9ecb6267 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 24 Dec 2024 21:30:32 +0100
Subject: [PATCH 132/434] avcodec/aac/aacdec: Free channel layout
Fixes: 371445194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5981081124274176
Fixes: memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae81beb3512855eae1eab3ce9a87cb0d4399fc67)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 038251d266..e62bf0f952 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -1102,6 +1102,8 @@ static av_cold int decode_close(AVCodecContext *avctx)
for (int i = 0; i < 2; i++) {
OutputConfiguration *oc = &ac->oc[i];
+ av_channel_layout_uninit(&ac->oc[i].ch_layout);
+
AACUSACConfig *usac = &oc->usac;
for (int j = 0; j < usac->nb_elems; j++) {
AACUsacElemConfig *ec = &usac->elems[j];
--
2.49.1
From cac9112bf35cd016407ab8c499be9896830d6262 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 25 Dec 2024 05:13:02 +0100
Subject: [PATCH 133/434] avformat/mlvdec: Check avio_read()
Fixes: use-of-uninitialized-value
Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb85423142103d694d97bad1967bd3dc55440e71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mlvdec.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c
index 1a6d38f37c..985365326e 100644
--- a/libavformat/mlvdec.c
+++ b/libavformat/mlvdec.c
@@ -82,13 +82,15 @@ static int check_file_header(AVIOContext *pb, uint64_t guid)
static void read_string(AVFormatContext *avctx, AVIOContext *pb, const char *tag, unsigned size)
{
char * value = av_malloc(size + 1);
+ int ret;
+
if (!value) {
avio_skip(pb, size);
return;
}
- avio_read(pb, value, size);
- if (!value[0]) {
+ ret = avio_read(pb, value, size);
+ if (ret != size || !value[0]) {
av_free(value);
return;
}
--
2.49.1
From 615f29e301fd08e377ed69104fe0806810fac39a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 18 Nov 2024 04:09:11 +0100
Subject: [PATCH 134/434] avformat/rpl: Fix check for negative values
Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376
Found-by: ossfuzz
Reported-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eab65379bf89c55d8ec4bc6f00e04f15b37d3d85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rpl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/rpl.c b/libavformat/rpl.c
index e971d0588f..b30d769efb 100644
--- a/libavformat/rpl.c
+++ b/libavformat/rpl.c
@@ -102,7 +102,7 @@ static AVRational read_fps(const char* line, int* error)
line++;
for (; *line>='0' && *line<='9'; line++) {
// Truncate any numerator too large to fit into an int64_t
- if (num > (INT64_MAX - 9) / 10 || den > INT64_MAX / 10)
+ if (num > (INT64_MAX - 9) / 10ULL || den > INT64_MAX / 10ULL)
break;
num = 10 * num + (*line - '0');
den *= 10;
--
2.49.1
From 1a254c5354fb58c694603fdedd60923cf368c46f Mon Sep 17 00:00:00 2001
From: Janne Grunau <janne-ffmpeg@jannau.net>
Date: Fri, 3 Jan 2025 01:54:38 +0100
Subject: [PATCH 135/434] aarch64: vp9mc: Load only 12 pixels in the 4 pixel
wide horizontal filter
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
Under these conditions like seen by Firefox a read beyond the end of the
buffer results in a segfault.
After the over-read is reduced to a single pixel it's reasonable to use
VP9's emulated edge motion compensation for this.
Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 430c38f698a65d597e863330810b05e083682be6)
---
libavcodec/aarch64/vp9mc_neon.S | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/libavcodec/aarch64/vp9mc_neon.S b/libavcodec/aarch64/vp9mc_neon.S
index abf2bae9db..38f44ca56d 100644
--- a/libavcodec/aarch64/vp9mc_neon.S
+++ b/libavcodec/aarch64/vp9mc_neon.S
@@ -230,6 +230,9 @@ function \type\()_8tap_\size\()h_\idx1\idx2
// reduced dst stride
.if \size >= 16
sub x1, x1, x5
+.elseif \size == 4
+ add x12, x2, #8
+ add x13, x7, #8
.endif
// size >= 16 loads two qwords and increments x2,
// for size 4/8 it's enough with one qword and no
@@ -248,9 +251,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
.if \size >= 16
ld1 {v4.8b, v5.8b, v6.8b}, [x2], #24
ld1 {v16.8b, v17.8b, v18.8b}, [x7], #24
-.else
+.elseif \size == 8
ld1 {v4.8b, v5.8b}, [x2]
ld1 {v16.8b, v17.8b}, [x7]
+.else // \size == 4
+ ld1 {v4.8b}, [x2]
+ ld1 {v16.8b}, [x7]
+ ld1 {v5.s}[0], [x12], x3
+ ld1 {v17.s}[0], [x13], x3
.endif
uxtl v4.8h, v4.8b
uxtl v5.8h, v5.8b
--
2.49.1
From 535a8262ccf6cfd74388ee78b7ab5389f199e213 Mon Sep 17 00:00:00 2001
From: Janne Grunau <janne-ffmpeg@jannau.net>
Date: Fri, 3 Jan 2025 01:54:39 +0100
Subject: [PATCH 136/434] arm: vp9mc: Load only 12 pixels in the 4 pixel wide
horizontal filter
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
This mirrors the aarch64 change.
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit f3662562156c9b908588b1e58e4203fd09217cb6)
---
libavcodec/arm/vp9mc_neon.S | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavcodec/arm/vp9mc_neon.S b/libavcodec/arm/vp9mc_neon.S
index bd8cda7c30..2ec729bb31 100644
--- a/libavcodec/arm/vp9mc_neon.S
+++ b/libavcodec/arm/vp9mc_neon.S
@@ -279,11 +279,13 @@ function \type\()_8tap_\size\()h_\idx1\idx2
sub r1, r1, r5
.endif
@ size >= 16 loads two qwords and increments r2,
- @ for size 4/8 it's enough with one qword and no
- @ postincrement
+ @ size 4 loads 1 d word, increments r2 and loads 1 32-bit lane
+ @ for size 8 it's enough with one qword and no postincrement
.if \size >= 16
sub r3, r3, r5
sub r3, r3, #8
+.elseif \size == 4
+ sub r3, r3, #8
.endif
@ Load the filter vector
vld1.16 {q0}, [r12,:128]
@@ -295,9 +297,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
.if \size >= 16
vld1.8 {d18, d19, d20}, [r2]!
vld1.8 {d24, d25, d26}, [r7]!
-.else
+.elseif \size == 8
vld1.8 {q9}, [r2]
vld1.8 {q12}, [r7]
+.else @ size == 4
+ vld1.8 {d18}, [r2]!
+ vld1.8 {d24}, [r7]!
+ vld1.32 {d19[0]}, [r2]
+ vld1.32 {d25[0]}, [r7]
.endif
vmovl.u8 q8, d18
vmovl.u8 q9, d19
--
2.49.1
From 7d1532f7529796540910e034eceb96741ed2513c Mon Sep 17 00:00:00 2001
From: Janne Grunau <janne-ffmpeg@jannau.net>
Date: Fri, 3 Jan 2025 01:54:40 +0100
Subject: [PATCH 137/434] vp9: recon: Use emulated edge to prevent buffer
overflows
The arm/aarch64 horizontal filter reads one additional pixel beyond what
the filter uses. This can become an issue if the application does not
allocate larger buffers than what's required for the pixel data. If the
motion vector points to the bottom right edge of the picture this
becomes a read buffer overflow. This triggers segfaults in Firefox for
video resolutions which result in a page aligned picture size like
1280x640.
Prevent this by using emulated edge in this case.
Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 060464105bdca82b8cfb91c7a6fb56df4c7cd9d0)
---
libavcodec/vp9recon.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libavcodec/vp9recon.c b/libavcodec/vp9recon.c
index ef08ed17c8..ccc49d7716 100644
--- a/libavcodec/vp9recon.c
+++ b/libavcodec/vp9recon.c
@@ -319,7 +319,11 @@ static av_always_inline void mc_luma_unscaled(VP9TileData *td, const vp9_mc_func
// The arm/aarch64 _hv filters read one more row than what actually is
// needed, so switch to emulated edge one pixel sooner vertically
// (!!my * 5) than horizontally (!!mx * 4).
+ // The arm/aarch64 _h filters read one more pixel than what actually is
+ // needed, so switch to emulated edge if that would read beyond the bottom
+ // right block.
if (x < !!mx * 3 || y < !!my * 3 ||
+ ((ARCH_AARCH64 || ARCH_ARM) && (x + !!mx * 5 > w - bw) && (y + !!my * 5 + 1 > h - bh)) ||
x + !!mx * 4 > w - bw || y + !!my * 5 > h - bh) {
s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
ref - !!my * 3 * ref_stride - !!mx * 3 * bytesperpixel,
@@ -358,7 +362,11 @@ static av_always_inline void mc_chroma_unscaled(VP9TileData *td, const vp9_mc_fu
// The arm/aarch64 _hv filters read one more row than what actually is
// needed, so switch to emulated edge one pixel sooner vertically
// (!!my * 5) than horizontally (!!mx * 4).
+ // The arm/aarch64 _h filters read one more pixel than what actually is
+ // needed, so switch to emulated edge if that would read beyond the bottom
+ // right block.
if (x < !!mx * 3 || y < !!my * 3 ||
+ ((ARCH_AARCH64 || ARCH_ARM) && (x + !!mx * 5 > w - bw) && (y + !!my * 5 + 1 > h - bh)) ||
x + !!mx * 4 > w - bw || y + !!my * 5 > h - bh) {
s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
ref_u - !!my * 3 * src_stride_u - !!mx * 3 * bytesperpixel,
--
2.49.1
From 0151f1daab9224322db7a808191365d65872ed1c Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Tue, 10 Dec 2024 12:18:56 +0800
Subject: [PATCH 138/434] aarch64/vvc: Fix clip in alf
Fix test failure:
./tests/checkasm/checkasm --test=vvc_alf 3607569773
(cherry picked from commit 40feba5f77e1c1dc185a9b5e6f2c7e33d211b993)
---
libavcodec/aarch64/vvc/alf.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/aarch64/vvc/alf.S b/libavcodec/aarch64/vvc/alf.S
index c624093640..8801b3afb6 100644
--- a/libavcodec/aarch64/vvc/alf.S
+++ b/libavcodec/aarch64/vvc/alf.S
@@ -148,7 +148,7 @@
sqxtun v20.8b, v20.8h
str d20, [dst]
.else
- smin v20.8h, v20.8h, v25.8h
+ umin v20.8h, v20.8h, v25.8h
str q20, [dst]
.endif
ret
@@ -249,7 +249,7 @@
sqxtun v20.8b, v20.8h
str s20, [dst]
.else
- smin v20.4h, v20.4h, v25.4h
+ umin v20.4h, v20.4h, v25.4h
str d20, [dst]
.endif
ret
--
2.49.1
From 89bc70ddd81b156c1442a85738a4c7fe69f771c1 Mon Sep 17 00:00:00 2001
From: Bin Peng <pengbin@visionular.com>
Date: Mon, 16 Dec 2024 10:31:23 +0800
Subject: [PATCH 139/434] lavc/aarch64: Fix ff_pred8x8_plane_neon_10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix test failure on aarch64:
./tests/checkasm/checkasm --test=h264pred 479612
The mismatch between neon and C functions can also be reproduced using the following bitstream and command line.
wget https://streams.videolan.org/ffmpeg/incoming/intra8x8pred_10bit.264
./ffmpeg -cpuflags 0 -threads 1 -i intra8x8pred_10bit.264 -f framemd5 -y md5_ref
./ffmpeg -threads 1 -i intra8x8pred_10bit.264 -f framemd5 -y md5_neon
Signed-off-by: Bin Peng <pengbin@visionular.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit decc9e643cc3ac5537f42b465e2637fbefbf41cc)
---
libavcodec/aarch64/h264pred_neon.S | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/libavcodec/aarch64/h264pred_neon.S b/libavcodec/aarch64/h264pred_neon.S
index ea37689f34..168f8191ad 100644
--- a/libavcodec/aarch64/h264pred_neon.S
+++ b/libavcodec/aarch64/h264pred_neon.S
@@ -595,12 +595,11 @@ function ff_pred8x8_plane_neon_10, export=1
ssubl v2.4s, v2.4h, v3.4h
ext v0.16b, v0.16b, v0.16b, #14
mov v0.h[0], wzr
- mul v0.8h, v0.8h, v5.h[0]
dup v1.4s, v2.s[0]
dup v2.4s, v2.s[0]
dup v3.8h, v5.h[1]
- saddw v1.4s, v1.4s, v0.4h
- saddw2 v2.4s, v2.4s, v0.8h
+ smlal v1.4s, v0.4h, v5.h[0]
+ smlal2 v2.4s, v0.8h, v5.h[0]
mov w3, #8
mvni v4.8h, #0xFC, lsl #8 // 1023 for clipping
1:
--
2.49.1
From 54331d4305909afdb8957c8567626aeb139c4fb2 Mon Sep 17 00:00:00 2001
From: Bin Peng <pengbin@visionular.com>
Date: Fri, 13 Dec 2024 22:19:47 +0800
Subject: [PATCH 140/434] lavc/aarch64: Fix ff_pred16x16_plane_neon_10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix test failure on aarch64:
./tests/checkasm/checkasm --test=h264pred 367840
Signed-off-by: Peng Bin <pengbin@visionular.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 72a3656e8468a394373b6397aacc906d7f7794c2)
---
libavcodec/aarch64/h264pred_neon.S | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/libavcodec/aarch64/h264pred_neon.S b/libavcodec/aarch64/h264pred_neon.S
index 168f8191ad..d0999938ef 100644
--- a/libavcodec/aarch64/h264pred_neon.S
+++ b/libavcodec/aarch64/h264pred_neon.S
@@ -502,28 +502,27 @@ function ff_pred16x16_plane_neon_10, export=1
add v7.4h, v7.4h, v0.4h
shl v2.4h, v7.4h, #4
ssubl v2.4s, v2.4h, v3.4h
- shl v3.4h, v4.4h, #4
ext v0.16b, v0.16b, v0.16b, #14
- ssubl v6.4s, v5.4h, v3.4h
+ sxtl v6.4s, v5.4h // c
mov v0.h[0], wzr
mul v0.8h, v0.8h, v4.h[0]
dup v16.4s, v2.s[0]
dup v17.4s, v2.s[0]
- dup v2.8h, v4.h[0]
- dup v3.4s, v6.s[0]
- shl v2.8h, v2.8h, #3
+ dup v2.8h, v4.h[0] // b
+ dup v3.4s, v6.s[0] // c
+ sshll v2.4s, v2.4h, #3 // b * 8
saddw v16.4s, v16.4s, v0.4h
saddw2 v17.4s, v17.4s, v0.8h
- saddw v3.4s, v3.4s, v2.4h
+ sub v3.4s, v3.4s, v2.4s
mov w3, #16
mvni v4.8h, #0xFC, lsl #8 // 1023 for clipping
1:
sqshrun v0.4h, v16.4s, #5
sqshrun2 v0.8h, v17.4s, #5
- saddw v16.4s, v16.4s, v2.4h
- saddw v17.4s, v17.4s, v2.4h
+ add v16.4s, v16.4s, v2.4s
+ add v17.4s, v17.4s, v2.4s
sqshrun v1.4h, v16.4s, #5
sqshrun2 v1.8h, v17.4s, #5
add v16.4s, v16.4s, v3.4s
--
2.49.1
From 15684239ca9c29d74ac6b781209fb4938c94b829 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:49 -0500
Subject: [PATCH 141/434] avformat/dvdvideodec: remove unused headers
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 3ad96243d756b2b63431410112956e36e4044e4a)
---
libavformat/dvdvideodec.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 6bd1dbc17f..4e33d1aba6 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -44,8 +44,6 @@
#include "libavutil/mem.h"
#include "libavutil/opt.h"
#include "libavutil/samplefmt.h"
-#include "libavutil/time.h"
-#include "libavutil/timestamp.h"
#include "avformat.h"
#include "avio_internal.h"
--
2.49.1
From aebce8b1b84a4bc7b98f2f7f520aaf6db8dddfd8 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:50 -0500
Subject: [PATCH 142/434] avformat/dvdvideodec: fix menu PGC number off-by-one
in state
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 94346edbbfeff7a54ab04631ef4ba2781460e17c)
---
libavformat/dvdvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 4e33d1aba6..da41a9d329 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -344,7 +344,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state)
}
/* make sure the PGC is valid */
- state->pgcn = c->opt_pgc - 1;
+ state->pgcn = c->opt_pgc;
state->pgc = pgci_ut->lu[c->opt_menu_lu - 1].pgcit->pgci_srp[c->opt_pgc - 1].pgc;
if (!state->pgc || !state->pgc->program_map || !state->pgc->cell_playback) {
av_log(s, AV_LOG_ERROR, "Invalid PGC structure for menu [LU %d, PGC %d]\n",
--
2.49.1
From 5d37c7cf081fb766e52d894ac7d9c6964a3c2347 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:51 -0500
Subject: [PATCH 143/434] avformat/dvdvideodec: measure duration of the current
menu VOBU in state
This will be a pre-requisite to calculating chapter markers
for menus.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 39c662f54125f55b6f0014ac61d92cb2618f5db0)
---
libavformat/dvdvideodec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index da41a9d329..18c356c132 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -474,6 +474,7 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
}
state->vobu_e_ptm = pci.pci_gi.vobu_e_ptm;
+ state->vobu_duration = pci.pci_gi.vobu_e_ptm - pci.pci_gi.vobu_s_ptm;
av_log(s, AV_LOG_DEBUG, "NAV packet: sector=%d "
"vobu_s_ptm=%d vobu_e_ptm=%d ts_offset=%" PRId64 "\n",
--
2.49.1
From a5c48cc7a1b20fd2865b5d6e34e66b8b56da702c Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:52 -0500
Subject: [PATCH 144/434] avformat/dvdvideodec: remove "auto" value for -pg
option, default to 1
The default "auto" mode is effectively useless; the reasonable
default use case is to use the first PG (segment) of the
selected PGC for both menus and standard titles. Just
default the value to 1, since the option is irrelevant
unless -pgc is also set.
Note that this should not break users using this advanced option.
The "auto" mode errored and asked for a PG number regardless
for non-menus, and for menus the mode simply defaulted to 1.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit e1ace1d3146744439a8c7768813c8008de1e9ec6)
---
doc/demuxers.texi | 3 +--
libavformat/dvdvideodec.c | 31 +++++++++----------------------
2 files changed, 10 insertions(+), 24 deletions(-)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index 04293c4813..74b68778bd 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -397,8 +397,7 @@ Default is 0, automatically resolve from value of @option{title}.
The entry PG to start playback, in conjunction with @option{pgc}.
Alternative to setting @option{title}.
Chapter markers are not supported at this time.
-Default is 0, automatically resolve from value of @option{title}, or
-start from the beginning (PG 1) of the menu.
+Default is 1, the first PG of the PGC.
@item preindex @var{bool}
Enable this to have accurate chapter (PTT) markers and duration measurement,
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 18c356c132..bed7c38ff6 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -537,7 +537,7 @@ static int dvdvideo_play_open(AVFormatContext *s, DVDVideoPlaybackState *state)
goto end_dvdnav_error;
}
- if (c->opt_pgc > 0 && c->opt_pg > 0) {
+ if (c->opt_pgc > 0) {
if (dvdnav_program_play(state->dvdnav, c->opt_title, c->opt_pgc, c->opt_pg) != DVDNAV_STATUS_OK) {
av_log(s, AV_LOG_ERROR, "Unable to start playback at title %d, PGC %d, PG %d\n",
c->opt_title, c->opt_pgc, c->opt_pg);
@@ -1541,13 +1541,6 @@ static int dvdvideo_read_header(AVFormatContext *s)
c->opt_menu_lu = 1;
}
- if (!c->opt_pg) {
- av_log(s, AV_LOG_INFO, "Defaulting to menu PG #1. "
- "This is not always desirable, validation suggested.\n");
-
- c->opt_pg = 1;
- }
-
if ((ret = dvdvideo_ifo_open(s)) < 0 ||
(ret = dvdvideo_menu_open(s, &c->play_state)) < 0 ||
(ret = dvdvideo_subdemux_open(s)) < 0 ||
@@ -1558,7 +1551,13 @@ static int dvdvideo_read_header(AVFormatContext *s)
return 0;
}
- if (c->opt_chapter_end != 0 && c->opt_chapter_start > c->opt_chapter_end) {
+ if (c->opt_pgc && (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex)) {
+ av_log(s, AV_LOG_ERROR, "PGC extraction not compatible with chapter or preindex options\n");
+
+ return AVERROR(EINVAL);
+ }
+
+ if (!c->opt_pgc && (c->opt_chapter_end != 0 && c->opt_chapter_start > c->opt_chapter_end)) {
av_log(s, AV_LOG_ERROR, "Chapter (PTT) range [%d, %d] is invalid\n",
c->opt_chapter_start, c->opt_chapter_end);
@@ -1572,18 +1571,6 @@ static int dvdvideo_read_header(AVFormatContext *s)
c->opt_title = 1;
}
- if (c->opt_pgc) {
- if (c->opt_pg == 0) {
- av_log(s, AV_LOG_ERROR, "Invalid coordinates. If -pgc is set, -pg must be set too.\n");
-
- return AVERROR(EINVAL);
- } else if (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex) {
- av_log(s, AV_LOG_ERROR, "-pgc is not compatible with the -preindex or "
- "-chapter_start/-chapter_end options\n");
- return AVERROR(EINVAL);
- }
- }
-
if ((ret = dvdvideo_ifo_open(s)) < 0)
return ret;
@@ -1761,7 +1748,7 @@ static const AVOption dvdvideo_options[] = {
{"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
{"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
{"menu_vts", "menu VTS (0=VMG main menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
- {"pg", "entry PG number (0=auto)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=0 }, 0, 255, AV_OPT_FLAG_DECODING_PARAM },
+ {"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM },
{"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM },
{"preindex", "enable for accurate chapter markers, slow (2-pass read)", OFFSET(opt_preindex), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
{"region", "playback region number (0=free)", OFFSET(opt_region), AV_OPT_TYPE_INT, { .i64=0 }, 0, 8, AV_OPT_FLAG_DECODING_PARAM },
--
2.49.1
From b108d17c5659f5cd78a0de61da9306c225f4bc50 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:53 -0500
Subject: [PATCH 145/434] avformat/dvdvideodec: move memcpy below missed NAV
packet warning
Readability improvement; the warning can be bundled beneath
the preceding validations rather than awkwardly between the memcpy
and return.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 6bbaa7db49de86653bd23544e5bb55315265f828)
---
libavformat/dvdvideodec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index bed7c38ff6..9246ac0863 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -804,13 +804,13 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
return AVERROR_INPUT_CHANGED;
}
- memcpy(buf, &nav_buf, nav_len);
-
if (state->pgn != cur_pgn)
av_log(s, AV_LOG_WARNING, "Unexpected PG change (expected=%d actual=%d); "
"this could be due to a missed NAV packet\n",
state->pgn, cur_pgn);
+ memcpy(buf, &nav_buf, nav_len);
+
(*p_nav_event) = nav_event;
state->is_seeking = 0;
--
2.49.1
From 6f4ae5f183890928de1cfc230dc080bb93eaa5be Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:54 -0500
Subject: [PATCH 146/434] avformat/dvdvideodec: standardize the NAV packet
event signal
This consolidates the FFERROR_REDO handling of NAV packets to
dvdvideo_subdemux_read_data(), is a pre-requisite to calculating
chapter markers for menus, and a pre-requisite to fixing the
frame desync issue when the subdemuxer is flushed.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit b38ca20bf2544c503e30d0f68453483ed24430c3)
---
libavformat/dvdvideodec.c | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 9246ac0863..066edaaa27 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -390,7 +390,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state)
}
static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state,
- uint8_t *buf, int buf_size,
+ uint8_t *buf, int buf_size, int *p_is_nav_packet,
void (*flush_cb)(AVFormatContext *s))
{
int64_t blocks_read = 0;
@@ -398,6 +398,8 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
pci_t pci = (pci_t) {0};
dsi_t dsi = (dsi_t) {0};
+ (*p_is_nav_packet) = 0;
+
if (buf_size != DVDVIDEO_BLOCK_SIZE) {
av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n",
DVDVIDEO_BLOCK_SIZE, buf_size);
@@ -481,7 +483,9 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
dsi.dsi_gi.nv_pck_lbn,
pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ts_offset);
- return FFERROR_REDO;
+ (*p_is_nav_packet) = 1;
+
+ return 0;
}
/* we are in the middle of a VOBU, so pass on the PS packet */
@@ -611,8 +615,7 @@ end_dvdnav_error:
}
static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state,
- uint8_t *buf, int buf_size,
- int *p_nav_event,
+ uint8_t *buf, int buf_size, int *p_is_nav_packet,
void (*flush_cb)(AVFormatContext *s))
{
DVDVideoDemuxContext *c = s->priv_data;
@@ -627,6 +630,8 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
pci_t *e_pci;
dsi_t *e_dsi;
+ (*p_is_nav_packet) = 0;
+
if (buf_size != DVDVIDEO_BLOCK_SIZE) {
av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n",
DVDVIDEO_BLOCK_SIZE, buf_size);
@@ -780,9 +785,9 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
state->vobu_e_ptm = e_pci->pci_gi.vobu_e_ptm;
- (*p_nav_event) = nav_event;
+ (*p_is_nav_packet) = 1;
- return nav_len;
+ return 0;
case DVDNAV_BLOCK_OK:
if (!state->in_ps) {
if (state->in_pgc)
@@ -811,8 +816,6 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
memcpy(buf, &nav_buf, nav_len);
- (*p_nav_event) = nav_event;
-
state->is_seeking = 0;
return nav_len;
@@ -1442,18 +1445,18 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size)
AVFormatContext *s = opaque;
DVDVideoDemuxContext *c = s->priv_data;
- int ret = 0;
- int nav_event;
+ int ret;
+ int is_nav_packet;
if (c->play_end)
return AVERROR_EOF;
if (c->opt_menu)
- ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size,
+ ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet,
dvdvideo_subdemux_flush);
else
- ret = dvdvideo_play_next_ps_block(opaque, &c->play_state, buf, buf_size,
- &nav_event, dvdvideo_subdemux_flush);
+ ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet,
+ dvdvideo_subdemux_flush);
if (ret == AVERROR_EOF) {
c->mpeg_pb.pub.eof_reached = 1;
@@ -1462,7 +1465,7 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size)
return AVERROR_EOF;
}
- if (ret >= 0 && nav_event == DVDNAV_NAV_PACKET)
+ if (ret == 0 && is_nav_packet)
return FFERROR_REDO;
return ret;
--
2.49.1
From ece2a9a27522f73c7157d67c7cbd99f9c902d1ce Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:55 -0500
Subject: [PATCH 147/434] avformat/dvdvideodec: enable chapter calculation for
menus
Menus are generally segmented by cell, so use them as the
marker delimiters. Requires preindex option to be enabled.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit c1e4b6c676c4e5e587c4762a7a8ca29184bc5f46)
---
doc/demuxers.texi | 1 -
libavformat/dvdvideodec.c | 53 ++++++++++++++++++++++++++-------------
2 files changed, 35 insertions(+), 19 deletions(-)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index 74b68778bd..a03e80732a 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -405,7 +405,6 @@ which requires a slow second pass read in order to index the chapter marker
timestamps from NAV packets. This is non-ideal extra work for real optical drives.
It is recommended and faster to use this option with a backup of the DVD structure
stored on a hard drive. Not compatible with @option{pgc} and @option{pg}.
-Not applicable to menus.
Default is 0, false.
@item trim @var{bool}
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 066edaaa27..5df123ac44 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -909,19 +909,26 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s)
{
DVDVideoDemuxContext *c = s->priv_data;
- int ret = 0, interrupt = 0;
- int nb_chapters = 0, last_ptt = c->opt_chapter_start;
+ int ret, partn, last_partn;
+ int interrupt = 0, nb_chapters = 0;
uint64_t cur_chapter_offset = 0, cur_chapter_duration = 0;
DVDVideoPlaybackState state = {0};
uint8_t nav_buf[DVDVIDEO_BLOCK_SIZE];
- int nav_event;
+ int is_nav_packet;
if (c->opt_chapter_start == c->opt_chapter_end)
- return ret;
+ return 0;
- if ((ret = dvdvideo_play_open(s, &state)) < 0)
- return ret;
+ if (c->opt_menu) {
+ if ((ret = dvdvideo_menu_open(s, &state)) < 0)
+ return ret;
+ last_partn = state.celln;
+ } else {
+ if ((ret = dvdvideo_play_open(s, &state)) < 0)
+ return ret;
+ last_partn = c->opt_chapter_start;
+ }
if (state.pgc->nr_of_programs == 1)
goto end_close;
@@ -930,15 +937,22 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s)
"Indexing chapter markers, this will take a long time. Please wait...\n");
while (!(interrupt = ff_check_interrupt(&s->interrupt_callback))) {
- ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE,
- &nav_event, NULL);
+ if (c->opt_menu)
+ ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet,
+ NULL);
+ else
+ ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet,
+ NULL);
+
if (ret < 0 && ret != AVERROR_EOF)
goto end_close;
- if (nav_event != DVDNAV_NAV_PACKET && ret != AVERROR_EOF)
+ if (!is_nav_packet && ret != AVERROR_EOF)
continue;
- if (state.ptt == last_ptt) {
+ partn = c->opt_menu ? state.celln : state.ptt;
+
+ if (partn == last_partn) {
cur_chapter_duration += state.vobu_duration;
/* ensure we add the last chapter */
if (ret != AVERROR_EOF)
@@ -957,7 +971,7 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s)
cur_chapter_offset += cur_chapter_duration;
cur_chapter_duration = state.vobu_duration;
- last_ptt = state.ptt;
+ last_partn = partn;
if (ret == AVERROR_EOF)
break;
@@ -977,7 +991,10 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s)
ret = 0;
end_close:
- dvdvideo_play_close(s, &state);
+ if (c->opt_menu)
+ dvdvideo_menu_close(s, &state);
+ else
+ dvdvideo_play_close(s, &state);
return ret;
}
@@ -1523,11 +1540,10 @@ static int dvdvideo_read_header(AVFormatContext *s)
if (c->opt_menu) {
if (c->opt_region ||
c->opt_title > 1 ||
- c->opt_preindex ||
c->opt_chapter_start > 1 ||
c->opt_chapter_end > 0) {
av_log(s, AV_LOG_ERROR, "-menu is not compatible with the -region, -title, "
- "-preindex, or -chapter_start/-chapter_end options\n");
+ "or -chapter_start/-chapter_end options\n");
return AVERROR(EINVAL);
}
@@ -1544,10 +1560,11 @@ static int dvdvideo_read_header(AVFormatContext *s)
c->opt_menu_lu = 1;
}
- if ((ret = dvdvideo_ifo_open(s)) < 0 ||
- (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 ||
- (ret = dvdvideo_subdemux_open(s)) < 0 ||
- (ret = dvdvideo_video_stream_setup(s)) < 0 ||
+ if ((ret = dvdvideo_ifo_open(s)) < 0 ||
+ (c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) ||
+ (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 ||
+ (ret = dvdvideo_subdemux_open(s)) < 0 ||
+ (ret = dvdvideo_video_stream_setup(s)) < 0 ||
(ret = dvdvideo_audio_stream_add_all(s)) < 0)
return ret;
--
2.49.1
From 75c1943e30923b8d3c409dc65c56e9b423c50727 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:56 -0500
Subject: [PATCH 148/434] avformat/dvdvideodec: simplify dvdvideo_read_packet()
The function has a few branches where it discards frames via
FFERROR_REDO; consolidate is via a goto block to simplify the
function and improve readability. Logging still maintains
all the relevant details for the reason of the discard.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 1964faa568c2b7bd9e172f7090a601625bb5dd9e)
---
libavformat/dvdvideodec.c | 44 +++++++++++++++++++--------------------
1 file changed, 21 insertions(+), 23 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 5df123ac44..ebcfdca9a5 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1615,8 +1615,9 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
DVDVideoDemuxContext *c = s->priv_data;
int ret;
- enum AVMediaType st_type;
- int found_stream = 0;
+ int is_key = 0;
+ int st_mapped = 0;
+ AVStream *st_subdemux;
if (c->play_end)
return AVERROR_EOF;
@@ -1629,32 +1630,27 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
if (!c->segment_started)
c->segment_started = 1;
- st_type = c->mpeg_ctx->streams[pkt->stream_index]->codecpar->codec_type;
+ st_subdemux = c->mpeg_ctx->streams[pkt->stream_index];
+ is_key = pkt->flags & AV_PKT_FLAG_KEY;
/* map the subdemuxer stream to the parent demuxer's stream (by startcode) */
for (int i = 0; i < s->nb_streams; i++) {
- if (s->streams[i]->id == c->mpeg_ctx->streams[pkt->stream_index]->id) {
+ if (s->streams[i]->id == st_subdemux->id) {
pkt->stream_index = s->streams[i]->index;
- found_stream = 1;
+ st_mapped = 1;
+
break;
}
}
- if (!found_stream) {
- av_log(s, AV_LOG_DEBUG, "discarding frame with stream that was not in IFO headers "
- "(stream id=%d)\n", c->mpeg_ctx->streams[pkt->stream_index]->id);
-
- return FFERROR_REDO;
- }
+ if (!st_mapped)
+ goto discard;
if (pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE) {
if (!c->play_started) {
/* try to start at the beginning of a GOP */
- if (st_type != AVMEDIA_TYPE_VIDEO || !(pkt->flags & AV_PKT_FLAG_KEY)) {
- av_log(s, AV_LOG_VERBOSE, "Discarding packet which is not a video keyframe or "
- "with unset PTS/DTS at start\n");
- return FFERROR_REDO;
- }
+ if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key)
+ goto discard;
c->first_pts = pkt->pts;
c->play_started = 1;
@@ -1663,13 +1659,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
pkt->pts += c->play_state.ts_offset - c->first_pts;
pkt->dts += c->play_state.ts_offset - c->first_pts;
- if (pkt->pts < 0) {
- av_log(s, AV_LOG_VERBOSE, "Discarding packet with negative PTS (st=%d pts=%" PRId64 "), "
- "this is OK at start of playback\n",
- pkt->stream_index, pkt->pts);
-
- return FFERROR_REDO;
- }
+ if (pkt->pts < 0)
+ goto discard;
} else {
av_log(s, AV_LOG_WARNING, "Unset PTS or DTS @ st=%d pts=%" PRId64 " dts=%" PRId64 "\n",
pkt->stream_index, pkt->pts, pkt->dts);
@@ -1681,6 +1672,13 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
c->play_state.ts_offset, c->first_pts);
return c->play_end ? AVERROR_EOF : 0;
+
+discard:
+ av_log(s, st_mapped ? AV_LOG_VERBOSE : AV_LOG_DEBUG,
+ "Discarding frame @ st=%d pts=%" PRId64 " dts=%" PRId64 " is_key=%d st_mapped=%d\n",
+ st_mapped ? pkt->stream_index : -1, pkt->pts, pkt->dts, is_key, st_mapped);
+
+ return FFERROR_REDO;
}
static int dvdvideo_close(AVFormatContext *s)
--
2.49.1
From e46e1c3368a97dcf87cd93d386928ddff7b75001 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:57 -0500
Subject: [PATCH 149/434] avformat/dvdvideodec: reset the subdemuxer on
discontinuity instead of flushing
DVDs naturally consist of segmented MPEG-PS blobs within a VOB
(i.e. VOBs are not linear). NAV packs set the segment boundaries.
When switching between segments, discontinuities occur and thus
the subdemuxer needs to be reset. The current approach to manage
this is by invoking ff_read_frame_flush() on the subdemuxer context,
via a callback function which is invoked during the menu or dvdnav
block functions. The same subdemuxer context is used throughout
the demux, with a stretched PTS wrap bits value (64) + disabled
overflow correction, and then flushed on each segment. Eventually,
a play_end context variable is set to declare EOF.
However, this approach causes frame drops. The block read flushes the
demuxer before the frame read is complete, causing frames to drop
on discontinuity. The play_end signal likewise ends playback before
the frame read is complete, causing frames to drop at end of the title.
To compound the issue, the PTS wrap bits value of 64 is wrong;
the VOBU limit is actually 32 and the overflow correction should work.
Instead, EOF the MPEG-PS subdemuxer organically when each VOB segment
ends, and re-open it if needed with the offset after the full frame read
is complete. In doing so, correct the PTS wrap behavior to 32 bits and
remove the play_end/segment_started signals and callback pattern.
Note that the timestamps as reported by the NAV packets are known as
"PTMs", so the fields storing the time prior to adjustment are renamed
accordingly. This makes it more clear when we are offsetting the
NAV packet reported timestamps versus what we present as a demuxer.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit a1ae66c827370b7caa90f10068bdd913f4cf2f18)
---
libavformat/dvdvideodec.c | 139 ++++++++++++++++++++------------------
1 file changed, 75 insertions(+), 64 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index ebcfdca9a5..726c45601f 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -56,7 +56,7 @@
#define DVDVIDEO_MAX_PS_SEARCH_BLOCKS 128
#define DVDVIDEO_BLOCK_SIZE 2048
#define DVDVIDEO_TIME_BASE_Q (AVRational) { 1, 90000 }
-#define DVDVIDEO_PTS_WRAP_BITS 64 /* VOBUs use 32 (PES allows 33) */
+#define DVDVIDEO_PTS_WRAP_BITS 32 /* VOBUs use 32 (PES allows 33) */
#define DVDVIDEO_LIBDVDX_LOG_BUFFER_SIZE 1024
#define PCI_START_BYTE 45 /* complement dvdread's DSI_START_BYTE */
@@ -115,8 +115,9 @@ typedef struct DVDVideoPlaybackState {
int pgc_nb_pg_est; /* number of PGs as reported by IFOs */
int pgcn; /* ID of the PGC we are playing */
int pgn; /* ID of the PG we are in now */
+ int ptm_discont; /* signal that a PTM discontinuity occurred */
+ int64_t ptm_offset; /* PTM discontinuity offset (as NAV value) */
int ptt; /* ID of the chapter we are in now */
- int64_t ts_offset; /* PTS discontinuity offset (ex. VOB change) */
uint32_t vobu_duration; /* duration of the current VOBU */
uint32_t vobu_e_ptm; /* end PTM of the current VOBU */
int vtsn; /* ID of the active VTS (video title set) */
@@ -163,11 +164,11 @@ typedef struct DVDVideoDemuxContext {
/* playback control */
int64_t first_pts; /* the PTS of the first video keyframe */
- int play_end; /* signal EOF to the parent demuxer */
- DVDVideoPlaybackState play_state; /* the active playback state */
int play_started; /* signal that playback has started */
+ DVDVideoPlaybackState play_state; /* the active playback state */
+ int64_t pts_offset; /* PTS discontinuity offset (ex. VOB change) */
int seek_warned; /* signal that we warned about seeking limits */
- int segment_started; /* signal that subdemuxer is on a segment */
+ int subdemux_reset; /* signal that subdemuxer should be reset */
} DVDVideoDemuxContext;
static void dvdvideo_libdvdread_log(void *opaque, dvd_logger_level_t level,
@@ -390,8 +391,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state)
}
static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state,
- uint8_t *buf, int buf_size, int *p_is_nav_packet,
- void (*flush_cb)(AVFormatContext *s))
+ uint8_t *buf, int buf_size, int *p_is_nav_packet)
{
int64_t blocks_read = 0;
uint8_t read_buf[DVDVIDEO_BLOCK_SIZE] = {0};
@@ -399,6 +399,7 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
dsi_t dsi = (dsi_t) {0};
(*p_is_nav_packet) = 0;
+ state->ptm_discont = 0;
if (buf_size != DVDVIDEO_BLOCK_SIZE) {
av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n",
@@ -465,10 +466,8 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
if (state->in_pgc) {
if (state->vobu_e_ptm != pci.pci_gi.vobu_s_ptm) {
- if (flush_cb)
- flush_cb(s);
-
- state->ts_offset += state->vobu_e_ptm - pci.pci_gi.vobu_s_ptm;
+ state->ptm_discont = 1;
+ state->ptm_offset += state->vobu_e_ptm - pci.pci_gi.vobu_s_ptm;
}
} else {
state->in_pgc = 1;
@@ -479,9 +478,10 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
state->vobu_duration = pci.pci_gi.vobu_e_ptm - pci.pci_gi.vobu_s_ptm;
av_log(s, AV_LOG_DEBUG, "NAV packet: sector=%d "
- "vobu_s_ptm=%d vobu_e_ptm=%d ts_offset=%" PRId64 "\n",
+ "vobu_s_ptm=%d vobu_e_ptm=%d ptm_offset=%" PRId64 "\n",
dsi.dsi_gi.nv_pck_lbn,
- pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ts_offset);
+ pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ptm_offset);
+
(*p_is_nav_packet) = 1;
@@ -615,8 +615,7 @@ end_dvdnav_error:
}
static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state,
- uint8_t *buf, int buf_size, int *p_is_nav_packet,
- void (*flush_cb)(AVFormatContext *s))
+ uint8_t *buf, int buf_size, int *p_is_nav_packet)
{
DVDVideoDemuxContext *c = s->priv_data;
@@ -631,6 +630,7 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
dsi_t *e_dsi;
(*p_is_nav_packet) = 0;
+ state->ptm_discont = 0;
if (buf_size != DVDVIDEO_BLOCK_SIZE) {
av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n",
@@ -776,10 +776,8 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
state->in_ps = 1;
} else {
if (state->vobu_e_ptm != e_pci->pci_gi.vobu_s_ptm) {
- if (flush_cb)
- flush_cb(s);
-
- state->ts_offset += state->vobu_e_ptm - e_pci->pci_gi.vobu_s_ptm;
+ state->ptm_discont = 1;
+ state->ptm_offset += state->vobu_e_ptm - e_pci->pci_gi.vobu_s_ptm;
}
}
@@ -938,11 +936,9 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s)
while (!(interrupt = ff_check_interrupt(&s->interrupt_callback))) {
if (c->opt_menu)
- ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet,
- NULL);
+ ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet);
else
- ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet,
- NULL);
+ ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet);
if (ret < 0 && ret != AVERROR_EOF)
goto end_close;
@@ -1444,19 +1440,6 @@ static int dvdvideo_subp_stream_add_all(AVFormatContext *s)
return 0;
}
-static void dvdvideo_subdemux_flush(AVFormatContext *s)
-{
- DVDVideoDemuxContext *c = s->priv_data;
-
- if (!c->segment_started)
- return;
-
- av_log(s, AV_LOG_DEBUG, "flushing sub-demuxer\n");
- avio_flush(&c->mpeg_pb.pub);
- ff_read_frame_flush(c->mpeg_ctx);
- c->segment_started = 0;
-}
-
static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size)
{
AVFormatContext *s = opaque;
@@ -1465,25 +1448,32 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size)
int ret;
int is_nav_packet;
- if (c->play_end)
- return AVERROR_EOF;
-
if (c->opt_menu)
- ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet,
- dvdvideo_subdemux_flush);
+ ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet);
else
- ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet,
- dvdvideo_subdemux_flush);
+ ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet);
- if (ret == AVERROR_EOF) {
- c->mpeg_pb.pub.eof_reached = 1;
- c->play_end = 1;
+ if (ret < 0)
+ goto subdemux_eof;
- return AVERROR_EOF;
+ if (is_nav_packet) {
+ if (c->play_state.ptm_discont) {
+ c->subdemux_reset = 1;
+
+ ret = AVERROR_EOF;
+ goto subdemux_eof;
+ }
+
+ return FFERROR_REDO;
}
- if (ret == 0 && is_nav_packet)
- return FFERROR_REDO;
+ return ret;
+
+subdemux_eof:
+ c->mpeg_pb.pub.eof_reached = 1;
+ c->mpeg_pb.pub.error = ret;
+ c->mpeg_pb.pub.read_packet = NULL;
+ c->mpeg_pb.pub.buf_end = c->mpeg_pb.pub.buf_ptr = c->mpeg_pb.pub.buffer;
return ret;
}
@@ -1525,12 +1515,24 @@ static int dvdvideo_subdemux_open(AVFormatContext *s)
c->mpeg_ctx->max_analyze_duration = 0;
c->mpeg_ctx->interrupt_callback = s->interrupt_callback;
c->mpeg_ctx->pb = &c->mpeg_pb.pub;
- c->mpeg_ctx->correct_ts_overflow = 0;
c->mpeg_ctx->io_open = NULL;
return avformat_open_input(&c->mpeg_ctx, "", &ff_mpegps_demuxer.p, NULL);
}
+static int dvdvideo_subdemux_reset(AVFormatContext *s)
+{
+ int ret;
+
+ av_log(s, AV_LOG_VERBOSE, "Resetting sub-demuxer\n");
+
+ dvdvideo_subdemux_close(s);
+ if ((ret = dvdvideo_subdemux_open(s)) < 0)
+ return ret;
+
+ return 0;
+}
+
static int dvdvideo_read_header(AVFormatContext *s)
{
DVDVideoDemuxContext *c = s->priv_data;
@@ -1619,16 +1621,20 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
int st_mapped = 0;
AVStream *st_subdemux;
- if (c->play_end)
- return AVERROR_EOF;
-
ret = av_read_frame(c->mpeg_ctx, pkt);
+ if (ret < 0) {
+ if (c->subdemux_reset && ret == AVERROR_EOF) {
+ c->subdemux_reset = 0;
+ c->pts_offset = c->play_state.ptm_offset;
+
+ if ((ret = dvdvideo_subdemux_reset(s)) < 0)
+ return ret;
+
+ return FFERROR_REDO;
+ }
- if (ret < 0)
return ret;
-
- if (!c->segment_started)
- c->segment_started = 1;
+ }
st_subdemux = c->mpeg_ctx->streams[pkt->stream_index];
is_key = pkt->flags & AV_PKT_FLAG_KEY;
@@ -1656,8 +1662,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
c->play_started = 1;
}
- pkt->pts += c->play_state.ts_offset - c->first_pts;
- pkt->dts += c->play_state.ts_offset - c->first_pts;
+ pkt->pts += c->pts_offset - c->first_pts;
+ pkt->dts += c->pts_offset - c->first_pts;
if (pkt->pts < 0)
goto discard;
@@ -1667,11 +1673,11 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
}
av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " "
- "ts_offset=%" PRId64 " first_pts=%" PRId64 "\n",
+ "pts_offset=%" PRId64 " first_pts=%" PRId64 "\n",
pkt->stream_index, pkt->pts, pkt->dts,
- c->play_state.ts_offset, c->first_pts);
+ c->pts_offset, c->first_pts);
- return c->play_end ? AVERROR_EOF : 0;
+ return 0;
discard:
av_log(s, st_mapped ? AV_LOG_VERBOSE : AV_LOG_DEBUG,
@@ -1700,6 +1706,7 @@ static int dvdvideo_close(AVFormatContext *s)
static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags)
{
DVDVideoDemuxContext *c = s->priv_data;
+ int ret;
int64_t new_nav_pts;
pci_t* new_nav_pci;
dsi_t* new_nav_dsi;
@@ -1744,13 +1751,17 @@ static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t time
c->play_state.in_ps = 0;
c->play_state.is_seeking = 1;
c->play_state.nav_pts = timestamp;
- c->play_state.ts_offset = timestamp;
+ c->play_state.ptm_offset = timestamp;
+ c->play_state.ptm_discont = 0;
c->play_state.vobu_e_ptm = new_nav_pci->pci_gi.vobu_s_ptm;
c->first_pts = 0;
c->play_started = 0;
+ c->pts_offset = timestamp;
+ c->subdemux_reset = 0;
- dvdvideo_subdemux_flush(s);
+ if ((ret = dvdvideo_subdemux_reset(s)) < 0)
+ return ret;
av_log(s, AV_LOG_DEBUG, "seeking: requested_nav_pts=%" PRId64 " new_nav_pts=%" PRId64 "\n",
timestamp, new_nav_pts);
--
2.49.1
From a61eb0c2c0d51567de5e8d3627bff9ba08020410 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:58 -0500
Subject: [PATCH 150/434] avformat/dvdvideodec: check the length of a NAV
packet when reading titles
Some discs present titles with bogus NAV packets. We apply this check
for menus and for title MPEG blocks, but we should also apply it
for NAV packets during title demuxing.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit afc152f564fbeca4d2ff62195e3f0b6244e28cb3)
---
libavformat/dvdvideodec.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 726c45601f..f7c7ba5a3b 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -740,6 +740,13 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState
return AVERROR_EOF;
}
+ if (nav_len != DVDVIDEO_BLOCK_SIZE) {
+ av_log(s, AV_LOG_ERROR, "Invalid NAV packet size (expected=%d actual=%d)\n",
+ DVDVIDEO_BLOCK_SIZE, nav_len);
+
+ return AVERROR_INVALIDDATA;
+ }
+
e_pci = dvdnav_get_current_nav_pci(state->dvdnav);
e_dsi = dvdnav_get_current_nav_dsi(state->dvdnav);
--
2.49.1
From 212546e9c61a02b92627a8945aaa893644b03acc Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:04:59 -0500
Subject: [PATCH 151/434] avformat/dvdvideodec: default menu_vts option to 1
and clarify description
Menu 0 is the VIDEO_TS root menu, which does not appear to be used
commonly for menu segments. Instead, default to the menu of VTS 1.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 4a03e95ff4c3ed15d5420bd97c7868e0b62e1d0a)
---
doc/demuxers.texi | 2 +-
libavformat/dvdvideodec.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index a03e80732a..95be82aefc 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -384,7 +384,7 @@ Default is 0, the first language unit.
@item menu_vts @var{int}
The VTS where the menu lives, or 0 if it is a VMG menu (root-level).
-Default is 0, VMG menu.
+Default is 1, menu of the first VTS.
@item pgc @var{int}
The entry PGC to start playback, in conjunction with @option{pg}.
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index f7c7ba5a3b..1da1865061 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1783,7 +1783,7 @@ static const AVOption dvdvideo_options[] = {
{"chapter_start", "entry chapter (PTT) number", OFFSET(opt_chapter_start), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM },
{"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
{"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
- {"menu_vts", "menu VTS (0=VMG main menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
+ {"menu_vts", "menu VTS (0=VMG root menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=1 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
{"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM },
{"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM },
{"preindex", "enable for accurate chapter markers, slow (2-pass read)", OFFSET(opt_preindex), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
--
2.49.1
From 340795adc9825230b77a4352e2eba6da3239541c Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:00 -0500
Subject: [PATCH 152/434] avformat/dvdvideodec: remove auto value for menu_lu
option
The "auto" mode serves no functional purpose except for logging
a message and setting the value to 1. The documentation clearly
explains what the option is for.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 60434b483c54aa683a3249a158c8610d5db2fe4a)
---
doc/demuxers.texi | 2 +-
libavformat/dvdvideodec.c | 9 +--------
2 files changed, 2 insertions(+), 9 deletions(-)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index 95be82aefc..86a9158e59 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -380,7 +380,7 @@ Default is false.
@item menu_lu @var{int}
The menu language to demux. In DVD, menus are grouped by language.
-Default is 0, the first language unit.
+Default is 1, the first language unit.
@item menu_vts @var{int}
The VTS where the menu lives, or 0 if it is a VMG menu (root-level).
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 1da1865061..9983d34ec9 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1562,13 +1562,6 @@ static int dvdvideo_read_header(AVFormatContext *s)
return AVERROR(EINVAL);
}
- if (!c->opt_menu_lu) {
- av_log(s, AV_LOG_INFO, "Defaulting to menu language unit #1. "
- "This is not always desirable, validation suggested.\n");
-
- c->opt_menu_lu = 1;
- }
-
if ((ret = dvdvideo_ifo_open(s)) < 0 ||
(c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) ||
(ret = dvdvideo_menu_open(s, &c->play_state)) < 0 ||
@@ -1782,7 +1775,7 @@ static const AVOption dvdvideo_options[] = {
{"chapter_end", "exit chapter (PTT) number (0=end)", OFFSET(opt_chapter_end), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
{"chapter_start", "entry chapter (PTT) number", OFFSET(opt_chapter_start), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM },
{"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
- {"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
+ {"menu_lu", "menu language unit", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM },
{"menu_vts", "menu VTS (0=VMG root menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=1 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM },
{"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM },
{"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM },
--
2.49.1
From 09e08d790efa49aba3ded60a1a70732bc590c475 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:01 -0500
Subject: [PATCH 153/434] avformat/dvdvideodec: open subdemuxer after
initializing IFO headers
It is wasteful to open the subdemuxer if an error occurs while
initializing streams or reading IFO headers.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit a2c57e27d6bb7b849b4e84612bb99dc514f6bc96)
---
libavformat/dvdvideodec.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 9983d34ec9..72565ee125 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1565,9 +1565,9 @@ static int dvdvideo_read_header(AVFormatContext *s)
if ((ret = dvdvideo_ifo_open(s)) < 0 ||
(c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) ||
(ret = dvdvideo_menu_open(s, &c->play_state)) < 0 ||
- (ret = dvdvideo_subdemux_open(s)) < 0 ||
(ret = dvdvideo_video_stream_setup(s)) < 0 ||
- (ret = dvdvideo_audio_stream_add_all(s)) < 0)
+ (ret = dvdvideo_audio_stream_add_all(s)) < 0 ||
+ (ret = dvdvideo_subdemux_open(s)) < 0)
return ret;
return 0;
@@ -1599,16 +1599,14 @@ static int dvdvideo_read_header(AVFormatContext *s)
if (!c->opt_pgc && c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0)
return ret;
- if ((ret = dvdvideo_play_open(s, &c->play_state)) < 0 ||
- (ret = dvdvideo_subdemux_open(s)) < 0 ||
- (ret = dvdvideo_video_stream_setup(s)) < 0 ||
- (ret = dvdvideo_audio_stream_add_all(s)) < 0 ||
- (ret = dvdvideo_subp_stream_add_all(s)) < 0)
+ if ((ret = dvdvideo_play_open(s, &c->play_state)) < 0 ||
+ (!c->opt_pgc && !c->opt_preindex && (ret = dvdvideo_chapters_setup_simple(s)) < 0) ||
+ (ret = dvdvideo_video_stream_setup(s)) < 0 ||
+ (ret = dvdvideo_audio_stream_add_all(s)) < 0 ||
+ (ret = dvdvideo_subp_stream_add_all(s)) < 0 ||
+ (ret = dvdvideo_subdemux_open(s)) < 0)
return ret;
- if (!c->opt_pgc && !c->opt_preindex)
- return dvdvideo_chapters_setup_simple(s);
-
return 0;
}
--
2.49.1
From 19740bcbf8c4e14c110698bedd4a6046c4f5adc7 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:02 -0500
Subject: [PATCH 154/434] avformat/dvdvideodec: remove unnecessary need_parsing
argument
The value is always AVSTREAM_PARSE_HEADERS.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 3656379d9225778d9b76e4cfe6832ae6e594b8a2)
---
libavformat/dvdvideodec.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 72565ee125..d64a678589 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1051,9 +1051,7 @@ static int dvdvideo_video_stream_analyze(AVFormatContext *s, video_attr_t video_
return 0;
}
-static int dvdvideo_video_stream_add(AVFormatContext *s,
- DVDVideoVTSVideoStreamEntry *entry,
- enum AVStreamParseType need_parsing)
+static int dvdvideo_video_stream_add(AVFormatContext *s, DVDVideoVTSVideoStreamEntry *entry)
{
AVStream *st;
FFStream *sti;
@@ -1077,7 +1075,7 @@ static int dvdvideo_video_stream_add(AVFormatContext *s,
sti = ffstream(st);
sti->request_probe = 0;
- sti->need_parsing = need_parsing;
+ sti->need_parsing = AVSTREAM_PARSE_HEADERS;
sti->display_aspect_ratio = entry->dar;
avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS,
@@ -1101,7 +1099,7 @@ static int dvdvideo_video_stream_setup(AVFormatContext *s)
video_attr = c->vts_ifo->vtsi_mat->vts_video_attr;
if ((ret = dvdvideo_video_stream_analyze(s, video_attr, &entry)) < 0 ||
- (ret = dvdvideo_video_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0) {
+ (ret = dvdvideo_video_stream_add(s, &entry)) < 0) {
av_log(s, AV_LOG_ERROR, "Unable to add video stream\n");
return ret;
@@ -1213,8 +1211,7 @@ static int dvdvideo_audio_stream_analyze(AVFormatContext *s, audio_attr_t audio_
return 0;
}
-static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamEntry *entry,
- enum AVStreamParseType need_parsing)
+static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamEntry *entry)
{
AVStream *st;
FFStream *sti;
@@ -1239,7 +1236,7 @@ static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamE
sti = ffstream(st);
sti->request_probe = 0;
- sti->need_parsing = need_parsing;
+ sti->need_parsing = AVSTREAM_PARSE_HEADERS;
avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS,
DVDVIDEO_TIME_BASE_Q.num, DVDVIDEO_TIME_BASE_Q.den);
@@ -1282,7 +1279,7 @@ static int dvdvideo_audio_stream_add_all(AVFormatContext *s)
if (s->streams[j]->id == entry.startcode)
continue;
- if ((ret = dvdvideo_audio_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0)
+ if ((ret = dvdvideo_audio_stream_add(s, &entry)) < 0)
goto break_error;
continue;
@@ -1319,8 +1316,7 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub
return 0;
}
-static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStreamEntry *entry,
- enum AVStreamParseType need_parsing)
+static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStreamEntry *entry)
{
AVStream *st;
FFStream *sti;
@@ -1346,7 +1342,7 @@ static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStrea
sti = ffstream(st);
sti->request_probe = 0;
- sti->need_parsing = need_parsing;
+ sti->need_parsing = AVSTREAM_PARSE_HEADERS;
avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS,
DVDVIDEO_TIME_BASE_Q.num, DVDVIDEO_TIME_BASE_Q.den);
@@ -1371,7 +1367,7 @@ static int dvdvideo_subp_stream_add_internal(AVFormatContext *s, uint32_t offset
if (s->streams[i]->id == entry.startcode)
return 0;
- if ((ret = dvdvideo_subp_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0)
+ if ((ret = dvdvideo_subp_stream_add(s, &entry)) < 0)
goto end_error;
return 0;
--
2.49.1
From 53e66c71613583783d3e7386ee4a015f41dda4bf Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:03 -0500
Subject: [PATCH 155/434] avformat/dvdvideodec: drop packets with unset PTS or
DTS
The packets effectively serve no purpose and we are already
dropping packets with PTS less than 0. This also creates
for a smoother seeking experience after the subdemuxer
reset fix.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit f2f238c3a4855cd0919889940c2f45958ac47be6)
---
libavformat/dvdvideodec.c | 31 +++++++++++++------------------
1 file changed, 13 insertions(+), 18 deletions(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index d64a678589..f20d2aa5cb 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1643,29 +1643,24 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
}
}
- if (!st_mapped)
+ if (!st_mapped || pkt->pts == AV_NOPTS_VALUE || pkt->dts == AV_NOPTS_VALUE)
goto discard;
- if (pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE) {
- if (!c->play_started) {
- /* try to start at the beginning of a GOP */
- if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key)
- goto discard;
-
- c->first_pts = pkt->pts;
- c->play_started = 1;
- }
-
- pkt->pts += c->pts_offset - c->first_pts;
- pkt->dts += c->pts_offset - c->first_pts;
-
- if (pkt->pts < 0)
+ if (!c->play_started) {
+ /* try to start at the beginning of a GOP */
+ if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key)
goto discard;
- } else {
- av_log(s, AV_LOG_WARNING, "Unset PTS or DTS @ st=%d pts=%" PRId64 " dts=%" PRId64 "\n",
- pkt->stream_index, pkt->pts, pkt->dts);
+
+ c->first_pts = pkt->pts;
+ c->play_started = 1;
}
+ pkt->pts += c->pts_offset - c->first_pts;
+ pkt->dts += c->pts_offset - c->first_pts;
+
+ if (pkt->pts < 0)
+ goto discard;
+
av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " "
"pts_offset=%" PRId64 " first_pts=%" PRId64 "\n",
pkt->stream_index, pkt->pts, pkt->dts,
--
2.49.1
From a626a08c45b0b4cefebef740612aa1c52a209bac Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:04 -0500
Subject: [PATCH 156/434] avformat/dvdvideodec: discard duplicate or partial
AC3 samples
Some DVD muxers signal segments to start with duplicate audio samples
when starting extraction from a chapter marker or terminate seamless PGs
on partial audio samples (causing corrupt AC3 frames). Clean up after
these muxers by tracking frames with duplicate PTS and eliminating
partial AC3 frames.
This results in smoother chapter extraction and overall seeking experience,
with linear PTS and AC3 delay within 32ms (1 frame) away from the video.
The issue was not apparent until the flushing pattern was replaced with
a full subdemux reset, as the flushing dropped the frames prematurely,
along side others, as such they were never present to begin with.
(cherry picked from commit 0912407b9de431fb750e74cb307ea7a11fc27e6b)
---
libavformat/dvdvideodec.c | 36 +++++++++++++++++++++++++++++++++++-
1 file changed, 35 insertions(+), 1 deletion(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index f20d2aa5cb..179181ce69 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -38,6 +38,7 @@
#include <dvdread/ifo_types.h>
#include <dvdread/nav_read.h>
+#include "libavcodec/ac3_parser.h"
#include "libavutil/avstring.h"
#include "libavutil/avutil.h"
#include "libavutil/intreadwrite.h"
@@ -166,6 +167,7 @@ typedef struct DVDVideoDemuxContext {
int64_t first_pts; /* the PTS of the first video keyframe */
int play_started; /* signal that playback has started */
DVDVideoPlaybackState play_state; /* the active playback state */
+ int64_t *prev_pts; /* track the previous PTS emitted per stream */
int64_t pts_offset; /* PTS discontinuity offset (ex. VOB change) */
int seek_warned; /* signal that we warned about seeking limits */
int subdemux_reset; /* signal that subdemuxer should be reset */
@@ -1566,7 +1568,7 @@ static int dvdvideo_read_header(AVFormatContext *s)
(ret = dvdvideo_subdemux_open(s)) < 0)
return ret;
- return 0;
+ goto end_ready;
}
if (c->opt_pgc && (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex)) {
@@ -1603,6 +1605,14 @@ static int dvdvideo_read_header(AVFormatContext *s)
(ret = dvdvideo_subdemux_open(s)) < 0)
return ret;
+end_ready:
+ c->prev_pts = av_malloc(s->nb_streams * sizeof(int64_t));
+ if (!c->prev_pts)
+ return AVERROR(ENOMEM);
+
+ for (int i = 0; i < s->nb_streams; i++)
+ c->prev_pts[i] = AV_NOPTS_VALUE;
+
return 0;
}
@@ -1614,6 +1624,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
int is_key = 0;
int st_mapped = 0;
AVStream *st_subdemux;
+ uint8_t ac3_bitstream_id;
+ uint16_t ac3_frame_size;
ret = av_read_frame(c->mpeg_ctx, pkt);
if (ret < 0) {
@@ -1661,11 +1673,27 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt)
if (pkt->pts < 0)
goto discard;
+ /* clean up after DVD muxers which end seamless PGs on duplicate or partial AC3 samples */
+ if (st_subdemux->codecpar->codec_type == AVMEDIA_TYPE_AUDIO &&
+ st_subdemux->codecpar->codec_id == AV_CODEC_ID_AC3) {
+
+ if (pkt->pts <= c->prev_pts[pkt->stream_index])
+ goto discard;
+
+ ret = av_ac3_parse_header(pkt->buf->data, pkt->size,
+ &ac3_bitstream_id, &ac3_frame_size);
+
+ if (ret < 0 || pkt->size != ac3_frame_size)
+ goto discard;
+ }
+
av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " "
"pts_offset=%" PRId64 " first_pts=%" PRId64 "\n",
pkt->stream_index, pkt->pts, pkt->dts,
c->pts_offset, c->first_pts);
+ c->prev_pts[pkt->stream_index] = pkt->pts;
+
return 0;
discard:
@@ -1673,6 +1701,9 @@ discard:
"Discarding frame @ st=%d pts=%" PRId64 " dts=%" PRId64 " is_key=%d st_mapped=%d\n",
st_mapped ? pkt->stream_index : -1, pkt->pts, pkt->dts, is_key, st_mapped);
+ if (st_mapped)
+ c->prev_pts[pkt->stream_index] = pkt->pts;
+
return FFERROR_REDO;
}
@@ -1689,6 +1720,9 @@ static int dvdvideo_close(AVFormatContext *s)
dvdvideo_ifo_close(s);
+ if (c->prev_pts)
+ av_freep(&c->prev_pts);
+
return 0;
}
--
2.49.1
From 7fc55c38c77629723f38fd5a78459b8253589d03 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Mon, 7 Oct 2024 18:05:05 -0500
Subject: [PATCH 157/434] avformat/dvdvideodec: don't allow seeking beyond
dvdnav reported duration
There is no reason to accept timestamp values beyond what dvdnav
reported as the duration of the title.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 1d55f548466516a6a4ed4cc67e118e1c29c6ae5a)
---
libavformat/dvdvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 179181ce69..4d11480dfd 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1743,7 +1743,7 @@ static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t time
if ((flags & AVSEEK_FLAG_BYTE))
return AVERROR(ENOSYS);
- if (timestamp < 0)
+ if (timestamp < 0 || timestamp > s->duration)
return AVERROR(EINVAL);
if (!c->seek_warned) {
--
2.49.1
From 7264127438e468fdf2eb267ac7827fb0f81f6e63 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Tue, 26 Nov 2024 20:09:04 -0600
Subject: [PATCH 158/434] avformat/dvdvideodec: fix missing last chapter marker
due to off-by-one
When using fast chapter marker calculation (default), the last
marker is inadverdently ignored due to an off-by-one.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit a5a899bfcbe458bc9e4e73f883ed63cbaacbb451)
---
libavformat/dvdvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 4d11480dfd..9916351e86 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -874,7 +874,7 @@ static int dvdvideo_chapters_setup_simple(AVFormatContext *s)
int64_t total_duration = 0;
int chapter_start = c->opt_chapter_start;
- int chapter_end = c->opt_chapter_end > 0 ? c->opt_chapter_end : c->play_state.pgc_nb_pg_est - 1;
+ int chapter_end = c->opt_chapter_end > 0 ? c->opt_chapter_end : c->play_state.pgc_nb_pg_est;
/* dvdnav_describe_title_chapters() describes PGs rather than PTTs, so validate our range */
if (c->play_state.pgc_nb_pg_est == 1 ||
--
2.49.1
From a6d4bac44d2d7f034027fadb4920830d521b4190 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Wed, 27 Nov 2024 11:13:44 -0600
Subject: [PATCH 159/434] avformat/dvdvideodec: check return code of
ff_dvdclut_yuv_to_rgb()
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit e256761defe527c81521ae035ae3ee6f16265707)
---
libavformat/dvdvideodec.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c
index 9916351e86..f92c5ae54a 100644
--- a/libavformat/dvdvideodec.c
+++ b/libavformat/dvdvideodec.c
@@ -1299,6 +1299,7 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub
{
DVDVideoDemuxContext *c = s->priv_data;
+ int ret;
char lang_dvd[3] = {0};
entry->startcode = 0x20 + (offset & 0x1F);
@@ -1310,7 +1311,9 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub
/* dvdsub palettes currently have no colorspace tagging and all muxers only support RGB */
/* this is not a lossless conversion, but no use cases are supported for the original YUV */
- ff_dvdclut_yuv_to_rgb(entry->clut, FF_DVDCLUT_CLUT_SIZE);
+ ret = ff_dvdclut_yuv_to_rgb(entry->clut, FF_DVDCLUT_CLUT_SIZE);
+ if (ret < 0)
+ return ret;
AV_WB16(lang_dvd, subp_attr.lang_code);
entry->lang_iso = ff_convert_lang_to(lang_dvd, AV_LANG_ISO639_2_BIBL);
--
2.49.1
From 0ccb070863424e0f355c9d905b91c612eef7af60 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Wed, 27 Nov 2024 23:28:50 -0600
Subject: [PATCH 160/434] doc/demuxers/dvdvideo: seeking is supported, remove
outdated statement
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 1c2c70fe4d17e93401f88fa9e4ec2b8404790bd3)
---
doc/demuxers.texi | 1 -
1 file changed, 1 deletion(-)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index 86a9158e59..cc81c615dd 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -292,7 +292,6 @@ DVD-Video demuxer, powered by libdvdnav and libdvdread.
Can directly ingest DVD titles, specifically sequential PGCs, into
a conversion pipeline. Menu assets, such as background video or audio,
can also be demuxed given the menu's coordinates (at best effort).
-Seeking is not supported at this time.
Block devices (DVD drives), ISO files, and directory structures are accepted.
Activate with @code{-f dvdvideo} in front of one of these inputs.
--
2.49.1
From 3a375e3dcf09f8ac7dcf213160789ff96da88b7c Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Wed, 18 Dec 2024 20:17:35 -0600
Subject: [PATCH 161/434] avcodec/cbs_av1: fix variable shadowing in
cbs_av1_split_fragment()
header is previously declared as an int argument then
shadowed in the scope of the loop as a AV1RawOBUHeader.
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 8e8260aabf39c8c39eb99d5de9c21a76eb314747)
---
libavcodec/cbs_av1.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
index 458381f038..98d745f494 100644
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -728,16 +728,16 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,
}
while (size > 0) {
- AV1RawOBUHeader header;
+ AV1RawOBUHeader obu_header;
uint64_t obu_size;
init_get_bits(&gbc, data, 8 * size);
- err = cbs_av1_read_obu_header(ctx, &gbc, &header);
+ err = cbs_av1_read_obu_header(ctx, &gbc, &obu_header);
if (err < 0)
goto fail;
- if (header.obu_has_size_field) {
+ if (obu_header.obu_has_size_field) {
if (get_bits_left(&gbc) < 8) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid OBU: fragment "
"too short (%"SIZE_SPECIFIER" bytes).\n", size);
@@ -748,7 +748,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,
if (err < 0)
goto fail;
} else
- obu_size = size - 1 - header.obu_extension_flag;
+ obu_size = size - 1 - obu_header.obu_extension_flag;
pos = get_bits_count(&gbc);
av_assert0(pos % 8 == 0 && pos / 8 <= size);
@@ -763,7 +763,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx,
goto fail;
}
- err = ff_cbs_append_unit_data(frag, header.obu_type,
+ err = ff_cbs_append_unit_data(frag, obu_header.obu_type,
data, obu_length, frag->data_ref);
if (err < 0)
goto fail;
--
2.49.1
From 0a51afd21d6c76a9f4e5797135db6e067e3ad645 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Sat, 12 Oct 2024 12:18:30 -0500
Subject: [PATCH 162/434] avformat/smoothstreamingenc: check return value of
avcodec_parameters_copy()
Written in the dominant style of the surrounding code block.
Reviewed-by: ePirat <epirat07@gmail.com>
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 3528bfed450842a991df6e076fe72d4c2eee6432)
---
libavformat/smoothstreamingenc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/smoothstreamingenc.c b/libavformat/smoothstreamingenc.c
index 9547419d31..adf3008003 100644
--- a/libavformat/smoothstreamingenc.c
+++ b/libavformat/smoothstreamingenc.c
@@ -331,7 +331,9 @@ static int ism_write_header(AVFormatContext *s)
if (!(st = avformat_new_stream(ctx, NULL))) {
return AVERROR(ENOMEM);
}
- avcodec_parameters_copy(st->codecpar, s->streams[i]->codecpar);
+ if ((ret = avcodec_parameters_copy(st->codecpar, s->streams[i]->codecpar)) < 0) {
+ return ret;
+ }
st->sample_aspect_ratio = s->streams[i]->sample_aspect_ratio;
st->time_base = s->streams[i]->time_base;
--
2.49.1
From 9d9b87be2b5f3119f1d92e073bbf59114a0555ed Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Fri, 11 Oct 2024 02:06:35 -0500
Subject: [PATCH 163/434] avformat/dashdec: return ret directly in
open_demux_for_component()
Signed-off-by: Marth64 <marth64@proxyid.net>
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 6ee7555a909d263080de8490628e92bf0c5cdb15)
---
libavformat/dashdec.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 99ac6197be..9ce23aec65 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1939,16 +1939,15 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p
}
ret = reopen_demux_for_component(s, pls);
- if (ret < 0) {
- goto fail;
- }
+ if (ret < 0)
+ return ret;
+
for (i = 0; i < pls->ctx->nb_streams; i++) {
AVStream *st = avformat_new_stream(s, NULL);
AVStream *ist = pls->ctx->streams[i];
- if (!st) {
- ret = AVERROR(ENOMEM);
- goto fail;
- }
+ if (!st)
+ return AVERROR(ENOMEM);
+
st->id = i;
avcodec_parameters_copy(st->codecpar, ist->codecpar);
avpriv_set_pts_info(st, ist->pts_wrap_bits, ist->time_base.num, ist->time_base.den);
@@ -1958,8 +1957,6 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p
}
return 0;
-fail:
- return ret;
}
static int is_common_init_section_exist(struct representation **pls, int n_pls)
--
2.49.1
From ba94588afaf1dfbe280202e115f294afd5baf06a Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Fri, 11 Oct 2024 02:06:36 -0500
Subject: [PATCH 164/434] avformat/dashdec: check return code of
avcodec_parameters_copy()
Signed-off-by: Marth64 <marth64@proxyid.net>
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 7acc2ebd5d9e09198ea235870f8e6a9a5de667f8)
---
libavformat/dashdec.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 9ce23aec65..cd1b3da3a2 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1949,7 +1949,11 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p
return AVERROR(ENOMEM);
st->id = i;
- avcodec_parameters_copy(st->codecpar, ist->codecpar);
+
+ ret = avcodec_parameters_copy(st->codecpar, ist->codecpar);
+ if (ret < 0)
+ return ret;
+
avpriv_set_pts_info(st, ist->pts_wrap_bits, ist->time_base.num, ist->time_base.den);
// copy disposition
--
2.49.1
From ae7332065bb3c17fcef0244346e5a7f4edc94d97 Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Fri, 11 Oct 2024 02:06:37 -0500
Subject: [PATCH 165/434] avformat/dashdec: format open_demux_for_component()
Signed-off-by: Marth64 <marth64@proxyid.net>
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 95bb47de7dc564ad8a36d6c0770400815a9b39c2)
---
libavformat/dashdec.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index cd1b3da3a2..a1d274f2f0 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -1932,11 +1932,10 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p
int i;
pls->parent = s;
- pls->cur_seq_no = calc_cur_seg_no(s, pls);
+ pls->cur_seq_no = calc_cur_seg_no(s, pls);
- if (!pls->last_seq_no) {
+ if (!pls->last_seq_no)
pls->last_seq_no = calc_max_seg_no(pls, s->priv_data);
- }
ret = reopen_demux_for_component(s, pls);
if (ret < 0)
--
2.49.1
From dd78b9ed7c5ee97e9eb2bd03f8387c2d6348ceca Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Sat, 12 Oct 2024 12:25:40 -0500
Subject: [PATCH 166/434] avformat/hlsenc: check return value of
avcodec_parameters_copy()
Written in the dominant style of the surrounding code block.
Signed-off-by: Marth64 <marth64@proxyid.net>
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit f46415f37332c4291882ae1b403aaf8179e3ea49)
---
libavformat/hlsenc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c
index 1e932b7b0e..081d91f7d9 100644
--- a/libavformat/hlsenc.c
+++ b/libavformat/hlsenc.c
@@ -887,7 +887,9 @@ static int hls_mux_init(AVFormatContext *s, VariantStream *vs)
if (!(st = avformat_new_stream(loc, NULL)))
return AVERROR(ENOMEM);
- avcodec_parameters_copy(st->codecpar, vs->streams[i]->codecpar);
+ ret = avcodec_parameters_copy(st->codecpar, vs->streams[i]->codecpar);
+ if (ret < 0)
+ return ret;
if (!oc->oformat->codec_tag ||
av_codec_get_id (oc->oformat->codec_tag, vs->streams[i]->codecpar->codec_tag) == st->codecpar->codec_id ||
av_codec_get_tag(oc->oformat->codec_tag, vs->streams[i]->codecpar->codec_id) <= 0) {
--
2.49.1
From 60551696c0867654ee705cccf891c3b30d53b0dd Mon Sep 17 00:00:00 2001
From: Marth64 <marth64@proxyid.net>
Date: Wed, 20 Nov 2024 01:35:18 -0600
Subject: [PATCH 167/434] avformat/libssh: fix credential variables typo
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 084d3515cabf1f7141e8789f21db534b304a47cc)
---
libavformat/libssh.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/libssh.c b/libavformat/libssh.c
index 5c062a7245..523b79befe 100644
--- a/libavformat/libssh.c
+++ b/libavformat/libssh.c
@@ -190,13 +190,13 @@ static av_cold int libssh_close(URLContext *h)
static av_cold int libssh_connect(URLContext *h, const char *url, char *path, size_t path_size)
{
LIBSSHContext *libssh = h->priv_data;
- char proto[10], hostname[1024], credencials[1024];
+ char proto[10], hostname[1024], credentials[1024];
int port = 22, ret;
const char *user = NULL, *pass = NULL;
char *end = NULL;
av_url_split(proto, sizeof(proto),
- credencials, sizeof(credencials),
+ credentials, sizeof(credentials),
hostname, sizeof(hostname),
&port,
path, path_size,
@@ -212,7 +212,7 @@ static av_cold int libssh_connect(URLContext *h, const char *url, char *path, si
if ((ret = libssh_create_ssh_session(libssh, hostname, port)) < 0)
return ret;
- user = av_strtok(credencials, ":", &end);
+ user = av_strtok(credentials, ":", &end);
pass = av_strtok(end, ":", &end);
if ((ret = libssh_authentication(libssh, user, pass)) < 0)
--
2.49.1
From 9328e07ad5196e2992c348b518e046c539830ca5 Mon Sep 17 00:00:00 2001
From: Eugene Zemtsov <eugene@chromium.org>
Date: Thu, 24 Oct 2024 18:54:10 -0700
Subject: [PATCH 168/434] avformat/mov: fix crash when trying to get a fragment
time for a non-existing fragment
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Marth64 <marth64@proxyid.net>
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit 7c9bde1d0d26ffa74b6791666c3a27c6d5d5019f)
---
libavformat/mov.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index a4c5a2a93c..ff32d4160e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1644,6 +1644,8 @@ static int64_t get_frag_time(AVFormatContext *s, AVStream *dst_st,
// to fragments that referenced this stream in the sidx
if (sc->has_sidx) {
frag_stream_info = get_frag_stream_info(frag_index, index, sc->id);
+ if (!frag_stream_info)
+ return AV_NOPTS_VALUE;
if (frag_stream_info->sidx_pts != AV_NOPTS_VALUE)
return frag_stream_info->sidx_pts;
if (frag_stream_info->first_tfra_pts != AV_NOPTS_VALUE)
--
2.49.1
From 5b2ee11a600a847b08adb5d4aaa425950b83afa3 Mon Sep 17 00:00:00 2001
From: Eugene Zemtsov <eugene@chromium.org>
Date: Thu, 24 Oct 2024 18:52:45 -0700
Subject: [PATCH 169/434] avcodec/decode: Fix incorrect enum type used in
side_data_map()
It's AVPacketSideDataType, not AVFrameSideDataType.
Reviewed-by: Ted (Chromium) Meyer <tmathmeyer@chromium.org>
Reviewed-by: Marth64 <marth64@proxyid.net>
Signed-off-by: Marth64 <marth64@proxyid.net>
(cherry picked from commit e9c3698ed23ab3d8cf1fe1fc74b3b2f8ba42c865)
---
libavcodec/decode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index c331bb8596..148af71ac4 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -1466,8 +1466,8 @@ static int side_data_map(AVFrame *dst,
{
for (int i = 0; map[i].packet < AV_PKT_DATA_NB; i++) {
- const enum AVFrameSideDataType type_pkt = map[i].packet;
- const enum AVFrameSideDataType type_frame = map[i].frame;
+ const enum AVPacketSideDataType type_pkt = map[i].packet;
+ const enum AVFrameSideDataType type_frame = map[i].frame;
const AVPacketSideData *sd_pkt;
AVFrameSideData *sd_frame;
--
2.49.1
From d72536008ac377164b00d214a2521e5ce604260b Mon Sep 17 00:00:00 2001
From: Jonathan Baudanza <jon@jonb.org>
Date: Wed, 8 Jan 2025 09:22:13 +0900
Subject: [PATCH 170/434] avformat/rtpdec: int overflow in start_time_realtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This was previously adjusted by me in 6b3f9c2e92b.
Unfortunately, I traded one integer overflow bug for
another.
Currently, NTP timestamps that exceed INT64_MAX
(~Jan 20, 1968) will cause an overflow when passed
to av_rescale.
This patch replaces av_rescale, which operates on
int64_t, with ff_parse_ntp_time, which operates on
uint64_t. This will give the correct values for
timestamps back around the NTP epoch and present day
timestamps.
Fixes ticket #11388.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c0fbb6d5b7aab2e01125e30c69c0af4c07855e6f)
---
libavformat/rtsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index c48fa26d90..5ea471b40c 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -2320,7 +2320,7 @@ redo:
}
// Make real NTP start time available in AVFormatContext
if (s->start_time_realtime == AV_NOPTS_VALUE) {
- s->start_time_realtime = av_rescale (rtpctx->first_rtcp_ntp_time, 1000000, 1LL << 32) - NTP_OFFSET_US;
+ s->start_time_realtime = ff_parse_ntp_time(rtpctx->first_rtcp_ntp_time) - NTP_OFFSET_US;
if (rtpctx->st) {
s->start_time_realtime -=
av_rescale_q (rtpctx->rtcp_ts_offset, rtpctx->st->time_base, AV_TIME_BASE_Q);
--
2.49.1
From aeb86310480382138a9046d5a427f4a8c1b866ea Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 19 Nov 2024 13:24:49 -0300
Subject: [PATCH 171/434] avformat/hevc: fix writing hvcC when no arrays are
provided in hvcC-formatted input
Don't reject extradata with missing PS NALUs if array_completeness is not
requested.
Fixes a regression since a696b28886.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5813e5aa344b8c03c83bf62e729be0f447944ed1)
---
libavformat/hevc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavformat/hevc.c b/libavformat/hevc.c
index e1f31ee1bb..7cf0b0ffb2 100644
--- a/libavformat/hevc.c
+++ b/libavformat/hevc.c
@@ -958,10 +958,12 @@ static int hvcc_write(AVIOContext *pb, HEVCDecoderConfigurationRecord *hvcc,
/*
* We need at least one of each: VPS, SPS and PPS.
*/
- if ((!numNalus[VPS_INDEX] || numNalus[VPS_INDEX] > HEVC_MAX_VPS_COUNT) && !is_lhvc)
+ if ((flags & FLAG_ARRAY_COMPLETENESS) &&
+ (!numNalus[VPS_INDEX] || numNalus[VPS_INDEX] > HEVC_MAX_VPS_COUNT) && !is_lhvc)
return AVERROR_INVALIDDATA;
- if (!numNalus[SPS_INDEX] || numNalus[SPS_INDEX] > HEVC_MAX_SPS_COUNT ||
- !numNalus[PPS_INDEX] || numNalus[PPS_INDEX] > HEVC_MAX_PPS_COUNT)
+ if ((flags & FLAG_ARRAY_COMPLETENESS) &&
+ (!numNalus[SPS_INDEX] || numNalus[SPS_INDEX] > HEVC_MAX_SPS_COUNT ||
+ !numNalus[PPS_INDEX] || numNalus[PPS_INDEX] > HEVC_MAX_PPS_COUNT))
return AVERROR_INVALIDDATA;
/* unsigned int(8) configurationVersion = 1; */
--
2.49.1
From 14af28c2f5facd07951aa048e53bd562d80826aa Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 Aug 2024 22:53:47 +0200
Subject: [PATCH 172/434] avformat/mxfdec: Check that key was read sucessfull
Fixes: use of uninitialized value
Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c62cbcae2612acbc7ab5e8a7e7815674a6e8df4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 2f8ab3890d..a263239288 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1530,7 +1530,8 @@ static int mxf_read_indirect_value(void *arg, AVIOContext *pb, int size)
if (size <= 17)
return 0;
- avio_read(pb, key, 17);
+ if (avio_read(pb, key, 17) != 17)
+ return AVERROR_INVALIDDATA;
/* TODO: handle other types of of indirect values */
if (memcmp(key, mxf_indirect_value_utf16le, 17) == 0) {
return mxf_read_utf16le_string(pb, size - 17, &tagged_value->value);
--
2.49.1
From 0da3deb079a614b68468fb2057796fa94663fcdf Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 Aug 2024 23:15:32 +0200
Subject: [PATCH 173/434] avcodec/hapdec: Clear tex buffer
The code following makes no attempt to initialize all of the buffer
Fixes: use of uninitialized value
Fixes: 70980/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5329909059223552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7eeeda703b599847aa89c7c08bb433d0b3da9590)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hapdec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/hapdec.c b/libavcodec/hapdec.c
index 918eff7876..70bf592f2a 100644
--- a/libavcodec/hapdec.c
+++ b/libavcodec/hapdec.c
@@ -310,6 +310,7 @@ static int hap_decode(AVCodecContext *avctx, AVFrame *frame,
ret = av_reallocp(&ctx->tex_buf, ctx->tex_size);
if (ret < 0)
return ret;
+ memset(ctx->tex_buf, 0, ctx->tex_size);
avctx->execute2(avctx, decompress_chunks_thread, NULL,
ctx->chunk_results, ctx->chunk_count);
--
2.49.1
From f44a7207f018906cef31be86ec7d6ee276fbb54d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 7 Aug 2024 22:55:03 +0200
Subject: [PATCH 174/434] avcodec/cfhdenc: Clear dwt_tmp
This occurs on a 32x32 input
Fixes: use of uninitialized value
Fixes: 70897/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5960860961406976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9de721de709fa9cc06a3ce3f542a1e7d45b2b0bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cfhdenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/cfhdenc.c b/libavcodec/cfhdenc.c
index 3be6798d8d..ceea15efc4 100644
--- a/libavcodec/cfhdenc.c
+++ b/libavcodec/cfhdenc.c
@@ -285,7 +285,7 @@ static av_cold int cfhd_encode_init(AVCodecContext *avctx)
s->plane[i].dwt_buf =
av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_buf));
s->plane[i].dwt_tmp =
- av_malloc_array(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
+ av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp));
if (!s->plane[i].dwt_buf || !s->plane[i].dwt_tmp)
return AVERROR(ENOMEM);
--
2.49.1
From d32543f520576d336063b3371d1692e18541a9ea Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Aug 2024 14:47:42 +0200
Subject: [PATCH 175/434] avformat/rmdec: check that buf if completely filled
Fixes: use of uninitialized value
Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9578c135d00dd9cc01491b8559d7fad5a387e90d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rmdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 25a8681cfd..4b21105d3d 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -188,7 +188,8 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
st->codecpar->ch_layout.nb_channels = avio_rb16(pb);
if (version == 5) {
ast->deint_id = avio_rl32(pb);
- avio_read(pb, buf, 4);
+ if (avio_read(pb, buf, 4) != 4)
+ return AVERROR_INVALIDDATA;
buf[4] = 0;
} else {
AV_WL32(buf, 0);
--
2.49.1
From d322ffdef526a2913423a0ba69fb729c7f54837f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Aug 2024 16:33:43 +0200
Subject: [PATCH 176/434] avformat/jpegxl_anim_dec: clear buffer padding
Fixes: use of uninitialized value
Fixes: 70992/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-5735819170611200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f0b95bb176445a509d99e7497e90f20355b8411)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/jpegxl_anim_dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c
index 2338a2e8c0..7798f3dabc 100644
--- a/libavformat/jpegxl_anim_dec.c
+++ b/libavformat/jpegxl_anim_dec.c
@@ -43,7 +43,7 @@ typedef struct JXLAnimDemuxContext {
static int jpegxl_anim_probe(const AVProbeData *p)
{
- uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE];
+ uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE] = {0};
int copied = 0, ret;
FFJXLMetadata meta = { 0 };
--
2.49.1
From 5129ae45bf1c4b50074309175328ea922d7bf98d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 16 Aug 2024 17:30:45 +0200
Subject: [PATCH 177/434] avcodec/get_buffer: Use av_buffer_mallocz() for audio
same as its done for video
Fixes: Use of uninintialized value
Fixes: 70993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6378949754552320
Fixes: 71104/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5001538727116800
For the AAC/USAC/SBR code which reads uninitialized memory, it would be good, if it did not
a fix for that is welcome!
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b9b4c9ebf07748993ad91ba9b9b9f06914d67865)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/get_buffer.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/get_buffer.c b/libavcodec/get_buffer.c
index ff19f61e86..7e705380fc 100644
--- a/libavcodec/get_buffer.c
+++ b/libavcodec/get_buffer.c
@@ -142,7 +142,10 @@ static int update_frame_pool(AVCodecContext *avctx, AVFrame *frame)
if (ret < 0)
goto fail;
- pool->pools[0] = av_buffer_pool_init(pool->linesize[0], NULL);
+ pool->pools[0] = av_buffer_pool_init(pool->linesize[0],
+ CONFIG_MEMORY_POISONING ?
+ NULL :
+ av_buffer_allocz);
if (!pool->pools[0]) {
ret = AVERROR(ENOMEM);
goto fail;
--
2.49.1
From 553517868db17584029fc5ecb2648be93245cab5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 5 Jan 2025 02:36:25 +0100
Subject: [PATCH 178/434] avfilter/vf_addroi: Add missing NULL termination to
addroi_var_names[]()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: out of array read
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b72de492959fb19eab37368232e65a4371c367f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_addroi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavfilter/vf_addroi.c b/libavfilter/vf_addroi.c
index de857eced4..d6765e9d8c 100644
--- a/libavfilter/vf_addroi.c
+++ b/libavfilter/vf_addroi.c
@@ -39,6 +39,7 @@ enum {
static const char *const addroi_var_names[] = {
"iw",
"ih",
+ NULL,
};
typedef struct AddROIContext {
--
2.49.1
From 601616f2de4274fd6da6ed9a80843d6c56e65131 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 6 Jan 2025 05:06:10 +0100
Subject: [PATCH 179/434] avfilter/vf_grayworld: Use the correct pointer for
av_log()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: crash
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ffa127aa6853790acb40004fbab97f13ff4c72e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_grayworld.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/vf_grayworld.c b/libavfilter/vf_grayworld.c
index a6a51dcb7d..91b097a4b8 100644
--- a/libavfilter/vf_grayworld.c
+++ b/libavfilter/vf_grayworld.c
@@ -266,10 +266,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
}
/* input and output transfer will be linear */
if (in->color_trc == AVCOL_TRC_UNSPECIFIED) {
- av_log(s, AV_LOG_WARNING, "Untagged transfer, assuming linear light.\n");
+ av_log(ctx, AV_LOG_WARNING, "Untagged transfer, assuming linear light.\n");
out->color_trc = AVCOL_TRC_LINEAR;
} else if (in->color_trc != AVCOL_TRC_LINEAR) {
- av_log(s, AV_LOG_WARNING, "Gray world color correction works on linear light only.\n");
+ av_log(ctx, AV_LOG_WARNING, "Gray world color correction works on linear light only.\n");
}
td.in = in;
--
2.49.1
From b827ac49b770635fc666f8543cb9585e1bc6308b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 6 Jan 2025 22:01:39 +0100
Subject: [PATCH 180/434] avfilter/af_pan: Fix sscanf() use
Fixes: Memory Data Leak
Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5b6391d64807578ab872dc58fb8aa621dcfc38a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/af_pan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
index 0d20b0307b..5feb2439c7 100644
--- a/libavfilter/af_pan.c
+++ b/libavfilter/af_pan.c
@@ -196,7 +196,7 @@ static av_cold int init(AVFilterContext *ctx)
sign = 1;
while (1) {
gain = 1;
- if (sscanf(arg, "%lf%n *%n", &gain, &len, &len))
+ if (sscanf(arg, "%lf%n *%n", &gain, &len, &len) >= 1)
arg += len;
if (parse_channel_name(&arg, &in_ch_id, &named)){
av_log(ctx, AV_LOG_ERROR,
--
2.49.1
From 658029334e078a9f0af1efbcbbd8daf871241dc2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 1 Dec 2024 03:25:09 +0100
Subject: [PATCH 181/434] swscale/output: Fix undefined overflow in
yuv2rgba64_full_X_c_template()
Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int'
Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56faee21c136942c491f30a2e82cfbbfce180beb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/output.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libswscale/output.c b/libswscale/output.c
index ae9a50637a..366883ab1b 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -1352,9 +1352,9 @@ yuv2rgba64_full_X_c_template(SwsContext *c, const int16_t *lumFilter,
B = U * c->yuv2rgb_u2b_coeff;
// 8bit: 30 - 22 = 8bit, 16bit: 30bit - 14 = 16bit
- output_pixel(&dest[0], av_clip_uintp2(((R_B + Y)>>14) + (1<<15), 16));
- output_pixel(&dest[1], av_clip_uintp2((( G + Y)>>14) + (1<<15), 16));
- output_pixel(&dest[2], av_clip_uintp2(((B_R + Y)>>14) + (1<<15), 16));
+ output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + (unsigned)Y)>>14) + (1<<15), 16));
+ output_pixel(&dest[1], av_clip_uintp2(((int)( G + (unsigned)Y)>>14) + (1<<15), 16));
+ output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + (unsigned)Y)>>14) + (1<<15), 16));
if (eightbytes) {
output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
dest += 4;
--
2.49.1
From da1e316a1f3ddd1db01fd25d8ee975b63238d595 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 1 Dec 2024 03:31:56 +0100
Subject: [PATCH 182/434] avcodec/osq: Fixes several undefined overflows in
do_decode()
Fixes: signed integer overflow: 1239596184 + 2119376059 cannot be represented in type 'int'
Fixes: 376136844/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6581164455821312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f511b4518fa4337f603275f865eb13ac5520d0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 1bf6264699..83b4a9d618 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -300,7 +300,7 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += (int)(P2 + P3) / 2 + (unsigned)p;
break;
case 8:
- dst[n] += (int)(P2 + P3) / 2;
+ dst[n] += (int)(P2 + P3) / 2 + 0U;
break;
case 9:
dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p;
@@ -309,13 +309,13 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p;
break;
case 11:
- dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2;
+ dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2 + 0U;
break;
case 12:
dst[n] += (unsigned)dst[B];
break;
case 13:
- dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2;
+ dst[n] += (int)((unsigned)dst[D] + dst[B]) / 2 + 0U;
break;
case 14:
dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p;
--
2.49.1
From 585c799b1088f9f97c1ae7cde33cb3b1aceaa0cc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 1 Dec 2024 21:40:43 +0100
Subject: [PATCH 183/434] avformat/iamf_parse: Check output_channel_count
Fixes: -nan is outside the range of representable values of type 'int'
Fixes: 377072730/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6545416570601472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4485a0fd77c50157feb308090d84b52cd84e80a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/iamf_parse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 3486104aba..1ec6924908 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -417,7 +417,7 @@ static int ambisonics_config(void *s, AVIOContext *pb,
output_channel_count = avio_r8(pb); // C
substream_count = avio_r8(pb); // N
- if (audio_element->nb_substreams != substream_count)
+ if (audio_element->nb_substreams != substream_count || output_channel_count == 0)
return AVERROR_INVALIDDATA;
order = floor(sqrt(output_channel_count - 1));
--
2.49.1
From 73fd3789955a76553d74f9453c8ca2c5f18a6fb9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 1 Dec 2024 22:27:18 +0100
Subject: [PATCH 184/434] avcodec/aacsbr_template: Clear n_q on error
Fixes: index 5 out of bounds for type 'uint8_t [5]'
Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f029bfb7f9ca1c73fecb8d0eacf3c4e0550f771)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aacsbr_template.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
index 436b549fe7..9fae44d9a5 100644
--- a/libavcodec/aacsbr_template.c
+++ b/libavcodec/aacsbr_template.c
@@ -599,6 +599,7 @@ static int sbr_make_f_derived(AACDecContext *ac, SpectralBandReplication *sbr)
if (sbr->n_q > 5) {
av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q);
+ sbr->n_q = 1;
return -1;
}
--
2.49.1
From 5e02e1ba96efcd052f815e6b5c51433176c7b16c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 1 Dec 2024 23:30:55 +0100
Subject: [PATCH 185/434] avcodec/vc1dec: Clear block_index in
vc1_decode_reset()
Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251de1791e645f16e80b09d82999d4a5e24b1ad1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vc1dec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 5f1a5bd437..2c314e7b55 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -788,6 +788,7 @@ static av_cold void vc1_decode_reset(AVCodecContext *avctx)
for (i = 0; i < 4; i++)
av_freep(&v->sr_rows[i >> 1][i & 1]);
ff_mpv_common_end(&v->s);
+ memset(v->s.block_index, 0, sizeof(v->s.block_index));
av_freep(&v->mv_type_mb_plane);
av_freep(&v->direct_mb_plane);
av_freep(&v->forward_mb_plane);
--
2.49.1
From 41f805228415c51a65b533de8e7f2fa42b24f8ed Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 9 Jan 2025 00:02:35 +0100
Subject: [PATCH 186/434] avformat/mov: Factorize sanity check out
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 16b3d3e3ebb9ff7b00c0fd14b0167779ada87f86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index ff32d4160e..6918a6e045 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5021,6 +5021,24 @@ static int mov_update_iamf_streams(MOVContext *c, const AVStream *st)
}
#endif
+static int sanity_checks(void *log_obj, MOVStreamContext *sc, int index)
+{
+ if ((sc->chunk_count && (!sc->stts_count || !sc->stsc_count ||
+ (!sc->sample_size && !sc->sample_count))) ||
+ (!sc->chunk_count && sc->sample_count)) {
+ av_log(log_obj, AV_LOG_ERROR, "stream %d, missing mandatory atoms, broken header\n",
+ index);
+ return 1;
+ }
+
+ if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
+ av_log(log_obj, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
+ index);
+ return 2;
+ }
+ return 0;
+}
+
static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
AVStream *st;
@@ -5053,19 +5071,9 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_freep(&sc->stsc_data);
}
- /* sanity checks */
- if ((sc->chunk_count && (!sc->stts_count || !sc->stsc_count ||
- (!sc->sample_size && !sc->sample_count))) ||
- (!sc->chunk_count && sc->sample_count)) {
- av_log(c->fc, AV_LOG_ERROR, "stream %d, missing mandatory atoms, broken header\n",
- st->index);
- return 0;
- }
- if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) {
- av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n",
- st->index);
- return AVERROR_INVALIDDATA;
- }
+ ret = sanity_checks(c->fc, sc, st->index);
+ if (ret)
+ return ret > 1 ? AVERROR_INVALIDDATA : 0;
fix_timescale(c, sc);
--
2.49.1
From 0bb8a38c10a16c6956baabbf0dd9a2f634c89a01 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 7 Jan 2025 23:21:32 +0100
Subject: [PATCH 187/434] avformat/mov: perform sanity checks for heif before
index building
Fixes: undefined NULL pointer use
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6363211175493632
This performs equivalent sanity checks as are done in mov_read_trak()
before mov_build_index()
Reported-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit afbc3a1b23b3ba3e5a3f2820228a5fe51b517be7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6918a6e045..695b975147 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10136,7 +10136,8 @@ static int mov_parse_heif_items(AVFormatContext *s)
st->codecpar->width = item->width;
st->codecpar->height = item->height;
- if (sc->sample_count != 1 || sc->chunk_count != 1)
+ err = sanity_checks(s, sc, item->item_id);
+ if (err)
return AVERROR_INVALIDDATA;
sc->sample_sizes[0] = item->extent_length;
--
2.49.1
From 5fed7010f8586f682e2d4e2d3068569ca989e192 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 9 Jan 2025 21:35:06 +0100
Subject: [PATCH 188/434] avcodec/ffv1enc: Fix handling of 32bit unsigned
symbols
This may be needed for floats
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 402824e9e99461f1c9e74a6730ced40894669560)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 7dcecb5905..3e80906dd0 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -198,7 +198,7 @@ static av_always_inline av_flatten void put_symbol_inline(RangeCoder *c,
} while (0)
if (v) {
- const int a = FFABS(v);
+ const unsigned a = is_signed ? FFABS(v) : v;
const int e = av_log2(a);
put_rac(c, state + 0, 0);
if (e <= 9) {
--
2.49.1
From ece76d7dd4660da49a880cf3be50c2eb51278db1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 8 Jan 2025 02:59:28 +0100
Subject: [PATCH 189/434] avcodec/mpegvideo_enc: Check FLV1 resolution limits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 827c073154f4cc17d1bd3777dff3b58370210bcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mpegvideo_enc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index a332edd1ae..74b598d089 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -567,6 +567,12 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
av_log(avctx, AV_LOG_ERROR, "H.263 does not support resolutions above 2048x1152\n");
return AVERROR(EINVAL);
}
+ if (s->codec_id == AV_CODEC_ID_FLV1 &&
+ (avctx->width > 65535 ||
+ avctx->height > 65535 )) {
+ av_log(avctx, AV_LOG_ERROR, "FLV does not support resolutions above 16bit\n");
+ return AVERROR(EINVAL);
+ }
if ((s->codec_id == AV_CODEC_ID_H263 ||
s->codec_id == AV_CODEC_ID_H263P ||
s->codec_id == AV_CODEC_ID_RV20) &&
--
2.49.1
From 75385a729f6c4b8a47e4cc1fe4717172982efad2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 8 Jan 2025 03:11:02 +0100
Subject: [PATCH 190/434] avfilter/vf_v360: Fix NULL pointer use
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: applying zero offset to null pointer
partly Fixes: verysmall.flv
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66e9888bf418984a274beddbc3e87e9f1b8f5077)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_v360.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c
index 12e40205ba..4ba389e335 100644
--- a/libavfilter/vf_v360.c
+++ b/libavfilter/vf_v360.c
@@ -4255,8 +4255,8 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
int16_t *u = r->u[p] + ((j - slice_start) * uv_linesize + i) * elements;
int16_t *v = r->v[p] + ((j - slice_start) * uv_linesize + i) * elements;
int16_t *ker = r->ker[p] + ((j - slice_start) * uv_linesize + i) * elements;
- uint8_t *mask8 = p ? NULL : r->mask + ((j - slice_start) * s->pr_width[0] + i);
- uint16_t *mask16 = p ? NULL : (uint16_t *)r->mask + ((j - slice_start) * s->pr_width[0] + i);
+ uint8_t *mask8 = (p || !r->mask) ? NULL : r->mask + ((j - slice_start) * s->pr_width[0] + i);
+ uint16_t *mask16 = (p || !r->mask) ? NULL : (uint16_t *)r->mask + ((j - slice_start) * s->pr_width[0] + i);
int in_mask, out_mask;
if (s->out_transpose)
--
2.49.1
From ac9c710e180880d77fd6844cf3a2435681bf6419 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 15 Jan 2025 03:30:21 +0100
Subject: [PATCH 191/434] avutil/avstring: dont mess with NULL pointers in
av_match_list()
Fixes: applying zero offset to null pointer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6c54943d161812b3c4034116cb14f3f5c05dc43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavutil/avstring.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavutil/avstring.c b/libavutil/avstring.c
index 2071dd36a5..875eb691db 100644
--- a/libavutil/avstring.c
+++ b/libavutil/avstring.c
@@ -452,10 +452,12 @@ int av_match_list(const char *name, const char *list, char separator)
if (k && (!p[k] || p[k] == separator))
return 1;
q = strchr(q, separator);
- q += !!q;
+ if(q)
+ q++;
}
p = strchr(p, separator);
- p += !!p;
+ if (p)
+ p++;
}
return 0;
--
2.49.1
From c3c7ecfe48d464a0b06564f2e92504b1d9c91d69 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 16 Jan 2025 00:22:05 +0100
Subject: [PATCH 192/434] avformat/dashdec: Check whitelist
Fixes: CVE-2023-6602, V. DASH Playlist SSRF
Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/dashdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index a1d274f2f0..71d79067a9 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -446,7 +446,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url,
av_freep(pb);
av_dict_copy(&tmp, *opts, 0);
av_dict_copy(&tmp, opts2, 0);
- ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);
+ ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp, s->protocol_whitelist, s->protocol_blacklist);
if (ret >= 0) {
// update cookies on http response with setcookies.
char *new_cookies = NULL;
@@ -1225,7 +1225,7 @@ static int parse_manifest(AVFormatContext *s, const char *url, AVIOContext *in)
close_in = 1;
av_dict_copy(&opts, c->avio_opts, 0);
- ret = avio_open2(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts);
+ ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist);
av_dict_free(&opts);
if (ret < 0)
return ret;
--
2.49.1
From 5ee56ebd30488be9c44d3744458222673df53bf5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 19 Jan 2025 02:02:52 +0100
Subject: [PATCH 193/434] avcodec/ffv1enc: Fix RCT for GBR colorspace
It performs better when its less buggy
Compression changes for rgb_scanline_half_piz_dw_t08 (using float16 with remaping) from
56086 byte to 34371
(with a single slice its 28122 byte)
prior remap it was 188186 bytes
ACES_OT_VWG_SampleFrames/ACES_OT_VWG_SampleFrames improves too but only by a fraction of a percent
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62c98cdd549a44d59d5b01d42dfbe35aed413d37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1enc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 3e80906dd0..7b8ed7acc6 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -1002,6 +1002,10 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc,
r = p[0];
g = p[1];
b = p[2];
+ } else if (f->use32bit || transparency) {
+ g = *((const uint16_t *)(src[0] + x*2 + stride[0]*y));
+ b = *((const uint16_t *)(src[1] + x*2 + stride[1]*y));
+ r = *((const uint16_t *)(src[2] + x*2 + stride[2]*y));
} else {
b = *((const uint16_t*)(src[0] + x*2 + stride[0]*y));
g = *((const uint16_t*)(src[1] + x*2 + stride[1]*y));
--
2.49.1
From 30bef79c6929540655ccf7b86ce565b31f9c6564 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 26 Dec 2024 01:46:49 +0100
Subject: [PATCH 194/434] avformat/vqf: Check avio_read() in add_metadata()
Fixes: use of uninitialized data
Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c43dbecbdad152a91eadc7538b545852eee562ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/vqf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index 4820e0817c..79deb33744 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -63,7 +63,8 @@ static void add_metadata(AVFormatContext *s, uint32_t tag,
buf = av_malloc(len+1);
if (!buf)
return;
- avio_read(s->pb, buf, len);
+ if (len != avio_read(s->pb, buf, len))
+ return;
buf[len] = 0;
AV_WL32(key, tag);
av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL);
--
2.49.1
From c82813c966084e553abb35f00aeaab59038b11d9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 31 Dec 2024 04:13:25 +0100
Subject: [PATCH 195/434] avformat/vqf: Propagate errors from add_metadata()
Suggested-by: Marton Balint <cus@passwd.hu>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49fa3f6c5ba6d43cc4b3ade4f8d9dc2fdbc71f0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/vqf.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index 79deb33744..58b1546f53 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -51,23 +51,28 @@ static int vqf_probe(const AVProbeData *probe_packet)
return AVPROBE_SCORE_EXTENSION;
}
-static void add_metadata(AVFormatContext *s, uint32_t tag,
+static int add_metadata(AVFormatContext *s, uint32_t tag,
unsigned int tag_len, unsigned int remaining)
{
int len = FFMIN(tag_len, remaining);
char *buf, key[5] = {0};
+ int ret;
if (len == UINT_MAX)
- return;
+ return AVERROR_INVALIDDATA;
buf = av_malloc(len+1);
if (!buf)
- return;
- if (len != avio_read(s->pb, buf, len))
- return;
+ return AVERROR(ENOMEM);
+
+ ret = avio_read(s->pb, buf, len);
+ if (ret < 0)
+ return ret;
+ if (len != ret)
+ return AVERROR_INVALIDDATA;
buf[len] = 0;
AV_WL32(key, tag);
- av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL);
+ return av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL);
}
static const AVMetadataConv vqf_metadata_conv[] = {
@@ -165,7 +170,9 @@ static int vqf_read_header(AVFormatContext *s)
avio_skip(s->pb, FFMIN(len, header_size));
break;
default:
- add_metadata(s, chunk_tag, len, header_size);
+ ret = add_metadata(s, chunk_tag, len, header_size);
+ if (ret < 0)
+ return ret;
break;
}
--
2.49.1
From f710d5af0a749c0c2e29eac3a202b211791562a7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 1 Jan 2025 05:03:08 +0100
Subject: [PATCH 196/434] avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
Fixes: use-of-uninitialized-value
Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e81d410242ea604c4f667da4a415836c1575d72f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cbs_vp9.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c
index 816d06da04..ff99fe32fb 100644
--- a/libavcodec/cbs_vp9.c
+++ b/libavcodec/cbs_vp9.c
@@ -375,7 +375,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
superframe_header = frag->data[frag->data_size - 1];
if ((superframe_header & 0xe0) == 0xc0) {
- VP9RawSuperframeIndex sfi;
+ VP9RawSuperframeIndex sfi = {0};
GetBitContext gbc;
size_t index_size, pos;
int i;
--
2.49.1
From 1646840988ed12aefc35ef283bb44f91df277ad9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 26 Dec 2024 02:53:45 +0100
Subject: [PATCH 197/434] avformat/wtvdec: Initialize buf
ff_parse_mpeg2_descriptor() reads over what is initialized
Fixes: use of uninitialized memory
Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 17b019c517af26c6d2f0c6266938c60d36db1fa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/wtvdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
index 730c7fca78..21c9649869 100644
--- a/libavformat/wtvdec.c
+++ b/libavformat/wtvdec.c
@@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p
int stream_index = ff_find_stream_index(s, sid);
if (stream_index >= 0) {
AVStream *st = s->streams[stream_index];
- uint8_t buf[258];
+ uint8_t buf[258] = {0};
const uint8_t *pbuf = buf;
int buf_size;
--
2.49.1
From 43eaca54bc88f86be84b3c7b276bd03a71a72653 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 26 Dec 2024 03:07:51 +0100
Subject: [PATCH 198/434] avformat/ipmovie: Check signature_buffer read
Fixes: use of uninitilaized data
Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 788abe0d253b2034af15876d7889265d4746df2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/ipmovie.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/ipmovie.c b/libavformat/ipmovie.c
index 5d1748953a..3701be276f 100644
--- a/libavformat/ipmovie.c
+++ b/libavformat/ipmovie.c
@@ -614,7 +614,8 @@ static int ipmovie_read_header(AVFormatContext *s)
ipmovie->avf = s;
- avio_read(pb, signature_buffer, sizeof(signature_buffer));
+ if (avio_read(pb, signature_buffer, sizeof(signature_buffer)) != sizeof(signature_buffer))
+ return AVERROR_INVALIDDATA;
while (memcmp(signature_buffer, signature, sizeof(signature))) {
memmove(signature_buffer, signature_buffer + 1, sizeof(signature_buffer) - 1);
signature_buffer[sizeof(signature_buffer) - 1] = avio_r8(pb);
--
2.49.1
From 5f337bd79837e1f7a94d934de21729062acd40b7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 26 Dec 2024 03:28:53 +0100
Subject: [PATCH 199/434] avformat/iamf_reader: Initialize padding and check
read in ff_iamf_read_packet()
Fixes: Use of uninitialized memory
Fixes: 377642312/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554550985424896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aec2933344b2b32fc931bdf0b46eef1bd42225ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/iamf_reader.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c
index 9f3469b64f..d331e1315e 100644
--- a/libavformat/iamf_reader.c
+++ b/libavformat/iamf_reader.c
@@ -282,7 +282,7 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c,
int read = 0;
while (1) {
- uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
+ uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE] = {0};
enum IAMF_OBU_Type type;
unsigned obu_size;
unsigned skip_samples, discard_padding;
@@ -294,6 +294,8 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c,
size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size));
if (size < 0)
return size;
+ if (size != FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size))
+ return AVERROR_INVALIDDATA;
len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type,
&skip_samples, &discard_padding);
--
2.49.1
From 293e4ddd986f97622d887002820c61e895a348db Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 30 Nov 2024 01:48:22 +0100
Subject: [PATCH 200/434] avcodec/huffyuvdec: Initialize whole output for
decode_gray_bitstream()
Fixes: use of uninitialized memory
Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef71552cf970876085d99834abdb8e429aea9730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/huffyuvdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c
index a8ccb724f5..c98904d497 100644
--- a/libavcodec/huffyuvdec.c
+++ b/libavcodec/huffyuvdec.c
@@ -783,6 +783,8 @@ static void decode_gray_bitstream(HYuvDecContext *s, int count)
for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
READ_2PIX(s->temp[0][2 * i], s->temp[0][2 * i + 1], 0);
}
+ for (; i < count; i++)
+ s->temp[0][2 * i] = s->temp[0][2 * i + 1] = 0;
} else {
for (i = 0; i < count; i++) {
READ_2PIX(s->temp[0][2 * i], s->temp[0][2 * i + 1], 0);
--
2.49.1
From a7a6d92e841815780f1fc137e60cc88317f634bd Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 23 Sep 2024 20:05:37 +0200
Subject: [PATCH 201/434] avformat/mxfdec: Check avio_read() success in
mxf_decrypt_triplet()
Fixes: Use of uninitialized memory
Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ecc96f4d08d74b0590ab03f39f93f386910c4c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index a263239288..682f724260 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -671,7 +671,8 @@ static int mxf_decrypt_triplet(AVFormatContext *s, AVPacket *pkt, KLVPacket *klv
if (size < 32 || size - 32 < orig_size || (int)orig_size != orig_size)
return AVERROR_INVALIDDATA;
avio_read(pb, ivec, 16);
- avio_read(pb, tmpbuf, 16);
+ if (avio_read(pb, tmpbuf, 16) != 16)
+ return AVERROR_INVALIDDATA;
if (mxf->aesc)
av_aes_crypt(mxf->aesc, tmpbuf, tmpbuf, 1, ivec, 1);
if (memcmp(tmpbuf, checkv, 16))
--
2.49.1
From dc07f98934edb0d78d7a7cdacd65188af9423045 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 23 Jan 2025 01:21:59 +0100
Subject: [PATCH 202/434] Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 186 insertions(+)
diff --git a/Changelog b/Changelog
index 17bec3ceee..56f7993e72 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,192 @@
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
+version 7.1.1:
+ avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
+ avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
+ avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet()
+ avformat/ipmovie: Check signature_buffer read
+ avformat/wtvdec: Initialize buf
+ avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
+ avformat/vqf: Propagate errors from add_metadata()
+ avformat/vqf: Check avio_read() in add_metadata()
+ avcodec/ffv1enc: Fix RCT for GBR colorspace
+ avformat/dashdec: Check whitelist
+ avutil/avstring: dont mess with NULL pointers in av_match_list()
+ avfilter/vf_v360: Fix NULL pointer use
+ avcodec/mpegvideo_enc: Check FLV1 resolution limits
+ avcodec/ffv1enc: Fix handling of 32bit unsigned symbols
+ avformat/mov: perform sanity checks for heif before index building
+ avformat/mov: Factorize sanity check out
+ avcodec/vc1dec: Clear block_index in vc1_decode_reset()
+ avcodec/aacsbr_template: Clear n_q on error
+ avformat/iamf_parse: Check output_channel_count
+ avcodec/osq: Fixes several undefined overflows in do_decode()
+ swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
+ avfilter/af_pan: Fix sscanf() use
+ avfilter/vf_grayworld: Use the correct pointer for av_log()
+ avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]()
+ avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video
+ avformat/jpegxl_anim_dec: clear buffer padding
+ avformat/rmdec: check that buf if completely filled
+ avcodec/cfhdenc: Clear dwt_tmp
+ avcodec/hapdec: Clear tex buffer
+ avformat/mxfdec: Check that key was read sucessfull
+ avformat/hevc: fix writing hvcC when no arrays are provided in hvcC-formatted input
+ avformat/rtpdec: int overflow in start_time_realtime
+ avcodec/decode: Fix incorrect enum type used in side_data_map()
+ avformat/mov: fix crash when trying to get a fragment time for a non-existing fragment
+ avformat/libssh: fix credential variables typo
+ avformat/hlsenc: check return value of avcodec_parameters_copy()
+ avformat/dashdec: format open_demux_for_component()
+ avformat/dashdec: check return code of avcodec_parameters_copy()
+ avformat/dashdec: return ret directly in open_demux_for_component()
+ avformat/smoothstreamingenc: check return value of avcodec_parameters_copy()
+ avcodec/cbs_av1: fix variable shadowing in cbs_av1_split_fragment()
+ doc/demuxers/dvdvideo: seeking is supported, remove outdated statement
+ avformat/dvdvideodec: check return code of ff_dvdclut_yuv_to_rgb()
+ avformat/dvdvideodec: fix missing last chapter marker due to off-by-one
+ avformat/dvdvideodec: don't allow seeking beyond dvdnav reported duration
+ avformat/dvdvideodec: discard duplicate or partial AC3 samples
+ avformat/dvdvideodec: drop packets with unset PTS or DTS
+ avformat/dvdvideodec: remove unnecessary need_parsing argument
+ avformat/dvdvideodec: open subdemuxer after initializing IFO headers
+ avformat/dvdvideodec: remove auto value for menu_lu option
+ avformat/dvdvideodec: default menu_vts option to 1 and clarify description
+ avformat/dvdvideodec: check the length of a NAV packet when reading titles
+ avformat/dvdvideodec: reset the subdemuxer on discontinuity instead of flushing
+ avformat/dvdvideodec: simplify dvdvideo_read_packet()
+ avformat/dvdvideodec: enable chapter calculation for menus
+ avformat/dvdvideodec: standardize the NAV packet event signal
+ avformat/dvdvideodec: move memcpy below missed NAV packet warning
+ avformat/dvdvideodec: remove "auto" value for -pg option, default to 1
+ avformat/dvdvideodec: measure duration of the current menu VOBU in state
+ avformat/dvdvideodec: fix menu PGC number off-by-one in state
+ avformat/dvdvideodec: remove unused headers
+ lavc/aarch64: Fix ff_pred16x16_plane_neon_10
+ lavc/aarch64: Fix ff_pred8x8_plane_neon_10
+ aarch64/vvc: Fix clip in alf
+ vp9: recon: Use emulated edge to prevent buffer overflows
+ arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
+ aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
+ avformat/rpl: Fix check for negative values
+ avformat/mlvdec: Check avio_read()
+ avcodec/aac/aacdec: Free channel layout
+ avformat/mov: dereference pointer after null check
+ avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
+ avformat/matroskadec: Check pre_ns for overflow
+ tools/target_dec_fuzzer: Adjust threshold for EACMV
+ tools/target_dec_fuzzer: Adjust threshold for MVC1
+ tools/target_dec_fuzzer: Adjust Threshold for indeo5
+ avutil/timecode: Avoid fps overflow in av_timecode_get_smpte_from_framenum()
+ avcodec/aac/aacdec_usac: Dont leave type at a invalid value
+ avcodec/aac/aacdec_usac: Clean ics2->max_sfb when first SCE fails
+ avcodec/webp: Check ref_x/y
+ avcodec/ilbcdec: Initialize tempbuff2
+ swscale/swscale_unscaled: Fix odd height with nv24_to_yuv420p_chroma()
+ avcodec/hevc/hevcdec: initialize qp_y_tab
+ avformat/qcp: Check for read failure in header
+ avcodec/eatgq: Check bytestream2_get_buffer() for failure
+ avformat/dxa: check bpc
+ swscale/slice: clear allocated memory in alloc_lines()
+ avcodec/h2645_parse: Ignore NAL with nuh_layer_id == 63
+ MAINTAINERS: Lauri is still available but is really low on time nowadays
+ MAINTAINERS: Remove Guillaume Poirier and Romain Dolbeau
+ avcodec/mjpegdec: Disallow progressive bayer images
+ avformat/icodec: fix integer overflow with nb_pal
+ doc/developer: Document relationship between git accounts and MAINTAINERS
+ doc/infra: Document trac backup system
+ doc/infra: Document gitolite
+ avformat/vividas: Check avio_read() for failure
+ avformat/ilbc: Check avio_read() for failure
+ avformat/nistspheredec: Clear buffer
+ avformat/mccdec: Initialize and check rate.den
+ avformat/rpl: check channels
+ INSTALL: explain the circular dependency issue and solution
+ avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
+ avformat/mxfdec: Fix overflow in midpoint computation
+ swscale/output: used unsigned for bit accumulation
+ swscale/rgb2rgb_template: Fix ff_rgb24toyv12_c() with odd height
+ avcodec/rangecoder: only perform renorm check/loop for callers that need it
+ avcodec/ffv1: add a named constant for the quant table size
+ avcodec/ffv1: RCT is only possible with RGB
+ avcodec/ffv1enc: Fix RCT with RGB64
+ avcodec/ffv1dec: Fix end computation with ec=2
+ avcodec/ffv1enc: Move slice termination into threads
+ avcodec/ffv1enc: Prevent generation of files with broken slices
+ avformat/matroskadec: Check desc_bytes so bits fit in 64bit
+ avformat/mov: Avoid overflow in dts
+ avcodec/ffv1enc: Correct error message about unsupported version
+ avcodec/ffv1: Store and reuse sx/sy
+ avcodec/ffv1enc: Slice combination is unsupported
+ avcodec/ffv1enc: 2Pass mode is not possible with golomb coding
+ avfilter/buffersrc: check for valid sample rate
+ avcodec/libdav1d: clear the buffered Dav1dData on decoding failure
+ avformat/iamf_writer: ensure the stream groups are not empty
+ avformat/iamf_writer: fix setting num_samples_per_frame for OPUS
+ avformat/iamf_parse: fix setting duration for the last subblock in a parameter definition
+ avformat/iamf_parse: add checks to parameter definition durations
+ avformat/iamf_parse: reject ambisonics mode > 1
+ checkasm: Print benchmarks of C-only functions
+ avcodec/ac3dec: fix downmix logic for eac3
+ avcodec/codec_desc: remove Intra Only prop for AAC
+ avcodec/mediacodecdec: set set keyframe flag in output frames
+ avcodec/libfdk-aacenc: set keyframe in output packets
+ avcodec/libfdk-aacdec: set keyframe flag and profile in output frames
+ avcodec/audiotoolboxnec: set set keyframe flag in output packets
+ avcodec/audiotoolboxdec: set set keyframe flag in output frames
+ avcodec/aacenc: set keyframe flag in output packets
+ avcodec/aac/aacdec: set keyframe flag in output frames
+ avcodec/aac_parser: set key_frame and profile
+ avformat/mov: don't unconditionally set all audio packets in fragments as key frames
+ avformat/matroskadec: set all frames in a keyframe simple box as keyframes
+ avformat/test/movenc: set audio packets as key frames
+ avformat/movenc: write stss boxes for xHE-AAC
+ avformat/spdifdec: parse headers for audio codecs
+ avformat/movenc: don't disable edit lists when writing CMAF output
+ avcodec/libfdk-aacenc: export CPB properties
+ avformat/movenc: don't write a calculated avgBitrate when the provided one is unset
+ libavutil/riscv: Make use of elf_aux_info() on FreeBSD / OpenBSD riscv
+ libavutil/ppc: defines involving bit shifts should be unsigned
+ libavutil/ppc: Include the hardware feature flags like the other archs
+ lavu/riscv: fix compilation without Vector support
+ avfilter/f_loop: fix aloop activate logic
+ avfilter/f_loop: fix length of aloop leftover buffer
+ avfilter/vf_zscale: align the frame buffers
+ lavfi/vf_zscale: fix call to av_pix_fmt_count_planes
+ lavfi/vf_zscale: fix tmp buffer ptr alignment for zimg_filter_graph_process
+ avfilter/framepool: align the frame buffers
+ avcodec/h2645_sei: use the RefStruct API for film_grain_characteristics
+ avcodec/aom_film_grain: allocate film grain metadata dynamically
+ avformat/mov: use an array of pointers for heif_item
+ avformat/mov: split off heif item initialization to its own function
+ avformat/mov: factorize getting the current item
+ lavc/h264idct: fix RISC-V group multiplier
+ lavc/h264dsp: move RISC-V fn pointers to .data.rel.ro
+ avcodec/jpegxl_parser: fix reading lz77-pair as initial entropy symbol
+ avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
+ avcodec/cbs_h266: Fix regression in DVB clip introduced by 93281630a71c06642adfebebb0d4b105a4e02e91
+ avcodec/x86/vvc: add prototypes for OF functions
+ Document stream specifier syntax change from 46cbe4ab5c
+ fftools/ffplay: fix crash when vk renderer is null
+ avutil/wchar_filename: re-introduce explicit cast of void* to char*
+ fate/ffmpeg: add samples dependency to fate-ffmpeg-spec-disposition
+ fftools/ffmpeg_filter: treat apad filter as a source
+ lavc/avcodec: fix global/private option precendence
+ avfilter/framesync: fix forward EOF pts
+ avcodec/vaapi_encode: fix compilation without CONFIG_VAAPI_1
+ libavcodec: x86: Remove an explicit include of config.asm
+ checkasm: lls: Use relative tolerances rather than absolute ones
+ arm: Consistently use proper interworking function returns
+ avcodec/libx265: unbreak build for X265_BUILD >= 213
+ fftools: log unconnected filter output label
+ fftools: do not access out of bounds filtergraph
+ avcodec/mediacodecenc: Fix access of uninitialized value
+ avformat/img2enc: Fix integer truncation when frame_pts is enabled
+ avformat/internal: Add ff_get_frame_filename
+ avformat/mov: don't return the latest stream when an item stream is expected
+
+
version 7.1:
- Raw Captions with Time (RCWT) closed caption demuxer
- LC3/LC3plus decoding/encoding using external library liblc3
--
2.49.1
From a4bf50b5c0e9ea55f1bbadc38ce6fb690ece63d8 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 28 Jan 2025 21:23:11 -0300
Subject: [PATCH 203/434] avformat/mov: fix overflow in drift timestamp
calculation
Fixes: signed integer overflow: 7803923888585309955 - -3407677434275325337 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 377736723/clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5052449500889088
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 02958ab7156b4e14f1918f2b72c6d3678852698f)
---
libavformat/mov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 695b975147..63e8fe31ff 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3545,7 +3545,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
current_dts += sc->stts_data[i].duration * (uint64_t)sample_count;
if (current_dts > corrected_dts) {
- int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1);
+ int64_t drift = av_sat_sub64(current_dts, corrected_dts) / FFMAX(sample_count, 1);
uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1;
current_dts -= correction * (uint64_t)sample_count;
sc->stts_data[i].duration -= correction;
--
2.49.1
From 8a72775d5dba3253c4ffd9b7ec91f73beda42641 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 27 Dec 2024 11:53:16 -0300
Subject: [PATCH 204/434] avutil/downmix_info: zero the allocated buffer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0bed1b89530042f0a835b8d1178aa52b40a751f6)
(cherry picked from commit a649b2a8313571fcec101143e9479299eb8bc214)
---
libavutil/downmix_info.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavutil/downmix_info.c b/libavutil/downmix_info.c
index c634c6a79f..83771a3051 100644
--- a/libavutil/downmix_info.c
+++ b/libavutil/downmix_info.c
@@ -27,9 +27,12 @@ AVDownmixInfo *av_downmix_info_update_side_data(AVFrame *frame)
side_data = av_frame_get_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO);
- if (!side_data)
+ if (!side_data) {
side_data = av_frame_new_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO,
sizeof(AVDownmixInfo));
+ if (side_data)
+ memset(side_data->data, 0, sizeof(AVDownmixInfo))
+ }
if (!side_data)
return NULL;
--
2.49.1
From 57a53adf2b1237965ce6f5546398b1a81599be38 Mon Sep 17 00:00:00 2001
From: Steven Zhou <steven.zhou@netint.ca>
Date: Sat, 23 Nov 2024 01:20:36 +0000
Subject: [PATCH 205/434] avfilter/drawtext: fix memory leak when using
"reinit" runtime command
Free AVOption in drawtext private context when freeing old copy of drawtext
private context during processing of "reinit" runtime command.
Signed-off-by: Steven Zhou <steven.zhou@netint.ca>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d1fa9cf4b496361ebae3c950153756c6f0baf501)
---
libavfilter/vf_drawtext.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c
index 4c55a01155..daaa1fd83a 100644
--- a/libavfilter/vf_drawtext.c
+++ b/libavfilter/vf_drawtext.c
@@ -1217,6 +1217,7 @@ static int command(AVFilterContext *ctx, const char *cmd, const char *arg, char
ctx->priv = old;
uninit(ctx);
+ av_opt_free(old);
av_freep(&old);
ctx->priv = new;
--
2.49.1
From 8accee8b56a8be0485332e78b8d4cb14f6d27760 Mon Sep 17 00:00:00 2001
From: Patrice Dumas <pertusus@free.fr>
Date: Fri, 1 Nov 2024 15:57:07 +0100
Subject: [PATCH 206/434] doc/t2h: Support texinfo 7.1 and 7.2 pretest
Here is a proposed patch for portability of doc/t2h.pm for GNU Texinfo
7.1 and 7.1.90 (7.2 pretest). I tested against 7.1 and 7.1.90 (7.2
pretest). There is a difference in the headings compared to the website
version, maybe related to FA_ICONS not being set the same, but the
result seems correct.
I also renamed $element to $output_unit in ffmpeg_heading_command as in
new equivalent makeinfo/texi2any code the $element variable is the
$command variable in ffmpeg_heading_command, which is very confusing. I
left as is the $command variable to have a patch easier to read, but it
could make sense to rename $command as $element later on.
The patch could also have effects with Texinfo 7.0, since some of the
changes are for that version, but that probably never show up because it
is for situations that may not exist in ffmpeg manuals (for example
@node without sectioning command), or because the code is robust to some
missing information (case of $heading_level in ffmpeg_heading_command
that was not set, as far as I can tell).
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 4d9cdf82ee36a7da4f065821c86165fe565aeac2)
---
doc/t2h.pm | 169 ++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 129 insertions(+), 40 deletions(-)
diff --git a/doc/t2h.pm b/doc/t2h.pm
index b7485e1f1e..4875d66305 100644
--- a/doc/t2h.pm
+++ b/doc/t2h.pm
@@ -54,12 +54,24 @@ sub get_formatting_function($$) {
}
# determine texinfo version
-my $program_version_num = version->declare(ff_get_conf('PACKAGE_VERSION'))->numify;
+my $package_version = ff_get_conf('PACKAGE_VERSION');
+$package_version =~ s/\+dev$//;
+my $program_version_num = version->declare($package_version)->numify;
my $program_version_6_8 = $program_version_num >= 6.008000;
# no navigation elements
ff_set_from_init_file('HEADERS', 0);
+my %sectioning_commands = %Texinfo::Common::sectioning_commands;
+if (scalar(keys(%sectioning_commands)) == 0) {
+ %sectioning_commands = %Texinfo::Commands::sectioning_heading_commands;
+}
+
+my %root_commands = %Texinfo::Common::root_commands;
+if (scalar(keys(%root_commands)) == 0) {
+ %root_commands = %Texinfo::Commands::root_commands;
+}
+
sub ffmpeg_heading_command($$$$$)
{
my $self = shift;
@@ -77,6 +89,9 @@ sub ffmpeg_heading_command($$$$$)
return $result;
}
+ # no need to set it as the $element_id is output unconditionally
+ my $heading_id;
+
my $element_id = $self->command_id($command);
$result .= "<a name=\"$element_id\"></a>\n"
if (defined($element_id) and $element_id ne '');
@@ -84,24 +99,40 @@ sub ffmpeg_heading_command($$$$$)
print STDERR "Process $command "
.Texinfo::Structuring::_print_root_command_texi($command)."\n"
if ($self->get_conf('DEBUG'));
- my $element;
- if ($Texinfo::Common::root_commands{$command->{'cmdname'}}
- and $command->{'parent'}
- and $command->{'parent'}->{'type'}
- and $command->{'parent'}->{'type'} eq 'element') {
- $element = $command->{'parent'};
+ my $output_unit;
+ if ($root_commands{$command->{'cmdname'}}) {
+ if ($command->{'associated_unit'}) {
+ $output_unit = $command->{'associated_unit'};
+ } elsif ($command->{'structure'}
+ and $command->{'structure'}->{'associated_unit'}) {
+ $output_unit = $command->{'structure'}->{'associated_unit'};
+ } elsif ($command->{'parent'}
+ and $command->{'parent'}->{'type'}
+ and $command->{'parent'}->{'type'} eq 'element') {
+ $output_unit = $command->{'parent'};
+ }
}
- if ($element) {
+
+ if ($output_unit) {
$result .= &{get_formatting_function($self, 'format_element_header')}($self, $cmdname,
- $command, $element);
+ $command, $output_unit);
}
my $heading_level;
# node is used as heading if there is nothing else.
if ($cmdname eq 'node') {
- if (!$element or (!$element->{'extra'}->{'section'}
- and $element->{'extra'}->{'node'}
- and $element->{'extra'}->{'node'} eq $command
+ if (!$output_unit or
+ (((!$output_unit->{'extra'}->{'section'}
+ and $output_unit->{'extra'}->{'node'}
+ and $output_unit->{'extra'}->{'node'} eq $command)
+ or
+ ((($output_unit->{'extra'}->{'unit_command'}
+ and $output_unit->{'extra'}->{'unit_command'} eq $command)
+ or
+ ($output_unit->{'unit_command'}
+ and $output_unit->{'unit_command'} eq $command))
+ and $command->{'extra'}
+ and not $command->{'extra'}->{'associated_section'}))
# bogus node may not have been normalized
and defined($command->{'extra'}->{'normalized'}))) {
if ($command->{'extra'}->{'normalized'} eq 'Top') {
@@ -111,7 +142,15 @@ sub ffmpeg_heading_command($$$$$)
}
}
} else {
- $heading_level = $command->{'level'};
+ if (defined($command->{'extra'})
+ and defined($command->{'extra'}->{'section_level'})) {
+ $heading_level = $command->{'extra'}->{'section_level'};
+ } elsif ($command->{'structure'}
+ and defined($command->{'structure'}->{'section_level'})) {
+ $heading_level = $command->{'structure'}->{'section_level'};
+ } else {
+ $heading_level = $command->{'level'};
+ }
}
my $heading = $self->command_text($command);
@@ -119,8 +158,8 @@ sub ffmpeg_heading_command($$$$$)
# if there is an error in the node.
if (defined($heading) and $heading ne '' and defined($heading_level)) {
- if ($Texinfo::Common::root_commands{$cmdname}
- and $Texinfo::Common::sectioning_commands{$cmdname}) {
+ if ($root_commands{$cmdname}
+ and $sectioning_commands{$cmdname}) {
my $content_href = $self->command_contents_href($command, 'contents',
$self->{'current_filename'});
if ($content_href) {
@@ -140,7 +179,13 @@ sub ffmpeg_heading_command($$$$$)
}
}
- if ($self->in_preformatted()) {
+ my $in_preformatted;
+ if ($program_version_num >= 7.001090) {
+ $in_preformatted = $self->in_preformatted_context();
+ } else {
+ $in_preformatted = $self->in_preformatted();
+ }
+ if ($in_preformatted) {
$result .= $heading."\n";
} else {
# if the level was changed, set the command name right
@@ -149,21 +194,25 @@ sub ffmpeg_heading_command($$$$$)
$cmdname
= $Texinfo::Common::level_to_structuring_command{$cmdname}->[$heading_level];
}
- # format_heading_text expects an array of headings for texinfo >= 7.0
if ($program_version_num >= 7.000000) {
- $heading = [$heading];
- }
- $result .= &{get_formatting_function($self,'format_heading_text')}(
+ $result .= &{get_formatting_function($self,'format_heading_text')}($self,
+ $cmdname, [$cmdname], $heading,
+ $heading_level +$self->get_conf('CHAPTER_HEADER_LEVEL') -1,
+ $heading_id, $command);
+
+ } else {
+ $result .= &{get_formatting_function($self,'format_heading_text')}(
$self, $cmdname, $heading,
$heading_level +
$self->get_conf('CHAPTER_HEADER_LEVEL') - 1, $command);
+ }
}
}
$result .= $content if (defined($content));
return $result;
}
-foreach my $command (keys(%Texinfo::Common::sectioning_commands), 'node') {
+foreach my $command (keys(%sectioning_commands), 'node') {
texinfo_register_command_formatting($command, \&ffmpeg_heading_command);
}
@@ -188,28 +237,56 @@ sub ffmpeg_begin_file($$$)
my $filename = shift;
my $element = shift;
- my $command;
- if ($element and $self->get_conf('SPLIT')) {
- $command = $self->element_command($element);
+ my ($element_command, $node_command, $command_for_title);
+ if ($element) {
+ if ($element->{'unit_command'}) {
+ $element_command = $element->{'unit_command'};
+ } elsif ($self->can('tree_unit_element_command')) {
+ $element_command = $self->tree_unit_element_command($element);
+ } elsif ($self->can('tree_unit_element_command')) {
+ $element_command = $self->element_command($element);
+ }
+
+ $node_command = $element_command;
+ if ($element_command and $element_command->{'cmdname'}
+ and $element_command->{'cmdname'} ne 'node'
+ and $element_command->{'extra'}
+ and $element_command->{'extra'}->{'associated_node'}) {
+ $node_command = $element_command->{'extra'}->{'associated_node'};
+ }
+
+ $command_for_title = $element_command if ($self->get_conf('SPLIT'));
}
- my ($title, $description, $encoding, $date, $css_lines,
- $doctype, $bodytext, $copying_comment, $after_body_open,
- $extra_head, $program_and_version, $program_homepage,
+ my ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype,
+ $root_html_element_attributes, $body_attributes, $copying_comment,
+ $after_body_open, $extra_head, $program_and_version, $program_homepage,
$program, $generator);
- if ($program_version_num >= 7.000000) {
- ($title, $description, $encoding, $date, $css_lines,
- $doctype, $bodytext, $copying_comment, $after_body_open,
+ if ($program_version_num >= 7.001090) {
+ ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype,
+ $root_html_element_attributes, $body_attributes, $copying_comment,
+ $after_body_open, $extra_head, $program_and_version, $program_homepage,
+ $program, $generator) = $self->_file_header_information($command_for_title,
+ $filename);
+ } elsif ($program_version_num >= 7.000000) {
+ ($title, $description, $encoding, $date, $css_lines, $doctype,
+ $root_html_element_attributes, $copying_comment, $after_body_open,
$extra_head, $program_and_version, $program_homepage,
- $program, $generator) = $self->_file_header_information($command);
+ $program, $generator) = $self->_file_header_information($command_for_title,
+ $filename);
} else {
($title, $description, $encoding, $date, $css_lines,
- $doctype, $bodytext, $copying_comment, $after_body_open,
- $extra_head, $program_and_version, $program_homepage,
- $program, $generator) = $self->_file_header_informations($command);
+ $doctype, $root_html_element_attributes, $copying_comment,
+ $after_body_open, $extra_head, $program_and_version, $program_homepage,
+ $program, $generator) = $self->_file_header_informations($command_for_title);
}
- my $links = $self->_get_links ($filename, $element);
+ my $links;
+ if ($program_version_num >= 7.000000) {
+ $links = $self->_get_links($filename, $element, $node_command);
+ } else {
+ $links = $self->_get_links ($filename, $element);
+ }
my $head1 = $ENV{"FFMPEG_HEADER1"} || <<EOT;
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
@@ -252,13 +329,25 @@ sub ffmpeg_program_string($)
if (defined($self->get_conf('PROGRAM'))
and $self->get_conf('PROGRAM') ne ''
and defined($self->get_conf('PACKAGE_URL'))) {
- return $self->convert_tree(
+ if ($program_version_num >= 7.001090) {
+ return $self->convert_tree(
+ $self->cdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.',
+ { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')},
+ 'program' => {'text' => $self->get_conf('PROGRAM') }}));
+ } else {
+ return $self->convert_tree(
$self->gdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.',
- { 'program_homepage' => $self->get_conf('PACKAGE_URL'),
- 'program' => $self->get_conf('PROGRAM') }));
+ { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')},
+ 'program' => {'text' => $self->get_conf('PROGRAM') }}));
+ }
} else {
- return $self->convert_tree(
- $self->gdt('This document was generated automatically.'));
+ if ($program_version_num >= 7.001090) {
+ return $self->convert_tree(
+ $self->cdt('This document was generated automatically.'));
+ } else {
+ return $self->convert_tree(
+ $self->gdt('This document was generated automatically.'));
+ }
}
}
if ($program_version_6_8) {
--
2.49.1
From e0f3c1018a0973abb18e240cbf0bc98daf15f6b6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 6 Feb 2025 18:44:04 -0300
Subject: [PATCH 207/434] avutil/downmix_info: add missing semicolon
Fixes compilation broken by 8a72775d5dba3253c4ffd9b7ec91f73beda42641.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavutil/downmix_info.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavutil/downmix_info.c b/libavutil/downmix_info.c
index 83771a3051..7e6c3e854d 100644
--- a/libavutil/downmix_info.c
+++ b/libavutil/downmix_info.c
@@ -31,7 +31,7 @@ AVDownmixInfo *av_downmix_info_update_side_data(AVFrame *frame)
side_data = av_frame_new_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO,
sizeof(AVDownmixInfo));
if (side_data)
- memset(side_data->data, 0, sizeof(AVDownmixInfo))
+ memset(side_data->data, 0, sizeof(AVDownmixInfo));
}
if (!side_data)
--
2.49.1
From 31f0084cbbaa863af4a733bd9fb8202388ac5c4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Fri, 24 Jan 2025 23:32:52 +0200
Subject: [PATCH 208/434] configure: Improve the check for the rsync
--contimeout option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Traditionally, macOS has shipped an old version of rsync that lacked
support for this option, hence this check (added in
a8b3f0c5cf548f654e30c981988bb71981a3f8d3).
However, in macOS 15.x, Apple have switched to providing rsync as a
different tool, openrsync. The version of openrsync in at least
macOS 15.2 does include "[--contimeout]" (note the lack of "=" after
the option), in the output of "rsync --help", but when used, the tool
errors out with "rsync: --contimeout=60: unknown option". So apparently
the tool erroenously lists the option as supported, while it really
isn't.
The original rsync tool (with a new enough version) prints
"--contimeout=SECONDS" in the output of "rsync --help".
It is unclear which version of openrsync Apple are shipping; the latest
upstream openrsync from OpenBSD does support the option and includes
"[--contimeout=seconds]" in the output of "--help", and older versions
don't seem to include the option as listed at all.
Therefore, check for "--conntimeout=" with the "=", this should
properly detect both new enough rsync and openrsync.
This fixes running "fate-rsync" on macOS 15.x.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 3cd4e8470a1ef82223d124523f8219691dfefb60)
---
configure | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure b/configure
index d77a55b653..9c013505f2 100755
--- a/configure
+++ b/configure
@@ -7175,7 +7175,7 @@ enabled makeinfo \
disabled makeinfo_html && texi2html --help 2> /dev/null | grep -q 'init-file' && enable texi2html || disable texi2html
perl -v > /dev/null 2>&1 && enable perl || disable perl
pod2man --help > /dev/null 2>&1 && enable pod2man || disable pod2man
-rsync --help 2> /dev/null | grep -q 'contimeout' && enable rsync_contimeout || disable rsync_contimeout
+rsync --help 2> /dev/null | grep -q 'contimeout=' && enable rsync_contimeout || disable rsync_contimeout
xmllint --version > /dev/null 2>&1 && enable xmllint || disable xmllint
check_headers linux/fb.h
--
2.49.1
From ac494b8325cc9612a382e9762e1f4c7819009c0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Thu, 23 Jan 2025 12:53:10 +0200
Subject: [PATCH 209/434] rtmpproto: Avoid rare crashes in the fail: codepath
in rtmp_open
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When running the cleanup in rtmp_close on failures in rtmp_open,
we can in rare cases end up using rt->playpath, assuming that it
is still set.
The crash could happen if we hit the fail codepath in rtmp_open
while publishing (rt->is_input == 0) with rt->state set to
a value > STATE_FCPUBLISH.
This would normally not happen while publishing; either we have
an error (and rt->state <= STATE_FCPUBLISH) or we reach
rt->state = STATE_PUBLISHING, and then we also return successfully
from rtmp_open.
The unexpected combination of states could happen if the server
responds with e.g. "NetStream.Play.Stop" while expecting
"NetStream.Publish.Start"; this sets rt->state to STATE_STOPPED,
which also fulfills the condition "> STATE_FCPUBLISH".
We don't need to free the rt->playpath/tcurl/flashver strings here;
they're handled via AVOption, and thus are freed automatically when
the protocol instance is freed (that's why they aren't freed
manually within the rtmp_close function either).
We also don't need to free the AVDictionary with options; it's
owned by the caller.
A smaller fix would be to just call rtmp_close before freeing
the strings and dictionary, but as we don't need to free them
at all, let's remove that redundant code.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f4819ce01584e0858fdc312aa8a17c55e350a92)
---
libavformat/rtmpproto.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index b3b1eedacb..91f18b6088 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -2918,10 +2918,6 @@ reconnect:
return 0;
fail:
- av_freep(&rt->playpath);
- av_freep(&rt->tcurl);
- av_freep(&rt->flashver);
- av_dict_free(opts);
rtmp_close(s);
return ret;
}
--
2.49.1
From f2b85c8aa1e194c62e16493f28487765c006c7d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Wed, 5 Feb 2025 22:51:56 +0200
Subject: [PATCH 210/434] x86: aacencdsp: Fix negating signed values in
aac_quantize_bands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Previously, we would do OR with the sign bit, forcing the output
to a negative value, while we want to negate it, by inverting the
sign bit.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8b3e0061e10bf6d4224813774c537866c6b23b12)
---
libavcodec/x86/aacencdsp.asm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/x86/aacencdsp.asm b/libavcodec/x86/aacencdsp.asm
index 86eaebcbe5..8e435b7d2a 100644
--- a/libavcodec/x86/aacencdsp.asm
+++ b/libavcodec/x86/aacencdsp.asm
@@ -96,7 +96,7 @@ cglobal aac_quantize_bands, 5, 5, 6, out, in, scaled, size, is_signed, maxval, Q
addps m2, m1
minps m2, m3
andps m5, m4, [inq+sizeq]
- orps m2, m5
+ xorps m2, m5
cvttps2dq m2, m2
mova [outq+sizeq], m2
add sizeq, mmsize
--
2.49.1
From 283e5a4fa071d43f0d539dfaa33443668a0a6dc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Wed, 29 Jan 2025 10:55:22 +0200
Subject: [PATCH 211/434] checkasm: aacencdsp: Actually test nonzero values in
quant_bands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Previously, we read elements from ff_aac_pow34sf_tab; however
that table is initialized to zero; one needs to call
ff_aac_float_common_init() to make sure that the table is
initialized.
However, given the range of the input values, a large number of
entries in ff_aac_pow34sf_tab would give results outside of the
range for signed 32 bit integers. As the largest aac_cb_maxval
entry is 16, it seems more reasonable to produce values within
an order of mangitude of that value.
(When hitting INT_MIN, implementations may end up with different
results depending on whether the value is negated as a float or
as an int. This corner case is irrelevant in practice as this
is way outside of the expected value range here.)
Coincidentally, this fixes linking checkasm with Apple's older
linker. (In Xcode 15, Apple switched to a new linker. The one in
older toolchains seems to have a bug where it won't figure out to
load object files from a static library, if the only symbol
referenced in the object file is a "common" symbol, i.e. one for
a zero-initialized variable. This issue can also be reproduced with
newer Apple toolchains by passing -Wl,-ld_classic to the linker.)
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e75a0f3c75551dfb57e0b4f34fd5b57e9543fade)
---
tests/checkasm/aacencdsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/checkasm/aacencdsp.c b/tests/checkasm/aacencdsp.c
index 5308a2ac03..713284211c 100644
--- a/tests/checkasm/aacencdsp.c
+++ b/tests/checkasm/aacencdsp.c
@@ -67,7 +67,7 @@ static void test_abs_pow34(AACEncDSPContext *s)
static void test_quant_bands(AACEncDSPContext *s)
{
int maxval = randomize_elem(aac_cb_maxval);
- float q34 = randomize_elem(ff_aac_pow34sf_tab);
+ float q34 = (float)rnd() / (UINT_MAX / 1024);
float rounding = (rnd() & 1) ? ROUND_TO_ZERO : ROUND_STANDARD;
LOCAL_ALIGNED_16(float, in, [BUF_SIZE]);
LOCAL_ALIGNED_16(float, scaled, [BUF_SIZE]);
--
2.49.1
From 745e70f1d5b01db845a8e3d05b6ecf04ed0dd70e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Thu, 12 Dec 2024 14:27:25 +0200
Subject: [PATCH 212/434] fate: Add a dependency on ffprobe for fate-flcl1905
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This fixes occasional failed tests, if doing "make fate" without a
regular "make" or "make all" inbetween.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit eb79c316c7b205f45e7003e91f77c253818e6685)
---
tests/fate/audio.mak | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/tests/fate/audio.mak b/tests/fate/audio.mak
index 4d6c479b6b..6e091760ea 100644
--- a/tests/fate/audio.mak
+++ b/tests/fate/audio.mak
@@ -82,10 +82,12 @@ fate-smacker-audio: CMD = framecrc -i $(TARGET_SAMPLES)/smacker/wetlogo.smk -vn
FATE_SAMPLES_AUDIO-$(call DEMDEC, WSVQA, WS_SND1, ARESAMPLE_FILTER) += fate-ws_snd
fate-ws_snd: CMD = md5 -i $(TARGET_SAMPLES)/vqa/ws_snd.vqa -f s16le -af aresample
-FATE_SAMPLES_AUDIO-$(call DEMDEC, WAV, WMAV2, FILE_PROTOCOL) += fate-flcl1905
+FATE_SAMPLES_AUDIO_FFPROBE-$(call DEMDEC, WAV, WMAV2, FILE_PROTOCOL) += fate-flcl1905
fate-flcl1905: CMD = run ffprobe$(PROGSSUF)$(EXESUF) -show_frames -show_packets -print_format compact $(TARGET_SAMPLES)/wav/FLCL_Ending_My-short.wav
FATE_SAMPLES_AUDIO += $(FATE_SAMPLES_AUDIO-yes)
+FATE_SAMPLES_AUDIO_FFPROBE += $(FATE_SAMPLES_AUDIO_FFPROBE-yes)
FATE_SAMPLES_FFMPEG += $(FATE_SAMPLES_AUDIO)
-fate-audio: $(FATE_SAMPLES_AUDIO)
+FATE_SAMPLES_FFPROBE += $(FATE_SAMPLES_AUDIO_FFPROBE)
+fate-audio: $(FATE_SAMPLES_AUDIO) $(FATE_SAMPLES_AUDIO_FFPROBE)
--
2.49.1
From 8cabfd922a726a964eeae8b5276583f470df39c3 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Thu, 10 Oct 2024 16:01:21 +0200
Subject: [PATCH 213/434] lavc/hevcdec: unbreak WPP/progress2 code
The "progress2" API in pthread_slice.c currently associates a progress
value with a thread rather than a job, relying on the broken assumption
that a job's thread number is equal to its job number modulo thread
count.
This removes this API entirely, and changes hevcdec to use a
ThreadProgress-based implementation that associates a
mutex/cond/progress value with every job.
Fixes races and deadlocks in hevdec with slice threading, e.g. some of
those mentioned in #11221.
(cherry picked from commit 79c47dfd25f101b6842bbec8c6ffef8d5077c3ae)
---
libavcodec/hevc/hevcdec.c | 57 ++++++++++++++++-----
libavcodec/hevc/hevcdec.h | 3 ++
libavcodec/pthread_slice.c | 102 -------------------------------------
libavcodec/thread.h | 4 --
libavcodec/utils.c | 19 -------
5 files changed, 46 insertions(+), 139 deletions(-)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 6fe72bd297..6f0ae12558 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -54,6 +54,7 @@
#include "progressframe.h"
#include "refstruct.h"
#include "thread.h"
+#include "threadprogress.h"
static const uint8_t hevc_pel_weight[65] = { [2] = 0, [4] = 1, [6] = 2, [8] = 3, [12] = 4, [16] = 5, [24] = 6, [32] = 7, [48] = 8, [64] = 9 };
@@ -2751,6 +2752,8 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist,
const uint8_t *data = s->data + s->sh.offset[ctb_row];
const size_t data_size = s->sh.size[ctb_row];
+ int progress = 0;
+
int ret;
if (ctb_row)
@@ -2762,13 +2765,15 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist,
hls_decode_neighbour(lc, l, pps, sps, x_ctb, y_ctb, ctb_addr_ts);
- ff_thread_await_progress2(s->avctx, ctb_row, thread, SHIFT_CTB_WPP);
+ if (ctb_row)
+ ff_thread_progress_await(&s->wpp_progress[ctb_row - 1],
+ progress + SHIFT_CTB_WPP + 1);
/* atomic_load's prototype requires a pointer to non-const atomic variable
* (due to implementations via mutexes, where reads involve writes).
* Of course, casting const away here is nevertheless safe. */
if (atomic_load((atomic_int*)&s->wpp_err)) {
- ff_thread_report_progress2(s->avctx, ctb_row , thread, SHIFT_CTB_WPP);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX);
return 0;
}
@@ -2792,19 +2797,19 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist,
ctb_addr_ts++;
ff_hevc_save_states(lc, pps, ctb_addr_ts);
- ff_thread_report_progress2(s->avctx, ctb_row, thread, 1);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], ++progress);
ff_hevc_hls_filters(lc, l, pps, x_ctb, y_ctb, ctb_size);
if (!more_data && (x_ctb+ctb_size) < sps->width && ctb_row != s->sh.num_entry_point_offsets) {
/* Casting const away here is safe, because it is an atomic operation. */
atomic_store((atomic_int*)&s->wpp_err, 1);
- ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX);
return 0;
}
if ((x_ctb+ctb_size) >= sps->width && (y_ctb+ctb_size) >= sps->height ) {
ff_hevc_hls_filter(lc, l, pps, x_ctb, y_ctb, ctb_size);
- ff_thread_report_progress2(s->avctx, ctb_row , thread, SHIFT_CTB_WPP);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX);
return ctb_addr_ts;
}
ctb_addr_rs = pps->ctb_addr_ts_to_rs[ctb_addr_ts];
@@ -2814,17 +2819,43 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist,
break;
}
}
- ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX);
return 0;
error:
l->tab_slice_address[ctb_addr_rs] = -1;
/* Casting const away here is safe, because it is an atomic operation. */
atomic_store((atomic_int*)&s->wpp_err, 1);
- ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP);
+ ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX);
return ret;
}
+static int wpp_progress_init(HEVCContext *s, unsigned count)
+{
+ if (s->nb_wpp_progress < count) {
+ void *tmp = av_realloc_array(s->wpp_progress, count,
+ sizeof(*s->wpp_progress));
+ if (!tmp)
+ return AVERROR(ENOMEM);
+
+ s->wpp_progress = tmp;
+ memset(s->wpp_progress + s->nb_wpp_progress, 0,
+ (count - s->nb_wpp_progress) * sizeof(*s->wpp_progress));
+
+ for (int i = s->nb_wpp_progress; i < count; i++) {
+ int ret = ff_thread_progress_init(&s->wpp_progress[i], 1);
+ if (ret < 0)
+ return ret;
+ s->nb_wpp_progress = i + 1;
+ }
+ }
+
+ for (int i = 0; i < count; i++)
+ ff_thread_progress_reset(&s->wpp_progress[i]);
+
+ return 0;
+}
+
static int hls_slice_data_wpp(HEVCContext *s, const H2645NAL *nal)
{
const HEVCPPS *const pps = s->pps;
@@ -2909,7 +2940,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const H2645NAL *nal)
}
atomic_store(&s->wpp_err, 0);
- res = ff_slice_thread_allocz_entries(s->avctx, s->sh.num_entry_point_offsets + 1);
+ res = wpp_progress_init(s, s->sh.num_entry_point_offsets + 1);
if (res < 0)
return res;
@@ -3827,6 +3858,10 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx)
ff_hevc_ps_uninit(&s->ps);
+ for (int i = 0; i < s->nb_wpp_progress; i++)
+ ff_thread_progress_destroy(&s->wpp_progress[i]);
+ av_freep(&s->wpp_progress);
+
av_freep(&s->sh.entry_point_offset);
av_freep(&s->sh.offset);
av_freep(&s->sh.size);
@@ -3981,12 +4016,6 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
HEVCContext *s = avctx->priv_data;
int ret;
- if (avctx->active_thread_type & FF_THREAD_SLICE) {
- ret = ff_slice_thread_init_progress(avctx);
- if (ret < 0)
- return ret;
- }
-
ret = hevc_init_context(avctx);
if (ret < 0)
return ret;
diff --git a/libavcodec/hevc/hevcdec.h b/libavcodec/hevc/hevcdec.h
index 6ba2ca3887..473709b4e8 100644
--- a/libavcodec/hevc/hevcdec.h
+++ b/libavcodec/hevc/hevcdec.h
@@ -540,6 +540,9 @@ typedef struct HEVCContext {
/** The target for the common_cabac_state of the local contexts. */
HEVCCABACState cabac;
+ struct ThreadProgress *wpp_progress;
+ unsigned nb_wpp_progress;
+
atomic_int wpp_err;
const uint8_t *data;
diff --git a/libavcodec/pthread_slice.c b/libavcodec/pthread_slice.c
index a4d31c6f4d..ac455e48ed 100644
--- a/libavcodec/pthread_slice.c
+++ b/libavcodec/pthread_slice.c
@@ -41,11 +41,6 @@ typedef int (action_func)(AVCodecContext *c, void *arg);
typedef int (action_func2)(AVCodecContext *c, void *arg, int jobnr, int threadnr);
typedef int (main_func)(AVCodecContext *c);
-typedef struct Progress {
- pthread_cond_t cond;
- pthread_mutex_t mutex;
-} Progress;
-
typedef struct SliceThreadContext {
AVSliceThread *thread;
action_func *func;
@@ -54,11 +49,6 @@ typedef struct SliceThreadContext {
void *args;
int *rets;
int job_size;
-
- int *entries;
- int entries_count;
- int thread_count;
- Progress *progress;
} SliceThreadContext;
static void main_function(void *priv) {
@@ -82,18 +72,9 @@ static void worker_func(void *priv, int jobnr, int threadnr, int nb_jobs, int nb
void ff_slice_thread_free(AVCodecContext *avctx)
{
SliceThreadContext *c = avctx->internal->thread_ctx;
- int i;
avpriv_slicethread_free(&c->thread);
- for (i = 0; i < c->thread_count; i++) {
- Progress *const progress = &c->progress[i];
- pthread_mutex_destroy(&progress->mutex);
- pthread_cond_destroy(&progress->cond);
- }
-
- av_freep(&c->entries);
- av_freep(&c->progress);
av_freep(&avctx->internal->thread_ctx);
}
@@ -175,86 +156,3 @@ int ff_slice_thread_init(AVCodecContext *avctx)
avctx->execute2 = thread_execute2;
return 0;
}
-
-int av_cold ff_slice_thread_init_progress(AVCodecContext *avctx)
-{
- SliceThreadContext *const p = avctx->internal->thread_ctx;
- int err, i = 0, thread_count = avctx->thread_count;
-
- p->progress = av_calloc(thread_count, sizeof(*p->progress));
- if (!p->progress) {
- err = AVERROR(ENOMEM);
- goto fail;
- }
-
- for (; i < thread_count; i++) {
- Progress *const progress = &p->progress[i];
- err = pthread_mutex_init(&progress->mutex, NULL);
- if (err) {
- err = AVERROR(err);
- goto fail;
- }
- err = pthread_cond_init (&progress->cond, NULL);
- if (err) {
- err = AVERROR(err);
- pthread_mutex_destroy(&progress->mutex);
- goto fail;
- }
- }
- err = 0;
-fail:
- p->thread_count = i;
- return err;
-}
-
-void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n)
-{
- SliceThreadContext *p = avctx->internal->thread_ctx;
- Progress *const progress = &p->progress[thread];
- int *entries = p->entries;
-
- pthread_mutex_lock(&progress->mutex);
- entries[field] +=n;
- pthread_cond_signal(&progress->cond);
- pthread_mutex_unlock(&progress->mutex);
-}
-
-void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift)
-{
- SliceThreadContext *p = avctx->internal->thread_ctx;
- Progress *progress;
- int *entries = p->entries;
-
- if (!entries || !field) return;
-
- thread = thread ? thread - 1 : p->thread_count - 1;
- progress = &p->progress[thread];
-
- pthread_mutex_lock(&progress->mutex);
- while ((entries[field - 1] - entries[field]) < shift){
- pthread_cond_wait(&progress->cond, &progress->mutex);
- }
- pthread_mutex_unlock(&progress->mutex);
-}
-
-int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count)
-{
- if (avctx->active_thread_type & FF_THREAD_SLICE) {
- SliceThreadContext *p = avctx->internal->thread_ctx;
-
- if (p->entries_count == count) {
- memset(p->entries, 0, p->entries_count * sizeof(*p->entries));
- return 0;
- }
- av_freep(&p->entries);
-
- p->entries = av_calloc(count, sizeof(*p->entries));
- if (!p->entries) {
- p->entries_count = 0;
- return AVERROR(ENOMEM);
- }
- p->entries_count = count;
- }
-
- return 0;
-}
diff --git a/libavcodec/thread.h b/libavcodec/thread.h
index 47c00a0ed2..7df5839ed0 100644
--- a/libavcodec/thread.h
+++ b/libavcodec/thread.h
@@ -56,10 +56,6 @@ int ff_thread_get_buffer(AVCodecContext *avctx, AVFrame *f, int flags);
int ff_slice_thread_execute_with_mainfunc(AVCodecContext *avctx,
int (*action_func2)(AVCodecContext *c, void *arg, int jobnr, int threadnr),
int (*main_func)(AVCodecContext *c), void *arg, int *ret, int job_count);
-int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count);
-int ff_slice_thread_init_progress(AVCodecContext *avctx);
-void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n);
-void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift);
enum ThreadingStatus {
FF_THREAD_IS_COPY,
diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index a63ca71a44..6909a5ba2b 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -913,25 +913,6 @@ int ff_thread_can_start_frame(AVCodecContext *avctx)
{
return 1;
}
-
-int ff_slice_thread_init_progress(AVCodecContext *avctx)
-{
- return 0;
-}
-
-int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count)
-{
- return 0;
-}
-
-void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift)
-{
-}
-
-void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n)
-{
-}
-
#endif
const uint8_t *avpriv_find_start_code(const uint8_t *restrict p,
--
2.49.1
From 04fd3f69b3c3b608ca2654e3688dae7adc3adc8d Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 13 Jan 2025 17:28:02 -0300
Subject: [PATCH 214/434] avformat/iamf_parse: add missing av_free() call on
failure path
Fixes ticket #11416
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd)
---
libavformat/iamf_parse.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 1ec6924908..1ccb1007e9 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -565,6 +565,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb,
if (!mode && !constant_subblock_duration && total_duration != duration) {
av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id);
+ av_free(param);
return AVERROR_INVALIDDATA;
}
--
2.49.1
From b06845c6727a7c4391a7d5f607ae078aa0073c43 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 17 Feb 2025 11:41:24 -0300
Subject: [PATCH 215/434] avformat/iamf_parse: add missing constrains for
num_parameters in audio_element_oub()
Fixes ticket #11475.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0526535cd58444dd264e810b2f3348b4d96cff3b)
---
libavformat/iamf_parse.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 1ccb1007e9..7c784c6955 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -728,6 +728,12 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
}
num_parameters = ffio_read_leb(pbc);
+ if (num_parameters > 2 && audio_element_type == 0) {
+ av_log(s, AV_LOG_ERROR, "Audio Element parameter count %u is invalid"
+ " for Channel representations\n", num_parameters);
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
if (num_parameters && audio_element_type != 0) {
av_log(s, AV_LOG_ERROR, "Audio Element parameter count %u is invalid"
" for Scene representations\n", num_parameters);
--
2.49.1
From 9abf2aef37a4c1bd81f89a9ff76dfee3e61710e6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 17 Feb 2025 11:41:25 -0300
Subject: [PATCH 216/434] avformat/iamf_parse: ensure there's at most one of
each parameter types in audio elements
Should prevent potential memory leaks on invalid files.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5470d024e18968b3bdef2b745966f7617f1eb9f2)
---
libavformat/iamf_parse.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 7c784c6955..7b3b1e87fa 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -747,11 +747,19 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
type = ffio_read_leb(pbc);
if (type == AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN)
ret = AVERROR_INVALIDDATA;
- else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING)
+ else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING) {
+ if (element->demixing_info) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
ret = param_parse(s, c, pbc, type, audio_element, &element->demixing_info);
- else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN)
+ } else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) {
+ if (element->recon_gain_info) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
ret = param_parse(s, c, pbc, type, audio_element, &element->recon_gain_info);
- else {
+ } else {
unsigned param_definition_size = ffio_read_leb(pbc);
avio_skip(pbc, param_definition_size);
}
--
2.49.1
From b753bac08f6881b2d3dea8f1ab84c81550f35897 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 16 Jan 2025 01:28:46 +0100
Subject: [PATCH 217/434] avformat/hls: Be more picky on extensions
This blocks disallowed extensions from probing
It also requires all available segments to have matching extensions to the format
mpegts is treated independent of the extension
It is recommended to set the whitelists correctly
instead of depending on extensions, but this should help a bit,
and this is easier to backport
Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer
Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification
The other parts of CVE-2023-6602 have been fixed by prior commits
Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/demuxers.texi | 7 +++++++
libavformat/hls.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 57 insertions(+)
diff --git a/doc/demuxers.texi b/doc/demuxers.texi
index cc81c615dd..2324b3b469 100644
--- a/doc/demuxers.texi
+++ b/doc/demuxers.texi
@@ -564,6 +564,13 @@ prefer to use #EXT-X-START if it's in playlist instead of live_start_index.
@item allowed_extensions
',' separated list of file extensions that hls is allowed to access.
+@item extension_picky
+This blocks disallowed extensions from probing
+It also requires all available segments to have matching extensions to the format
+except mpegts, which is always allowed.
+It is recommended to set the whitelists correctly instead of depending on extensions
+Enabled by default.
+
@item max_reload
Maximum number of times a insufficient list is attempted to be reloaded.
Default value is 1000.
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 62473a15dd..34abcb6e0d 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -223,6 +223,7 @@ typedef struct HLSContext {
AVDictionary *avio_opts;
AVDictionary *seg_format_opts;
char *allowed_extensions;
+ int extension_picky;
int max_reload;
int http_persistent;
int http_multiple;
@@ -731,6 +732,40 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url,
return ret;
}
+static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct playlist *pls, struct segment *seg)
+{
+ HLSContext *c = s->priv_data;
+ int matchA = 3;
+ int matchF = 0;
+
+ if (!c->extension_picky)
+ return 0;
+
+ if (strcmp(c->allowed_extensions, "ALL"))
+ matchA = av_match_ext (seg->url, c->allowed_extensions)
+ + 2*(ff_match_url_ext(seg->url, c->allowed_extensions) > 0);
+
+ if (!matchA) {
+ av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url);
+ return AVERROR_INVALIDDATA;
+ }
+
+ if (in_fmt) {
+ if (in_fmt->extensions) {
+ matchF = av_match_ext( seg->url, in_fmt->extensions)
+ + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0);
+ } else if (!strcmp(in_fmt->name, "mpegts"))
+ matchF = 3;
+
+ if (!(matchA & matchF)) {
+ av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches allowed extensions in url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url);
+ return AVERROR_INVALIDDATA;
+ }
+ }
+
+ return 0;
+}
+
static int parse_playlist(HLSContext *c, const char *url,
struct playlist *pls, AVIOContext *in)
{
@@ -989,6 +1024,14 @@ static int parse_playlist(HLSContext *c, const char *url,
goto fail;
}
+ ret = test_segment(c->ctx, pls->ctx ? pls->ctx->iformat : NULL, pls, seg);
+ if (ret < 0) {
+ av_free(seg->url);
+ av_free(seg->key);
+ av_free(seg);
+ goto fail;
+ }
+
if (duration < 0.001 * AV_TIME_BASE) {
av_log(c->ctx, AV_LOG_WARNING, "Cannot get correct #EXTINF value of segment %s,"
" set to default value to 1ms.\n", seg->url);
@@ -2114,6 +2157,11 @@ static int hls_read_header(AVFormatContext *s)
pls->ctx->interrupt_callback = s->interrupt_callback;
url = av_strdup(pls->segments[0]->url);
ret = av_probe_input_buffer(&pls->pb.pub, &in_fmt, url, NULL, 0, 0);
+
+ for (int n = 0; n < pls->n_segments; n++)
+ if (ret >= 0)
+ ret = test_segment(s, in_fmt, pls, pls->segments[n]);
+
if (ret < 0) {
/* Free the ctx - it isn't initialized properly at this point,
* so avformat_close_input shouldn't be called. If
@@ -2576,6 +2624,8 @@ static const AVOption hls_options[] = {
OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
{.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
INT_MIN, INT_MAX, FLAGS},
+ {"extension_picky", "Be picky with all extensions matching",
+ OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS},
{"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 3}, 0, INT_MAX, FLAGS},
{"m3u8_hold_counters", "The maximum number of times to load m3u8 when it refreshes without new segments",
--
2.49.1
From 9dea077922bce2e2e1359fc62b82448459ddcd42 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 28 Jan 2025 12:51:58 +0100
Subject: [PATCH 218/434] avformat/hls: Print input format in error message
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8455331302c72cde2f0b72f255004a91189dd93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 34abcb6e0d..fdf1df0906 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -758,7 +758,7 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
matchF = 3;
if (!(matchA & matchF)) {
- av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches allowed extensions in url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url);
+ av_log(s, AV_LOG_ERROR, "detected format %s extension %s mismatches allowed extensions in url %s\n", in_fmt->name, in_fmt->extensions ? in_fmt->extensions : "none", seg->url);
return AVERROR_INVALIDDATA;
}
}
--
2.49.1
From c74740fcd543a545d66ca830e3f2a122f730cae3 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 30 Jan 2025 02:28:32 +0100
Subject: [PATCH 219/434] avcodec/h263dec: Check against previous dimensions
instead of coded
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c
Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a26a06a6875c4abfb96362a65145264b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/h263dec.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
index 0c23012584..5eefdc4602 100644
--- a/libavcodec/h263dec.c
+++ b/libavcodec/h263dec.c
@@ -431,6 +431,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict,
MpegEncContext *s = avctx->priv_data;
int ret;
int slice_ret = 0;
+ int bak_width, bak_height;
/* no supplementary picture */
if (buf_size == 0) {
@@ -482,6 +483,9 @@ retry:
if (ret < 0)
return ret;
+ bak_width = s->width;
+ bak_height = s->height;
+
/* let's go :-) */
if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) {
ret = ff_wmv2_decode_picture_header(s);
@@ -501,11 +505,12 @@ retry:
}
if (ret < 0 || ret == FRAME_SKIPPED) {
- if ( s->width != avctx->coded_width
- || s->height != avctx->coded_height) {
+ if ( s->width != bak_width
+ || s->height != bak_height) {
av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n");
- s->width = avctx->coded_width;
- s->height= avctx->coded_height;
+ s->width = bak_width;
+ s->height= bak_height;
+
}
}
if (ret == FRAME_SKIPPED)
--
2.49.1
From 880007e75cf53b33dada07d1e4649df17938201a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 28 Jan 2025 13:26:34 +0100
Subject: [PATCH 220/434] avformat/hls: .ts is always ok even if its a mov/mp4
Maybe fixes: 11435
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e12572933dc1c49e9b35d772ddcae896c2ba8a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index fdf1df0906..1b2ebce2ab 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -754,6 +754,10 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
if (in_fmt->extensions) {
matchF = av_match_ext( seg->url, in_fmt->extensions)
+ 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0);
+ if(av_match_name("mp4", in_fmt->name)) {
+ matchF |= av_match_ext( seg->url, "ts")
+ + 2*(ff_match_url_ext(seg->url, "ts") > 0);
+ }
} else if (!strcmp(in_fmt->name, "mpegts"))
matchF = 3;
--
2.49.1
From 6c4e56f07d1a703435854f2156c881885f7798da Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 28 Jan 2025 23:07:54 +0100
Subject: [PATCH 221/434] libavformat/hls: Be more restrictive on mpegts
extensions
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0113e30806b205111344e266bc69ff9657a3ca02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 1b2ebce2ab..ef79ad3353 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -758,8 +758,10 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
matchF |= av_match_ext( seg->url, "ts")
+ 2*(ff_match_url_ext(seg->url, "ts") > 0);
}
- } else if (!strcmp(in_fmt->name, "mpegts"))
- matchF = 3;
+ } else if (!strcmp(in_fmt->name, "mpegts")) {
+ matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
+ + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
+ }
if (!(matchA & matchF)) {
av_log(s, AV_LOG_ERROR, "detected format %s extension %s mismatches allowed extensions in url %s\n", in_fmt->name, in_fmt->extensions ? in_fmt->extensions : "none", seg->url);
--
2.49.1
From 4018b915a63f74c6433ad8987f49d8737bb35176 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 2 Feb 2025 21:25:45 +0100
Subject: [PATCH 222/434] avcodec/vvc/refs: fix negative pps_scaling_win
offsets
The spec seems to allow these to be negative
Fixes: left shift of negative value -15
Fixes: 392687035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-6559804532785152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Frank Plowman <post@frankplowman.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33679f5325f5ad82993eb2bda89ef5fe37f2e5da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vvc/refs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavcodec/vvc/refs.c b/libavcodec/vvc/refs.c
index 133ff9eaba..bf093bea98 100644
--- a/libavcodec/vvc/refs.c
+++ b/libavcodec/vvc/refs.c
@@ -146,10 +146,10 @@ static VVCFrame *alloc_frame(VVCContext *s, VVCFrameContext *fc)
for (int j = 0; j < frame->ctb_count; j++)
frame->rpl_tab[j] = frame->rpl;
- win->left_offset = pps->r->pps_scaling_win_left_offset << sps->hshift[CHROMA];
- win->right_offset = pps->r->pps_scaling_win_right_offset << sps->hshift[CHROMA];
- win->top_offset = pps->r->pps_scaling_win_top_offset << sps->vshift[CHROMA];
- win->bottom_offset = pps->r->pps_scaling_win_bottom_offset << sps->vshift[CHROMA];
+ win->left_offset = pps->r->pps_scaling_win_left_offset * (1 << sps->hshift[CHROMA]);
+ win->right_offset = pps->r->pps_scaling_win_right_offset * (1 << sps->hshift[CHROMA]);
+ win->top_offset = pps->r->pps_scaling_win_top_offset * (1 << sps->vshift[CHROMA]);
+ win->bottom_offset = pps->r->pps_scaling_win_bottom_offset * (1 << sps->vshift[CHROMA]);
frame->ref_width = pps->r->pps_pic_width_in_luma_samples - win->left_offset - win->right_offset;
frame->ref_height = pps->r->pps_pic_height_in_luma_samples - win->bottom_offset - win->top_offset;
--
2.49.1
From 43ba995a31d892c2c6cc575b60c40b2fb9d2078d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 6 Feb 2025 13:09:08 +0100
Subject: [PATCH 223/434] avformat/hls: Fix twitter
Allow mp4 with all mpegts extensions
Fixes: Ticket11435
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cef3422b4819e3b6f07086625fa7890eaa8d45e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index ef79ad3353..fbc88c8f88 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -755,8 +755,8 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
matchF = av_match_ext( seg->url, in_fmt->extensions)
+ 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0);
if(av_match_name("mp4", in_fmt->name)) {
- matchF |= av_match_ext( seg->url, "ts")
- + 2*(ff_match_url_ext(seg->url, "ts") > 0);
+ matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
+ + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
}
} else if (!strcmp(in_fmt->name, "mpegts")) {
matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
--
2.49.1
From c388bc1774f0c3559e600d75c9ac1f9b148e70ae Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 5 Feb 2025 03:47:52 +0100
Subject: [PATCH 224/434] avformat/mxfdec: Check edit unit for overflow in
mxf_set_current_edit_unit()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a6ad9eab2f1c37a18c2f30e6660260edd7c0c16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxfdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 682f724260..8905008202 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -3887,7 +3887,7 @@ static int64_t mxf_set_current_edit_unit(MXFContext *mxf, AVStream *st, int64_t
int64_t new_edit_unit;
MXFIndexTable *t = mxf_find_index_table(mxf, track->index_sid);
- if (!t || track->wrapping == UnknownWrapped)
+ if (!t || track->wrapping == UnknownWrapped || edit_unit > INT64_MAX - track->edit_units_per_packet)
return -1;
if (mxf_edit_unit_absolute_offset(mxf, t, edit_unit + track->edit_units_per_packet, track->edit_rate, NULL, &next_ofs, NULL, 0) < 0 &&
--
2.49.1
From 6acfaa1084fb71e1e1014dfc3cd8f98ca88b304a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Feb 2025 01:24:37 +0100
Subject: [PATCH 225/434] avformat/wavdec: Fix overflow of intermediate in
block_align check
Fixes: signed integer overflow: -251517880 * 32 cannot be represented in type 'int'
Fixes: 385224934/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4909298151915520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1afbc40875069312dd729b5959fb04950c3938db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/wavdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 78e37b88d7..ae6ff0e022 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -912,10 +912,10 @@ static int w64_read_header(AVFormatContext *s)
if (st->codecpar->block_align &&
st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS &&
st->codecpar->bits_per_coded_sample < 128) {
- int block_align = st->codecpar->block_align;
+ int64_t block_align = st->codecpar->block_align;
block_align = FFMAX(block_align,
- ((st->codecpar->bits_per_coded_sample + 7) / 8) *
+ ((st->codecpar->bits_per_coded_sample + 7LL) / 8) *
st->codecpar->ch_layout.nb_channels);
if (block_align > st->codecpar->block_align) {
av_log(s, AV_LOG_WARNING, "invalid block_align: %d, broken file.\n",
--
2.49.1
From 2e7364727caa44ce040056f9498e1c0c93bb9511 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Feb 2025 02:33:21 +0100
Subject: [PATCH 226/434] avformat/mlvdec: fix size checks
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0df9262f2688c1c848af993bbb67d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mlvdec.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c
index 985365326e..20a6f3629a 100644
--- a/libavformat/mlvdec.c
+++ b/libavformat/mlvdec.c
@@ -437,19 +437,25 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt)
if (size < 16)
return AVERROR_INVALIDDATA;
avio_skip(pb, 12); //timestamp, frameNumber
- if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO)
+ size -= 12;
+ if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
+ if (size < 8)
+ return AVERROR_INVALIDDATA;
avio_skip(pb, 8); // cropPosX, cropPosY, panPosX, panPosY
+ size -= 8;
+ }
space = avio_rl32(pb);
+ if (size < space + 4LL)
+ return AVERROR_INVALIDDATA;
avio_skip(pb, space);
+ size -= space;
if ((mlv->class[st->id] & (MLV_CLASS_FLAG_DELTA|MLV_CLASS_FLAG_LZMA))) {
ret = AVERROR_PATCHWELCOME;
} else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
ret = av_get_packet(pb, pkt, (st->codecpar->width * st->codecpar->height * st->codecpar->bits_per_coded_sample + 7) >> 3);
} else { // AVMEDIA_TYPE_AUDIO
- if (space > UINT_MAX - 24 || size < (24 + space))
- return AVERROR_INVALIDDATA;
- ret = av_get_packet(pb, pkt, size - (24 + space));
+ ret = av_get_packet(pb, pkt, size - 4);
}
if (ret < 0)
--
2.49.1
From 0e5b6a715627b8166ae5276a75ba5459d87b344e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 7 Feb 2025 23:31:20 +0100
Subject: [PATCH 227/434] avcodec/aac/aacdec: Clear SFO on error
types and SFO become confused for a USAC stream
Fixes: out of array access
Fixes: 383854203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4996677847547904.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d1be369af6a6f01976be8c80be1177dc524983e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index e62bf0f952..39edf73fb7 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -1745,6 +1745,7 @@ int ff_aac_decode_ics(AACDecContext *ac, SingleChannelElement *sce,
return 0;
fail:
+ memset(sce->sfo, 0, sizeof(sce->sfo));
tns->present = 0;
return ret;
}
--
2.49.1
From bf8c0be971351158e33c02f9e20931114d498119 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 8 Feb 2025 00:18:24 +0100
Subject: [PATCH 228/434] avcodec/aac/aacdec_usac: Simplify
decode_usac_scale_factors()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41cd72d76e14137a68c50f5a4e7dcab1c367e39c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec_usac.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index 2938e69387..ccdf58bc8e 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -567,15 +567,8 @@ static int decode_usac_scale_factors(AACDecContext *ac,
int offset_sf = global_gain;
for (int g = 0; g < ics->num_window_groups; g++) {
for (int sfb = 0; sfb < ics->max_sfb; sfb++) {
- /* First coefficient is just the global gain */
- if (!g && !sfb) {
- /* The cannonical representation of quantized scalefactors
- * in the spec is with 100 subtracted. */
- sce->sfo[0] = offset_sf - 100;
- continue;
- }
-
- offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO;
+ if (g || sfb)
+ offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO;
if (offset_sf > 255U) {
av_log(ac->avctx, AV_LOG_ERROR,
"Scalefactor (%d) out of range.\n", offset_sf);
--
2.49.1
From 6646dd2825ef088746356d7db97e8d5b2b506e75 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 8 Feb 2025 22:16:38 +0100
Subject: [PATCH 229/434] avcodec/aac/aacdec_lpd: Limit get_unary()
The limit is based on later code storing 32bits
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 464fb861b17b4cd9fc7ba8a18d0be040458bdfc7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec_lpd.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/libavcodec/aac/aacdec_lpd.c b/libavcodec/aac/aacdec_lpd.c
index 20bbb007ff..a4b91a510f 100644
--- a/libavcodec/aac/aacdec_lpd.c
+++ b/libavcodec/aac/aacdec_lpd.c
@@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
{
if (nk_mode == 1) {
for (int k = 0; k < no_qn; k++) {
- qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges
+ qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges
if (qn[k])
qn[k]++;
}
@@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
if (nk_mode == 2) {
for (int k = 0; k < no_qn; k++) {
if (qn[k] > 4) {
- qn[k] = get_unary(gb, 0, INT32_MAX);;
+ qn[k] = get_unary(gb, 0, 65);
if (qn[k])
qn[k] += 4;
}
@@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
for (int k = 0; k < no_qn; k++) {
if (qn[k] > 4) {
- int qn_ext = get_unary(gb, 0, INT32_MAX);;
+ int qn_ext = get_unary(gb, 0, 65);
switch (qn_ext) {
case 0: qn[k] = 5; break;
case 1: qn[k] = 6; break;
@@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv,
}
}
+ if (nk > 25)
+ return AVERROR_PATCHWELCOME;
+
skip_bits(gb, 4*n);
if (nk > 0)
--
2.49.1
From d3929313917fddc8689f8faecda0966d0a4498a3 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 9 Feb 2025 01:28:17 +0100
Subject: [PATCH 230/434] avformat/iff: Check that we have a stream in
read_dst_frame()
Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8668957ef604bd2b99175310638bc5031ae0d991)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/iff.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/iff.c b/libavformat/iff.c
index 7601baa629..6b4503fdb3 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -360,6 +360,9 @@ static int read_dst_frame(AVFormatContext *s, AVPacket *pkt)
uint64_t chunk_pos, data_pos, data_size;
int ret = AVERROR_EOF;
+ if (s->nb_streams < 1)
+ return AVERROR_INVALIDDATA;
+
while (!avio_feof(pb)) {
chunk_pos = avio_tell(pb);
if (chunk_pos >= iff->body_end)
--
2.49.1
From 3e16202c39b6b92337d5d417f536de46aba03f71 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 26 Feb 2025 03:19:17 +0100
Subject: [PATCH 231/434] Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/Changelog b/Changelog
index 56f7993e72..4247ece409 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,35 @@ Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 7.1.1:
+ avformat/iff: Check that we have a stream in read_dst_frame()
+ avcodec/aac/aacdec_lpd: Limit get_unary()
+ avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors()
+ avcodec/aac/aacdec: Clear SFO on error
+ avformat/mlvdec: fix size checks
+ avformat/wavdec: Fix overflow of intermediate in block_align check
+ avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
+ avformat/hls: Fix twitter
+ avcodec/vvc/refs: fix negative pps_scaling_win offsets
+ libavformat/hls: Be more restrictive on mpegts extensions
+ avformat/hls: .ts is always ok even if its a mov/mp4
+ avcodec/h263dec: Check against previous dimensions instead of coded
+ avformat/hls: Print input format in error message
+ avformat/hls: Be more picky on extensions
+ avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements
+ avformat/iamf_parse: add missing constrains for num_parameters in audio_element_oub()
+ avformat/iamf_parse: add missing av_free() call on failure path
+ lavc/hevcdec: unbreak WPP/progress2 code
+ fate: Add a dependency on ffprobe for fate-flcl1905
+ checkasm: aacencdsp: Actually test nonzero values in quant_bands
+ x86: aacencdsp: Fix negating signed values in aac_quantize_bands
+ rtmpproto: Avoid rare crashes in the fail: codepath in rtmp_open
+ configure: Improve the check for the rsync --contimeout option
+ avutil/downmix_info: add missing semicolon
+ doc/t2h: Support texinfo 7.1 and 7.2 pretest
+ avfilter/drawtext: fix memory leak when using "reinit" runtime command
+ avutil/downmix_info: zero the allocated buffer
+ avformat/mov: fix overflow in drift timestamp calculation
+ Changelog: update
avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet()
--
2.49.1
From 71889a8437d04124e8cb6919ee078f436082ab41 Mon Sep 17 00:00:00 2001
From: Pavel Koshevoy <pkoshevoy@gmail.com>
Date: Sun, 23 Feb 2025 09:43:56 -0700
Subject: [PATCH 232/434] avformat/mov: (v4) fix get_eia608_packet
The problem is reproducible with "Test for Quicktime 608 CC file.mov"
from https://samples.ffmpeg.org/MPEG2/subcc/
ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov
See https://trac.ffmpeg.org/ticket/11470
---
libavformat/mov.c | 70 +++++++++++++++++++++++++++++++++++++++--------
1 file changed, 59 insertions(+), 11 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 63e8fe31ff..41ca280c8a 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10526,25 +10526,73 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt)
return 0;
}
-static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size)
+static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int src_size)
{
- int new_size, ret;
+ /* We can't make assumptions about the structure of the payload,
+ because it may include multiple cdat and cdt2 samples. */
+ const uint32_t cdat = AV_RB32("cdat");
+ const uint32_t cdt2 = AV_RB32("cdt2");
+ int ret, out_size = 0;
- if (size <= 8)
+ /* a valid payload must have size, 4cc, and at least 1 byte pair: */
+ if (src_size < 10)
return AVERROR_INVALIDDATA;
- new_size = ((size - 8) / 2) * 3;
- ret = av_new_packet(pkt, new_size);
+
+ /* avoid an int overflow: */
+ if ((src_size - 8) / 2 >= INT_MAX / 3)
+ return AVERROR_INVALIDDATA;
+
+ ret = av_new_packet(pkt, ((src_size - 8) / 2) * 3);
if (ret < 0)
return ret;
- avio_skip(pb, 8);
- for (int j = 0; j < new_size; j += 3) {
- pkt->data[j] = 0xFC;
- pkt->data[j+1] = avio_r8(pb);
- pkt->data[j+2] = avio_r8(pb);
+ /* parse and re-format the c608 payload in one pass. */
+ while (src_size >= 10) {
+ const uint32_t atom_size = avio_rb32(pb);
+ const uint32_t atom_type = avio_rb32(pb);
+ const uint32_t data_size = atom_size - 8;
+ const uint8_t cc_field =
+ atom_type == cdat ? 1 :
+ atom_type == cdt2 ? 2 :
+ 0;
+
+ /* account for bytes consumed for atom size and type. */
+ src_size -= 8;
+
+ /* make sure the data size stays within the buffer boundaries. */
+ if (data_size < 2 || data_size > src_size) {
+ ret = AVERROR_INVALIDDATA;
+ break;
+ }
+
+ /* make sure the data size is consistent with N byte pairs. */
+ if (data_size % 2 != 0) {
+ ret = AVERROR_INVALIDDATA;
+ break;
+ }
+
+ if (!cc_field) {
+ /* neither cdat or cdt2 ... skip it */
+ avio_skip(pb, data_size);
+ src_size -= data_size;
+ continue;
+ }
+
+ for (uint32_t i = 0; i < data_size; i += 2) {
+ pkt->data[out_size] = (0x1F << 3) | (1 << 2) | (cc_field - 1);
+ pkt->data[out_size + 1] = avio_r8(pb);
+ pkt->data[out_size + 2] = avio_r8(pb);
+ out_size += 3;
+ src_size -= 2;
+ }
}
- return 0;
+ if (src_size > 0)
+ /* skip any remaining unread portion of the input payload */
+ avio_skip(pb, src_size);
+
+ av_shrink_packet(pkt, out_size);
+ return ret;
}
static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *sample,
--
2.49.1
From a8a3fc84afa21de2d704101244f5ad5d88be3421 Mon Sep 17 00:00:00 2001
From: softworkz <softworkz@hotmail.com>
Date: Thu, 27 Feb 2025 16:36:56 +0000
Subject: [PATCH 233/434] avformat/hls: Partially revert "reduce default max
reload to 3"
(setting to 100 as a reasonable compromise)
The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c0a58b84a02701df1b6e5d5ac1d1b8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index fbc88c8f88..b96c5ab9d2 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2633,7 +2633,7 @@ static const AVOption hls_options[] = {
{"extension_picky", "Be picky with all extensions matching",
OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS},
{"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
- OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 3}, 0, INT_MAX, FLAGS},
+ OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 100}, 0, INT_MAX, FLAGS},
{"m3u8_hold_counters", "The maximum number of times to load m3u8 when it refreshes without new segments",
OFFSET(m3u8_hold_counters), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS},
{"http_persistent", "Use persistent HTTP connections",
--
2.49.1
From 68af2cc3feb8c78aec2722c728fd87f03515fa7c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 2 Mar 2025 16:29:39 +0100
Subject: [PATCH 234/434] Prepare for 7.1.1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 2 ++
RELEASE | 2 +-
doc/Doxyfile | 2 +-
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/Changelog b/Changelog
index 4247ece409..4b35e446cd 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,8 @@ Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 7.1.1:
+ avformat/hls: Partially revert "reduce default max reload to 3"
+ avformat/mov: (v4) fix get_eia608_packet
avformat/iff: Check that we have a stream in read_dst_frame()
avcodec/aac/aacdec_lpd: Limit get_unary()
avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors()
diff --git a/RELEASE b/RELEASE
index 0f0fefae5a..21c8c7b46b 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-7.1
+7.1.1
diff --git a/doc/Doxyfile b/doc/Doxyfile
index c6dc306197..16f3a78735 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
-PROJECT_NUMBER = 7.1
+PROJECT_NUMBER = 7.1.1
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
--
2.49.1
From db69d06eeeab4f46da15030a80d539efb4503ca8 Mon Sep 17 00:00:00 2001
From: Lynne <dev@lynne.ee>
Date: Wed, 1 Jan 2025 18:03:33 +0900
Subject: [PATCH 235/434] configure: update copyright year
On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.
(cherry picked from commit d3aa99a4f436e89773246339d9d363587a1d21df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
configure | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure b/configure
index 9c013505f2..ffa407d53d 100755
--- a/configure
+++ b/configure
@@ -8191,7 +8191,7 @@ cat > $TMPH <<EOF
#define FFMPEG_CONFIG_H
#define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
#define FFMPEG_LICENSE "$(c_escape $license)"
-#define CONFIG_THIS_YEAR 2024
+#define CONFIG_THIS_YEAR 2025
#define FFMPEG_DATADIR "$(eval c_escape $datadir)"
#define AVCONV_DATADIR "$(eval c_escape $datadir)"
#define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
--
2.49.1
From f023d2c61b3c178cb6d279ff51472ca16f239674 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 27 Feb 2025 23:38:09 -0300
Subject: [PATCH 236/434] fftools/ffmpeg_filter: also remove display matrix
side data from buffered frames
Some frames may be buffered before a complex filtergraph can be configured.
This change ensures the side data removal in the cases where autorotation is
enabled also applies to them.
Fixes ticket #11487
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 01f63ef0b44fa70d87edaf52f19fcdb2ae7446b3)
---
fftools/ffmpeg_filter.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c
index 38c7676a7e..3ef6818c72 100644
--- a/fftools/ffmpeg_filter.c
+++ b/fftools/ffmpeg_filter.c
@@ -1998,6 +1998,10 @@ static int configure_filtergraph(FilterGraph *fg, FilterGraphThread *fgt)
if (ifp->type_src == AVMEDIA_TYPE_SUBTITLE) {
sub2video_frame(&ifp->ifilter, tmp, !fgt->graph);
} else {
+ if (ifp->type_src == AVMEDIA_TYPE_VIDEO) {
+ if (ifp->displaymatrix_applied)
+ av_frame_remove_side_data(tmp, AV_FRAME_DATA_DISPLAYMATRIX);
+ }
ret = av_buffersrc_add_frame(ifp->filter, tmp);
}
av_frame_free(&tmp);
--
2.49.1
From 68b5db246407f0b0e398ce3b10ee57f738f0c524 Mon Sep 17 00:00:00 2001
From: Gyan Doshi <ffmpeg@gyani.pro>
Date: Sat, 22 Feb 2025 10:38:53 +0530
Subject: [PATCH 237/434] avcodec/libsvtav1: unbreak build with latest svtav1
SVT-AV1 made a change in their public API in 988e930c but without a
version bump or any other accessible marker, thus breaking ffmpeg build
with current versions of SVT-AV1.
They have finally bumped versions a month later, so check added.
(cherry picked from commit d1ed5c06e3edc5f2b5f3664c80121fa55b0baa95)
---
libavcodec/libsvtav1.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/libsvtav1.c b/libavcodec/libsvtav1.c
index 79b28eb4df..43fe531fde 100644
--- a/libavcodec/libsvtav1.c
+++ b/libavcodec/libsvtav1.c
@@ -435,7 +435,11 @@ static av_cold int eb_enc_init(AVCodecContext *avctx)
svt_enc->eos_flag = EOS_NOT_REACHED;
+#if SVT_AV1_CHECK_VERSION(3, 0, 0)
+ svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, &svt_enc->enc_params);
+#else
svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, svt_enc, &svt_enc->enc_params);
+#endif
if (svt_ret != EB_ErrorNone) {
return svt_print_error(avctx, svt_ret, "Error initializing encoder handle");
}
--
2.49.1
From ea34bf796251d1108f34b0962a8529fe78586f8d Mon Sep 17 00:00:00 2001
From: Brad Smith <brad-at-comstyle.com@ffmpeg.org>
Date: Fri, 18 Aug 2023 15:32:39 -0400
Subject: [PATCH 238/434] lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX
environments with Clang
Add a check for the existence of the vec_xl() function. Clang provides
the function even with VSX not enabled.
(cherry picked from commit 30a8641465f7b7923e92d8724ef6a595fccb9e58)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
configure | 8 ++++++++
libswscale/ppc/yuv2rgb_altivec.c | 4 ++--
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/configure b/configure
index ffa407d53d..eedf066c38 100755
--- a/configure
+++ b/configure
@@ -2212,6 +2212,7 @@ ARCH_EXT_LIST_PPC="
ldbrx
power8
ppc4xx
+ vec_xl
vsx
"
@@ -2759,6 +2760,7 @@ altivec_deps="ppc"
dcbzl_deps="ppc"
ldbrx_deps="ppc"
ppc4xx_deps="ppc"
+vec_xl_deps="altivec"
vsx_deps="altivec"
power8_deps="vsx"
@@ -6389,6 +6391,11 @@ elif enabled ppc; then
check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)"
fi
+ if enabled altivec && disabled vsx; then
+ check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 };
+ vector unsigned char y0 = vec_xl(0, y1i);"
+ fi
+
elif enabled riscv; then
enabled rv && check_inline_asm rv '".option arch, +zbb\nrev8 t0, t1"'
@@ -7941,6 +7948,7 @@ if enabled ppc; then
echo "POWER8 enabled ${power8-no}"
echo "PPC 4xx optimizations ${ppc4xx-no}"
echo "dcbzl available ${dcbzl-no}"
+ echo "vec_xl available ${vec_xl-no}"
fi
if enabled loongarch; then
echo "LSX enabled ${lsx-no}"
diff --git a/libswscale/ppc/yuv2rgb_altivec.c b/libswscale/ppc/yuv2rgb_altivec.c
index 5e1033a973..8b0a93796f 100644
--- a/libswscale/ppc/yuv2rgb_altivec.c
+++ b/libswscale/ppc/yuv2rgb_altivec.c
@@ -284,7 +284,7 @@ static inline void cvtyuvtoRGB(SwsContext *c, vector signed short Y,
* ------------------------------------------------------------------------------
*/
-#if !HAVE_VSX
+#if !HAVE_VEC_XL
static inline vector unsigned char vec_xl(signed long long offset, const ubyte *addr)
{
const vector unsigned char *v_addr = (const vector unsigned char *) (addr + offset);
@@ -292,7 +292,7 @@ static inline vector unsigned char vec_xl(signed long long offset, const ubyte *
return (vector unsigned char) vec_perm(v_addr[0], v_addr[1], align_perm);
}
-#endif /* !HAVE_VSX */
+#endif /* !HAVE_VEC_XL */
#define DEFCSP420_CVT(name, out_pixels) \
static int altivec_ ## name(SwsContext *c, const unsigned char **in, \
--
2.49.1
From dca3b4760f2f77aa2f71ad2ebb63bb0144d7edfd Mon Sep 17 00:00:00 2001
From: Brad Smith <brad@comstyle.com>
Date: Tue, 11 Mar 2025 00:31:47 -0400
Subject: [PATCH 239/434] lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX
environments with Clang v2
v2: test for function if AltiVec is enabled instead of with AltiVec and without VSX
(cherry picked from commit 49c8f33262d7c113c71cee9cd30b990a92afa0a1)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
configure | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure b/configure
index eedf066c38..ed56cf0155 100755
--- a/configure
+++ b/configure
@@ -6391,7 +6391,7 @@ elif enabled ppc; then
check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)"
fi
- if enabled altivec && disabled vsx; then
+ if enabled altivec; then
check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 };
vector unsigned char y0 = vec_xl(0, y1i);"
fi
--
2.49.1
From 276bd388f33b5071799691aee6e0cd99c7133d61 Mon Sep 17 00:00:00 2001
From: Peter Ross <pross@xvid.org>
Date: Thu, 19 Dec 2024 09:50:42 +1100
Subject: [PATCH 240/434] avcodec/Makefile: include aom_film_grain.o file for
h264_sei component
h264_sei depends on h2645_sei, which in turn depends on aom_film_grain for
ff_aom_uninit_film_grain_params()
(cherry picked from commit 7aeae8d1ae846302ba1e9955cf64fe83f02b7a57)
---
libavcodec/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/Makefile b/libavcodec/Makefile
index a4fcce3b42..153a9e3881 100644
--- a/libavcodec/Makefile
+++ b/libavcodec/Makefile
@@ -108,7 +108,7 @@ OBJS-$(CONFIG_H264PARSE) += h264_parse.o h264_ps.o h264data.o \
h2645data.o h2645_parse.o h2645_vui.o
OBJS-$(CONFIG_H264PRED) += h264pred.o
OBJS-$(CONFIG_H264QPEL) += h264qpel.o
-OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o
+OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o aom_film_grain.o
OBJS-$(CONFIG_HEVCPARSE) += h2645data.o h2645_parse.o h2645_vui.o
OBJS-$(CONFIG_HEVC_SEI) += h2645_sei.o aom_film_grain.o \
dynamic_hdr_vivid.o
--
2.49.1
From 48c0f071d4b5dd3c06c9978a2edc0fdcbbc3717a Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 11 Oct 2024 15:49:44 +0800
Subject: [PATCH 241/434] avcodec/mediacodecdec_common: Workaround MTK broken
crop implementation
MediaTek SOC return broken crop info, e.g.,
width: int32(3840) height: int32(2160) crop: Rect(0, 0, 318, 238)
It will notify the right crop info with infoOutputFormatChanged, but
too late.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit 7fe9d12f2571265b2a7b5c763d62ee80f9a9e2e2)
---
libavcodec/mediacodecdec_common.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c
index 3770b4f3ae..8a270f2f29 100644
--- a/libavcodec/mediacodecdec_common.c
+++ b/libavcodec/mediacodecdec_common.c
@@ -594,7 +594,8 @@ static int mediacodec_dec_parse_video_format(AVCodecContext *avctx, MediaCodecDe
AMEDIAFORMAT_GET_INT32(s->crop_right, "crop-right", 0);
// Try "crop" for NDK
- if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec)
+ // MediaTek SOC return some default value like Rect(0, 0, 318, 238)
+ if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec && !strstr(s->codec_name, ".mtk."))
ff_AMediaFormat_getRect(s->format, "crop", &s->crop_left, &s->crop_top, &s->crop_right, &s->crop_bottom);
if (s->crop_right && s->crop_bottom) {
--
2.49.1
From 579e7b85c8cd6c3960ff23216987c4038f146ba7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Wed, 25 Sep 2024 15:13:34 +0300
Subject: [PATCH 242/434] configure: Silence Xcode warnings about duplicate
libraries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Since Xcode 15, macOS developer tools use a new linker. The new
linker by default warns for duplicate -l options. As this is a
known and expected thing, not to be considered an issue, ask for
the warning to be silenced.
This silences linker warnings like this:
ld: warning: ignoring duplicate libraries: '-lc++', '-lcrypto', '-lm', '-logg', '-lpthread', '-lssl', '-lvorbis', '-lvpx', '-lz'
The linker can also warn about duplicate -rpath options, and there's
currently no option to silence those warnings.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit bd22d7e601933ef8a0975fc9252cee2d44632f61)
---
configure | 1 +
1 file changed, 1 insertion(+)
diff --git a/configure b/configure
index ed56cf0155..1610d00e7c 100755
--- a/configure
+++ b/configure
@@ -6487,6 +6487,7 @@ check_cc intrinsics_sse2 emmintrin.h "__m128i test = _mm_setzero_si128()"
check_ldflags -Wl,--as-needed
check_ldflags -Wl,-z,noexecstack
+check_ldflags -Wl,-no_warn_duplicate_libraries
if ! disabled network; then
check_func getaddrinfo $network_extralibs
--
2.49.1
From c91d887a25d33ba3b180b80187405aa38f19f2ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Mon, 14 Oct 2024 23:43:11 +0300
Subject: [PATCH 243/434] configure: Only try to use the
-no_warn_duplicate_libraries flag on Darwin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
While we only add the flag if the linker seems to support it,
it turns out that ld.bfd had a bug where the flag is accidentally
accepted, and the flag produces an output file named
"_warn_duplicate_libraries".
The ld.bfd bug was fixed in binutils 2.36, in
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3991c7acb29aa8d7d52150695eb3efa03a08dd50.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 38d08f5c451a312d9064b81472fa05ff53b2e780)
---
configure | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/configure b/configure
index 1610d00e7c..156d72e119 100755
--- a/configure
+++ b/configure
@@ -6487,7 +6487,9 @@ check_cc intrinsics_sse2 emmintrin.h "__m128i test = _mm_setzero_si128()"
check_ldflags -Wl,--as-needed
check_ldflags -Wl,-z,noexecstack
-check_ldflags -Wl,-no_warn_duplicate_libraries
+if [ $target_os = "darwin" ]; then
+ check_ldflags -Wl,-no_warn_duplicate_libraries
+fi
if ! disabled network; then
check_func getaddrinfo $network_extralibs
--
2.49.1
From 652a765ecb366d92d9b8f917dee2304c689aa5d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Tue, 29 Apr 2025 10:42:48 +0300
Subject: [PATCH 244/434] configure: Enable -fno-common for Darwin targets,
avoid linker warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Since GCC 10 and llvm.org Clang 11, -fno-common is the default.
However Apple's Xcode Clang hasn't followed suit yet, and still
defaults to -fcommon.
Compiling with -fcommon causes uninitialized global variables to
be treated as "common" (which allows multiple object files to have
similar definitions).
Common variables seem to have the issue that their intended alignment
isn't signaled, so the linker assumes that they may need alignment
according to their full size.
With large global tables, this can lead to linker warnings like
this, with Xcode 16.3:
ld: warning: reducing alignment of section __DATA,__common from 0x8000 to 0x4000 because it exceeds segment maximum alignment
This can be reproduced with a small snippet like this:
char table[16385];
int main(int argc, char* argv[]) { return 0; }
Compiling with -fno-common avoids this issue and warning, and
matches the default behaviour of other compilers. (Compiling with
-fno-common also avoids the risk of accidentally accepting
duplicate definitions of global variables, as long as they are
uninitialized.)
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f4e72eb5a3dbd25ed3ab6c9f89c42adcfc0b5e3d)
---
configure | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/configure b/configure
index 156d72e119..0aa7b72af3 100755
--- a/configure
+++ b/configure
@@ -5807,6 +5807,13 @@ case $target_os in
clang_version=$($cc -dumpversion)
test ${clang_version%%.*} -eq 11 && add_cflags -fno-stack-check
fi
+
+ # Xcode Clang doesn't default to -fno-common while upstream llvm.org
+ # Clang (and GCC) do. This avoids linker warnings on Xcode 16.3 about
+ # "reducing alignment of section __DATA,__common from 0x8000 to 0x4000
+ # because it exceeds segment maximum alignment".
+ check_cflags -fno-common
+
;;
msys*)
die "Native MSYS builds are discouraged, please use the MINGW environment."
--
2.49.1
From c6c20e04ccad29732bc5c2c8eafecad90b48ee61 Mon Sep 17 00:00:00 2001
From: Tobias Rapp <t.rapp@noa-archive.com>
Date: Wed, 30 Apr 2025 10:37:52 +0200
Subject: [PATCH 245/434] avfilter/vf_setparams: Fix chroma_location being
cleared
Fix chroma_location being cleared by setrange and setfield filters.
This was forgotten in 201f1cba150d44de6fedfeee4e8647170ed5fbca.
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com>
(cherry picked from commit 0f751d383667661e22261ae47cdc36cebd3cdc62)
---
libavfilter/vf_setparams.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavfilter/vf_setparams.c b/libavfilter/vf_setparams.c
index 14a16477c9..b12e46e354 100644
--- a/libavfilter/vf_setparams.c
+++ b/libavfilter/vf_setparams.c
@@ -246,6 +246,7 @@ static av_cold int init_setrange(AVFilterContext *ctx)
s->color_primaries = -1;
s->color_trc = -1;
s->colorspace = -1;
+ s->chroma_location = -1;
return 0;
}
@@ -282,6 +283,7 @@ static av_cold int init_setfield(AVFilterContext *ctx)
s->color_primaries = -1;
s->color_trc = -1;
s->colorspace = -1;
+ s->chroma_location = -1;
return 0;
}
--
2.49.1
From 9237125e51a4ecae76dc476b620e8e492c7aaf8b Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Thu, 17 Apr 2025 20:12:49 +0800
Subject: [PATCH 246/434] avformat/mov: Reduce seek when interleaved_read is
disabled
Don't select sample with small dts when interleaved_read is disabled.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit ca964ba139695fc0064d07ac6503626d549520c7)
---
libavformat/mov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 41ca280c8a..97a9cfecae 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10449,7 +10449,7 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st)
((s->pb->seekable & AVIO_SEEKABLE_NORMAL) &&
((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb && dts != AV_NOPTS_VALUE &&
((dtsdiff <= AV_TIME_BASE && current_sample->pos < sample->pos) ||
- (dtsdiff > AV_TIME_BASE && dts < best_dts)))))) {
+ (dtsdiff > AV_TIME_BASE && dts < best_dts && mov->interleaved_read)))))) {
sample = current_sample;
best_dts = dts;
*st = avst;
--
2.49.1
From 94784d0918932a25a8f013f29e6c862b61ecfa45 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 25 Apr 2025 01:08:36 +0800
Subject: [PATCH 247/434] avcodec/bsf/h264_mp4toannexb: Fix mixed bitstream
format
This bsf converts AV_PKT_DATA_NEW_EXTRADATA side data in avcc format
to in-band annexb format. However, the side data wasn't been removed
and copied from input packet to output packet. So the output packet
has mixed bitstream format. We don't support mixed bitstream format.
For example, h264_metadata report error in the following case:
ffmpeg -i foo.flv \
-bsf:v "h264_mp4toannexb,h264_metadata" \
-c copy -f null
This patch removed NEW_EXTRADATA side data after process.
This patch also add a check so only NEW_EXTRADATA in avcc format is
processed. NEW_EXTRADATA in annexb format is copied to output as is.
Reported-by: jiangjie <jiangjie618@gmail.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit 25812d303398552a7768dac04f2992bcb09ea000)
---
libavcodec/bsf/h264_mp4toannexb.c | 22 ++++++++++++----------
tests/fate/h264.mak | 4 ++--
2 files changed, 14 insertions(+), 12 deletions(-)
diff --git a/libavcodec/bsf/h264_mp4toannexb.c b/libavcodec/bsf/h264_mp4toannexb.c
index dda064287e..36b09b4dd6 100644
--- a/libavcodec/bsf/h264_mp4toannexb.c
+++ b/libavcodec/bsf/h264_mp4toannexb.c
@@ -93,6 +93,11 @@ static int h264_extradata_to_annexb(AVBSFContext *ctx,
const int padding = AV_INPUT_BUFFER_PADDING_SIZE;
int length_size, pps_offset = 0;
+ if (extradata_size < 7) {
+ av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extradata_size);
+ return AVERROR_INVALIDDATA;
+ }
+
bytestream2_init(gb, extradata, extradata_size);
bytestream2_skipu(gb, 4);
@@ -262,16 +267,11 @@ static int h264_mp4toannexb_init(AVBSFContext *ctx)
(extra_size >= 4 && AV_RB32(ctx->par_in->extradata) == 1)) {
av_log(ctx, AV_LOG_VERBOSE,
"The input looks like it is Annex B already\n");
- } else if (extra_size >= 7) {
- return h264_extradata_to_annexb(ctx,
- ctx->par_in->extradata,
- ctx->par_in->extradata_size);
- } else {
- av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extra_size);
- return AVERROR_INVALIDDATA;
+ return 0;
}
-
- return 0;
+ return h264_extradata_to_annexb(ctx,
+ ctx->par_in->extradata,
+ ctx->par_in->extradata_size);
}
static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)
@@ -293,10 +293,12 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt)
extradata = av_packet_get_side_data(in, AV_PKT_DATA_NEW_EXTRADATA,
&extradata_size);
- if (extradata) {
+ if (extradata && extradata[0] == 1) {
ret = h264_extradata_to_annexb(ctx, extradata, extradata_size);
if (ret < 0)
goto fail;
+ av_packet_side_data_remove(in->side_data, &in->side_data_elems,
+ AV_PKT_DATA_NEW_EXTRADATA);
}
/* nothing to filter */
diff --git a/tests/fate/h264.mak b/tests/fate/h264.mak
index e7038387ea..d93751f093 100644
--- a/tests/fate/h264.mak
+++ b/tests/fate/h264.mak
@@ -224,7 +224,7 @@ FATE_H264-$(call FRAMECRC, MOV, H264) += fate-h264-unescaped-extradata
# this sample contains field-coded frames, with both fields in a single packet
FATE_H264-$(call FRAMECRC, MOV, H264) += fate-h264-twofields-packet
-FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata
+FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF H264_METADATA_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata
FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF) += fate-h264-bsf-mp4toannexb \
fate-h264-bsf-mp4toannexb-2 \
@@ -438,7 +438,7 @@ fate-h264-bsf-mp4toannexb: CMD = md5 -i $(TARGET_SAMPLES)
fate-h264-bsf-mp4toannexb-2: CMD = md5 -i $(TARGET_SAMPLES)/h264/ps_prefix_first_idr.mp4 -c:v copy -f h264
fate-h264-bsf-mp4toannexb-2: CMP = oneline
fate-h264-bsf-mp4toannexb-2: REF = cffcfa6a2d0b58c9de1f5785f099f41d
-fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-map 0:v"
+fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-bsf h264_mp4toannexb,h264_metadata -map 0:v"
fate-h264-bsf-dts2pts: CMD = transcode "h264" $(TARGET_SAMPLES)/h264-conformance/CAPAMA3_Sand_F.264 \
mov "-c:v copy -bsf:v dts2pts -frames:v 50" "-c:v copy"
fate-h264_mp4toannexb_ticket5927: CMD = transcode "mp4" $(TARGET_SAMPLES)/h264/thezerotheorem-cut.mp4 \
--
2.49.1
From 4991c1ec92874737a9c4b1bce1b3f73a23b78b20 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Wed, 23 Apr 2025 20:59:41 +0800
Subject: [PATCH 248/434] avformat/hls: Fix get key file error
The offset and end_offset options are meant for segment, not for key.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit bb0c4649fb63591a2c9f5e3962815c2db8de50fc)
---
libavformat/hls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index b96c5ab9d2..896deb23d5 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -1351,7 +1351,7 @@ static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg,
if (seg->key_type == KEY_AES_128 || seg->key_type == KEY_SAMPLE_AES) {
if (strcmp(seg->key, pls->key_url)) {
AVIOContext *pb = NULL;
- if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, opts, NULL) == 0) {
+ if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, NULL, NULL) == 0) {
ret = avio_read(pb, pls->key, sizeof(pls->key));
if (ret != sizeof(pls->key)) {
av_log(pls->parent, AV_LOG_ERROR, "Unable to read key file %s\n",
--
2.49.1
From 7eaa8c110e830cb831781dad1bba8fe2365176fb Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 24 Mar 2025 13:51:15 -0300
Subject: [PATCH 249/434] avcodec/h264_slice: insert LCEVC side data before
get_buffer() call
Otherwise it will not be taken into account or applied at all.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 25b0a8e295749a60a238ba0d6fe7a3742937b6bb)
---
libavcodec/h264_slice.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 84595b1a8b..01c43a652e 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -191,6 +191,13 @@ static int alloc_picture(H264Context *h, H264Picture *pic)
av_assert0(!pic->f->data[0]);
+ if (h->sei.common.lcevc.info) {
+ HEVCSEILCEVC *lcevc = &h->sei.common.lcevc;
+ ret = ff_frame_new_side_data_from_buf(h->avctx, pic->f, AV_FRAME_DATA_LCEVC, &lcevc->info);
+ if (ret < 0)
+ return ret;
+ }
+
pic->tf.f = pic->f;
ret = ff_thread_get_ext_buffer(h->avctx, &pic->tf,
pic->reference ? AV_GET_BUFFER_FLAG_REF : 0);
--
2.49.1
From 59576ad4c5ce3667e0e1d967af57ad0c3f2d334a Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Fri, 9 May 2025 00:18:29 +0200
Subject: [PATCH 250/434] avformat/wavdec: increase requested probe score for
codec probe
Codec probing was primarily added to the wav demuxer to support DTS-in-wav
files, but DTS probing functions return AVPROBE_SCORE_EXTENSION+1, so we can be
a bit more strict with the required score.
This fixes MP3 misdetections for some wav files.
Fixes ticket #11581.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit ce01c7fb58597f525e130f47a13ff77f1db62bf4)
---
libavformat/wavdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index ae6ff0e022..7748a2fbb4 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -178,7 +178,7 @@ static void handle_stream_probing(AVStream *st)
{
if (st->codecpar->codec_id == AV_CODEC_ID_PCM_S16LE) {
FFStream *const sti = ffstream(st);
- sti->request_probe = AVPROBE_SCORE_EXTENSION;
+ sti->request_probe = AVPROBE_SCORE_EXTENSION + 1;
sti->probe_packets = FFMIN(sti->probe_packets, 32);
}
}
--
2.49.1
From 0b065663d46a0c38186b78bc91fe4849cd30493b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Fri, 10 May 2024 22:30:03 +0200
Subject: [PATCH 251/434] avcodec/libzvbi-teletextdec: change new lines to \n
in ASS header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes remaining \r\n is ASS header after 57c545090d.
Fixes AVERROR_BUG error during init as this decoder expected `\r\n` in
default ASS header. strstr(..., "\r\n[Events]\r\n") failed after changes
in 57c545090d.
Fixes ticket #11545.
Fixes: 57c545090d
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit eb6dc952cbd479bf43673af9ca0bc83f37f8f329)
---
libavcodec/libzvbi-teletextdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/libzvbi-teletextdec.c b/libavcodec/libzvbi-teletextdec.c
index 68ffe1f76c..e02ecb8b3a 100644
--- a/libavcodec/libzvbi-teletextdec.c
+++ b/libavcodec/libzvbi-teletextdec.c
@@ -91,7 +91,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx)
if (ret < 0)
return ret;
- event_pos = strstr(avctx->subtitle_header, "\r\n[Events]\r\n");
+ event_pos = strstr(avctx->subtitle_header, "\n[Events]\n");
if (!event_pos)
return AVERROR_BUG;
@@ -106,7 +106,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx)
"0,0," /* Spacing, Angle */
"3,0.1,0," /* BorderStyle, Outline, Shadow */
"5,1,1,1," /* Alignment, Margin[LRV] */
- "0\r\n" /* Encoding */
+ "0\n" /* Encoding */
"Style: "
"Subtitle," /* Name */
"Monospace,16," /* Font{name,size} */
@@ -116,7 +116,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx)
"0,0," /* Spacing, Angle */
"1,1,1," /* BorderStyle, Outline, Shadow */
"8,48,48,20," /* Alignment, Margin[LRV] */
- "0\r\n" /* Encoding */
+ "0\n" /* Encoding */
, event_pos);
if (!new_header)
--
2.49.1
From 24de8a98cfb33b10992772ba54f650eb61c96d44 Mon Sep 17 00:00:00 2001
From: Pavel Koshevoy <pkoshevoy@gmail.com>
Date: Sun, 18 May 2025 08:57:31 -0600
Subject: [PATCH 252/434] avformat/mpegts: update stream info when PMT ES
stream_type changes
I have several .ts captures where video and audio codec changes even
though the PMT version does not change and the PIDs stay the same.
This happens during transition to/from slate (mpeg2 video and audio)
to network broadcast (hevc video and eac3 audio in private PES).
I've updated fate ts-demux expected results.
---
libavformat/mpegts.c | 4 +++-
tests/ref/fate/ts-demux | 4 ++--
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 86b7c8e041..b5f29aee65 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -938,6 +938,8 @@ static int mpegts_set_stream_info(AVStream *st, PESContext *pes,
mpegts_find_stream_type(st, pes->stream_type, ISO_types);
if (pes->stream_type == 4 || pes->stream_type == 0x0f)
sti->request_probe = 50;
+ if (pes->stream_type == STREAM_TYPE_PRIVATE_DATA)
+ sti->request_probe = AVPROBE_SCORE_STREAM_RETRY;
if ((prog_reg_desc == AV_RL32("HDMV") ||
prog_reg_desc == AV_RL32("HDPR")) &&
st->codecpar->codec_id == AV_CODEC_ID_NONE) {
@@ -2496,7 +2498,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
if (!st)
goto out;
- if (pes && !pes->stream_type)
+ if (pes && pes->stream_type != stream_type)
mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);
add_pid_to_program(prg, pid);
diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux
index 45522c2bfb..732f9d0289 100644
--- a/tests/ref/fate/ts-demux
+++ b/tests/ref/fate/ts-demux
@@ -24,6 +24,6 @@ packet|codec_type=video|stream_index=0|pts=3912686363|pts_time=43474.292922|dts=
packet|codec_type=audio|stream_index=1|pts=3912644825|pts_time=43473.831389|dts=3912644825|dts_time=43473.831389|duration=2880|duration_time=0.032000|size=906|pos=474888|flags=K__|data_hash=CRC32:0893d398
packet|codec_type=audio|stream_index=2|pts=3912645580|pts_time=43473.839778|dts=3912645580|dts_time=43473.839778|duration=2880|duration_time=0.032000|size=354|pos=491808|flags=K__|data_hash=CRC32:f5963fa6
stream|index=0|codec_name=mpeg2video|profile=4|codec_type=video|codec_tag_string=[2][0][0][0]|codec_tag=0x0002|width=1280|height=720|coded_width=0|coded_height=0|closed_captions=0|film_grain=0|has_b_frames=1|sample_aspect_ratio=1:1|display_aspect_ratio=16:9|pix_fmt=yuv420p|level=4|color_range=tv|color_space=unknown|color_transfer=unknown|color_primaries=unknown|chroma_location=left|field_order=progressive|refs=1|ts_id=32776|ts_packetsize=188|id=0x31|r_frame_rate=60000/1001|avg_frame_rate=60000/1001|time_base=1/90000|start_pts=3912669846|start_time=43474.109400|duration_ts=19519|duration=0.216878|bit_rate=15000000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=15|extradata_size=150|extradata_hash=CRC32:53134fa8|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|side_datum/cpb_properties:side_data_type=CPB properties|side_datum/cpb_properties:max_bitrate=15000000|side_datum/cpb_properties:min_bitrate=0|side_datum/cpb_properties:avg_bitrate=0|side_datum/cpb_properties:buffer_size=9781248|side_datum/cpb_properties:vbv_delay=-1
-stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng
-stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es
+stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng
+stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es
format|filename=mp3ac325-4864-small.ts|nb_streams=3|nb_programs=1|nb_stream_groups=0|format_name=mpegts|start_time=43473.703389|duration=0.622889|size=512000|bit_rate=6575810|probe_score=50
--
2.49.1
From ccbd089467382a6693f792b1ea1c23e3bdda089d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Thu, 22 May 2025 21:21:24 +0000
Subject: [PATCH 253/434] avfilter/avfiltergraph: fix regression in picking
channel layout
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1b3f4842c18409dba5a345ef9e7b3de7a4fa3657)
---
libavfilter/avfiltergraph.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/avfiltergraph.c b/libavfilter/avfiltergraph.c
index 38077ff701..1744298ee5 100644
--- a/libavfilter/avfiltergraph.c
+++ b/libavfilter/avfiltergraph.c
@@ -1067,8 +1067,8 @@ static void swap_channel_layouts_on_filter(AVFilterContext *filter)
}
/* no penalty for LFE channel mismatch */
- if (av_channel_layout_channel_from_index(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 &&
- av_channel_layout_channel_from_index(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0)
+ if (av_channel_layout_index_from_channel(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 &&
+ av_channel_layout_index_from_channel(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0)
score += 10;
av_channel_layout_from_mask(&in_chlayout, av_channel_layout_subset(&in_chlayout, ~AV_CH_LOW_FREQUENCY));
av_channel_layout_from_mask(&out_chlayout, av_channel_layout_subset(&out_chlayout, ~AV_CH_LOW_FREQUENCY));
--
2.49.1
From 4c78a357d082b1097c4269dd1af116bb01ddc83e Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 16 May 2025 16:54:52 -0300
Subject: [PATCH 254/434] avcodec/lcevcdec: don't try to write to output frames
directly
The buffer references may not be writable at this point, as the decoder
calls get_buffer2() with the AV_GET_BUFFER_FLAG_REF flag.
Fixes races as reported by tsan, producing correct output regardless of
threading choices.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8eae65dc5c8960c9770017737d968eca2aa7f502)
---
libavcodec/decode.c | 39 ++++++++++++++++++++----
libavcodec/lcevcdec.c | 69 ++++++++++++++++++++++++-------------------
libavcodec/lcevcdec.h | 5 ++++
3 files changed, 78 insertions(+), 35 deletions(-)
diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index 148af71ac4..828013197c 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -1671,22 +1671,49 @@ static void update_frame_props(AVCodecContext *avctx, AVFrame *frame)
}
}
-static void attach_post_process_data(AVCodecContext *avctx, AVFrame *frame)
+static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame)
{
AVCodecInternal *avci = avctx->internal;
DecodeContext *dc = decode_ctx(avci);
if (dc->lcevc_frame) {
FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data;
+ FFLCEVCFrame *frame_ctx;
+ int ret;
- fdd->post_process_opaque = ff_refstruct_ref(dc->lcevc);
- fdd->post_process_opaque_free = ff_lcevc_unref;
- fdd->post_process = ff_lcevc_process;
+ frame_ctx = av_mallocz(sizeof(*frame_ctx));
+ if (!frame_ctx)
+ return AVERROR(ENOMEM);
+
+ frame_ctx->frame = av_frame_alloc();
+ if (!frame_ctx->frame) {
+ av_free(frame_ctx);
+ return AVERROR(ENOMEM);
+ }
+
+ frame_ctx->lcevc = ff_refstruct_ref(dc->lcevc);
+ frame_ctx->frame->width = frame->width;
+ frame_ctx->frame->height = frame->height;
+ frame_ctx->frame->format = frame->format;
frame->width = dc->width;
frame->height = dc->height;
+
+ ret = avctx->get_buffer2(avctx, frame_ctx->frame, 0);
+ if (ret < 0) {
+ ff_lcevc_unref(frame_ctx);
+ return ret;
+ }
+
+ validate_avframe_allocation(avctx, frame_ctx->frame);
+
+ fdd->post_process_opaque = frame_ctx;
+ fdd->post_process_opaque_free = ff_lcevc_unref;
+ fdd->post_process = ff_lcevc_process;
}
dc->lcevc_frame = 0;
+
+ return 0;
}
int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
@@ -1747,7 +1774,9 @@ int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
if (ret < 0)
goto fail;
- attach_post_process_data(avctx, frame);
+ ret = attach_post_process_data(avctx, frame);
+ if (ret < 0)
+ goto fail;
end:
if (avctx->codec_type == AVMEDIA_TYPE_VIDEO && !override_dimensions &&
diff --git a/libavcodec/lcevcdec.c b/libavcodec/lcevcdec.c
index ceeece3aa9..601e97b3a1 100644
--- a/libavcodec/lcevcdec.c
+++ b/libavcodec/lcevcdec.c
@@ -45,7 +45,7 @@ static LCEVC_ColorFormat map_format(int format)
return LCEVC_ColorFormat_Unknown;
}
-static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder,
+static int alloc_base_frame(void *logctx, FFLCEVCContext *lcevc,
const AVFrame *frame, LCEVC_PictureHandle *picture)
{
LCEVC_PictureDesc desc;
@@ -68,22 +68,22 @@ static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder,
desc.sampleAspectRatioDen = frame->sample_aspect_ratio.den;
/* Allocate LCEVC Picture */
- res = LCEVC_AllocPicture(decoder, &desc, picture);
+ res = LCEVC_AllocPicture(lcevc->decoder, &desc, picture);
if (res != LCEVC_Success) {
return AVERROR_EXTERNAL;
}
- res = LCEVC_LockPicture(decoder, *picture, LCEVC_Access_Write, &lock);
+ res = LCEVC_LockPicture(lcevc->decoder, *picture, LCEVC_Access_Write, &lock);
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
- res = LCEVC_GetPicturePlaneCount(decoder, *picture, &planes);
+ res = LCEVC_GetPicturePlaneCount(lcevc->decoder, *picture, &planes);
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
for (unsigned i = 0; i < planes; i++) {
LCEVC_PicturePlaneDesc plane;
- res = LCEVC_GetPictureLockPlaneDesc(decoder, lock, i, &plane);
+ res = LCEVC_GetPictureLockPlaneDesc(lcevc->decoder, lock, i, &plane);
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
@@ -94,43 +94,43 @@ static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder,
av_image_copy2(data, linesizes, frame->data, frame->linesize,
frame->format, frame->width, frame->height);
- res = LCEVC_UnlockPicture(decoder, lock);
+ res = LCEVC_UnlockPicture(lcevc->decoder, lock);
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
return 0;
}
-static int alloc_enhanced_frame(void *logctx, LCEVC_DecoderHandle decoder,
- const AVFrame *frame, LCEVC_PictureHandle *picture)
+static int alloc_enhanced_frame(void *logctx, FFLCEVCFrame *frame_ctx,
+ LCEVC_PictureHandle *picture)
{
+ FFLCEVCContext *lcevc = frame_ctx->lcevc;
LCEVC_PictureDesc desc ;
- LCEVC_ColorFormat fmt = map_format(frame->format);
+ LCEVC_ColorFormat fmt = map_format(frame_ctx->frame->format);
LCEVC_PicturePlaneDesc planes[4] = { 0 };
- int width = frame->width * 2 / FFMAX(frame->sample_aspect_ratio.den, 1);
- int height = frame->height * 2 / FFMAX(frame->sample_aspect_ratio.num, 1);
LCEVC_ReturnCode res;
- res = LCEVC_DefaultPictureDesc(&desc, fmt, width, height);
+ res = LCEVC_DefaultPictureDesc(&desc, fmt, frame_ctx->frame->width, frame_ctx->frame->height);
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
/* Set plane description */
for (int i = 0; i < 4; i++) {
- planes[i].firstSample = frame->data[i];
- planes[i].rowByteStride = frame->linesize[i];
+ planes[i].firstSample = frame_ctx->frame->data[i];
+ planes[i].rowByteStride = frame_ctx->frame->linesize[i];
}
/* Allocate LCEVC Picture */
- res = LCEVC_AllocPictureExternal(decoder, &desc, NULL, planes, picture);
+ res = LCEVC_AllocPictureExternal(lcevc->decoder, &desc, NULL, planes, picture);
if (res != LCEVC_Success) {
return AVERROR_EXTERNAL;
}
return 0;
}
-static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *in)
+static int lcevc_send_frame(void *logctx, FFLCEVCFrame *frame_ctx, const AVFrame *in)
{
+ FFLCEVCContext *lcevc = frame_ctx->lcevc;
const AVFrameSideData *sd = av_frame_get_side_data(in, AV_FRAME_DATA_LCEVC);
LCEVC_PictureHandle picture;
LCEVC_ReturnCode res;
@@ -143,7 +143,7 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *
if (res != LCEVC_Success)
return AVERROR_EXTERNAL;
- ret = alloc_base_frame(logctx, lcevc->decoder, in, &picture);
+ ret = alloc_base_frame(logctx, lcevc, in, &picture);
if (ret < 0)
return ret;
@@ -152,7 +152,7 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *
return AVERROR_EXTERNAL;
memset(&picture, 0, sizeof(picture));
- ret = alloc_enhanced_frame(logctx, lcevc->decoder, in, &picture);
+ ret = alloc_enhanced_frame(logctx, frame_ctx, &picture);
if (ret < 0)
return ret;
@@ -163,8 +163,9 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *
return 0;
}
-static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out)
+static int generate_output(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out)
{
+ FFLCEVCContext *lcevc = frame_ctx->lcevc;
LCEVC_PictureDesc desc;
LCEVC_DecodeInformation info;
LCEVC_PictureHandle picture;
@@ -184,6 +185,11 @@ static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out)
out->crop_right = desc.cropRight;
out->sample_aspect_ratio.num = desc.sampleAspectRatioNum;
out->sample_aspect_ratio.den = desc.sampleAspectRatioDen;
+
+ av_frame_copy_props(frame_ctx->frame, out);
+ av_frame_unref(out);
+ av_frame_move_ref(out, frame_ctx->frame);
+
out->width = desc.width + out->crop_left + out->crop_right;
out->height = desc.height + out->crop_top + out->crop_bottom;
@@ -194,13 +200,14 @@ static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out)
return 0;
}
-static int lcevc_receive_frame(void *logctx, FFLCEVCContext *lcevc, AVFrame *out)
+static int lcevc_receive_frame(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out)
{
+ FFLCEVCContext *lcevc = frame_ctx->lcevc;
LCEVC_PictureHandle picture;
LCEVC_ReturnCode res;
int ret;
- ret = generate_output(logctx, lcevc, out);
+ ret = generate_output(logctx, frame_ctx, out);
if (ret < 0)
return ret;
@@ -247,12 +254,7 @@ static int lcevc_init(FFLCEVCContext *lcevc, void *logctx)
#if CONFIG_LIBLCEVC_DEC
LCEVC_AccelContextHandle dummy = { 0 };
const int32_t event = LCEVC_Log;
-#endif
- if (lcevc->initialized)
- return 0;
-
-#if CONFIG_LIBLCEVC_DEC
if (LCEVC_CreateDecoder(&lcevc->decoder, dummy) != LCEVC_Success) {
av_log(logctx, AV_LOG_ERROR, "Failed to create LCEVC decoder\n");
return AVERROR_EXTERNAL;
@@ -277,7 +279,8 @@ static int lcevc_init(FFLCEVCContext *lcevc, void *logctx)
int ff_lcevc_process(void *logctx, AVFrame *frame)
{
FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data;
- FFLCEVCContext *lcevc = fdd->post_process_opaque;
+ FFLCEVCFrame *frame_ctx = fdd->post_process_opaque;
+ FFLCEVCContext *lcevc = frame_ctx->lcevc;
int ret;
if (!lcevc->initialized) {
@@ -287,11 +290,14 @@ int ff_lcevc_process(void *logctx, AVFrame *frame)
}
#if CONFIG_LIBLCEVC_DEC
- ret = lcevc_send_frame(logctx, lcevc, frame);
+ av_assert0(frame_ctx->frame);
+
+
+ ret = lcevc_send_frame(logctx, frame_ctx, frame);
if (ret)
return ret < 0 ? ret : 0;
- lcevc_receive_frame(logctx, lcevc, frame);
+ lcevc_receive_frame(logctx, frame_ctx, frame);
if (ret < 0)
return ret;
@@ -315,5 +321,8 @@ int ff_lcevc_alloc(FFLCEVCContext **plcevc)
void ff_lcevc_unref(void *opaque)
{
- ff_refstruct_unref(&opaque);
+ FFLCEVCFrame *lcevc = opaque;
+ ff_refstruct_unref(&lcevc->lcevc);
+ av_frame_free(&lcevc->frame);
+ av_free(opaque);
}
diff --git a/libavcodec/lcevcdec.h b/libavcodec/lcevcdec.h
index 7334d3a645..f0d17c0412 100644
--- a/libavcodec/lcevcdec.h
+++ b/libavcodec/lcevcdec.h
@@ -36,6 +36,11 @@ typedef struct FFLCEVCContext {
struct AVFrame;
+typedef struct FFLCEVCFrame {
+ FFLCEVCContext *lcevc;
+ struct AVFrame *frame;
+} FFLCEVCFrame;
+
int ff_lcevc_alloc(FFLCEVCContext **plcevc);
int ff_lcevc_process(void *logctx, struct AVFrame *frame);
void ff_lcevc_unref(void *opaque);
--
2.49.1
From 9373b442a689455bb5fcfddcfe70dfb8e4352fbc Mon Sep 17 00:00:00 2001
From: Coia Prant <coiaprant@gmail.com>
Date: Fri, 23 May 2025 17:32:00 +0800
Subject: [PATCH 255/434] configure: Use MSYSTEM_CARCH for default arch on
msys2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
On msys2, `uname -m` returns the architecture of the base msys2
layer. On Windows on arm64, the base msys2 layer itself is still
x86_64 only, even if running with e.g. the clangarm64 where the
windows native applications are built as aarch64.
If MSYSTEM_CARCH is set, use this instead of `uname -m` for
the default architecture. This gives the correct behaviour
for the clangarm64 environments. It also gives the correct
default for the 32 bit x86 environments such as `mingw32`.
(On `mingw32`, the fact that `uname -m` returned `x86_64`
hasn't been an issue, as both that and `i686` gets normalized
into `x86` internally in ffmpeg's configure.)
Signed-off-by: Coia Prant <coiaprant@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit df967d095ae6a42a46cd4c46b96d61cc1c319b23)
---
configure | 2 ++
1 file changed, 2 insertions(+)
diff --git a/configure b/configure
index 0aa7b72af3..b559dca5d0 100755
--- a/configure
+++ b/configure
@@ -4112,6 +4112,8 @@ if test "$target_os_default" = aix; then
arch_default=$(uname -p)
strip_default="strip -X32_64"
nm_default="nm -g -X32_64"
+elif test "$MSYSTEM_CARCH" != ""; then
+ arch_default="$MSYSTEM_CARCH"
else
arch_default=$(uname -m)
fi
--
2.49.1
From 0755e038ca9cee6094ba7310f4b40a3105735055 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Date: Sun, 25 May 2025 05:12:05 +0200
Subject: [PATCH 256/434] avformat/matroskadec: Fix VfW extradata size
The structure is padded to an even length with an internal
size field to indicate the real size.
The matroska-matroska-display-metadata test (writing FFV1
in VFW mode) was affected by this.
It should also fix ticket #11613.
Reviewed-by: compn <ff@hawaiiantel.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 92e310eb82e04713e55d248b65c22f0eb95afada)
---
libavformat/matroskadec.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index efa3e44c85..105a90a937 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -2876,6 +2876,11 @@ static int mkv_parse_video_codec(MatroskaTrack *track, AVCodecParameters *par,
{
if (!strcmp(track->codec_id, "V_MS/VFW/FOURCC") &&
track->codec_priv.size >= 40) {
+ uint32_t size = AV_RL32A(track->codec_priv.data);
+ // VFW extradata is padded to an even length, yet
+ // the size field contains the real length.
+ if (size & 1 && size == track->codec_priv.size - 1)
+ --track->codec_priv.size;
track->ms_compat = 1;
par->bits_per_coded_sample = AV_RL16(track->codec_priv.data + 14);
par->codec_tag = AV_RL32(track->codec_priv.data + 16);
--
2.49.1
From 0f1fe3d153e8869b4e768a548ad9b5148a45280f Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Date: Sun, 25 May 2025 03:31:17 +0200
Subject: [PATCH 257/434] avformat/matroska: Support JPEG2000 for demuxing
Legal since commit 1cd0a9be4b2d1e7c60184ec68404e00e46e3123e
(Jan 4) in the Cellar Matroska specification git repo.
We still hold out on muxing it due to compatibility with
old demuxers.
Reviewed-by: compn <ff@hawaiiantel.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 8a936b8726e10d84a06cacc872d267020f1ef156)
---
libavformat/matroska.c | 1 +
libavformat/matroskaenc.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavformat/matroska.c b/libavformat/matroska.c
index d0ecfbeb6a..7d94ed236f 100644
--- a/libavformat/matroska.c
+++ b/libavformat/matroska.c
@@ -82,6 +82,7 @@ const CodecTags ff_mkv_codec_tags[]={
{"V_AVS3" , AV_CODEC_ID_AVS3},
{"V_DIRAC" , AV_CODEC_ID_DIRAC},
{"V_FFV1" , AV_CODEC_ID_FFV1},
+ {"V_JPEG2000" , AV_CODEC_ID_JPEG2000},
{"V_MJPEG" , AV_CODEC_ID_MJPEG},
{"V_MPEG1" , AV_CODEC_ID_MPEG1VIDEO},
{"V_MPEG2" , AV_CODEC_ID_MPEG2VIDEO},
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c
index 60c896e964..5d00b26729 100644
--- a/libavformat/matroskaenc.c
+++ b/libavformat/matroskaenc.c
@@ -1956,8 +1956,8 @@ static int mkv_write_track(AVFormatContext *s, MatroskaMuxContext *mkv,
// look for a codec ID string specific to mkv to use,
// if none are found, use AVI codes
- if (par->codec_id == AV_CODEC_ID_FFV1) {
- /* FFV1 is actually supported natively in Matroska,
+ if (par->codec_id == AV_CODEC_ID_FFV1 || par->codec_id == AV_CODEC_ID_JPEG2000) {
+ /* FFV1 and JPEG2000 are actually supported natively in Matroska,
* yet we use the VfW way to mux it for compatibility
* with old demuxers. (FIXME: Are they really important?) */
} else if (par->codec_id != AV_CODEC_ID_RAWVIDEO || par->codec_tag) {
--
2.49.1
From 937051872de89676db882275d66f36b737b1c938 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 9 Jun 2025 13:29:29 +0200
Subject: [PATCH 258/434] Revert "avformat/mpegts: update stream info when PMT
ES stream_type changes"
This fixes mixing up contexts, use of uninitialized data and crashes.
More specifically:
==1001752== Conditional jump or move depends on uninitialised value(s)
==1001752== at 0xA9ED82: avpriv_h264_has_num_reorder_frames (h264dec.c:64)
==1001752== by 0x668C7E: has_decode_delay_been_guessed (demux.c:757)
==1001752== by 0x66AB13: compute_pkt_fields (demux.c:1137)
==1001752== by 0x66B2E9: parse_packet (demux.c:1265)
==1001752== by 0x66BD84: read_frame_internal (demux.c:1449)
==1001752== by 0x67085B: avformat_find_stream_info (demux.c:2692)
==1001752== by 0x25157C: ifile_open (ffmpeg_demux.c:1814)
==1001752== by 0x272B15: open_files (ffmpeg_opt.c:1366)
==1001752== by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415)
==1001752== by 0x2925C9: main (ffmpeg.c:991)
==1001752== Uninitialised value was created by a heap allocation
==1001752== at 0x483E0F0: memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1001752== by 0x483E212: posix_memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1001752== by 0x14882CE: av_malloc (mem.c:107)
==1001752== by 0x1463785: av_buffer_alloc (buffer.c:82)
==1001752== by 0x146423F: pool_alloc_buffer (buffer.c:369)
==1001752== by 0x14643C4: av_buffer_pool_get (buffer.c:407)
==1001752== by 0x752C4B: buffer_pool_get (mpegts.c:1142)
==1001752== by 0x7538F2: mpegts_push_data (mpegts.c:1407)
==1001752== by 0x758893: handle_packet (mpegts.c:2909)
==1001752== by 0x758E90: handle_packets (mpegts.c:3048)
==1001752== by 0x759B1D: mpegts_read_packet (mpegts.c:3290)
==1001752== by 0x6687A3: ff_read_packet (demux.c:649)
==1001752== by 0x66B594: read_frame_internal (demux.c:1346)
==1001752== by 0x67085B: avformat_find_stream_info (demux.c:2692)
==1001752== by 0x25157C: ifile_open (ffmpeg_demux.c:1814)
==1001752== by 0x272B15: open_files (ffmpeg_opt.c:1366)
==1001752== by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415)
==1001752== by 0x2925C9: main (ffmpeg.c:991)
Found-by: Alexander A. Shvedov <shvedov@gmx.com>
CC: Pavel Koshevoy <pkoshevoy@gmail.com>
This reverts commit 0021484d05f9b0f032fa319399de6e24eea0c04f.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mpegts.c | 4 +---
tests/ref/fate/ts-demux | 4 ++--
2 files changed, 3 insertions(+), 5 deletions(-)
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index b5f29aee65..86b7c8e041 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -938,8 +938,6 @@ static int mpegts_set_stream_info(AVStream *st, PESContext *pes,
mpegts_find_stream_type(st, pes->stream_type, ISO_types);
if (pes->stream_type == 4 || pes->stream_type == 0x0f)
sti->request_probe = 50;
- if (pes->stream_type == STREAM_TYPE_PRIVATE_DATA)
- sti->request_probe = AVPROBE_SCORE_STREAM_RETRY;
if ((prog_reg_desc == AV_RL32("HDMV") ||
prog_reg_desc == AV_RL32("HDPR")) &&
st->codecpar->codec_id == AV_CODEC_ID_NONE) {
@@ -2498,7 +2496,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len
if (!st)
goto out;
- if (pes && pes->stream_type != stream_type)
+ if (pes && !pes->stream_type)
mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc);
add_pid_to_program(prg, pid);
diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux
index 732f9d0289..45522c2bfb 100644
--- a/tests/ref/fate/ts-demux
+++ b/tests/ref/fate/ts-demux
@@ -24,6 +24,6 @@ packet|codec_type=video|stream_index=0|pts=3912686363|pts_time=43474.292922|dts=
packet|codec_type=audio|stream_index=1|pts=3912644825|pts_time=43473.831389|dts=3912644825|dts_time=43473.831389|duration=2880|duration_time=0.032000|size=906|pos=474888|flags=K__|data_hash=CRC32:0893d398
packet|codec_type=audio|stream_index=2|pts=3912645580|pts_time=43473.839778|dts=3912645580|dts_time=43473.839778|duration=2880|duration_time=0.032000|size=354|pos=491808|flags=K__|data_hash=CRC32:f5963fa6
stream|index=0|codec_name=mpeg2video|profile=4|codec_type=video|codec_tag_string=[2][0][0][0]|codec_tag=0x0002|width=1280|height=720|coded_width=0|coded_height=0|closed_captions=0|film_grain=0|has_b_frames=1|sample_aspect_ratio=1:1|display_aspect_ratio=16:9|pix_fmt=yuv420p|level=4|color_range=tv|color_space=unknown|color_transfer=unknown|color_primaries=unknown|chroma_location=left|field_order=progressive|refs=1|ts_id=32776|ts_packetsize=188|id=0x31|r_frame_rate=60000/1001|avg_frame_rate=60000/1001|time_base=1/90000|start_pts=3912669846|start_time=43474.109400|duration_ts=19519|duration=0.216878|bit_rate=15000000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=15|extradata_size=150|extradata_hash=CRC32:53134fa8|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|side_datum/cpb_properties:side_data_type=CPB properties|side_datum/cpb_properties:max_bitrate=15000000|side_datum/cpb_properties:min_bitrate=0|side_datum/cpb_properties:avg_bitrate=0|side_datum/cpb_properties:buffer_size=9781248|side_datum/cpb_properties:vbv_delay=-1
-stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng
-stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es
+stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng
+stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es
format|filename=mp3ac325-4864-small.ts|nb_streams=3|nb_programs=1|nb_stream_groups=0|format_name=mpegts|start_time=43473.703389|duration=0.622889|size=512000|bit_rate=6575810|probe_score=50
--
2.49.1
From e77b52b6cde5e7474439797b40fb1cad6085515b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 1 Apr 2025 02:00:41 +0200
Subject: [PATCH 259/434] doc: replace http/git by https urls
These are more secure
Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4d165c68fe74f4b9c7fa4cbc2e1467a0bafea37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/fate_config.sh.template | 2 +-
doc/git-howto.texi | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/doc/fate_config.sh.template b/doc/fate_config.sh.template
index 8681805d65..4ff8629d44 100644
--- a/doc/fate_config.sh.template
+++ b/doc/fate_config.sh.template
@@ -1,5 +1,5 @@
slot= # some unique identifier
-repo=git://source.ffmpeg.org/ffmpeg.git # the source repository
+repo=https://git.ffmpeg.org/ffmpeg.git # the source repository
#branch=release/2.6 # the branch to test
samples= # path to samples directory
workdir= # directory in which to do all the work
diff --git a/doc/git-howto.texi b/doc/git-howto.texi
index 075b188abe..3e050dbd4a 100644
--- a/doc/git-howto.texi
+++ b/doc/git-howto.texi
@@ -143,7 +143,7 @@ git log <filename(s)>
@end example
You may also use the graphical tools like @command{gitview} or @command{gitk}
-or the web interface available at @url{http://source.ffmpeg.org/}.
+or the web interface available at @url{https://git.ffmpeg.org/ffmpeg.git}.
@section Checking source tree status
--
2.49.1
From e7e022094ae4e3deaffb8062437899760836fb31 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 7 Feb 2025 00:04:25 -0300
Subject: [PATCH 260/434] avcodec/libtheora: fix setting keyframe_mask
t_info.keyframe_granule_shift is set to the library default of 6, which is ok
for gop sizes up to 63. Since there's apparently no way to query the updated
value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE,
calculate it manually instead.
Fixes ticket #11454.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 22aa71d4da37a4ad2b0d28deeace64b57aa2ef50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/libtheoraenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/libtheoraenc.c b/libavcodec/libtheoraenc.c
index 8844f4be6a..761cd45d44 100644
--- a/libavcodec/libtheoraenc.c
+++ b/libavcodec/libtheoraenc.c
@@ -234,7 +234,7 @@ static av_cold int encode_init(AVCodecContext* avc_context)
return AVERROR_EXTERNAL;
}
- h->keyframe_mask = (1 << t_info.keyframe_granule_shift) - 1;
+ h->keyframe_mask = (1 << av_ceil_log2(avc_context->gop_size)) - 1;
/* Clear up theora_info struct */
th_info_clear(&t_info);
--
2.49.1
From e5350ef107eccccfa148311af8e8c727a9330f55 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 4 Feb 2025 03:58:44 +0100
Subject: [PATCH 261/434] swscale/output: Fix integer overflow in
yuv2gbrp_full_X_c()
Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int'
Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce538ef97a7b1fdab6f2a3c8afc538c1cc3760d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/output.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libswscale/output.c b/libswscale/output.c
index 366883ab1b..2172e4b53b 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -2289,9 +2289,9 @@ yuv2gbrp_full_X_c(SwsContext *c, const int16_t *lumFilter,
Y -= c->yuv2rgb_y_offset;
Y *= c->yuv2rgb_y_coeff;
Y += 1 << (SH-1);
- R = Y + V * c->yuv2rgb_v2r_coeff;
- G = Y + V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
- B = Y + U * c->yuv2rgb_u2b_coeff;
+ R = Y + V * (unsigned)c->yuv2rgb_v2r_coeff;
+ G = Y + V * (unsigned)c->yuv2rgb_v2g_coeff + U * (unsigned)c->yuv2rgb_u2g_coeff;
+ B = Y + U * (unsigned)c->yuv2rgb_u2b_coeff;
if ((R | G | B) & 0xC0000000) {
R = av_clip_uintp2(R, 30);
--
2.49.1
From 2fa3801507023e41110605774b6a91d7ca39198e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 4 Feb 2025 03:58:45 +0100
Subject: [PATCH 262/434] avcodec/osq: avoid undefined negation
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 390646659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5040277374435328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a889f3e09249d2a643a6beb7d44a8e42ea3541)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 83b4a9d618..5c7826778d 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -190,7 +190,7 @@ static uint32_t get_urice(GetBitContext *gb, int k)
static int32_t get_srice(GetBitContext *gb, int x)
{
- int32_t y = get_urice(gb, x);
+ uint32_t y = get_urice(gb, x);
return get_bits1(gb) ? -y : y;
}
--
2.49.1
From d1cef18c5cacd3af19c72e73581642b82b7e6865 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 24 Mar 2025 02:57:46 +0100
Subject: [PATCH 263/434] configure: Clearer documentation for
"disable-safe-bitstream-reader"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 979608dde7a833b7af50a9f6bad81fc483c1ff04)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
configure | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/configure b/configure
index b559dca5d0..98b582a5d5 100755
--- a/configure
+++ b/configure
@@ -434,7 +434,9 @@ Advanced options (experts only):
--enable-hardcoded-tables use hardcoded tables instead of runtime generation
--disable-safe-bitstream-reader
disable buffer boundary checking in bitreaders
- (faster, but may crash)
+ (This disables some security checks and can cause undefined behavior,
+ crashes and arbitrary code execution, it may be faster, but
+ should only be used with trusted input)
--sws-max-filter-size=N the max filter size swscale uses [$sws_max_filter_size_default]
Optimization options (experts only):
--
2.49.1
From 0b7e43fb17b59668ad7e6838b066790e1d299647 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 22 Apr 2025 03:35:31 +0200
Subject: [PATCH 264/434] postproc/postprocess_template: Fix reading
uninitialized pixels in dering_C()
This issue was found through the new blocktest
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0118f392be916784f92508474e8d64243fd6fa97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libpostproc/postprocess_altivec_template.c | 2 +-
libpostproc/postprocess_template.c | 14 +++++++-------
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/libpostproc/postprocess_altivec_template.c b/libpostproc/postprocess_altivec_template.c
index a9d4cd29a3..eebceb7bcd 100644
--- a/libpostproc/postprocess_altivec_template.c
+++ b/libpostproc/postprocess_altivec_template.c
@@ -530,7 +530,7 @@ static inline void doVertDefFilter_altivec(uint8_t src[], int stride, PPContext
STORE(5)
}
-static inline void dering_altivec(uint8_t src[], int stride, PPContext *c) {
+static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) {
const vector signed int vsint32_8 = vec_splat_s32(8);
const vector unsigned int vuint32_4 = vec_splat_u32(4);
const vector signed char neg1 = vec_splat_s8(-1);
diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c
index d56b45d3b4..9da640e552 100644
--- a/libpostproc/postprocess_template.c
+++ b/libpostproc/postprocess_template.c
@@ -831,7 +831,7 @@ static inline void RENAME(doVertDefFilter)(uint8_t src[], int stride, PPContext
#endif //TEMPLATE_PP_ALTIVEC
#if !TEMPLATE_PP_ALTIVEC
-static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c)
+static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder)
{
#if TEMPLATE_PP_MMXEXT && HAVE_7REGS
DECLARE_ALIGNED(8, uint64_t, tmp)[3];
@@ -1047,7 +1047,7 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5,
for(y=0; y<10; y++){
int t = 0;
- if(src[stride*y + 0] > avg) t+= 1;
+ if(!leftborder && src[stride*y + 0] > avg) t+= 1;
if(src[stride*y + 1] > avg) t+= 2;
if(src[stride*y + 2] > avg) t+= 4;
if(src[stride*y + 3] > avg) t+= 8;
@@ -1056,7 +1056,7 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5,
if(src[stride*y + 6] > avg) t+= 64;
if(src[stride*y + 7] > avg) t+= 128;
if(src[stride*y + 8] > avg) t+= 256;
- if(src[stride*y + 9] > avg) t+= 512;
+ if(!rightborder && src[stride*y + 9] > avg) t+= 512;
t |= (~t)<<16;
t &= (t<<1) & (t>>1);
@@ -1073,8 +1073,8 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5,
int x;
int t = s[y-1];
- p= src + stride*y;
- for(x=1; x<9; x++){
+ p= src + stride*y + leftborder;
+ for(x=1+leftborder; x<9-rightborder; x++){
p++;
if(t & (1<<x)){
int f= (*(p-stride-1)) + 2*(*(p-stride)) + (*(p-stride+1))
@@ -3211,7 +3211,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[
#endif //TEMPLATE_PP_MMX
if(mode & DERING){
//FIXME filter first line
- if(y>0) RENAME(dering)(dstBlock - stride - 8, stride, c);
+ if(y>0) RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0);
}
if(mode & TEMP_NOISE_FILTER)
@@ -3233,7 +3233,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[
}
if(mode & DERING){
- if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c);
+ if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1);
}
if((mode & TEMP_NOISE_FILTER)){
--
2.49.1
From 64911ffc20b78683d19e61be63b60de91d945685 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 22 Apr 2025 21:04:37 +0200
Subject: [PATCH 265/434] postproc/postprocess_template: fix handling of first
row of dering_C
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 142eb90f07a43a1658d0b61c4ae447f76e88f66b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libpostproc/postprocess_altivec_template.c | 5 ++++-
libpostproc/postprocess_template.c | 12 +++++++-----
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/libpostproc/postprocess_altivec_template.c b/libpostproc/postprocess_altivec_template.c
index eebceb7bcd..4dea0036ce 100644
--- a/libpostproc/postprocess_altivec_template.c
+++ b/libpostproc/postprocess_altivec_template.c
@@ -530,7 +530,7 @@ static inline void doVertDefFilter_altivec(uint8_t src[], int stride, PPContext
STORE(5)
}
-static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) {
+static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder) {
const vector signed int vsint32_8 = vec_splat_s32(8);
const vector unsigned int vuint32_4 = vec_splat_u32(4);
const vector signed char neg1 = vec_splat_s8(-1);
@@ -577,6 +577,9 @@ static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int l
const vector signed int zero = vec_splat_s32(0);
vector unsigned char v_dt = vec_splat(vec_ld(0, dt), 0);
+ if (topborder)
+ return;
+
#define LOAD_LINE(i) \
const vector unsigned char perm##i = \
vec_lvsl(i * stride, srcCopy); \
diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c
index 9da640e552..309ea9d25a 100644
--- a/libpostproc/postprocess_template.c
+++ b/libpostproc/postprocess_template.c
@@ -831,9 +831,11 @@ static inline void RENAME(doVertDefFilter)(uint8_t src[], int stride, PPContext
#endif //TEMPLATE_PP_ALTIVEC
#if !TEMPLATE_PP_ALTIVEC
-static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder)
+static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder)
{
#if TEMPLATE_PP_MMXEXT && HAVE_7REGS
+ if (topborder)
+ return;
DECLARE_ALIGNED(8, uint64_t, tmp)[3];
__asm__ volatile(
"pxor %%mm6, %%mm6 \n\t"
@@ -1044,7 +1046,8 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5,
if(max - min <deringThreshold) return;
- for(y=0; y<10; y++){
+ s[0] = 0;
+ for(y=topborder; y<10; y++){
int t = 0;
if(!leftborder && src[stride*y + 0] > avg) t+= 1;
@@ -3210,8 +3213,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[
}
#endif //TEMPLATE_PP_MMX
if(mode & DERING){
- //FIXME filter first line
- if(y>0) RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0);
+ RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0, y<=0);
}
if(mode & TEMP_NOISE_FILTER)
@@ -3233,7 +3235,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[
}
if(mode & DERING){
- if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1);
+ RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1, y<=0);
}
if((mode & TEMP_NOISE_FILTER)){
--
2.49.1
From eb922deff1841e6d3a8367b61e3e4d69dcc5fa1b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Apr 2025 12:30:04 +0200
Subject: [PATCH 266/434] avformat/hls: Add cmfv and cmfa to allowed_extensions
Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e416c7cbdcf9679ea690c9c1dee4a7936)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 896deb23d5..e409f161f0 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2628,7 +2628,9 @@ static const AVOption hls_options[] = {
OFFSET(prefer_x_start), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, FLAGS},
{"allowed_extensions", "List of file extensions that hls is allowed to access",
OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
- {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"},
+ {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt"
+ ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp
+ },
INT_MIN, INT_MAX, FLAGS},
{"extension_picky", "Be picky with all extensions matching",
OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS},
--
2.49.1
From f2d135332be9ce4f8ba190f18c9ea667675c7c3b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Apr 2025 12:43:12 +0200
Subject: [PATCH 267/434] avformat/hls: Add ec3 to allowed_extensions
Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd7cf55613e8b17bcc95b29226285ec5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index e409f161f0..6e528ef987 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2630,6 +2630,7 @@ static const AVOption hls_options[] = {
OFFSET(allowed_extensions), AV_OPT_TYPE_STRING,
{.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt"
",cmfv,cmfa" // Ticket11526 www.nicovideo.jp
+ ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service))
},
INT_MIN, INT_MAX, FLAGS},
{"extension_picky", "Be picky with all extensions matching",
--
2.49.1
From 84e237a58e7887b621b4264d57cd59288019d7ee Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Apr 2025 12:47:34 +0200
Subject: [PATCH 268/434] avformat/hls: add fmp4 to allowed_extensions
Fixes: yt-dlp/issues/12700
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c7302e0ede8626fc3d92f1418c567fbab4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 6e528ef987..83c02d003a 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2631,6 +2631,7 @@ static const AVOption hls_options[] = {
{.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt"
",cmfv,cmfa" // Ticket11526 www.nicovideo.jp
",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service))
+ ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700
},
INT_MIN, INT_MAX, FLAGS},
{"extension_picky", "Be picky with all extensions matching",
--
2.49.1
From b8eb5f0cbd7a258c2f2197c1a7d86ca5ab69be51 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Apr 2025 18:52:05 +0200
Subject: [PATCH 269/434] avformat/hls: Fix Youtube AAC
Fixes: Ticket11435
Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48c0dba23b3ce8c2bcb180bd2c8029c3c2875424)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 83c02d003a..0df61d0753 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -754,7 +754,8 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
if (in_fmt->extensions) {
matchF = av_match_ext( seg->url, in_fmt->extensions)
+ 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0);
- if(av_match_name("mp4", in_fmt->name)) {
+ // Youtube uses aac files with .ts extension
+ if(av_match_name("mp4", in_fmt->name) || av_match_name("aac", in_fmt->name)) {
matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
+ 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
}
--
2.49.1
From 56e100a799ac25dddc42bda69588833c44a6581c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 30 Apr 2025 01:37:27 +0200
Subject: [PATCH 270/434] avformat/hls: Split allowed_segment_extensions off
allowed_extensions
This allows the user to set only the one that is needed to ALL or a
specific "wrong" extension like html
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f99f223eb1ac9a6e36dab0e31756369214b5564f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 0df61d0753..b404ded47d 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -223,6 +223,7 @@ typedef struct HLSContext {
AVDictionary *avio_opts;
AVDictionary *seg_format_opts;
char *allowed_extensions;
+ char *allowed_segment_extensions;
int extension_picky;
int max_reload;
int http_persistent;
@@ -741,12 +742,12 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
if (!c->extension_picky)
return 0;
- if (strcmp(c->allowed_extensions, "ALL"))
- matchA = av_match_ext (seg->url, c->allowed_extensions)
- + 2*(ff_match_url_ext(seg->url, c->allowed_extensions) > 0);
+ if (strcmp(c->allowed_segment_extensions, "ALL"))
+ matchA = av_match_ext (seg->url, c->allowed_segment_extensions)
+ + 2*(ff_match_url_ext(seg->url, c->allowed_segment_extensions) > 0);
if (!matchA) {
- av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url);
+ av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_segment_extensions\n", seg->url);
return AVERROR_INVALIDDATA;
}
@@ -2635,6 +2636,14 @@ static const AVOption hls_options[] = {
",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700
},
INT_MIN, INT_MAX, FLAGS},
+ {"allowed_segment_extensions", "List of file extensions that hls is allowed to access",
+ OFFSET(allowed_segment_extensions), AV_OPT_TYPE_STRING,
+ {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt"
+ ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp
+ ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service))
+ ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700
+ },
+ INT_MIN, INT_MAX, FLAGS},
{"extension_picky", "Be picky with all extensions matching",
OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS},
{"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded",
--
2.49.1
From 6153d693353540eb656705ebf84e33fdd3a5efc0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 30 Apr 2025 01:05:18 +0200
Subject: [PATCH 271/434] avformat/hls: Fix flash1.bogulus.cfd support
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75be669ca1c986cc3510a5ad847e82785e2682e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index b404ded47d..0b01f406f6 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -761,8 +761,11 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
+ 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
}
} else if (!strcmp(in_fmt->name, "mpegts")) {
- matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
- + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
+ const char *str = "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts"
+ ",html" // https://flash1.bogulus.cfd/
+ ;
+ matchF = av_match_ext( seg->url, str)
+ + 2*(ff_match_url_ext(seg->url, str) > 0);
}
if (!(matchA & matchF)) {
@@ -2642,6 +2645,7 @@ static const AVOption hls_options[] = {
",cmfv,cmfa" // Ticket11526 www.nicovideo.jp
",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service))
",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700
+ ",html" // https://flash1.bogulus.cfd/
},
INT_MIN, INT_MAX, FLAGS},
{"extension_picky", "Be picky with all extensions matching",
--
2.49.1
From ba06c473ba2e495e68a8cfab781eed257e76e470 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 1 May 2025 21:20:31 +0200
Subject: [PATCH 272/434] libpostproc: check minimum size
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 917c15435ae2e11a90de5d1a1153405bd3686fbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libpostproc/postprocess.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libpostproc/postprocess.c b/libpostproc/postprocess.c
index 015bc9d501..c7f18c09e6 100644
--- a/libpostproc/postprocess.c
+++ b/libpostproc/postprocess.c
@@ -898,6 +898,11 @@ void pp_postprocess(const uint8_t * src[3], const int srcStride[3],
int minStride= FFMAX(FFABS(srcStride[0]), FFABS(dstStride[0]));
int absQPStride = FFABS(QPStride);
+ if (width < 16 || height < 16) {
+ av_log(c, AV_LOG_ERROR, "Postproc is designed to filter 16x16 macroblock based formats, the minimum size is 1 macroblock\n");
+ return;
+ }
+
// c->stride and c->QPStride are always positive
if(c->stride < minStride || c->qpStride < absQPStride)
reallocBuffers(c, width, height,
--
2.49.1
From 2f0af494b6c8dc564821c08bc7b131721ec07bcf Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 1 May 2025 21:50:13 +0200
Subject: [PATCH 273/434] postproc/postprocess_template: fix dering with a
16x16 image
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd9adbdbfbd548ef320975552695cfc5c819e339)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libpostproc/postprocess_template.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c
index 309ea9d25a..f6ddb417bc 100644
--- a/libpostproc/postprocess_template.c
+++ b/libpostproc/postprocess_template.c
@@ -3235,7 +3235,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[
}
if(mode & DERING){
- RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1, y<=0);
+ RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, x<=8, 1, y<=0);
}
if((mode & TEMP_NOISE_FILTER)){
--
2.49.1
From 6786f8f038bdcf5906e720f422ac8cf5b4a400c8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 5 May 2025 19:53:57 +0200
Subject: [PATCH 274/434] tests/fate/filter-video: Fix dependancy for codecview
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b643e3f65d75a4e6a25986466254bdd4fc1a01a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
tests/fate/filter-video.mak | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/fate/filter-video.mak b/tests/fate/filter-video.mak
index 5b8a294afd..e827026a5a 100644
--- a/tests/fate/filter-video.mak
+++ b/tests/fate/filter-video.mak
@@ -498,7 +498,7 @@ fate-filter-pp7: CMD = framecrc -flags bitexact -export_side_data venc_params -i
FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, SPP, AVI, MPEG4) += spp
fate-filter-spp: CMD = framecrc -flags bitexact -export_side_data venc_params -idct simple -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf "spp=idct=simple:dct=int"
-FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, PP, AVI, MPEG4) += codecview
+FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, CODECVIEW, AVI, MPEG4) += codecview
fate-filter-codecview: CMD = framecrc -flags bitexact -idct simple -flags2 +export_mvs -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf codecview=mv=pf+bf+bb
# The above tests use vsynth1-mpeg4-qprd.avi created by fate-vsynth1-mpeg4-qprd
--
2.49.1
From 6fb3c736a60ee1323957124302538867303c490c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 May 2025 23:10:52 +0200
Subject: [PATCH 275/434] avformat/iff: Check nb_channels == 0 in MHDR
Fixes: division by 0
Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670
Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce1fd73d637a34551161fd8054ce3d410631982c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/iff.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/iff.c b/libavformat/iff.c
index 6b4503fdb3..3f75e135e5 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -497,6 +497,8 @@ static int iff_read_header(AVFormatContext *s)
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_MONO;
else if (st->codecpar->ch_layout.nb_channels == 2)
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
+ else if (st->codecpar->ch_layout.nb_channels == 0)
+ return AVERROR_INVALIDDATA;
break;
case ID_ABIT:
--
2.49.1
From dd21a1462e0846bd892b4089a84b6bd946c27bcc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 May 2025 23:46:04 +0200
Subject: [PATCH 276/434] avcodec/hevc/ps: Fix dependant layer id check
Fixes: shift exponent 49 is too large for 32-bit type 'int'
Fixes: 398060145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5023082406543360
Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e5523c98597a417eb43555933b1075d18ec5f8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevc/ps.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevc/ps.c b/libavcodec/hevc/ps.c
index f18b88489b..8b48cba8e0 100644
--- a/libavcodec/hevc/ps.c
+++ b/libavcodec/hevc/ps.c
@@ -612,8 +612,8 @@ static int decode_vps_ext(GetBitContext *gb, AVCodecContext *avctx, HEVCVPS *vps
}
/* Consequence of established layer dependencies */
- if (layer1_id_included != ((1 << vps->layer_id_in_nuh[0]) |
- (1 << vps->layer_id_in_nuh[1]))) {
+ if (layer1_id_included != ((1ULL << vps->layer_id_in_nuh[0]) |
+ (1ULL << vps->layer_id_in_nuh[1]))) {
av_log(avctx, AV_LOG_ERROR, "Dependent layer not included in layer ID?\n");
return AVERROR_PATCHWELCOME;
}
--
2.49.1
From 7c068e5550356f5b25c3f8e50e91c6f8c020c2d5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Apr 2025 16:49:31 +0200
Subject: [PATCH 277/434] avcodec/vorbisdec: Dont treat overread as error
This differs from libvorbis by
stddev: 2.44 PSNR: 88.58 MAXDIFF: 41 bytes: 834304/ 834304
for the file from the ticket
Fixes: Ticket11427
Regression since: dc89cf804a811c0d25f4649a99f7fab4b5b416fa
This is a similar solution to what james proposed earlier in
[FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd5a3c5fed2c190446b2beb9bc532887db360cf7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vorbisdec.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 218e855f7a..32944af311 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1469,8 +1469,10 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
unsigned step = FASTDIV(vr->partition_size << 1, dim << 1);
vorbis_codebook codebook = vc->codebooks[vqbook];
- if (get_bits_left(gb) <= 0)
- return AVERROR_INVALIDDATA;
+ if (get_bits_left(gb) < 0) {
+ av_log(vc->avctx, AV_LOG_ERROR, "Overread %d bits\n", -get_bits_left(gb));
+ return 0;
+ }
if (vr_type == 0) {
--
2.49.1
From 9ddab572c0bae2cbde7f15f2c56911e8a48dea3b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 16 Apr 2025 02:25:00 +0200
Subject: [PATCH 278/434] avcodec/h264_mb: Fix tmp_cr for arm
When decoding a bitstream with weighted-bipred enabled,
the results on ARM and x86 platforms may differ.
The reason for the inconsistency is that the value of
STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN
is set to the buffer stride of temporary buffers for U
and V components in mc_part_weighted.
If the buffer stride is 32 or 64 (as on x86 platforms),
the U and V pixels can be interleaved row by row without
overlapping, resulting in correct output.
However, on ARM platforms where the stride is 16,
the V component did overwrite part of the U component's pixels,
leading to incorrect predicted pixels.
The bug can be reproduced by the following bitstream.
https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264
Fixes: ticket 11357
Commit-msg-mostly-by: Bin Peng <pengbin@visionular.com>
Reviewed-by: Bin Peng <pengbin@visionular.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74fd2c3ddbaf1fef5c4777784aa72b5747ad389c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/h264_mb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/h264_mb.c b/libavcodec/h264_mb.c
index 4e94136313..2db0670478 100644
--- a/libavcodec/h264_mb.c
+++ b/libavcodec/h264_mb.c
@@ -407,7 +407,7 @@ static av_always_inline void mc_part_weighted(const H264Context *h, H264SliceCon
/* don't optimize for luma-only case, since B-frames usually
* use implicit weights => chroma too. */
uint8_t *tmp_cb = sl->bipred_scratchpad;
- uint8_t *tmp_cr = sl->bipred_scratchpad + (16 << pixel_shift);
+ uint8_t *tmp_cr = sl->bipred_scratchpad + (8 << pixel_shift + (chroma_idc == 3));
uint8_t *tmp_y = sl->bipred_scratchpad + 16 * sl->mb_uvlinesize;
int refn0 = sl->ref_cache[0][scan8[n]];
int refn1 = sl->ref_cache[1][scan8[n]];
--
2.49.1
From d432d24777874cb742b3463c112d74286ca702b3 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 22:05:07 +0200
Subject: [PATCH 279/434] MAINTAINERS: Add entry for samples-request
This is based on discussion with the GA and its simply the people
who have done or tried to do some uploads recently.
Everyone who has a shell account on ffmpeg.org should have powers to
upload samples.
CC: compn <compn@ffmpeg.org>
CC: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a5ed492e577707bc7eb48e25c27a14906adb6d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
MAINTAINERS | 1 +
1 file changed, 1 insertion(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 8a2ee04aed..f8339d9196 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -56,6 +56,7 @@ presets [0]
metadata subsystem Aurelien Jacobs
release management Michael Niedermayer
API tests [0]
+samples-request [2] Thilo Borgmann, James Almer, Ben Littler
Communication
--
2.49.1
From 6c0ec7b61dfee40df19f27e8cfdacc39d501125f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 May 2025 01:55:27 +0200
Subject: [PATCH 280/434] avformat/avidec: Ignore duplicate GAB2
Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a47046981d05c59f6ac766d5fbf6586261a216f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/avidec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 1ae09efc15..81a0ae31ba 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1122,6 +1122,10 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
int size;
AVProbeData pd;
unsigned int desc_len;
+
+ if (ast->sub_ctx)
+ return 0;
+
AVIOContext *pb = avio_alloc_context(pkt->data + 7,
pkt->size - 7,
0, NULL, NULL, NULL, NULL);
--
2.49.1
From 2ac90a049c8a4a8fbb5028e6bcbc3f930671bd3f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 May 2025 23:39:53 +0200
Subject: [PATCH 281/434] avformat/mov: reject negative ELST durations
Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f502064d0d2d75c97ece33f4b56eb84)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 97a9cfecae..b9761efbac 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6223,6 +6223,11 @@ static int mov_read_elst(MOVContext *c, AVIOContext *pb, MOVAtom atom)
c->fc->nb_streams-1, i, e->time);
return AVERROR_INVALIDDATA;
}
+ if (e->duration < 0) {
+ av_log(c->fc, AV_LOG_ERROR, "Track %d, edit %d: Invalid edit list duration=%"PRId64"\n",
+ c->fc->nb_streams-1, i, e->duration);
+ return AVERROR_INVALIDDATA;
+ }
}
sc->elst_count = i;
--
2.49.1
From 72d65a3a69cc5ddb5166118d9342b7fb94a12e2b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 May 2025 23:52:57 +0200
Subject: [PATCH 282/434] avformat/imf_cpl: do not continue looping forever
Fixes: infinite loop
Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824
Regression since: 61fa1e14e4178d3f2550c76f7a36484220f6dc0c
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39800d78b07e65a6b29a69366d651f80105b95a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/imf_cpl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index 137cff2a63..6ddea62abe 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -709,8 +709,7 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL *
av_log(log_ctx, AV_LOG_DEBUG, "Processing IMF CPL Segment\n");
sequence_list_elem = ff_imf_xml_get_child_element_by_name(segment_elem, "SequenceList");
- if (!sequence_list_elem)
- continue;
+ if (sequence_list_elem) {
sequence_elem = xmlFirstElementChild(sequence_list_elem);
while (sequence_elem) {
@@ -735,6 +734,7 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL *
sequence_elem = xmlNextElementSibling(sequence_elem);
}
+ }
segment_elem = xmlNextElementSibling(segment_elem);
}
--
2.49.1
From f9a3e1ac198184c6b6838fb1bab27428f53e46c1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 May 2025 23:55:24 +0200
Subject: [PATCH 283/434] avformat/imf_cpl: fix indention after previous commit
(cherry picked from commit d28bec8c4d1bcab3760463f501e14e51fd7b28c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/imf_cpl.c | 36 ++++++++++++++++++------------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c
index 6ddea62abe..8c3530f412 100644
--- a/libavformat/imf_cpl.c
+++ b/libavformat/imf_cpl.c
@@ -711,29 +711,29 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL *
sequence_list_elem = ff_imf_xml_get_child_element_by_name(segment_elem, "SequenceList");
if (sequence_list_elem) {
- sequence_elem = xmlFirstElementChild(sequence_list_elem);
- while (sequence_elem) {
- if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0)
- ret = push_marker_sequence(log_ctx, sequence_elem, cpl);
+ sequence_elem = xmlFirstElementChild(sequence_list_elem);
+ while (sequence_elem) {
+ if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0)
+ ret = push_marker_sequence(log_ctx, sequence_elem, cpl);
- else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0)
- ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl);
+ else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0)
+ ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl);
- else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0)
- ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl);
+ else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0)
+ ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl);
- else
- av_log(log_ctx,
- AV_LOG_INFO,
- "The following Sequence is not supported and is ignored: %s\n",
- sequence_elem->name);
+ else
+ av_log(log_ctx,
+ AV_LOG_INFO,
+ "The following Sequence is not supported and is ignored: %s\n",
+ sequence_elem->name);
- /* abort parsing only if memory error occurred */
- if (ret == AVERROR(ENOMEM))
- return ret;
+ /* abort parsing only if memory error occurred */
+ if (ret == AVERROR(ENOMEM))
+ return ret;
- sequence_elem = xmlNextElementSibling(sequence_elem);
- }
+ sequence_elem = xmlNextElementSibling(sequence_elem);
+ }
}
segment_elem = xmlNextElementSibling(segment_elem);
--
2.49.1
From 534c87eb242bf3dfb221945289d60c729464802c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 01:08:06 +0200
Subject: [PATCH 284/434] avcodec/sonic: Check num_taps
The encoder uses max 128 taps, which is quiet a lot already
If work is done to improve sonic, it will be more radical than changing the taps
Fixes: Timeout
Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd0a792766c8ae513dd849fc47fa9e899cc5664b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/sonic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
index 46c15b5fb1..d2057ac181 100644
--- a/libavcodec/sonic.c
+++ b/libavcodec/sonic.c
@@ -924,6 +924,9 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
if (get_bits1(&gb)) // XXX FIXME
av_log(avctx, AV_LOG_INFO, "Custom quant table\n");
+ if (s->num_taps > 128)
+ return AVERROR_INVALIDDATA;
+
s->block_align = 2048LL*s->samplerate/(44100*s->downsampling);
s->frame_size = s->channels*s->block_align*s->downsampling;
// avctx->frame_size = s->block_align;
--
2.49.1
From 1bd79545eea716ea18c84846141fca86412c7aa5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 01:35:29 +0200
Subject: [PATCH 285/434] avcodec/svq3: Check there are bits left before
decompression
Fixes: out of array read
Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c06f5b3ab97b1b1d0420309201568e38b3920860)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/svq3.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index f730358e2f..6319e9b021 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1253,6 +1253,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
uint8_t *buf;
if (watermark_height <= 0 ||
+ get_bits_left(&gb) <= 0 ||
(uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
return AVERROR_INVALIDDATA;
--
2.49.1
From 3a418442dca1b9bcab98f03ba6f09d6b1bec8542 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 23:09:07 +0200
Subject: [PATCH 286/434] avcodec/takdec: Check remaining space for first
predictors
Fixes: Timeout
Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e6db875afcd147d48718130fde4a05c3ac406db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/takdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/takdec.c b/libavcodec/takdec.c
index cfa69f4217..84c19f648f 100644
--- a/libavcodec/takdec.c
+++ b/libavcodec/takdec.c
@@ -434,6 +434,9 @@ static int decode_subframe(TAKDecContext *s, int32_t *decoded,
return AVERROR_INVALIDDATA;
}
+ if (get_bits_left(gb) < 2*10 + 2*size)
+ return AVERROR_INVALIDDATA;
+
s->predictors[0] = get_sbits(gb, 10);
s->predictors[1] = get_sbits(gb, 10);
s->predictors[2] = get_sbits(gb, size) * (1 << (10 - size));
--
2.49.1
From ebcd40e701a194edca5bd2f4a8e5262aa6ab1841 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 23:18:19 +0200
Subject: [PATCH 287/434] avformat/matroskadec: check that channels fit in
signed 32bit int
Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long'
Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05f8c8c4c2b8f3a0b206ecb7e1b5bba68a9820b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/matroskadec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 105a90a937..b6af422a4d 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -2843,6 +2843,8 @@ static int mka_parse_audio(MatroskaTrack *track, AVStream *st,
par->sample_rate = track->audio.out_samplerate;
// channel layout may be already set by codec private checks above
if (!av_channel_layout_check(&par->ch_layout)) {
+ if (track->audio.channels > INT32_MAX)
+ return AVERROR_PATCHWELCOME;
par->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
par->ch_layout.nb_channels = track->audio.channels;
}
--
2.49.1
From 2c4ca52c8aed6108063c733ce40043742aff5b3b Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sat, 10 May 2025 12:50:37 -0300
Subject: [PATCH 288/434] avformat/iamf_parse: increase PutBytes buffer when
writing AAC extradata
We may write up to 43 bits, so 5 bytes is not enough.
Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavformat/iamf_parse.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 7b3b1e87fa..9107f16003 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -285,10 +285,11 @@ static int update_extradata(AVCodecParameters *codecpar)
AV_WL16A(codecpar->extradata + 16, AV_RB16A(codecpar->extradata + 16)); // Byte swap Output Gain
break;
case AV_CODEC_ID_AAC: {
- uint8_t buf[5];
+ uint8_t buf[6];
+ int size = FFMIN(codecpar->extradata_size, sizeof(buf));
- init_put_bits(&pb, buf, sizeof(buf));
- ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size);
+ init_put_bits(&pb, buf, size);
+ ret = init_get_bits8(&gb, codecpar->extradata, size);
if (ret < 0)
return ret;
@@ -304,6 +305,10 @@ static int update_extradata(AVCodecParameters *codecpar)
skip_bits(&gb, 4);
put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config
ret = put_bits_left(&pb);
+ while (ret >= 32) {
+ put_bits32(&pb, get_bits_long(&gb, 32));
+ ret -= 32;
+ }
put_bits(&pb, ret, get_bits_long(&gb, ret));
flush_put_bits(&pb);
--
2.49.1
From 6400860b9d4bec5ace91ec3a5e43ad76f9660579 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 23 Jun 2025 12:31:37 -0300
Subject: [PATCH 289/434] avformat/iamf_parse: prevent overreads in
update_extradata
Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative
Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavformat/iamf_parse.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 9107f16003..a7a2b7deb5 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -288,7 +288,7 @@ static int update_extradata(AVCodecParameters *codecpar)
uint8_t buf[6];
int size = FFMIN(codecpar->extradata_size, sizeof(buf));
- init_put_bits(&pb, buf, size);
+ init_put_bits(&pb, buf, sizeof(buf));
ret = init_get_bits8(&gb, codecpar->extradata, size);
if (ret < 0)
return ret;
@@ -304,7 +304,10 @@ static int update_extradata(AVCodecParameters *codecpar)
skip_bits(&gb, 4);
put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config
- ret = put_bits_left(&pb);
+ ret = get_bits_left(&gb);
+ if (ret < 0)
+ return AVERROR_INVALIDDATA;
+ ret = FFMIN(ret, put_bits_left(&pb));
while (ret >= 32) {
put_bits32(&pb, get_bits_long(&gb, 32));
ret -= 32;
@@ -317,9 +320,10 @@ static int update_extradata(AVCodecParameters *codecpar)
}
case AV_CODEC_ID_FLAC: {
uint8_t buf[13];
+ int size = FFMIN(codecpar->extradata_size, sizeof(buf));
init_put_bits(&pb, buf, sizeof(buf));
- ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size);
+ ret = init_get_bits8(&gb, codecpar->extradata, size);
if (ret < 0)
return ret;
@@ -328,11 +332,14 @@ static int update_extradata(AVCodecParameters *codecpar)
put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate
skip_bits(&gb, 3);
put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1);
- ret = put_bits_left(&pb);
+ ret = get_bits_left(&gb);
+ if (ret < 0)
+ return AVERROR_INVALIDDATA;
+ ret = FFMIN(ret, put_bits_left(&pb));
put_bits(&pb, ret, get_bits(&gb, ret));
flush_put_bits(&pb);
- memcpy(codecpar->extradata, buf, sizeof(buf));
+ memcpy(codecpar->extradata, buf, put_bytes_output(&pb));
break;
}
}
--
2.49.1
From ca5c0a959d3a456fafa37fc84bf029af23a52ba4 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 8 Jul 2025 15:00:29 -0300
Subject: [PATCH 290/434] fftools/ffmpeg_demux: don't flag timestamps as
unreliable if they are generated
Regardless of the source being an AVFMT_NOTIMESTAMPS format, if the timestamps
are generated like when using the use_wallclock_as_timestamps demuxer option,
then they are reliable.
Fixes ticket #11268
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1787fade209b1ecbd4b911c9d77a52bcdec13fa6)
---
fftools/ffmpeg_demux.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c
index 13aef15eab..d44dce1119 100644
--- a/fftools/ffmpeg_demux.c
+++ b/fftools/ffmpeg_demux.c
@@ -912,9 +912,18 @@ static int ist_use(InputStream *ist, int decoding_needed,
if (decoding_needed && ds->sch_idx_dec < 0) {
int is_audio = ist->st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO;
+ int is_unreliable = !!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS);
+ int64_t use_wallclock_as_timestamps;
+
+ ret = av_opt_get_int(d->f.ctx, "use_wallclock_as_timestamps", 0, &use_wallclock_as_timestamps);
+ if (ret < 0)
+ return ret;
+
+ if (use_wallclock_as_timestamps)
+ is_unreliable = 0;
ds->dec_opts.flags |= (!!ist->fix_sub_duration * DECODER_FLAG_FIX_SUB_DURATION) |
- (!!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS) * DECODER_FLAG_TS_UNRELIABLE) |
+ (!!is_unreliable * DECODER_FLAG_TS_UNRELIABLE) |
(!!(d->loop && is_audio) * DECODER_FLAG_SEND_END_TS)
#if FFMPEG_OPT_TOP
| ((ist->top_field_first >= 0) * DECODER_FLAG_TOP_FIELD_FIRST)
--
2.49.1
From c2184b65d214d60f2d3df86a11ca502567a3d134 Mon Sep 17 00:00:00 2001
From: Lynne <dev@lynne.ee>
Date: Sat, 8 Feb 2025 04:35:31 +0100
Subject: [PATCH 291/434] aacenc_tns: clamp filter direction energy measurement
The issue is that:
float en[2];
...
tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
for (g = 0; g < tns->n_filt[w]; g++) {
tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
When using the AAC Main profile, n_filt = 3, and slant is by
default 2 (normal long frames), g can go above 1.
en is the evolution of energy in the frequency domain for every
band at the given window. E.g. whether the energy is concentrated
at the top of each band, or the bottom.
For 2-pole filters, its straightforward.
For 3-pole filters, we need more than 2 measurements.
This commit properly implements support for 3-pole filters, by measuring
the band energy across three areas.
Do note that even xHE-AAC caps n_filt to 2, and only AAC Main allows
n_filt == 3.
Fixes https://trac.ffmpeg.org/ticket/11418
(cherry picked from commit ed09aa28ae3b4509f00a24a9ebdeb084ee00736a)
---
libavcodec/aacenc_tns.c | 33 ++++++++++++++++++++++++---------
1 file changed, 24 insertions(+), 9 deletions(-)
diff --git a/libavcodec/aacenc_tns.c b/libavcodec/aacenc_tns.c
index fa3cd2af39..f9bc033b26 100644
--- a/libavcodec/aacenc_tns.c
+++ b/libavcodec/aacenc_tns.c
@@ -173,6 +173,7 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
sce->ics.window_sequence[0] == LONG_START_SEQUENCE ? 0 : 2;
const int sfb_len = sfb_end - sfb_start;
const int coef_len = sce->ics.swb_offset[sfb_end] - sce->ics.swb_offset[sfb_start];
+ const int n_filt = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
if (coef_len <= 0 || sfb_len <= 0) {
sce->tns.present = 0;
@@ -180,16 +181,30 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
}
for (w = 0; w < sce->ics.num_windows; w++) {
- float en[2] = {0.0f, 0.0f};
+ float en[4] = {0.0f, 0.0f, 0.0f, 0.0f};
int oc_start = 0;
int coef_start = sce->ics.swb_offset[sfb_start];
- for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
- FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
- if (g > sfb_start + (sfb_len/2))
- en[1] += band->energy;
- else
- en[0] += band->energy;
+ if (n_filt == 2) {
+ for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
+ FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
+ if (g > sfb_start + (sfb_len/2))
+ en[1] += band->energy; /* End */
+ else
+ en[0] += band->energy; /* Start */
+ }
+ en[2] = en[0];
+ } else {
+ for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
+ FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
+ if (g > sfb_start + (sfb_len/2) + (sfb_len/4))
+ en[2] += band->energy; /* End */
+ else if (g > sfb_start + (sfb_len/2) - (sfb_len/4))
+ en[1] += band->energy; /* Middle */
+ else
+ en[0] += band->energy; /* Start */
+ }
+ en[3] = en[0];
}
/* LPC */
@@ -199,9 +214,9 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
if (!order || !isfinite(gain) || gain < TNS_GAIN_THRESHOLD_LOW || gain > TNS_GAIN_THRESHOLD_HIGH)
continue;
- tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
+ tns->n_filt[w] = n_filt;
for (g = 0; g < tns->n_filt[w]; g++) {
- tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
+ tns->direction[w][g] = slant != 2 ? slant : en[g] < en[g + 1];
tns->order[w][g] = order/tns->n_filt[w];
tns->length[w][g] = sfb_len/tns->n_filt[w];
quantize_coefs(&coefs[oc_start], tns->coef_idx[w][g], tns->coef[w][g],
--
2.49.1
From 1b48158a23f1f2d4d5bc6a8de60b7fc049061da2 Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Sun, 3 Aug 2025 13:44:03 +0200
Subject: [PATCH 292/434] swscale/swscale_unscaled: use 8 line alignment for
planarCopyWrapper with dithering
Dithering relies on a 8 line dithering table and the code always uses it from
the beginning. So in order to make dithering independent from height of the
slices used we must enforce a 8 line alignment.
Fixes issue #20071.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit b61e510e7500c27c7dee2b9c8cfa77689195f2a0)
---
libswscale/swscale_unscaled.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c
index d403c953cc..cb73ba7810 100644
--- a/libswscale/swscale_unscaled.c
+++ b/libswscale/swscale_unscaled.c
@@ -2267,10 +2267,13 @@ void ff_get_unscaled_swscale(SwsContext *c)
c->chrDstVSubSample == c->chrSrcVSubSample &&
!isSemiPlanarYUV(srcFormat) && !isSemiPlanarYUV(dstFormat))))
{
- if (isPacked(c->srcFormat))
+ if (isPacked(c->srcFormat)) {
c->convert_unscaled = packedCopyWrapper;
- else /* Planar YUV or gray */
+ } else { /* Planar YUV or gray */
c->convert_unscaled = planarCopyWrapper;
+ if (c->dither != SWS_DITHER_NONE)
+ c->dst_slice_align = 8 << c->chrDstVSubSample;
+ }
}
#if ARCH_PPC
--
2.49.1
From 14fc61da7170abc658ff94f958468f334d77cf31 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 May 2025 16:55:13 +0200
Subject: [PATCH 293/434] avcodec/speexdec: Pass and check remaining packets to
decode functions
Fixes: out of array access
Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6986e75be87f512f65d64ac91ba19d505a8d210)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/speexdec.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index d25823ef6e..78f256ad26 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -168,7 +168,7 @@ typedef struct SpeexSubmode {
typedef struct SpeexMode {
int modeID; /**< ID of the mode */
- int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out);
+ int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out, int packets_left);
int frame_size; /**< Size of frames used for decoding */
int subframe_size; /**< Size of sub-frames used for decoding */
int lpc_size; /**< Order of LPC filter */
@@ -520,8 +520,8 @@ static const SpeexSubmode wb_submode4 = {
split_cb_shape_sign_unquant, &split_cb_high, -1.f
};
-static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *);
-static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *);
+static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left);
+static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left);
static const SpeexMode speex_modes[SPEEX_NB_MODES] = {
{
@@ -866,7 +866,7 @@ static void lsp_to_lpc(const float *freq, float *ak, int lpcrdr)
}
static int nb_decode(AVCodecContext *avctx, void *ptr_st,
- GetBitContext *gb, float *out)
+ GetBitContext *gb, float *out, int packets_left)
{
DecoderState *st = ptr_st;
float ol_gain = 0, ol_pitch_coef = 0, best_pitch_gain = 0, pitch_average = 0;
@@ -1217,7 +1217,7 @@ static void qmf_synth(const float *x1, const float *x2, const float *a, float *y
}
static int sb_decode(AVCodecContext *avctx, void *ptr_st,
- GetBitContext *gb, float *out)
+ GetBitContext *gb, float *out, int packets_left)
{
SpeexContext *s = avctx->priv_data;
DecoderState *st = ptr_st;
@@ -1233,9 +1233,11 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st,
mode = st->mode;
if (st->modeID > 0) {
+ if (packets_left <= 1)
+ return AVERROR_INVALIDDATA;
low_innov_alias = out + st->frame_size;
s->st[st->modeID - 1].innov_save = low_innov_alias;
- ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out);
+ ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out, packets_left);
if (ret < 0)
return ret;
}
@@ -1558,7 +1560,7 @@ static int speex_decode_frame(AVCodecContext *avctx, AVFrame *frame,
dst = (float *)frame->extended_data[0];
for (int i = 0; i < frames_per_packet; i++) {
- ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size);
+ ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size, frames_per_packet - i);
if (ret < 0)
return ret;
if (avctx->ch_layout.nb_channels == 2)
--
2.49.1
From ce49290d3196760c246a8577cd2db48815d75cbe Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 May 2025 23:57:33 +0200
Subject: [PATCH 294/434] avcodec/hevc/hevcdec: Check num_entry_point_offsets
The code uses int, unsigned int and uint16_t to store num_entry_point_offsets
This limits it to the smallest of the 3.
Alternatively uint16_t can be changed and then a larger limit used.
A Check will still be needed.
Fixes: 391974932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5966648879677440
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 791a333a0ea5aeee1bea12065b407ba442ac59b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevc/hevcdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 6f0ae12558..139f0811ef 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -1048,7 +1048,7 @@ static int hls_slice_header(SliceHeader *sh, const HEVCContext *s, GetBitContext
if (pps->tiles_enabled_flag || pps->entropy_coding_sync_enabled_flag) {
unsigned num_entry_point_offsets = get_ue_golomb_long(gb);
// It would be possible to bound this tighter but this here is simpler
- if (num_entry_point_offsets > get_bits_left(gb)) {
+ if (num_entry_point_offsets > get_bits_left(gb) || num_entry_point_offsets > UINT16_MAX) {
av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets);
return AVERROR_INVALIDDATA;
}
--
2.49.1
From a9c5da3261fd82415151c0c077f22857067df425 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 5 Jun 2025 18:24:07 -0300
Subject: [PATCH 295/434] avformat/movenc: fix writing reserved bits in
EC3SpecificBox
As described in section F.6.1 from ETSI TS 102 366.
Found-by: nyanmisaka
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 17729aa80c618dddb83276effa0e0bd0c1db3b70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/movenc.c | 4 ++--
tests/ref/fate/copy-trac3074 | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index d6effda6fa..83ce39613e 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -614,7 +614,7 @@ static int mov_write_eac3_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra
}
info = track->eac3_priv;
- size = 2 + ((34 * (info->num_ind_sub + 1) + 7) >> 3);
+ size = 2 + ((32 * (info->num_ind_sub + 1) + 7) >> 3);
buf = av_malloc(size);
if (!buf) {
return AVERROR(ENOMEM);
@@ -631,7 +631,7 @@ static int mov_write_eac3_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra
put_bits(&pbc, 3, info->substream[i].bsmod);
put_bits(&pbc, 3, info->substream[i].acmod);
put_bits(&pbc, 1, info->substream[i].lfeon);
- put_bits(&pbc, 5, 0); /* reserved */
+ put_bits(&pbc, 3, 0); /* reserved */
put_bits(&pbc, 4, info->substream[i].num_dep_sub);
if (!info->substream[i].num_dep_sub) {
put_bits(&pbc, 1, 0); /* reserved */
diff --git a/tests/ref/fate/copy-trac3074 b/tests/ref/fate/copy-trac3074
index 53ba27e920..9ed42c8d8d 100644
--- a/tests/ref/fate/copy-trac3074
+++ b/tests/ref/fate/copy-trac3074
@@ -1,5 +1,5 @@
-36fcc0a62695bcf93068fcfe68283ee9 *tests/data/fate/copy-trac3074.mp4
-334016 tests/data/fate/copy-trac3074.mp4
+5b4a3ed9de3b2a92e5dcb127bca12e68 *tests/data/fate/copy-trac3074.mp4
+334015 tests/data/fate/copy-trac3074.mp4
#tb 0: 1/48000
#media_type 0: audio
#codec_id 0: eac3
--
2.49.1
From ba4dd959a8997fd017519098d8c3464bb555f6be Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 22 Jun 2025 10:51:06 -0300
Subject: [PATCH 296/434] avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a
pointer
Fixes: libavcodec/mss2dsp.c:59:14: runtime error: applying zero offset to null pointer
Tested-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b1172b8cc615a884d4051517d7356d5842939bb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mss2dsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mss2dsp.c b/libavcodec/mss2dsp.c
index cc39dd637f..ace92ef9c7 100644
--- a/libavcodec/mss2dsp.c
+++ b/libavcodec/mss2dsp.c
@@ -56,7 +56,7 @@ static av_always_inline void mss2_blit_wmv9_template(uint8_t *dst,
}
}
}
- mask += mask_stride;
+ mask = FF_PTR_ADD(mask, mask_stride);
dst += dst_stride;
srcy += srcy_stride;
srcu += srcuv_stride * (r & 1);
--
2.49.1
From a2ac20306aaf2a284aa65f375f0aae27e4d11a58 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 17 Jun 2025 01:05:54 +0200
Subject: [PATCH 297/434] avcodec/osq: Fix signed integer overflow in
update_stats()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736
Note, none of the available osq files uses update_stats(), this change may fix or break
files using coding_mode == 2. The code prior looks wrong though
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c909ef31be96b6983698c3b01c675de8e5f2637a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 5c7826778d..70cbfa47ec 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -146,8 +146,8 @@ static void reset_stats(OSQChannel *cb)
static void update_stats(OSQChannel *cb, int val)
{
- cb->sum += FFABS(val) - cb->history[cb->pos];
- cb->history[cb->pos] = FFABS(val);
+ cb->sum += FFABS((int64_t)val) - cb->history[cb->pos];
+ cb->history[cb->pos] = FFABS((int64_t)val);
cb->pos++;
cb->count++;
if (cb->pos >= FF_ARRAY_ELEMS(cb->history))
--
2.49.1
From 43d2a880f97ab23f3cacd3140b637a0964083fb5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 17 Jun 2025 02:28:08 +0200
Subject: [PATCH 298/434] avcodec/osq: Add note about update_stats() count
It seems this is basically unused and unfinished code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b587afcb65192c4c4bf88422f6565e5355eaf31e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 70cbfa47ec..bbfab222c0 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -150,6 +150,8 @@ static void update_stats(OSQChannel *cb, int val)
cb->history[cb->pos] = FFABS((int64_t)val);
cb->pos++;
cb->count++;
+ //NOTE for this to make sense count would need to be limited to FF_ARRAY_ELEMS(cb->history)
+ //Otherwise the average computation later makes no sense
if (cb->pos >= FF_ARRAY_ELEMS(cb->history))
cb->pos = 0;
}
--
2.49.1
From 0b88d8b1ddd22e7afb3da6d1818e1af951805100 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 17 Jun 2025 02:31:28 +0200
Subject: [PATCH 299/434] avcodec/osq: Switch back to av_ceil_log2()
This returns to code closer to prior 56c334d732dbbce43b0c8fc0809ec545b7946832
The prior fixes should limit the sum and avoid the need for double argument log2()
Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:406
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736
No testcases except fuzzers
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5f861d335491ce2350102b74c7a17f875cad0ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index bbfab222c0..261f26f8bf 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -165,7 +165,8 @@ static int update_residue_parameter(OSQChannel *cb)
if (!sum)
return 0;
x = sum / cb->count;
- rice_k = ceil(log2(x));
+ av_assert2(x <= 0x80000000U);
+ rice_k = av_ceil_log2(x);
if (rice_k >= 30) {
double f = floor(sum / 1.4426952 + 0.5);
if (f <= 1) {
--
2.49.1
From a1509a6c142837dc89b480510214f4e1254dd595 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 17 Jun 2025 22:31:17 +0200
Subject: [PATCH 300/434] avcodec/osq: Request a coding mode 2 sample
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8e30d9eebd25d6ed2db744940f1a6d33534ef7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 261f26f8bf..fbb879ec8d 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -212,6 +212,8 @@ static int osq_channel_parameters(AVCodecContext *avctx, int ch)
cb->residue_parameter = get_urice(gb, 4);
if (!cb->residue_parameter || cb->residue_parameter >= 31)
return AVERROR_INVALIDDATA;
+ if (cb->coding_mode == 2)
+ avpriv_request_sample(avctx, "coding mode 2");
} else if (cb->coding_mode == 3) {
cb->residue_bits = get_urice(gb, 4);
if (!cb->residue_bits || cb->residue_bits >= 31)
--
2.49.1
From 093b349dd6c30feba90ea6ce42e85ba63cd57ba5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 21 Jun 2025 02:01:22 +0200
Subject: [PATCH 301/434] avformat/iff: Check nb_channels == 0 in CHNL
Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b1301004bdade13e3fee22081459e339ddd2637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/iff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/iff.c b/libavformat/iff.c
index 3f75e135e5..82d31811a9 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -280,7 +280,7 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, uint64_t eof)
return AVERROR_INVALIDDATA;
st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
st->codecpar->ch_layout.nb_channels = avio_rb16(pb);
- if (size < 2 + st->codecpar->ch_layout.nb_channels * 4)
+ if (size < 2 + st->codecpar->ch_layout.nb_channels * 4 || !st->codecpar->ch_layout.nb_channels)
return AVERROR_INVALIDDATA;
if (st->codecpar->ch_layout.nb_channels > FF_ARRAY_ELEMS(dsd_layout)) {
avpriv_request_sample(s, "channel layout");
--
2.49.1
From 3ece3ded0cb3c9dde6d9b7c1085264ca65f698ae Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 21 Jun 2025 23:15:17 +0200
Subject: [PATCH 302/434] avformat/mov: Check that sample_count is allocated in
mov_parse_heif_items()
Fixes: NULL pointer dereference
Fixes: 416811958/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5425269114732544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ffe97d9b9e10e88db29d8d910c24ec00ef24edc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index b9761efbac..cd1846798a 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -10142,7 +10142,7 @@ static int mov_parse_heif_items(AVFormatContext *s)
st->codecpar->height = item->height;
err = sanity_checks(s, sc, item->item_id);
- if (err)
+ if (err || !sc->sample_count)
return AVERROR_INVALIDDATA;
sc->sample_sizes[0] = item->extent_length;
--
2.49.1
From 12c458605fbaa2809cf45d16c79f65e5c20ed460 Mon Sep 17 00:00:00 2001
From: Frank Plowman <post@frankplowman.com>
Date: Sat, 21 Jun 2025 13:05:14 +0100
Subject: [PATCH 303/434] lavc/vvc: Fix condition for using default scaling
factor
Add handling here for
sps_scaling_matrix_for_alternative_colour_space_disabled_flag.
Also add parentheses to make behaviour a little more explicit,
where &&'s precedence over || was relied on previously.
Reported-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Frank Plowman <post@frankplowman.com>
(cherry picked from commit 540a2497d2385f94a661a6bbe0f088636d972783)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vvc/intra.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vvc/intra.c b/libavcodec/vvc/intra.c
index 41ed89c946..c08e79df7e 100644
--- a/libavcodec/vvc/intra.c
+++ b/libavcodec/vvc/intra.c
@@ -390,10 +390,10 @@ static const uint8_t* derive_scale_m(const VVCLocalContext *lc, const TransformB
const int log2_matrix_size = (id < 2) ? 1 : (id < 8) ? 2 : 3;
uint8_t *p = scale_m;
- av_assert0(!sps->r->sps_scaling_matrix_for_alternative_colour_space_disabled_flag);
-
if (!rsh->sh_explicit_scaling_list_used_flag || tb->ts ||
- sps->r->sps_scaling_matrix_for_lfnst_disabled_flag && cu->apply_lfnst_flag[tb->c_idx])
+ (sps->r->sps_scaling_matrix_for_lfnst_disabled_flag && cu->apply_lfnst_flag[tb->c_idx]) ||
+ (sps->r->sps_scaling_matrix_for_alternative_colour_space_disabled_flag &&
+ sps->r->sps_scaling_matrix_designated_colour_space_flag == cu->act_enabled_flag))
return ff_vvc_default_scale_m;
if (!sl) {
--
2.49.1
From e6a6020a8fc5cfe7d62b257fe33f2c14236bc5db Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 27 Jun 2025 18:09:24 +0200
Subject: [PATCH 304/434] avcodec/speexdec: consider differing frame sizes in
remaining space check
Fixes: talk109-q5.spx
Regression since: f6986e75be87f512f65d64ac91ba19d505a8d210
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfd1f81e7d06e64cc03d670bafe739cc8925f5be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/speexdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index 78f256ad26..2c14d7d044 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -1233,7 +1233,7 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st,
mode = st->mode;
if (st->modeID > 0) {
- if (packets_left <= 1)
+ if (packets_left * s->frame_size < 2*st->frame_size)
return AVERROR_INVALIDDATA;
low_innov_alias = out + st->frame_size;
s->st[st->modeID - 1].innov_save = low_innov_alias;
--
2.49.1
From 00d12cb2840b79db018ad78d9429fa65cf0a760b Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Sat, 21 Jun 2025 08:21:40 +0200
Subject: [PATCH 305/434] avfilter/avfilter: fix forwarding EOF for simple API
filters in filter_activate_default
EOF only need to be forwarded back if all outputs have reached EOF.
Fixes infinte loop with ffprobe -f lavfi -i "smptebars=d=1,select=n=2:e=1[out0][out1]"
Regression since d9e41ead82263e96ebd14d4d88d6e7f858dd944c.
Fixes ticket #10959.
Fixes ticket #11366.
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit a736ac72bb2e457484724f0589fd11a2b2b5f852)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/avfilter.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c
index 8a2a9e0593..058fb233d2 100644
--- a/libavfilter/avfilter.c
+++ b/libavfilter/avfilter.c
@@ -1213,16 +1213,14 @@ static int forward_status_change(AVFilterContext *filter, FilterLinkInternal *li
static int ff_filter_activate_default(AVFilterContext *filter)
{
unsigned i;
+ int nb_eofs = 0;
- for (i = 0; i < filter->nb_outputs; i++) {
- FilterLinkInternal *li = ff_link_internal(filter->outputs[i]);
- int ret = li->status_in;
-
- if (ret) {
- for (int j = 0; j < filter->nb_inputs; j++)
- ff_inlink_set_status(filter->inputs[j], ret);
- return 0;
- }
+ for (i = 0; i < filter->nb_outputs; i++)
+ nb_eofs += ff_outlink_get_status(filter->outputs[i]) == AVERROR_EOF;
+ if (filter->nb_outputs && nb_eofs == filter->nb_outputs) {
+ for (int j = 0; j < filter->nb_inputs; j++)
+ ff_inlink_set_status(filter->inputs[j], AVERROR_EOF);
+ return 0;
}
for (i = 0; i < filter->nb_inputs; i++) {
--
2.49.1
From ede4c939e313f6b0140a61389ca0bd8e70779d37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Thu, 3 Jul 2025 23:08:23 +0200
Subject: [PATCH 306/434] avcodec/opus: don't materialize buf pointer from null
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: avcodec/opus/dec.c: runtime error: applying non-zero offset 10 to null pointer
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b6ec5abb5fb3cffdfcd25f834c43e53cab2cabe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/opus/dec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/opus/dec.c b/libavcodec/opus/dec.c
index 6c59dc1f46..dbefcddb0c 100644
--- a/libavcodec/opus/dec.c
+++ b/libavcodec/opus/dec.c
@@ -585,6 +585,9 @@ static int opus_decode_packet(AVCodecContext *avctx, AVFrame *frame,
s->decoded_samples = ret;
decoded_samples = FFMIN(decoded_samples, ret);
+ if (!buf)
+ continue;
+
buf += s->packet.packet_size;
buf_size -= s->packet.packet_size;
}
--
2.49.1
From 9a43666d469bde54d01be7d22e648794a4eedf02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Mon, 30 Jun 2025 20:36:09 +0200
Subject: [PATCH 307/434] fftools/cmdutils: don't try to load arguments from
file if not needed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CLI option parser checks if argument exists when needed, but in this
case only OPT_TYPE_BOOL where checked, so OPT_TYPE_FUNC without argument
where trying to load a file from `arg` which is NULL in this case.
Fixes crash on `ffmpeg -/version`
Fixes: 6d17991b7e1bf1a5d104c8a6261709f7e6640d97
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f62e2de98eaf1afdea238b53b2b5ac8f0875239)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
fftools/cmdutils.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fftools/cmdutils.c b/fftools/cmdutils.c
index 9beed94ead..f1a41e049b 100644
--- a/fftools/cmdutils.c
+++ b/fftools/cmdutils.c
@@ -255,9 +255,10 @@ static int write_option(void *optctx, const OptionDef *po, const char *opt,
if (*opt == '/') {
opt++;
- if (po->type == OPT_TYPE_BOOL) {
+ if (!opt_has_arg(po)) {
av_log(NULL, AV_LOG_FATAL,
- "Requested to load an argument from file for a bool option '%s'\n",
+ "Requested to load an argument from file for an option '%s'"
+ " which does not take an argument\n",
po->name);
return AVERROR(EINVAL);
}
--
2.49.1
From 46580a5f9ac3a94f938d2044096492010ee61f1e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 3 Jul 2025 03:01:11 +0200
Subject: [PATCH 308/434] avcodec/smacker: Move buffer allocation to later
Reduces allocations on random input
Fixes: 421650030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-6144441767493632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9899c8c00bb7674fe3cf5c8483b522c6c78e1248)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/smacker.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index 8f198d6957..1883dc3f13 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -646,10 +646,6 @@ static int smka_decode_frame(AVCodecContext *avctx, AVFrame *frame,
"The buffer does not contain an integer number of samples\n");
return AVERROR_INVALIDDATA;
}
- if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
- return ret;
- samples = (int16_t *)frame->data[0];
- samples8 = frame->data[0];
// Initialize
for(i = 0; i < (1 << (bits + stereo)); i++) {
@@ -671,6 +667,12 @@ static int smka_decode_frame(AVCodecContext *avctx, AVFrame *frame,
} else
values[i] = h.entries[0].value;
}
+
+ if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
+ return ret;
+ samples = (int16_t *)frame->data[0];
+ samples8 = frame->data[0];
+
/* this codec relies on wraparound instead of clipping audio */
if(bits) { //decode 16-bit data
for(i = stereo; i >= 0; i--)
--
2.49.1
From 520a037003d48ec33e017afbe3e4a30a9b62c40e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 19 Jun 2025 23:02:25 +0200
Subject: [PATCH 309/434] avcodec/psd: Move frame allocation after RLE
processing
Fixes: Timeout
Fixes: 410609448/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PSD_fuzzer-6267226128973824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67559760c6636b9c1643e4870bfe8c98244803d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/psd.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/psd.c b/libavcodec/psd.c
index 3e5bfcd360..35c76a6014 100644
--- a/libavcodec/psd.c
+++ b/libavcodec/psd.c
@@ -418,9 +418,6 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
s->uncompressed_size = s->line_size * s->height * s->channel_count;
- if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)
- return ret;
-
/* decode picture if need */
if (s->compression == PSD_RLE) {
s->tmp = av_malloc(s->uncompressed_size);
@@ -443,6 +440,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
ptr_data = s->gb.buffer;
}
+ if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)
+ return ret;
+
/* Store data */
if ((avctx->pix_fmt == AV_PIX_FMT_YA8)||(avctx->pix_fmt == AV_PIX_FMT_YA16BE)){/* Interleaved */
ptr = picture->data[0];
--
2.49.1
From e0c5acb3e343d1c91c0914a786ff59176d4066a2 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Thu, 10 Jul 2025 16:26:39 +0000
Subject: [PATCH 310/434] libavcodec/alsdec.c: Add check for av_malloc_array()
and av_calloc()
Add check for the return value of av_malloc_array() and av_calloc()
to avoid potential NULL pointer dereference.
Fixes: dcfd24b10c ("avcodec/alsdec: Implement floating point sample data decoding")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/alsdec.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 28f2079985..26eba6d2eb 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -2119,8 +2119,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->nbits = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits));
ctx->mlz = av_mallocz(sizeof(*ctx->mlz));
- if (!ctx->mlz || !ctx->acf || !ctx->shift_value || !ctx->last_shift_value
- || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
+ if (!ctx->larray || !ctx->nbits || !ctx->mlz || !ctx->acf || !ctx->shift_value
+ || !ctx->last_shift_value || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
return AVERROR(ENOMEM);
}
@@ -2132,6 +2132,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
for (c = 0; c < channels; ++c) {
ctx->raw_mantissa[c] = av_calloc(ctx->cur_frame_length, sizeof(**ctx->raw_mantissa));
+ if (!ctx->raw_mantissa[c]) {
+ av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
+ return AVERROR(ENOMEM);
+ }
}
}
--
2.49.1
From afe0eeed9916a89c0fa7a89e48b04423c11e8262 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 13 Jul 2025 19:56:13 -0300
Subject: [PATCH 311/434] avcodec/ffv1dec: don't add offsets to NULL pointers
Fixes: libavcodec/ffv1dec.c:452:43: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9c55f22ef234046dfd47ae414f59e9e2c1530263)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 79374658ec..06edae7678 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -334,14 +334,16 @@ static int decode_slice(AVCodecContext *c, void *arg)
} else if (f->use32bit) {
uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0],
p->data[1] + ps * x + y * p->linesize[1],
- p->data[2] + ps * x + y * p->linesize[2],
- p->data[3] + ps * x + y * p->linesize[3] };
+ p->data[2] + ps * x + y * p->linesize[2] };
+ if (f->transparency)
+ planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame32(f, sc, &gb, planes, width, height, p->linesize);
} else {
uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0],
p->data[1] + ps * x + y * p->linesize[1],
- p->data[2] + ps * x + y * p->linesize[2],
- p->data[3] + ps * x + y * p->linesize[3] };
+ p->data[2] + ps * x + y * p->linesize[2] };
+ if (f->transparency)
+ planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame(f, sc, &gb, planes, width, height, p->linesize);
}
if (f->ac != AC_GOLOMB_RICE && f->version > 2) {
--
2.49.1
From 1013638e36327a74ab4486dcc470f11a3586087e Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 13 Jul 2025 19:50:57 -0300
Subject: [PATCH 312/434] swscale/swscale_unscaled: don't add offsets to NULL
pointers
Fixes: libswscale/swscale_unscaled.c:916:20: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit af9b43455a972841154b194057a79ee8b606e727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/swscale_unscaled.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c
index cb73ba7810..45ea88218a 100644
--- a/libswscale/swscale_unscaled.c
+++ b/libswscale/swscale_unscaled.c
@@ -772,7 +772,7 @@ static int Rgb16ToPlanarRgb16Wrapper(SwsContext *c, const uint8_t *src[],
return srcSliceH;
}
- for(i=0; i<4; i++) {
+ for (i = 0; i < 4 && dst[i]; i++) {
dst2013[i] += stride2013[i] * srcSliceY / 2;
dst1023[i] += stride1023[i] * srcSliceY / 2;
}
--
2.49.1
From 99bdc928f50a9e8fdc79061515da90500f46b873 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Sun, 13 Jul 2025 20:01:26 -0300
Subject: [PATCH 313/434] avcodec/motion_est: don't add offsets to NULL
pointers
Fixes: libavcodec/motion_est.c:94:31: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 585a8d53576f19a14394d7728ed2831e1bee8dbf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/motion_est.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index e4f17fb2d8..c0c2f315fa 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -90,12 +90,12 @@ static inline void init_ref(MotionEstContext *c, uint8_t *const src[3],
};
int i;
for(i=0; i<3; i++){
- c->src[0][i]= src [i] + offset[i];
- c->ref[0][i]= ref [i] + offset[i];
+ c->src[0][i]= src[i] ? FF_PTR_ADD(src[i], offset[i]) : NULL;
+ c->ref[0][i]= ref[i] ? FF_PTR_ADD(ref[i], offset[i]) : NULL;
}
if(ref_index){
for(i=0; i<3; i++){
- c->ref[ref_index][i]= ref2[i] + offset[i];
+ c->ref[ref_index][i]= ref2[i] ? FF_PTR_ADD(ref2[i], offset[i]) : NULL;
}
}
}
--
2.49.1
From a18b2da35588070adb313582cb6407927fd32665 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Thu, 17 Jul 2025 01:34:33 +0200
Subject: [PATCH 314/434] avfilter/vaf_spectrumsynth: don't use uninitialized
variable as scale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
scale was never initialized. av_tx_init() will use default scale if we
pass NULL.
Fixes: b3117f376d1c50b3c39befe27cbba12d5c0f80da
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 6302ff1fd92648ad11e3ee52f3a72b79ee4a7e6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vaf_spectrumsynth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/vaf_spectrumsynth.c b/libavfilter/vaf_spectrumsynth.c
index a62151aa4f..9a197f5359 100644
--- a/libavfilter/vaf_spectrumsynth.c
+++ b/libavfilter/vaf_spectrumsynth.c
@@ -145,7 +145,7 @@ static int config_output(AVFilterLink *outlink)
int height = ctx->inputs[0]->h;
AVRational time_base = ctx->inputs[0]->time_base;
AVRational frame_rate = inl0->frame_rate;
- float factor, overlap, scale;
+ float factor, overlap;
int i, ch, ret;
outlink->sample_rate = s->sample_rate;
@@ -180,7 +180,7 @@ static int config_output(AVFilterLink *outlink)
s->win_size = s->size * 2;
s->nb_freq = s->size;
- ret = av_tx_init(&s->fft, &s->tx_fn, AV_TX_FLOAT_FFT, 1, s->win_size, &scale, 0);
+ ret = av_tx_init(&s->fft, &s->tx_fn, AV_TX_FLOAT_FFT, 1, s->win_size, NULL, 0);
if (ret < 0) {
av_log(ctx, AV_LOG_ERROR, "Unable to create FFT context. "
"The window size might be too high.\n");
--
2.49.1
From 5b24ea3add0d44713ee9a5bfb81adef2a20188ae Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 15 Jul 2025 23:28:09 +0200
Subject: [PATCH 315/434] avcodec/ivi: Check luma/chroma mb_size
Fixes: shift exponent -1 is negative
Fixes: 429011224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5031059358285824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f1c3e18579c249cc729bc6033c034f6a6f7426)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ivi.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c
index e7d8d10c3e..a38f382d5f 100644
--- a/libavcodec/ivi.c
+++ b/libavcodec/ivi.c
@@ -994,9 +994,11 @@ static int decode_band(IVI45DecContext *ctx,
for (t = 0; t < band->num_tiles; t++) {
tile = &band->tiles[t];
- if (tile->mb_size != band->mb_size) {
- av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d\n",
- band->mb_size, tile->mb_size);
+ if (tile->mb_size != band->mb_size ||
+ ctx->planes[0].bands[0].mb_size < band->mb_size
+ ) {
+ av_log(avctx, AV_LOG_ERROR, "MB sizes mismatch: %d vs. %d vs. %d\n",
+ band->mb_size, tile->mb_size, ctx->planes[0].bands[0].mb_size);
return AVERROR_INVALIDDATA;
}
tile->is_empty = get_bits1(&ctx->gb);
--
2.49.1
From 8a0f196d3fe4e3332bebba71107982934761a376 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 15 Jul 2025 22:19:24 +0200
Subject: [PATCH 316/434] avcodec/cfhd: Check idwt_buf size before allocation
Fixes: OOM
Fixes: 428760799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_DEC_fuzzer-5685176435015680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d72bf6fe0793c3f069ba181a0e733dcc9f28180)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cfhd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
index 6f1d960058..7d8aca3713 100644
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -25,6 +25,7 @@
#include "libavutil/attributes.h"
#include "libavutil/common.h"
+#include "libavutil/imgutils.h"
#include "libavutil/intreadwrite.h"
#include "libavutil/mem.h"
#include "libavutil/pixdesc.h"
@@ -275,6 +276,9 @@ static int alloc_buffers(AVCodecContext *avctx)
int height = (i || bayer) ? s->coded_height >> chroma_y_shift : s->coded_height;
ptrdiff_t stride = (FFALIGN(width / 8, 8) + 64) * 8;
+ if ((ret = av_image_check_size2(stride, height, avctx->max_pixels, s->coded_format, 0, avctx)) < 0)
+ return ret;
+
if (chroma_y_shift && !bayer)
height = FFALIGN(height / 8, 2) * 8;
s->plane[i].width = width;
--
2.49.1
From 21f90d9c909ce29444b0e2dc03cda90c92a72932 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 16 Jul 2025 00:01:07 +0200
Subject: [PATCH 317/434] avcodec/ffv1dec: Check k in get_vlc_symbol()
The true problem happens in several previous get_vlc_symbol()
but checking that is more expensive (involving FFABS())
here its just a simple check between 2 variables we have.
Fixes: Assertion log >= k failed at libavcodec/golomb.h:406
Fixes: 429296194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-4691594622337024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 051e0d7744dbb45f680bbfa72bfead947b11ef2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 06edae7678..3b6a0f6421 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -81,6 +81,11 @@ static inline int get_vlc_symbol(GetBitContext *gb, VlcState *const state,
k++;
i += i;
}
+ if (k > bits) {
+ ff_dlog(NULL, "k-overflow bias:%d error:%d drift:%d count:%d k:%d",
+ state->bias, state->error_sum, state->drift, state->count, k);
+ k = bits;
+ }
v = get_sr_golomb(gb, k, 12, bits);
ff_dlog(NULL, "v:%d bias:%d error:%d drift:%d count:%d k:%d",
--
2.49.1
From ac8d81266ffb8ee8b02a5d93ef9fdcde01eb64f1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 13 Jul 2025 03:10:27 +0200
Subject: [PATCH 318/434] avformat/concatdec: Clip duration in one more case in
get_best_effort_duration()
Fixes: signed integer overflow: 40000 - -9223372036854770000 cannot be represented in type 'long'
Fixes: 427262541/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4831506940100608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8cdb47e47a7a53a3c635a71bf712d79119eb86b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/concatdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index fe65d0c768..e0c2c87248 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -326,7 +326,7 @@ static int64_t get_best_effort_duration(ConcatFile *file, AVFormatContext *avf)
if (file->outpoint != AV_NOPTS_VALUE)
return av_sat_sub64(file->outpoint, file->file_inpoint);
if (avf->duration > 0)
- return avf->duration - (file->file_inpoint - file->file_start_time);
+ return av_sat_sub64(avf->duration, file->file_inpoint - file->file_start_time);
if (file->next_dts != AV_NOPTS_VALUE)
return file->next_dts - file->file_inpoint;
return AV_NOPTS_VALUE;
--
2.49.1
From 4d1a79a9ec6855b15353e8eb599036a38db142b0 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 18 Jul 2025 21:42:35 -0300
Subject: [PATCH 319/434] avcodec/ffv1dec: don't add offsets to more NULL
pointers
Fixes: libavcodec/ffv1dec.c:453:43: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 48ef4caac2d49cab8ed4decc33e86cd879dc8736)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 3b6a0f6421..4607169c33 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -337,16 +337,20 @@ static int decode_slice(AVCodecContext *c, void *arg)
decode_plane(f, sc, &gb, p->data[0] + ps*x + y*p->linesize[0] , width, height, p->linesize[0], 0, 2);
decode_plane(f, sc, &gb, p->data[0] + ps*x + y*p->linesize[0] + 1, width, height, p->linesize[0], 1, 2);
} else if (f->use32bit) {
- uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0],
- p->data[1] + ps * x + y * p->linesize[1],
- p->data[2] + ps * x + y * p->linesize[2] };
+ uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0] };
+ if (f->chroma_planes) {
+ planes[1] = p->data[1] + ps * x + y * p->linesize[1];
+ planes[2] = p->data[2] + ps * x + y * p->linesize[2];
+ }
if (f->transparency)
planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame32(f, sc, &gb, planes, width, height, p->linesize);
} else {
- uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0],
- p->data[1] + ps * x + y * p->linesize[1],
- p->data[2] + ps * x + y * p->linesize[2] };
+ uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0] };
+ if (f->chroma_planes) {
+ planes[1] = p->data[1] + ps * x + y * p->linesize[1];
+ planes[2] = p->data[2] + ps * x + y * p->linesize[2];
+ }
if (f->transparency)
planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame(f, sc, &gb, planes, width, height, p->linesize);
--
2.49.1
From 7764b5a12cf0613039118b7c92974a4dcb9cbd2b Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 22 Jul 2025 11:57:13 -0300
Subject: [PATCH 320/434] avcodec/ffv1dec: don't check chroma_planes for
f->colorspace > 0
It's RGB, so check instead if it's packed or planar.
Fixes: libavcodec/ffv1dec.c:461:43: runtime error: applying zero offset to null pointer
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 86670fec9cc83d634f39d23fdfcfcee253594b0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1dec.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index 4607169c33..19a3254057 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -337,22 +337,20 @@ static int decode_slice(AVCodecContext *c, void *arg)
decode_plane(f, sc, &gb, p->data[0] + ps*x + y*p->linesize[0] , width, height, p->linesize[0], 0, 2);
decode_plane(f, sc, &gb, p->data[0] + ps*x + y*p->linesize[0] + 1, width, height, p->linesize[0], 1, 2);
} else if (f->use32bit) {
- uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0] };
- if (f->chroma_planes) {
- planes[1] = p->data[1] + ps * x + y * p->linesize[1];
- planes[2] = p->data[2] + ps * x + y * p->linesize[2];
- }
+ uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0],
+ p->data[1] + ps * x + y * p->linesize[1],
+ p->data[2] + ps * x + y * p->linesize[2] };
if (f->transparency)
planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame32(f, sc, &gb, planes, width, height, p->linesize);
} else {
uint8_t *planes[4] = { p->data[0] + ps * x + y * p->linesize[0] };
- if (f->chroma_planes) {
+ if (f->avctx->bits_per_raw_sample > 8) {
planes[1] = p->data[1] + ps * x + y * p->linesize[1];
planes[2] = p->data[2] + ps * x + y * p->linesize[2];
+ if (f->transparency)
+ planes[3] = p->data[3] + ps * x + y * p->linesize[3];
}
- if (f->transparency)
- planes[3] = p->data[3] + ps * x + y * p->linesize[3];
decode_rgb_frame(f, sc, &gb, planes, width, height, p->linesize);
}
if (f->ac != AC_GOLOMB_RICE && f->version > 2) {
--
2.49.1
From 484611443c5af0ecc7135854b89fa42ed725557c Mon Sep 17 00:00:00 2001
From: Leo Izen <leo.izen@gmail.com>
Date: Tue, 15 Jul 2025 13:54:05 -0400
Subject: [PATCH 321/434] avcodec/jpegxl_parser: add sanity check for frame
size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If a frame size is absolutely massive, this can spin the parser as it
attempts to decode a permuted TOC. We add a sanity check here for eight
times the size of the image for an internal frame to prevent malicious
bitstreams from slowing the parser down to a crawl.
Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 829680f96a7a7ff02d1543895ec0fb713309d5c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/jpegxl_parser.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 76122af54a..a2591ffc0d 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1315,6 +1315,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
if (get_bits1(gb)) {
JXLEntropyDecoder dec;
int64_t end, lehmer = 0;
+ /* parser sanity check to prevent TOC perm from spinning cpu */
+ if (width > meta->coded_width * 8 || height > meta->coded_height * 8) {
+ av_log(avctx, AV_LOG_WARNING, "frame of size %" PRIu32 "x%" PRIu32
+ " exceeds max size of %" PRIu32 "x%" PRIu32 ", aborting parser\n",
+ width, height, meta->coded_width * 8, meta->coded_height * 8);
+ return AVERROR_INVALIDDATA;
+ }
ret = entropy_decoder_init(avctx, gb, &dec, 8);
if (ret < 0)
return ret;
@@ -1331,7 +1338,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer));
if (lehmer < 0 || get_bits_left(gb) < 0) {
entropy_decoder_close(&dec);
- return AVERROR_BUFFER_TOO_SMALL;
+ return lehmer < 0 ? lehmer : AVERROR_BUFFER_TOO_SMALL;
}
}
entropy_decoder_close(&dec);
--
2.49.1
From f083c463f1e22697332ce884c32b8c5c38a44053 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 23 Jul 2025 01:57:54 +0200
Subject: [PATCH 322/434] avformat/asfdec_f: Check amount of value read
Fixes: use of uninitialized memory
Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa197924a66d83106c5d4dadb8610a1c526afd67)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/asfdec_f.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index 2441cadb44..36623bcb75 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -240,8 +240,10 @@ static void get_tag(AVFormatContext *s, const char *key, int type, int len, int
case ASF_UNICODE:
avio_get_str16le(s->pb, len, value, 2 * len + 1);
break;
- case -1: // ASCI
- avio_read(s->pb, value, len);
+ case -1:; // ASCII
+ int ret = ffio_read_size(s->pb, value, len);
+ if (ret < 0)
+ goto finish;
value[len]=0;
break;
case ASF_BYTE_ARRAY:
--
2.49.1
From 1b1524ee893aacf139edc8b753bd5cd70e0aa08c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 23 Jul 2025 13:05:29 +0200
Subject: [PATCH 323/434] avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on
allocation
Fixes: use of uninitialized memory
Fixes: 378102648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5896308499480576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a21c37f75ef493bafed3e3fdfbd3cf48990439b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevc/hevcdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 139f0811ef..7bd3a706a7 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -151,10 +151,10 @@ static int pic_arrays_init(HEVCLayerContext *l, const HEVCSPS *sps)
int w = sps->width >> sps->hshift[c_idx];
int h = sps->height >> sps->vshift[c_idx];
l->sao_pixel_buffer_h[c_idx] =
- av_malloc((w * 2 * sps->ctb_height) <<
+ av_mallocz((w * 2 * sps->ctb_height) <<
sps->pixel_shift);
l->sao_pixel_buffer_v[c_idx] =
- av_malloc((h * 2 * sps->ctb_width) <<
+ av_mallocz((h * 2 * sps->ctb_width) <<
sps->pixel_shift);
if (!l->sao_pixel_buffer_h[c_idx] ||
!l->sao_pixel_buffer_v[c_idx])
--
2.49.1
From c785b5580ed0509bacc2f06b934ab25e1ba13ebc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 23 Jul 2025 13:16:33 +0200
Subject: [PATCH 324/434] avformat/mov: make sure file_checksum is fully
initialized
Fixes: use of uninitialized memory
Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b16e1ddd9c0bc4ca90447d481186216cfdce0fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mov.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index cd1846798a..15631f6848 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1370,7 +1370,9 @@ static int mov_read_adrm(MOVContext *c, AVIOContext *pb, MOVAtom atom)
avio_read(pb, output, 8); // go to offset 8, absolute position 0x251
avio_read(pb, input, DRM_BLOB_SIZE);
avio_read(pb, output, 4); // go to offset 4, absolute position 0x28d
- avio_read(pb, file_checksum, 20);
+ ret = ffio_read_size(pb, file_checksum, 20);
+ if (ret < 0)
+ goto fail;
// required by external tools
ff_data_to_hex(checksum_string, file_checksum, sizeof(file_checksum), 1);
--
2.49.1
From 68fe5db819ba4a4c344bc260016d1cd382b211d1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 23 Jul 2025 13:36:42 +0200
Subject: [PATCH 325/434] avformat/vqf: Ensure that comm_chunk is fully read
Fixes: use of uninitialized memory
Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7a327b3a43df6ab82885cea5ae02bf9dd899a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/vqf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index 58b1546f53..803182e61b 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -20,6 +20,7 @@
*/
#include "avformat.h"
+#include "avio_internal.h"
#include "demux.h"
#include "internal.h"
#include "libavutil/intreadwrite.h"
@@ -143,7 +144,9 @@ static int vqf_read_header(AVFormatContext *s)
if (len < 12)
return AVERROR_INVALIDDATA;
- avio_read(s->pb, comm_chunk, 12);
+ ret = ffio_read_size(s->pb, comm_chunk, 12);
+ if (ret < 0)
+ return ret;
st->codecpar->ch_layout.nb_channels = AV_RB32(comm_chunk) + 1;
read_bitrate = AV_RB32(comm_chunk + 4);
rate_flag = AV_RB32(comm_chunk + 8);
--
2.49.1
From 7c7d96277f84d672d1f8143d210abd8e7a25ff48 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 23 Jul 2025 21:13:33 +0200
Subject: [PATCH 326/434] avcodec/shorten: Clear the additionally allocated
space on realloc
Fixes: use of uninitialized memory
Fixes: 421954767/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-515682786246656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 909229b880d5f2c2277ab10915954b18d5162322)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/shorten.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 46d3b7a615..b846aa2486 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -584,7 +584,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame,
if (avpkt->size) {
int max_framesize = s->blocksize * s->channels * 8;
void *tmp_ptr;
-
+ unsigned old_allocated_bitstream_size = s->allocated_bitstream_size;
tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,
max_framesize + AV_INPUT_BUFFER_PADDING_SIZE);
if (!tmp_ptr) {
@@ -592,9 +592,8 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame,
return AVERROR(ENOMEM);
}
s->bitstream = tmp_ptr;
- if (max_framesize > s->max_framesize)
- memset(s->bitstream + s->max_framesize, 0, (max_framesize - s->max_framesize) +
- AV_INPUT_BUFFER_PADDING_SIZE);
+ if (s->allocated_bitstream_size > old_allocated_bitstream_size)
+ memset(s->bitstream + old_allocated_bitstream_size, 0, s->allocated_bitstream_size - old_allocated_bitstream_size);
s->max_framesize = FFMAX(s->max_framesize, max_framesize);
*got_frame_ptr = 0;
goto finish_frame;
--
2.49.1
From 27624d678d27153287c1f27121b414537879885c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 24 Jul 2025 01:05:40 +0200
Subject: [PATCH 327/434] avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
Fixes: use of uninitialized memory
Fixes: 427532813/clusterfuzz-testcase-minimized-ffmpeg_dem_MXG_fuzzer-5661938917113856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b12e919cfe3bf69038225794330d14575fb78d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/mxg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/mxg.c b/libavformat/mxg.c
index 6a39873f21..40139d7d3d 100644
--- a/libavformat/mxg.c
+++ b/libavformat/mxg.c
@@ -127,6 +127,8 @@ static int mxg_update_cache(AVFormatContext *s, unsigned int cache_size)
mxg->cache_size += ret;
+ memset(mxg->buffer_ptr + mxg->cache_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
return ret;
}
--
2.49.1
From 7889a9944fd4f6536fbc68d8f77256ac7e682d46 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 13 Jul 2025 01:17:02 +0200
Subject: [PATCH 328/434] avcodec/mpegvideo_dec: Fix lowres=3 field select
interlaced mpeg4 frame
Fixes: out of array read in the chroma plane
Fixes: 428034092/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_DEC_fuzzer-5582608941776896.test
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b849ac006b667dbd494a28de2f8b059fec308ac2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mpegvideo_dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mpegvideo_dec.c b/libavcodec/mpegvideo_dec.c
index 1cab108935..0c2937a7cc 100644
--- a/libavcodec/mpegvideo_dec.c
+++ b/libavcodec/mpegvideo_dec.c
@@ -603,7 +603,7 @@ static av_always_inline void mpeg_motion_lowres(MpegEncContext *s,
ptr_cr = ref_picture[2] + uvsrc_y * uvlinesize + uvsrc_x;
if ((unsigned) src_x > FFMAX( h_edge_pos - (!!sx) - 2 * block_s, 0) || uvsrc_y<0 ||
- (unsigned) src_y > FFMAX((v_edge_pos >> field_based) - (!!sy) - FFMAX(h, hc<<s->chroma_y_shift), 0)) {
+ (unsigned) src_y > FFMAX((v_edge_pos >> field_based) - (!!sy) - FFMAX(h, field_select + hc<<s->chroma_y_shift), 0)) {
s->vdsp.emulated_edge_mc(s->sc.edge_emu_buffer, ptr_y,
linesize >> field_based, linesize >> field_based,
17, 17 + field_based,
--
2.49.1
From 342ea86330ae388baf686fa220892833d55a1c3f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 28 Jul 2025 23:41:56 +0200
Subject: [PATCH 329/434] avformat/dashdec: Allocate space for appended "/"
Fixes: writing 1 byte over the end of the array
Fixes: BIGSLEEP-433502298/test.xml
Found-by: Google Big Sleep
A prettier solution is welcome!
A testcase exists only for the baseurl case
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce0a655f85c1144d19a4acad59afbb92e4997e30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/dashdec.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 71d79067a9..71f5d76c2e 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -735,7 +735,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
}
tmp_max_url_size = aligned(tmp_max_url_size);
- text = av_mallocz(tmp_max_url_size);
+ text = av_mallocz(tmp_max_url_size + 1);
if (!text) {
updated = AVERROR(ENOMEM);
goto end;
@@ -747,7 +747,7 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
}
av_free(text);
- path = av_mallocz(tmp_max_url_size);
+ path = av_mallocz(tmp_max_url_size + 2);
tmp_str = av_mallocz(tmp_max_url_size);
if (!tmp_str || !path) {
updated = AVERROR(ENOMEM);
@@ -769,6 +769,15 @@ static int resolve_content_path(AVFormatContext *s, const char *url, int *max_ur
node = baseurl_nodes[rootId];
baseurl = xmlNodeGetContent(node);
+ if (baseurl) {
+ size_t len = xmlStrlen(baseurl)+2;
+ char *tmp = xmlRealloc(baseurl, len);
+ if (!tmp) {
+ updated = AVERROR(ENOMEM);
+ goto end;
+ }
+ baseurl = tmp;
+ }
root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path;
if (node) {
xmlNodeSetContent(node, root_url);
--
2.49.1
From b559d2f7019366e1180bccc3a40214849891cbb0 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 14:34:25 +0200
Subject: [PATCH 330/434] avcodec/cri: Factor read_len out
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9bf3c141bb96dd285477278400b8349e9f964b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cri.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/libavcodec/cri.c b/libavcodec/cri.c
index 6932bb6745..12c33399bd 100644
--- a/libavcodec/cri.c
+++ b/libavcodec/cri.c
@@ -220,10 +220,11 @@ static int cri_decode_frame(AVCodecContext *avctx, AVFrame *p,
if (bytestream2_get_le32(gb) != 0)
return AVERROR_INVALIDDATA;
break;
- case 102:
- bytestream2_get_buffer(gb, codec_name, FFMIN(length, sizeof(codec_name) - 1));
- length -= FFMIN(length, sizeof(codec_name) - 1);
- if (strncmp(codec_name, "cintel_craw", FFMIN(length, sizeof(codec_name) - 1)))
+ case 102:;
+ int read_len = FFMIN(length, sizeof(codec_name) - 1);
+ bytestream2_get_buffer(gb, codec_name, read_len))
+ length -= read_len;
+ if (strncmp(codec_name, "cintel_craw", read_len))
return AVERROR_INVALIDDATA;
compressed = 1;
goto skip;
--
2.49.1
From b1507d4ba549aa9a9e83645468b7f96e06ed9f97 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 14:34:59 +0200
Subject: [PATCH 331/434] avcodec/cri: Check bytestream2_get_buffer() for end
Fixes: use of uninintialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5910856640823296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea3851bebf91a96b11d16be2b36bf88111e30e36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cri.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavcodec/cri.c b/libavcodec/cri.c
index 12c33399bd..f9ae257ba7 100644
--- a/libavcodec/cri.c
+++ b/libavcodec/cri.c
@@ -222,7 +222,8 @@ static int cri_decode_frame(AVCodecContext *avctx, AVFrame *p,
break;
case 102:;
int read_len = FFMIN(length, sizeof(codec_name) - 1);
- bytestream2_get_buffer(gb, codec_name, read_len))
+ if (read_len != bytestream2_get_buffer(gb, codec_name, read_len))
+ return AVERROR_INVALIDDATA;
length -= read_len;
if (strncmp(codec_name, "cintel_craw", read_len))
return AVERROR_INVALIDDATA;
--
2.49.1
From b2c5e60251a92450e47f78fccb8a209ff51a3355 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 14:44:04 +0200
Subject: [PATCH 332/434] avcodec/iff: Clear ham_buf
Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6651797156724736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e9e7cb3b65167f37dcbfcf6a2ee308548af4e73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/iff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 13010b451e..66839c3c39 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -279,7 +279,7 @@ static int extract_header(AVCodecContext *const avctx,
if (avctx->codec_tag == MKTAG('P', 'B', 'M', ' ') && s->ham == 4)
extra_space = 4;
- s->ham_buf = av_malloc((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE);
+ s->ham_buf = av_mallocz((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE);
if (!s->ham_buf)
return AVERROR(ENOMEM);
--
2.49.1
From 6a1664950d2cd3086a0e7276b06dc1d434d64c6a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 14:39:53 +0200
Subject: [PATCH 333/434] avcodec/imc: Clear padding of buf16
Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IAC_fuzzer-6685890556788736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 715df4b1ff398758ca1b8a82c3d16940bc63fc56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/imc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/imc.c b/libavcodec/imc.c
index 5891e3621a..72c4c6ff89 100644
--- a/libavcodec/imc.c
+++ b/libavcodec/imc.c
@@ -966,6 +966,8 @@ static int imc_decode_frame(AVCodecContext *avctx, AVFrame *frame,
LOCAL_ALIGNED_16(uint16_t, buf16, [(IMC_BLOCK_SIZE + AV_INPUT_BUFFER_PADDING_SIZE) / 2]);
+ memset(buf16 + IMC_BLOCK_SIZE/2, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
q->avctx = avctx;
if (buf_size < IMC_BLOCK_SIZE * avctx->ch_layout.nb_channels) {
--
2.49.1
From 1730270bd24f7bc8667f57e3abd12f01d4c23948 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 08:33:40 +0200
Subject: [PATCH 334/434] avcodec/lzf: Check for input space
Fixes: use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5597015691296768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 610d368d9bc3f1b7073a0b33e352f8bd7db24c7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/lzf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 1e3c86c88c..94b369dd59 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -56,7 +56,10 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
p = *buf + len;
}
- bytestream2_get_buffer(gb, p, s);
+ int s2 = bytestream2_get_buffer(gb, p, s);
+ if (s2 != s)
+ return AVERROR_INVALIDDATA;
+
p += s;
len += s;
} else {
--
2.49.1
From eb047457a95546ce78360db1cfb07274e76ac2ee Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 14:52:36 +0200
Subject: [PATCH 335/434] avcodec/vqavideo; Check bytestream2_get_buffer()
reading next_codebook_buffer
Fixes: use of uninintilaized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6235973619351552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44864dbbb9b87d13d8f4ec92fb8536be0f9dbbc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vqavideo.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
index 4fd1861d25..37c083297b 100644
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -571,8 +571,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame)
}
/* accumulate partial codebook */
- bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
- chunk_size);
+ if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
+ chunk_size))
+ return AVERROR_INVALIDDATA;
s->next_codebook_buffer_index += chunk_size;
s->partial_countdown--;
@@ -600,8 +601,9 @@ static int vqa_decode_frame_pal8(VqaContext *s, AVFrame *frame)
}
/* accumulate partial codebook */
- bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
- chunk_size);
+ if (chunk_size != bytestream2_get_buffer(&s->gb, &s->next_codebook_buffer[s->next_codebook_buffer_index],
+ chunk_size))
+ return AVERROR_INVALIDDATA;
s->next_codebook_buffer_index += chunk_size;
s->partial_countdown--;
--
2.49.1
From 53721c5a7d33f4fb052aa7d54e6efe63dd04e5ee Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 3 Aug 2025 01:47:54 +0200
Subject: [PATCH 336/434] avcodec/fits: Clear naxis
Fixes: Use of uninitialized memory
Fixes: 423673969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_DEC_fuzzer-5602250833854464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1687daa93c131f929495c7ab0509d2e5c98b40f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/fits.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/fits.c b/libavcodec/fits.c
index 5f364960e0..0fc2d895b7 100644
--- a/libavcodec/fits.c
+++ b/libavcodec/fits.c
@@ -32,6 +32,8 @@ int avpriv_fits_header_init(FITSHeader *header, FITSHeaderState state)
{
header->state = state;
header->naxis_index = 0;
+ header->naxis = 0;
+ memset(header->naxisn, 0, sizeof(header->naxisn));
header->blank_found = 0;
header->pcount = 0;
header->gcount = 1;
--
2.49.1
From c6cc963647c99e1a13e13ed158ac5832feed2814 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Sun, 3 Aug 2025 20:09:38 +0000
Subject: [PATCH 337/434] avcodec/tests/avpacket: Add av_packet_free() to avoid
memory leak
Add av_packet_free() to free avpkt_clone and avpkt in the error paths to avoid potential memory leak.
Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab040e25657436e88a62624b3751a583dfe4e123)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/tests/avpacket.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/tests/avpacket.c b/libavcodec/tests/avpacket.c
index fed700b4be..f3451df576 100644
--- a/libavcodec/tests/avpacket.c
+++ b/libavcodec/tests/avpacket.c
@@ -101,11 +101,14 @@ int main(void)
if(!avpkt_clone) {
av_log(NULL, AV_LOG_ERROR,"av_packet_clone failed to clone AVPacket\n");
+ av_packet_free(&avpkt);
return 1;
}
/*test av_grow_packet*/
if(av_grow_packet(avpkt_clone, 20) < 0){
av_log(NULL, AV_LOG_ERROR, "av_grow_packet failed\n");
+ av_packet_free(&avpkt_clone);
+ av_packet_free(&avpkt);
return 1;
}
if(av_grow_packet(avpkt_clone, INT_MAX) == 0){
--
2.49.1
From ad37e50c6b98afeea613819d6f90a71b5296a071 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Sat, 2 Aug 2025 23:28:48 +0000
Subject: [PATCH 338/434] examples: Add av_freep to avoid potential memory leak
Add av_freep() to free avio_ctx_buffer if avio_alloc_context fails
to avoid potential memory leak.
Fixes: 5fc4dea39c ("examples: add avio_reading.c example")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ca58424ded24e931fed329174c28244b67d5670)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/examples/avio_read_callback.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/doc/examples/avio_read_callback.c b/doc/examples/avio_read_callback.c
index dffc061d9f..0a299b4c73 100644
--- a/doc/examples/avio_read_callback.c
+++ b/doc/examples/avio_read_callback.c
@@ -96,6 +96,7 @@ int main(int argc, char *argv[])
avio_ctx = avio_alloc_context(avio_ctx_buffer, avio_ctx_buffer_size,
0, &bd, &read_packet, NULL, NULL);
if (!avio_ctx) {
+ av_freep(&avio_ctx_buffer);
ret = AVERROR(ENOMEM);
goto end;
}
--
2.49.1
From d3085d1e7158e7688aafabbdfe5b12d0a34babff Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Sun, 3 Aug 2025 19:14:38 +0000
Subject: [PATCH 339/434] avcodec/tests/avpacket: Add av_free() to avoid memory
leak
Add av_free() to free extra_data if av_packet_add_side_data() fails.
Fixes: da3c69a5a9 ("Added test for libavcodec/avpacket.c")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 008679ec162d1769afd706af5b1ce7a593f13f2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/tests/avpacket.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/tests/avpacket.c b/libavcodec/tests/avpacket.c
index f3451df576..1572e1147f 100644
--- a/libavcodec/tests/avpacket.c
+++ b/libavcodec/tests/avpacket.c
@@ -51,6 +51,7 @@ static int setup_side_data_entry(AVPacket* avpkt)
ret = av_packet_add_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
extra_data, bytes);
if(ret < 0){
+ av_free(extra_data);
fprintf(stderr,
"Error occurred in av_packet_add_side_data: %s\n",
av_err2str(ret));
--
2.49.1
From 0c4a3c5b571c0cbfd68af83b2c16b3d0cda0e70f Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Sun, 3 Aug 2025 20:32:23 +0000
Subject: [PATCH 340/434] libavcodec/tests/motion: Add check for
avcodec_alloc_context3()
Add check for the return value of avcodec_alloc_context3() to avoid potential NULL pointer dereference.
Fixes: 5d48e4eafa ("Merge commit 'a6a750c7ef240b72ce01e9653343a0ddf247d196'")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55d234b4330d1588eb127cf2283a442ee341f2c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/tests/motion.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/tests/motion.c b/libavcodec/tests/motion.c
index c37fc551c3..719fba537d 100644
--- a/libavcodec/tests/motion.c
+++ b/libavcodec/tests/motion.c
@@ -129,6 +129,10 @@ int main(int argc, char **argv)
printf("ffmpeg motion test\n");
ctx = avcodec_alloc_context3(NULL);
+ if (!ctx) {
+ return 1;
+ }
+
ctx->flags |= AV_CODEC_FLAG_BITEXACT;
av_force_cpu_flags(0);
ff_me_cmp_init(&cctx, ctx);
--
2.49.1
From e8439f41ff943bc0279c280876baec4c226c93e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Wed, 23 Jul 2025 20:04:53 +0200
Subject: [PATCH 341/434] avformat/lrcdec: support arbitrary precision
timestamp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Apparently files with milliseconds exist in the wild. And since it cost
nothing to support arbitrary number of digits, extend format to support
that.
Depending on number of digits, the time base of fractional part is
changing. Most LRCs use 2 digits and centiseconds base, but subs with 3
digits and miliseconds exist too.
Set internal time base to AV_TIME_BASE, which in parcitice allows to
hold microseconds with 6 digits. Totally artificial, but who knows maybe
someone wants that.
Fixes: #11677
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit bc3cc0a6af44adc63caf4e5097fcfebd7a7475b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/lrcdec.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/libavformat/lrcdec.c b/libavformat/lrcdec.c
index 68c44bce97..7941c02c5d 100644
--- a/libavformat/lrcdec.c
+++ b/libavformat/lrcdec.c
@@ -78,7 +78,9 @@ static int64_t count_ts(const char *p)
static int64_t read_ts(const char *p, int64_t *start)
{
int64_t offset = 0;
- uint64_t mm, ss, cs;
+ uint64_t mm;
+ double ss;
+ char prefix[3];
while(p[offset] == ' ' || p[offset] == '\t') {
offset++;
@@ -86,14 +88,14 @@ static int64_t read_ts(const char *p, int64_t *start)
if(p[offset] != '[') {
return 0;
}
- if(sscanf(p, "[-%"SCNu64":%"SCNu64".%"SCNu64"]", &mm, &ss, &cs) == 3) {
- /* Just in case negative pts, players may drop it but we won't. */
- *start = -(int64_t) (mm*60000 + ss*1000 + cs*10);
- } else if(sscanf(p, "[%"SCNu64":%"SCNu64".%"SCNu64"]", &mm, &ss, &cs) == 3) {
- *start = mm*60000 + ss*1000 + cs*10;
- } else {
+ int ret = sscanf(p, "%2[[-]%"SCNu64":%lf]", prefix, &mm, &ss);
+ if (ret != 3 || prefix[0] != '[') {
return 0;
}
+ *start = (mm * 60 + ss) * AV_TIME_BASE;
+ if (prefix[1] == '-') {
+ *start = - *start;
+ }
do {
offset++;
} while(p[offset] && p[offset-1] != ']');
@@ -164,7 +166,7 @@ static int lrc_read_header(AVFormatContext *s)
if(!st) {
return AVERROR(ENOMEM);
}
- avpriv_set_pts_info(st, 64, 1, 1000);
+ avpriv_set_pts_info(st, 64, 1, AV_TIME_BASE);
lrc->ts_offset = 0;
st->codecpar->codec_type = AVMEDIA_TYPE_SUBTITLE;
st->codecpar->codec_id = AV_CODEC_ID_TEXT;
--
2.49.1
From a44dcc770ebd9e00e5c3907dd2cb938f0551d7a9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 2 Aug 2025 18:55:26 +0200
Subject: [PATCH 342/434] avformat/hls: add cmfv/cmfa exceptions
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3c3a6ecfb230c56a8ff9d219d79d5981b2aa4f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/hls.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 0b01f406f6..fe008eee9a 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -757,8 +757,8 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct
+ 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0);
// Youtube uses aac files with .ts extension
if(av_match_name("mp4", in_fmt->name) || av_match_name("aac", in_fmt->name)) {
- matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts")
- + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0);
+ matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts,cmfv,cmfa")
+ + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts,cmfv,cmfa") > 0);
}
} else if (!strcmp(in_fmt->name, "mpegts")) {
const char *str = "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts"
--
2.49.1
From cb491e8cb32ddd15d93c80815ff48921d116671b Mon Sep 17 00:00:00 2001
From: Kimapr <root@kimapr.net>
Date: Mon, 28 Jul 2025 06:32:27 +0500
Subject: [PATCH 343/434] avformat/libopenmpt: fix seeking weirdness
- proper pts for packets. leaving it blank leaves it up for guessing,
but the guess doesn't take seeking into account, causing weirdness.
- clamp to 0 when seeking to negative ts. libopenmpt docs are unclear on
this but not doing this causes an immediate EOF when seeking backwards
to the beginning in mpv.
- only set song duration and packet pts when they are non-negative and
in int64 range. NaNs count as out of range. this isn't a fix for any
specific issue but might be helpful still, and shouldn't break
anything.
(cherry picked from commit ecef5f9e1fb70b38f3e325c8e613349344c97de4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/libopenmpt.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/libavformat/libopenmpt.c b/libavformat/libopenmpt.c
index 736af7caf2..6c2ea91cba 100644
--- a/libavformat/libopenmpt.c
+++ b/libavformat/libopenmpt.c
@@ -148,7 +148,8 @@ static int read_header_openmpt(AVFormatContext *s)
if (!st)
return AVERROR(ENOMEM);
avpriv_set_pts_info(st, 64, 1, AV_TIME_BASE);
- st->duration = llrint(openmpt->duration*AV_TIME_BASE);
+ if (openmpt->duration >= 0 && openmpt->duration < ((double)INT64_MAX + 1) / AV_TIME_BASE)
+ st->duration = llrint(openmpt->duration*AV_TIME_BASE);
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_NE(AV_CODEC_ID_PCM_F32BE, AV_CODEC_ID_PCM_F32LE);
@@ -171,6 +172,8 @@ static int read_packet_openmpt(AVFormatContext *s, AVPacket *pkt)
if ((ret = av_new_packet(pkt, AUDIO_PKT_SIZE)) < 0)
return ret;
+ double pos = openmpt_module_get_position_seconds(openmpt->module);
+
switch (openmpt->ch_layout.nb_channels) {
case 1:
ret = openmpt_module_read_float_mono(openmpt->module, openmpt->sample_rate,
@@ -196,6 +199,9 @@ static int read_packet_openmpt(AVFormatContext *s, AVPacket *pkt)
pkt->size = ret * (openmpt->ch_layout.nb_channels * 4);
+ if (pos >= 0 && pos < ((double)INT64_MAX + 1) / AV_TIME_BASE)
+ pkt->pts = llrint(pos * AV_TIME_BASE);
+
return 0;
}
@@ -212,6 +218,8 @@ static int read_close_openmpt(AVFormatContext *s)
static int read_seek_openmpt(AVFormatContext *s, int stream_idx, int64_t ts, int flags)
{
OpenMPTContext *openmpt = s->priv_data;
+ if (ts < 0)
+ ts = 0;
openmpt_module_set_position_seconds(openmpt->module, (double)ts/AV_TIME_BASE);
return 0;
}
--
2.49.1
From e19066e0aa65c8a03efe6d57d582e9af41d6e278 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Wed, 6 Aug 2025 18:26:42 +0200
Subject: [PATCH 344/434] avcodec/cbs_h266_syntax_template: fix out of bounds
access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.
Fixes: 435225531/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6639684232216576
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit fb862976df08b3b132491abca9956f2fe9f96bc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/cbs_h266_syntax_template.c | 24 +++++++++---------------
1 file changed, 9 insertions(+), 15 deletions(-)
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index d33629b06c..19a4b3d713 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1899,10 +1899,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
}
unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
while (remaining_size > 0) {
- if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
+ if (i == VVC_MAX_TILE_COLUMNS) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
- "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
- current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
+ "Exceeded maximum tile columns (%d) (remaining size: %u)\n",
+ VVC_MAX_TILE_COLUMNS, remaining_size);
return AVERROR_INVALIDDATA;
}
unified_size = FFMIN(remaining_size, unified_size);
@@ -1911,12 +1911,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
i++;
}
current->num_tile_columns = i;
- if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
- av_log(ctx->log_ctx, AV_LOG_ERROR,
- "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
- current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
- return AVERROR_INVALIDDATA;
- }
remaining_size = pic_height_in_ctbs_y;
for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {
@@ -1931,18 +1925,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;
while (remaining_size > 0) {
+ if (i == VVC_MAX_TILE_ROWS) {
+ av_log(ctx->log_ctx, AV_LOG_ERROR,
+ "Exceeded maximum tile rows (%d) (remaining size: %u)\n",
+ VVC_MAX_TILE_ROWS, remaining_size);
+ return AVERROR_INVALIDDATA;
+ }
unified_size = FFMIN(remaining_size, unified_size);
current->row_height_val[i] = unified_size;
remaining_size -= unified_size;
i++;
}
current->num_tile_rows=i;
- if (current->num_tile_rows > VVC_MAX_TILE_ROWS) {
- av_log(ctx->log_ctx, AV_LOG_ERROR,
- "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n",
- current->num_tile_rows, VVC_MAX_TILE_ROWS);
- return AVERROR_INVALIDDATA;
- }
current->num_tiles_in_pic = current->num_tile_columns *
current->num_tile_rows;
--
2.49.1
From 247727435d754588574239d6d3f07da973ea6aaa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Wed, 6 Aug 2025 19:49:11 +0200
Subject: [PATCH 345/434] avcodec/mpc8: init avctx->sample_rate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes frame validation.
Fixes: 416134551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5765557242888192
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 09cb2d41d1862c2f9b3b66311ede28527d703700)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mpc8.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/libavcodec/mpc8.c b/libavcodec/mpc8.c
index 2785259119..ae145927ee 100644
--- a/libavcodec/mpc8.c
+++ b/libavcodec/mpc8.c
@@ -155,7 +155,13 @@ static av_cold int mpc8_decode_init(AVCodecContext * avctx)
init_get_bits(&gb, avctx->extradata, 16);
- skip_bits(&gb, 3);//sample rate
+ uint8_t sample_rate_idx = get_bits(&gb, 3);
+ static const int sample_rates[] = { 44100, 48000, 37800, 32000 };
+ if (sample_rate_idx >= FF_ARRAY_ELEMS(sample_rates)) {
+ av_log(avctx, AV_LOG_ERROR, "invalid sample rate index (%u)\n", sample_rate_idx);
+ return AVERROR_INVALIDDATA;
+ }
+ avctx->sample_rate = sample_rates[sample_rate_idx];
c->maxbands = get_bits(&gb, 5) + 1;
if (c->maxbands >= BANDS) {
av_log(avctx,AV_LOG_ERROR, "maxbands %d too high\n", c->maxbands);
--
2.49.1
From 346ac063dfc2f89cb42b1357c91bdc3b7e13d024 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Tue, 5 Aug 2025 19:31:15 +0000
Subject: [PATCH 346/434] libavcodec/videotoolbox_vp9: Move av_malloc() to
avoid memory leak
Move av_malloc() after the check for subsampling to avoid memory leak if subsampling < 0 and av_malloc() succeeds.
Fixes: a41a2efc85 ("lavc/videotoolbox: add VP9 hardware acceleration")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b4e6ccb13f10752bc5c2a963478c7f3764a0cfe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/videotoolbox_vp9.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/videotoolbox_vp9.c b/libavcodec/videotoolbox_vp9.c
index da94ff4e54..3c7494791d 100644
--- a/libavcodec/videotoolbox_vp9.c
+++ b/libavcodec/videotoolbox_vp9.c
@@ -71,12 +71,12 @@ CFDataRef ff_videotoolbox_vpcc_extradata_create(AVCodecContext *avctx)
uint8_t *vt_extradata;
int subsampling = get_vpx_chroma_subsampling(avctx->sw_pix_fmt, avctx->chroma_sample_location);
- vt_extradata_size = 1 + 3 + 6 + 2;
- vt_extradata = av_malloc(vt_extradata_size);
-
if (subsampling < 0)
return NULL;
+ vt_extradata_size = 1 + 3 + 6 + 2;
+ vt_extradata = av_malloc(vt_extradata_size);
+
if (!vt_extradata)
return NULL;
--
2.49.1
From 0e8ccde9e5c9daa081eb4c037d83350390c9aa2b Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Wed, 6 Aug 2025 16:39:47 +0000
Subject: [PATCH 347/434] libavfilter/af_firequalizer: Add check for
av_malloc_array()
Add check for the return value of av_malloc_array() to avoid potential NULL pointer dereference.
Fixes: d3be186ed1 ("avfilter/firequalizer: add dumpfile and dumpscale option")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a25462482c02c004d685a8fcf2fa63955aaa0931)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/af_firequalizer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavfilter/af_firequalizer.c b/libavfilter/af_firequalizer.c
index 386d8cd242..1ce8cabbd6 100644
--- a/libavfilter/af_firequalizer.c
+++ b/libavfilter/af_firequalizer.c
@@ -808,6 +808,8 @@ static int config_input(AVFilterLink *inlink)
if ((ret = av_tx_init(&s->analysis_rdft, &s->analysis_rdft_fn, AV_TX_FLOAT_RDFT, 0, 1 << rdft_bits, &scale, 0)) < 0)
return ret;
s->dump_buf = av_malloc_array(s->analysis_rdft_len + 2, sizeof(*s->dump_buf));
+ if (!s->dump_buf)
+ return AVERROR(ENOMEM);
}
s->analysis_buf = av_malloc_array((s->analysis_rdft_len + 2), sizeof(*s->analysis_buf));
--
2.49.1
From 2bba2b82fd746cf685266a613213ce44e525ddf6 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Sun, 3 Aug 2025 23:31:27 +0000
Subject: [PATCH 348/434] libavcodec/tests/snowenc: Add av_free() to avoid
memory leak
Add av_free() to free s.temp_dwt_buffer and s.temp_idwt_buffer at the end of the function to avoid memory leak.
Fixes: 5d48e4eafa ("Merge commit 'a6a750c7ef240b72ce01e9653343a0ddf247d196'")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 446cfbfb7446208bd1592bbc0ac18ac744543563)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/tests/snowenc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavcodec/tests/snowenc.c b/libavcodec/tests/snowenc.c
index eb4e64f377..311374e5d4 100644
--- a/libavcodec/tests/snowenc.c
+++ b/libavcodec/tests/snowenc.c
@@ -45,7 +45,8 @@ int main(void){
if (!s.temp_dwt_buffer || !s.temp_idwt_buffer) {
fprintf(stderr, "Failed to allocate memory\n");
- return 1;
+ ret = 1;
+ goto end;
}
av_lfg_init(&prng, 1);
@@ -145,5 +146,9 @@ int main(void){
}
}
+
+end:
+ av_free(s.temp_dwt_buffer);
+ av_free(s.temp_idwt_buffer);
return ret;
}
--
2.49.1
From 19856e140ecadbcaa17aa65be665510a4067b309 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Wed, 6 Aug 2025 14:54:22 +0000
Subject: [PATCH 349/434] examples: Add check and replace av_free() to avoid
potential memory errors
Add check for the return value of av_packet_alloc() to avoid potential NULL pointer dereference.
Moreover, replace redundant av_free() with fprintf().
Fixes: 9a38184a14 ("examples/decode_audio: allocate the packet dynamically")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c64cff64a22a59c0c02281ee9fd9d89963d14d16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/examples/decode_audio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/doc/examples/decode_audio.c b/doc/examples/decode_audio.c
index bcb3d87a69..26ce07a552 100644
--- a/doc/examples/decode_audio.c
+++ b/doc/examples/decode_audio.c
@@ -128,6 +128,10 @@ int main(int argc, char **argv)
outfilename = argv[2];
pkt = av_packet_alloc();
+ if (!pkt) {
+ fprintf(stderr, "Could not allocate AVPacket\n");
+ exit(1); /* or proper cleanup and returning */
+ }
/* find the MPEG audio decoder */
codec = avcodec_find_decoder(AV_CODEC_ID_MP2);
@@ -161,7 +165,7 @@ int main(int argc, char **argv)
}
outfile = fopen(outfilename, "wb");
if (!outfile) {
- av_free(c);
+ fprintf(stderr, "Could not open %s\n", outfilename);
exit(1);
}
--
2.49.1
From 97932677dbc29c1173f3361886022426ac74197e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 10:35:15 +0200
Subject: [PATCH 350/434] avcodec/exr: Dont access outside xsize/ysize
Fixes: out of array access
Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f45da79b2c336c5f8f3e563d72b8a22fecdcde0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 4bac0be89b..49e6172e41 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1107,6 +1107,9 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
for (int y = 0; y < td->ysize; y += 8) {
for (int x = 0; x < td->xsize; x += 8) {
+ int bw = FFMIN(8, td->xsize - x);
+ int bh = FFMIN(8, td->ysize - y);
+
memset(td->block, 0, sizeof(td->block));
for (int j = 0; j < 3; j++) {
@@ -1134,8 +1137,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
float *ub = td->block[1];
float *vb = td->block[2];
- for (int yy = 0; yy < 8; yy++) {
- for (int xx = 0; xx < 8; xx++) {
+ for (int yy = 0; yy < bh; yy++) {
+ for (int xx = 0; xx < bw; xx++) {
const int idx = xx + yy * 8;
convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]);
--
2.49.1
From d7e188f33f638d85a1ab70943bde70359454b05c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 10:08:14 +0200
Subject: [PATCH 351/434] avcodec/exr: Check rle_raw_data and surroundings
Fixes: out of array read
Fixes: BIGSLEEP-436510153/dwa_uncompress_read.exr
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0d9c003d76383e82b57b6d5aa33776709d0cda2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 49e6172e41..8d64ad3dec 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -991,6 +991,7 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
const int dc_h = td->ysize >> 3;
GetByteContext gb, agb;
int skip, ret;
+ int have_rle = 0;
if (compressed_size <= 88)
return AVERROR_INVALIDDATA;
@@ -1015,6 +1016,11 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
)
return AVERROR_INVALIDDATA;
+ if ((uint64_t)rle_raw_size > INT_MAX) {
+ avpriv_request_sample(s->avctx, "Too big rle_raw_size");
+ return AVERROR_INVALIDDATA;
+ }
+
bytestream2_init(&gb, src + 88, compressed_size - 88);
skip = bytestream2_get_le16(&gb);
if (skip < 2)
@@ -1085,6 +1091,9 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
if (rle_raw_size > 0 && rle_csize > 0 && rle_usize > 0) {
unsigned long dest_len = rle_usize;
+ if (2LL * td->xsize * td->ysize > rle_raw_size)
+ return AVERROR_INVALIDDATA;
+
av_fast_padded_malloc(&td->rle_data, &td->rle_size, rle_usize);
if (!td->rle_data)
return AVERROR(ENOMEM);
@@ -1101,6 +1110,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
if (ret < 0)
return ret;
bytestream2_skip(&gb, rle_csize);
+
+ have_rle = 1;
}
bytestream2_init(&agb, td->ac_data, ac_count * 2);
@@ -1159,7 +1170,7 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
if (s->nb_channels < 4)
return 0;
- for (int y = 0; y < td->ysize && td->rle_raw_data; y++) {
+ for (int y = 0; y < td->ysize && have_rle; y++) {
uint32_t *ao = ((uint32_t *)td->uncompressed_data) + y * td->xsize * s->nb_channels;
uint8_t *ai0 = td->rle_raw_data + y * td->xsize;
uint8_t *ai1 = td->rle_raw_data + y * td->xsize + rle_raw_size / 2;
--
2.49.1
From 4c036ec307040469783bab0b7223006c0facec1d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 5 Aug 2025 23:18:47 +0200
Subject: [PATCH 352/434] avcodec/jpeg2000dec: move cdef default check into
get_siz()
This way cdef is at its final value earlier
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 104d6846c1be0cb757dc95d5801a416f4d7c687d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/jpeg2000dec.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 2e09b279dc..3f7174fb03 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -271,6 +271,17 @@ static int get_siz(Jpeg2000DecoderContext *s)
return AVERROR_INVALIDDATA;
}
+ for (i = 0; i < s->ncomponents; i++) {
+ if (s->cdef[i] < 0) {
+ for (i = 0; i < s->ncomponents; i++) {
+ s->cdef[i] = i + 1;
+ }
+ if ((s->ncomponents & 1) == 0)
+ s->cdef[s->ncomponents-1] = 0;
+ }
+ }
+ // after here we no longer have to consider negative cdef
+
for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i
uint8_t x = bytestream2_get_byteu(&s->g);
s->cbps[i] = (x & 0x7f) + 1;
@@ -2853,17 +2864,6 @@ static int jpeg2000_decode_frame(AVCodecContext *avctx, AVFrame *picture,
if (ret = jpeg2000_read_bitstream_packets(s))
goto end;
- for (int x = 0; x < s->ncomponents; x++) {
- if (s->cdef[x] < 0) {
- for (x = 0; x < s->ncomponents; x++) {
- s->cdef[x] = x + 1;
- }
- if ((s->ncomponents & 1) == 0)
- s->cdef[s->ncomponents-1] = 0;
- break;
- }
- }
-
avctx->execute2(avctx, jpeg2000_decode_tile, picture, NULL, s->numXtiles * s->numYtiles);
jpeg2000_dec_cleanup(s);
--
2.49.1
From d141e864f73152e94e0c45cc4abb8c329275c265 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 5 Aug 2025 23:42:23 +0200
Subject: [PATCH 353/434] avcodec/jpeg2000dec: implement cdef remapping during
pixel format matching
Fixes: out of array access
Fixes: poc.jp2
Found-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01a292c7e36545ddeb3c7f79cd02e2611cd37d73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/jpeg2000dec.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 3f7174fb03..508013a7f1 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -282,6 +282,14 @@ static int get_siz(Jpeg2000DecoderContext *s)
}
// after here we no longer have to consider negative cdef
+ int cdef_used = 0;
+ for (i = 0; i < s->ncomponents; i++)
+ cdef_used |= 1<<s->cdef[i];
+
+ // Check that the channels we have are what we expect for the number of components
+ if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents])
+ return AVERROR_INVALIDDATA;
+
for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i
uint8_t x = bytestream2_get_byteu(&s->g);
s->cbps[i] = (x & 0x7f) + 1;
@@ -294,7 +302,9 @@ static int get_siz(Jpeg2000DecoderContext *s)
av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]);
return AVERROR_INVALIDDATA;
}
- log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2;
+ int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1);
+
+ log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2;
}
s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width);
--
2.49.1
From 4e2da0082d46702fe5671e13885727c48ef09c20 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 13:36:06 +0200
Subject: [PATCH 354/434] avcodec/ffv1: Clear state on alloc
Fixes: use of uninitialized memory
Fixes: 428969823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_DEC_fuzzer-5909681623334912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70fc46d185663dbea0995bf868d66b58b388119e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ffv1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index 2b8564c2f5..cb3e76740d 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -81,7 +81,7 @@ av_cold int ff_ffv1_init_slice_state(const FFV1Context *f,
if (f->ac != AC_GOLOMB_RICE) {
if (!p->state)
- p->state = av_malloc_array(p->context_count, CONTEXT_SIZE *
+ p->state = av_calloc(p->context_count, CONTEXT_SIZE *
sizeof(uint8_t));
if (!p->state)
return AVERROR(ENOMEM);
--
2.49.1
From b5331bca1db858027f5ec149a9a4abddb1fdf874 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 13:09:26 +0200
Subject: [PATCH 355/434] avcodec/utvideodec: Set B for the width= 1 case
Fixes: use of uninitialized meory
Fixes: 428034093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-6195630160805888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 032dfe8584c4675f3253ebb5e333e834f55f7562)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/utvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index 4c0fa2ca67..934945c1be 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -402,7 +402,7 @@ static void restore_median_planar(UtvideoContext *c, uint8_t *src, ptrdiff_t str
// second line - first element has top prediction, the rest uses median
C = bsrc[-stride];
bsrc[0] += C;
- A = bsrc[0];
+ A = B = bsrc[0];
for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */
B = bsrc[i - stride];
bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C));
--
2.49.1
From 83d27b918ee0f7d11c661a828402d18670f95d11 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 11 May 2025 00:58:26 +0200
Subject: [PATCH 356/434] avcodec/aacsbr_template: Check ilb
Fixes: index 50 out of bounds for type 'INTFLOAT [40][2]'
Fixes: 401661737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4866055713652736
Someone knowing AAC well should review this, there is likely a nicer fix
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01a1b99fc2ccdf713abfa5203e36fbf5816e1b5f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aacsbr_template.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
index 9fae44d9a5..a126bd6f06 100644
--- a/libavcodec/aacsbr_template.c
+++ b/libavcodec/aacsbr_template.c
@@ -1626,6 +1626,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]
int ilb = ch_data->t_env[e] * 2 + ENVELOPE_ADJUSTMENT_OFFSET;
int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET;
+ if (ilb >= 40)
+ return;
+
for (m = 0; m < sbr->m[1]; m++) {
AAC_FLOAT sum = sbr->dsp.sum_square(X_high[m+kx1] + ilb, iub - ilb);
#if USE_FIXED
@@ -1644,6 +1647,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2]
int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET;
const uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow;
+ if (ilb >= 40)
+ return;
+
for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) {
#if USE_FIXED
SoftFloat sum = FLOAT_0;
--
2.49.1
From e8e40e89b1f7243dfacf57be620e7976e2d762f2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 8 May 2025 23:33:28 +0200
Subject: [PATCH 357/434] avcodec/aac/aacdec_usac: Limit sfo from noise offset
to be above -200
Fixes: out of array read
Fixes: 397731127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5577772965101568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d643a5ba0836c4d7ec86cb67fae387984ef3d1a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec_usac.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index ccdf58bc8e..3e5d31676c 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -1023,8 +1023,9 @@ static void apply_noise_fill(AACDecContext *ac, SingleChannelElement *sce,
}
}
- if (band_quantized_to_zero)
- sce->sfo[g*ics->max_sfb + sfb] += noise_offset;
+ if (band_quantized_to_zero) {
+ sce->sfo[g*ics->max_sfb + sfb] = FFMAX(sce->sfo[g*ics->max_sfb + sfb] + noise_offset, -200);
+ }
}
coef += g_len << 7;
}
--
2.49.1
From 5a65012cb8c86efa4f88302e0ad847c5e4fd0d8b Mon Sep 17 00:00:00 2001
From: Muhammad Faiz <mfcc64-at-gmail.com@ffmpeg.org>
Date: Thu, 3 Jul 2025 20:47:58 +0700
Subject: [PATCH 358/434] avfilter/avf_showcqt: fix unbounded index when
copying to fft_data
When timeclamp and/or fps are low, j can be negative.
Fix Ticket11640
(cherry picked from commit 35ea45835484b90490e7d1704ef99ccb7b775578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/avf_showcqt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/avf_showcqt.c b/libavfilter/avf_showcqt.c
index 00f679bc9e..9fc5b00dde 100644
--- a/libavfilter/avf_showcqt.c
+++ b/libavfilter/avf_showcqt.c
@@ -1520,7 +1520,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
i = insamples->nb_samples - remaining;
j = s->fft_len/2 + s->remaining_fill_max - s->remaining_fill;
if (remaining >= s->remaining_fill) {
- for (m = 0; m < s->remaining_fill; m++) {
+ for (m = FFMAX(0, -j); m < s->remaining_fill; m++) {
s->fft_data[j+m].re = audio_data[2*(i+m)];
s->fft_data[j+m].im = audio_data[2*(i+m)+1];
}
@@ -1549,7 +1549,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
s->fft_data[m] = s->fft_data[m+step];
s->remaining_fill = step;
} else {
- for (m = 0; m < remaining; m++) {
+ for (m = FFMAX(0, -j); m < remaining; m++) {
s->fft_data[j+m].re = audio_data[2*(i+m)];
s->fft_data[j+m].im = audio_data[2*(i+m)+1];
}
--
2.49.1
From 206195689a2ce3ce10a51a99c02a9a3ade502530 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 9 Aug 2025 11:38:07 +0200
Subject: [PATCH 359/434] avcodec/jpeg2000dec: Make sure the 4 extra bytes
allocated are initialized
Fixes: use of uninitialized memory
Fixes: 429130590/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5736930522497024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6fe3786cd8c06437756d407f727ff01cf1774ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/jpeg2000dec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 508013a7f1..6a86375e0c 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -1528,6 +1528,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,
bytestream2_get_bufferu(&s->g, cblk->data + cblk->length, cblk->lengthinc[cwsno]);
cblk->length += cblk->lengthinc[cwsno];
+ memset(cblk->data + cblk->length, 0, 4);
cblk->lengthinc[cwsno] = 0;
if (cblk->nb_terminationsinc) {
cblk->nb_terminationsinc--;
--
2.49.1
From e26028352bbb969e00f7060e97fe518d0de58bc7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 8 Aug 2025 15:03:56 +0200
Subject: [PATCH 360/434] avcodec/ilbcdec: Clear cbvec when used with
create_augmented_vector()
Fixes: use of uninitialized memory
Fixes: 42538134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9686fdd729a9caeeac0dc84dca2a65e4c9e5460b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/ilbcdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c
index 7fea39b43c..81b9a49f43 100644
--- a/libavcodec/ilbcdec.c
+++ b/libavcodec/ilbcdec.c
@@ -675,6 +675,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector *
/* get vector */
memcpy(cbvec, mem + lMem - k, cbveclen * 2);
} else if (index < base_size) {
+ memset(cbvec, 0, cbveclen * 2);
/* Calculate lag */
@@ -701,6 +702,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector *
filter_mafq12(&mem[memIndTest + 4], cbvec, kCbFiltersRev, CB_FILTERLEN, cbveclen);
} else {
+ memset(cbvec, 0, cbveclen * 2);
/* interpolated vectors */
/* Stuff zeros outside memory buffer */
memIndTest = lMem - cbveclen - CB_FILTERLEN;
--
2.49.1
From d5fc57fb795044d16c5d0cc3a13fc92ad9293eff Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 8 Aug 2025 23:19:03 +0200
Subject: [PATCH 361/434] avcodec/scpr3: Clear clr
clr is passing into decode_run_p() its not used when not set
but this possibly triggers msan (it doesnt locally)
Fixes?: use of uninintialized memory
Fixes?: 436997807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-6253316466606080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 354226037646d44701f0f2a84749fb2ea303f043)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/scpr3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/scpr3.c b/libavcodec/scpr3.c
index e91c198308..369d2653c2 100644
--- a/libavcodec/scpr3.c
+++ b/libavcodec/scpr3.c
@@ -1167,7 +1167,7 @@ static int decompress_p3(AVCodecContext *avctx,
}
} else {
int run, bx = x * 16 + sx1, by = y * 16 + sy1;
- uint32_t clr, ptype = 0, r, g, b;
+ uint32_t clr = 0, ptype = 0, r, g, b;
if (bx >= avctx->width)
return AVERROR_INVALIDDATA;
--
2.49.1
From d370b868bc62d52baf9e4fbb9ac3882ea922823d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Sat, 9 Aug 2025 16:49:17 +0200
Subject: [PATCH 362/434] avformat/lrcdec: limit input timestamp range to avoid
overflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: clusterfuzz-testcase-ffmpeg_dem_LRC_fuzzer-5226140131459072
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c74bc74398e7a1e235fdf51d0dd2dfb942626c82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/lrcdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/lrcdec.c b/libavformat/lrcdec.c
index 7941c02c5d..e3e091a61a 100644
--- a/libavformat/lrcdec.c
+++ b/libavformat/lrcdec.c
@@ -78,7 +78,7 @@ static int64_t count_ts(const char *p)
static int64_t read_ts(const char *p, int64_t *start)
{
int64_t offset = 0;
- uint64_t mm;
+ uint32_t mm;
double ss;
char prefix[3];
@@ -88,8 +88,8 @@ static int64_t read_ts(const char *p, int64_t *start)
if(p[offset] != '[') {
return 0;
}
- int ret = sscanf(p, "%2[[-]%"SCNu64":%lf]", prefix, &mm, &ss);
- if (ret != 3 || prefix[0] != '[') {
+ int ret = sscanf(p, "%2[[-]%"SCNu32":%lf]", prefix, &mm, &ss);
+ if (ret != 3 || prefix[0] != '[' || ss < 0 || ss > 60) {
return 0;
}
*start = (mm * 60 + ss) * AV_TIME_BASE;
--
2.49.1
From fb36a0027f8176ea44295811245eeb17ea757fdd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Sat, 9 Aug 2025 17:09:57 +0200
Subject: [PATCH 363/434] avcodec/g726: init missing sample rate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: 416134551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_G726_DEC_fuzzer-5695764455292928
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c2f7dae70d27a8f5ca1e3fa43d96ff5c8bf032fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/g726.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/g726.c b/libavcodec/g726.c
index e048cd973e..b1be487f77 100644
--- a/libavcodec/g726.c
+++ b/libavcodec/g726.c
@@ -457,6 +457,8 @@ static av_cold int g726_decode_init(AVCodecContext *avctx)
g726_reset(c);
avctx->sample_fmt = AV_SAMPLE_FMT_S16;
+ if (!avctx->sample_rate)
+ avctx->sample_rate = 8000;
return 0;
}
--
2.49.1
From f505332928cd2a60ff49d5de981d2a0e08f5f53f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Sat, 9 Aug 2025 17:15:51 +0200
Subject: [PATCH 364/434] avcodec/libvorbisdec: avoid overflow when assinging
sample rate from long to int
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: 416134551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_DEC_fuzzer-6096101407260672
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 2287a19abbd80d25b411a3028969c55c4b0b8c88)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/libvorbisdec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/libvorbisdec.c b/libavcodec/libvorbisdec.c
index a5e7a691d6..eb80ecf67d 100644
--- a/libavcodec/libvorbisdec.c
+++ b/libavcodec/libvorbisdec.c
@@ -113,6 +113,12 @@ static int oggvorbis_decode_init(AVCodecContext *avccontext) {
}
}
+ if (context->vi.rate <= 0 || context->vi.rate > INT_MAX) {
+ av_log(avccontext, AV_LOG_ERROR, "vorbis rate is invalid\n");
+ ret = AVERROR_INVALIDDATA;
+ goto error;
+ }
+
av_channel_layout_uninit(&avccontext->ch_layout);
avccontext->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
avccontext->ch_layout.nb_channels = context->vi.channels;
--
2.49.1
From dabc5ee6624e9f6d47e5200f1d84eaa68a1c8976 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
Date: Sun, 3 Aug 2025 16:46:10 +0200
Subject: [PATCH 365/434] avcodec/d3d12va_encode: fix label followed by a
declaration warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: d3d12va_encode.c: warning: label followed by a declaration is a
C23 extension
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit ac6db22e372460f3462d16eacdf9b7611cc3c0af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/d3d12va_encode.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/libavcodec/d3d12va_encode.c b/libavcodec/d3d12va_encode.c
index 68fb9927a8..897544fe10 100644
--- a/libavcodec/d3d12va_encode.c
+++ b/libavcodec/d3d12va_encode.c
@@ -974,8 +974,7 @@ rc_mode_found:
case RC_MODE_CQP:
// cqp ConfigParams will be updated in ctx->codec->configure.
break;
-
- case RC_MODE_CBR:
+ case RC_MODE_CBR: {
D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR *cbr_ctl;
ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_CBR);
@@ -996,8 +995,8 @@ rc_mode_found:
ctx->rc.ConfigParams.pConfiguration_CBR = cbr_ctl;
break;
-
- case RC_MODE_VBR:
+ }
+ case RC_MODE_VBR: {
D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR *vbr_ctl;
ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_VBR);
@@ -1019,8 +1018,8 @@ rc_mode_found:
ctx->rc.ConfigParams.pConfiguration_VBR = vbr_ctl;
break;
-
- case RC_MODE_QVBR:
+ }
+ case RC_MODE_QVBR: {
D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR *qvbr_ctl;
ctx->rc.ConfigParams.DataSize = sizeof(D3D12_VIDEO_ENCODER_RATE_CONTROL_QVBR);
@@ -1040,7 +1039,7 @@ rc_mode_found:
ctx->rc.ConfigParams.pConfiguration_QVBR = qvbr_ctl;
break;
-
+ }
default:
break;
}
--
2.49.1
From a9ec8317498b62192cc3df95ef2523eae8ec0294 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 9 Aug 2025 14:05:19 +0200
Subject: [PATCH 366/434] avcodec/exr: Check for pixel type consistency in DWA
Fixes: out of array access
Fixes: BIGSLEEP-436511754/testcase.exr
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0469d68acb52081ca8385b844b9650398242be0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 8d64ad3dec..20b2cfdc7e 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -2065,6 +2065,16 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
for (int i = 0; i < 4; i++)
s->channel_offsets[i] *= 2;
}
+ if (s->compression == EXR_DWAA ||
+ s->compression == EXR_DWAB) {
+ for (int i = 0; i<s->nb_channels; i++) {
+ EXRChannel *channel = &s->channels[i];
+ if (channel->pixel_type != s->pixel_type) {
+ avpriv_request_sample(s->avctx, "mixed pixel type DWA");
+ return AVERROR_PATCHWELCOME;
+ }
+ }
+ }
switch (s->pixel_type) {
case EXR_FLOAT:
--
2.49.1
From eebf2b2c3f9dff1fd6c4baaebc47f88e23ec56fe Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 8 Aug 2025 12:25:55 +0200
Subject: [PATCH 367/434] avcodec/dxv: Check that we initialize op_data
Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a8c41dcacbba011e553fbf35518577321d1aadb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index ba23222727..1cee57bc08 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -274,7 +274,9 @@ static int dxv_decompress_opcodes(GetByteContext *gb, void *dstp, size_t op_size
if ((flag & 3) == 0) {
bytestream2_skip(gb, 1);
- bytestream2_get_buffer(gb, dstp, op_size);
+ int read_size = bytestream2_get_buffer(gb, dstp, op_size);
+ if (read_size != op_size)
+ return AVERROR_INVALIDDATA;
} else if ((flag & 3) == 1) {
bytestream2_skip(gb, 1);
memset(dstp, bytestream2_get_byte(gb), op_size);
--
2.49.1
From 9397aec69f35bdad0676ce8770e251e7ac97eebf Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 8 Aug 2025 12:25:55 +0200
Subject: [PATCH 368/434] avcodec/dxv: Clear ctex
same issue as with tex
Fixes: 431665305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5339599339847680
Fixes: use of uninitialized memory
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e5f25c0a50ac17e20ddc3549dbff0976a5826b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 1cee57bc08..3af5321e93 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -39,6 +39,7 @@ typedef struct DXVContext {
uint8_t *tex_data; // Compressed texture
uint8_t *ctex_data; // Compressed chroma texture
+ unsigned ctex_data_size;
int64_t tex_size; // Texture size
int64_t ctex_size; // Chroma texture size
@@ -987,9 +988,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32;
ctx->op_size[3] = avctx->coded_width * avctx->coded_height / 16;
- ret = av_reallocp(&ctx->ctex_data, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
- if (ret < 0)
- return ret;
+ old_size = ctx->ctex_data_size;
+ ptr = av_fast_realloc(ctx->ctex_data, &ctx->ctex_data_size, ctx->ctex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->ctex_data = ptr;
+ if (old_size < ctx->ctex_data_size)
+ memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
+
for (i = 0; i < 4; i++) {
ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
if (ret < 0)
@@ -1081,6 +1087,8 @@ static int dxv_close(AVCodecContext *avctx)
av_freep(&ctx->tex_data);
av_freep(&ctx->ctex_data);
+ ctx->ctex_data_size = 0;
+
av_freep(&ctx->op_data[0]);
av_freep(&ctx->op_data[1]);
av_freep(&ctx->op_data[2]);
--
2.49.1
From 5a1ba3e7913b5016c27646994277db0eeaa22d14 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 7 Aug 2025 19:56:53 +0200
Subject: [PATCH 369/434] avcodec/dxv: Use av_fast_realloc() and clear all new
space
The code writing in the buffer has a wide range of error checks
which simply leave it partly uninitialized.
Initializing it on allocation ensures no sensitive data leaks and that
bugs are more reliably reproduceable
Fixes: use of uninitialized memory
Fixes: 435225510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-4521918634196992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a0b793737ec1a118d2119a677fa17926def01bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 3af5321e93..968ab8f1f8 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -38,6 +38,7 @@ typedef struct DXVContext {
GetByteContext gbc;
uint8_t *tex_data; // Compressed texture
+ unsigned tex_data_size;
uint8_t *ctex_data; // Compressed chroma texture
unsigned ctex_data_size;
@@ -972,9 +973,14 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) *
avctx->coded_height / TEXTURE_BLOCK_H *
texdsp_ctx.tex_ratio;
- ret = av_reallocp(&ctx->tex_data, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
- if (ret < 0)
- return ret;
+ unsigned old_size = ctx->tex_data_size;
+ void *ptr = av_fast_realloc(ctx->tex_data, &ctx->tex_data_size, ctx->tex_size + AV_INPUT_BUFFER_PADDING_SIZE);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->tex_data = ptr;
+
+ if (ctx->tex_data_size > old_size)
+ memset(ctx->tex_data + old_size, 0, ctx->tex_data_size - old_size);
if (avctx->pix_fmt != AV_PIX_FMT_RGBA) {
int i;
@@ -1086,6 +1092,8 @@ static int dxv_close(AVCodecContext *avctx)
DXVContext *ctx = avctx->priv_data;
av_freep(&ctx->tex_data);
+ ctx->tex_data_size = 0;
+
av_freep(&ctx->ctex_data);
ctx->ctex_data_size = 0;
--
2.49.1
From 3fc37d4999d5e227086d971600c89947b781c8c4 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 8 Aug 2025 12:43:46 +0200
Subject: [PATCH 370/434] avcodec/dxv: Use av_fast_realloc() for op_data
makes things consistent
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 373bd80b16643e349d229e2479fad565dba129a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 968ab8f1f8..44db215131 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -46,6 +46,7 @@ typedef struct DXVContext {
int64_t ctex_size; // Chroma texture size
uint8_t *op_data[4]; // Opcodes
+ unsigned op_data_size[4];
int64_t op_size[4]; // Opcodes size
} DXVContext;
@@ -1003,9 +1004,11 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
memset(ctx->ctex_data + old_size, 0, ctx->ctex_data_size - old_size);
for (i = 0; i < 4; i++) {
- ret = av_reallocp(&ctx->op_data[i], ctx->op_size[i]);
- if (ret < 0)
- return ret;
+ old_size = ctx->op_data_size[i];
+ ptr = av_fast_realloc(ctx->op_data[i], &ctx->op_data_size[i], ctx->op_size[i]);
+ if (!ptr)
+ return AVERROR(ENOMEM);
+ ctx->op_data[i] = ptr;
}
}
@@ -1101,6 +1104,7 @@ static int dxv_close(AVCodecContext *avctx)
av_freep(&ctx->op_data[1]);
av_freep(&ctx->op_data[2]);
av_freep(&ctx->op_data[3]);
+ memset(ctx->op_data_size, 0, sizeof(ctx->op_data_size));
return 0;
}
--
2.49.1
From 729dd9b2865bedd6a8160ef574db0d391c491bee Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Thu, 7 Aug 2025 14:50:10 +0000
Subject: [PATCH 371/434] libavfilter/dnn/dnn_backend_tf: Remove redundant
av_freep() to avoid double free
Remove redundant av_freep() to avoid double free since task will be freed in dnn_free_model_tf() after the success of ff_queue_push_back().
Fixes: af052f9066 ("lavfi/dnn: fix mem leak in TF backend error handle")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
(cherry picked from commit b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/dnn/dnn_backend_tf.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index 6ca7fb6910..2c33691f96 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -833,14 +833,12 @@ static int dnn_execute_model_tf(const DNNModel *model, DNNExecBaseParams *exec_p
ret = extract_lltask_from_task(task, tf_model->lltask_queue);
if (ret != 0) {
- av_freep(&task);
av_log(ctx, AV_LOG_ERROR, "unable to extract last level task from task.\n");
return ret;
}
request = ff_safe_queue_pop_front(tf_model->request_queue);
if (!request) {
- av_freep(&task);
av_log(ctx, AV_LOG_ERROR, "unable to get infer request.\n");
return AVERROR(EINVAL);
}
--
2.49.1
From 02c9280e629a7fe459a2196c0990297f3995cc58 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 13 Aug 2025 00:59:20 +0200
Subject: [PATCH 372/434] fftools/ffmpeg_mux_init: Use 64bit for score
computation in map_auto_video()
Fixes: signed integer overflow: 10 * 1952737655 cannot be represented in type 'int'
Fixes: PoC_avi_demux
Found-by: 2ourc3 (Salim LARGO)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cdbb5f1b93352f9e7eceb1562ad283a78b546091)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
fftools/ffmpeg_mux_init.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
index 8afb018de8..2a014c8b94 100644
--- a/fftools/ffmpeg_mux_init.c
+++ b/fftools/ffmpeg_mux_init.c
@@ -1557,7 +1557,7 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
{
AVFormatContext *oc = mux->fc;
InputStream *best_ist = NULL;
- int best_score = 0;
+ int64_t best_score = 0;
int qcr;
/* video: highest resolution */
@@ -1568,16 +1568,16 @@ static int map_auto_video(Muxer *mux, const OptionsContext *o)
for (int j = 0; j < nb_input_files; j++) {
InputFile *ifile = input_files[j];
InputStream *file_best_ist = NULL;
- int file_best_score = 0;
+ int64_t file_best_score = 0;
for (int i = 0; i < ifile->nb_streams; i++) {
InputStream *ist = ifile->streams[i];
- int score;
+ int64_t score;
if (ist->user_set_discard == AVDISCARD_ALL ||
ist->st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
continue;
- score = ist->st->codecpar->width * ist->st->codecpar->height
+ score = ist->st->codecpar->width * (int64_t)ist->st->codecpar->height
+ 100000000 * !!(ist->st->event_flags & AVSTREAM_EVENT_FLAG_NEW_PACKETS)
+ 5000000*!!(ist->st->disposition & AV_DISPOSITION_DEFAULT);
if((qcr!=MKTAG('A', 'P', 'I', 'C')) && (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC))
--
2.49.1
From 5cd1f52f68759ddc71fa784242b799430bbb1eff Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 15 Aug 2025 17:55:05 +0200
Subject: [PATCH 373/434] avcodec/utvideodec: Clear plane_start array
in pack mode the array is passed into decode_plane() without being initialized or used
Fixes: use of uninitialized memory
Fixes: 438780119/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5464037027807232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a22972db3b390d82dedbdbb5f44cc09a43912b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/utvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index 934945c1be..bc02ac44d5 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -585,7 +585,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
int buf_size = avpkt->size;
UtvideoContext *c = avctx->priv_data;
int i, j;
- const uint8_t *plane_start[5];
+ const uint8_t *plane_start[5] = {NULL};
int plane_size, max_slice_size = 0, slice_start, slice_end, slice_size;
int ret;
GetByteContext gb;
--
2.49.1
From 5c11cf98abdd728037553995bbf401d858b40aeb Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 17 Aug 2025 15:31:48 +0200
Subject: [PATCH 374/434] avcodec/sanm: Check w,h,left,top
The setup code fow w,h,left,top is complex, the code using it also falls in
at least 2 different classes, one using left/top the other not.
To ensure no out of array access happens we add this clear check.
Fixes: out of array access
Fixes: 439261995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5383455572819968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 134fbfd1dcb59441e38d870ddd231772f4e8e127)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/sanm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 8b7c0d9556..abd7981ac6 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -974,6 +974,11 @@ static int process_frame_obj(SANMVideoContext *ctx)
}
bytestream2_skip(&ctx->gb, 4);
+ if (w + FFMAX(left, 0) > ctx->avctx->width || h + FFMAX(top, 0) > ctx->avctx->height) {
+ avpriv_request_sample(ctx->avctx, "overly large frame\n");
+ return AVERROR_PATCHWELCOME;
+ }
+
switch (codec) {
case 1:
case 3:
--
2.49.1
From 32e940a6227b1fb7623643bcaf3b58ad9f5b0704 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 18 Aug 2025 17:20:49 +0200
Subject: [PATCH 375/434] avformat/lrcdec: Fix fate-sub-lrc-ms-remux on x86-32
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0243cf89b137b093b02a5c61a76e28cec1d69ae9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/lrcdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/lrcdec.c b/libavformat/lrcdec.c
index e3e091a61a..f4a879954e 100644
--- a/libavformat/lrcdec.c
+++ b/libavformat/lrcdec.c
@@ -92,7 +92,7 @@ static int64_t read_ts(const char *p, int64_t *start)
if (ret != 3 || prefix[0] != '[' || ss < 0 || ss > 60) {
return 0;
}
- *start = (mm * 60 + ss) * AV_TIME_BASE;
+ *start = llrint((mm * 60 + ss) * AV_TIME_BASE);
if (prefix[1] == '-') {
*start = - *start;
}
--
2.49.1
From 10c774906cdbb1e695f7b17791fae759396f65e9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 13 Aug 2025 13:11:23 +0200
Subject: [PATCH 376/434] avcodec/aac/aacdec: dont allow
ff_aac_output_configure() allocating a new frame if it has no frame
Fixes: null pointer dereference
Fixes: crash_test.mp4
Found-by: Intel PSIRT
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 39edf73fb7..4920f5e77f 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -466,6 +466,9 @@ int ff_aac_output_configure(AACDecContext *ac,
uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
uint8_t type_counts[TYPE_END] = { 0 };
+ if (get_new_frame && !ac->frame)
+ return AVERROR_INVALIDDATA;
+
if (ac->oc[1].layout_map != layout_map) {
memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
ac->oc[1].layout_map_tags = tags;
--
2.49.1
From 30563350ddcbd793ce323b555f1db3c725dd6c30 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 19 Aug 2025 03:12:37 +0200
Subject: [PATCH 377/434] avcodec/dxv: Check coded_height, to avoid invalid
av_clip()
Fixes: assertion failure
Fixes: 438961582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5850827739955200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cdee519d40e61bd65ba5b3fbec00acd50a08d0d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 44db215131..f4a6f382a9 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -940,6 +940,8 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame *frame,
}
break;
}
+ if (avctx->coded_height / 2 / TEXTURE_BLOCK_H < 1)
+ return AVERROR_INVALIDDATA;
texdsp_ctx.slice_count = av_clip(avctx->thread_count, 1,
avctx->coded_height / TEXTURE_BLOCK_H);
--
2.49.1
From 8e1a0c72dff2bce1edd852d40297037a3ac67abc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 19 Aug 2025 03:09:14 +0200
Subject: [PATCH 378/434] avcode: Use av_fast_realloc() in ff_lzf_uncompress()
Fixes: 438961582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer-5850827739955200
Fixes: mixed up realloc() functions
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Co-Authored-by: James Almer <jamrial@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0a5046c09996262d0f8b1802a4b34816f72fff06)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dxv.c | 4 ++--
libavcodec/lzf.c | 23 ++++++++++++++++++-----
libavcodec/lzf.h | 2 +-
libavcodec/notchlc.c | 5 +++--
4 files changed, 24 insertions(+), 10 deletions(-)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index f4a6f382a9..70497b7d97 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -42,7 +42,7 @@ typedef struct DXVContext {
uint8_t *ctex_data; // Compressed chroma texture
unsigned ctex_data_size;
- int64_t tex_size; // Texture size
+ size_t tex_size; // Texture size
int64_t ctex_size; // Chroma texture size
uint8_t *op_data[4]; // Opcodes
@@ -828,7 +828,7 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx)
static int dxv_decompress_lzf(AVCodecContext *avctx)
{
DXVContext *ctx = avctx->priv_data;
- return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size);
+ return ff_lzf_uncompress(&ctx->gbc, &ctx->tex_data, &ctx->tex_size, &ctx->tex_data_size);
}
static int dxv_decompress_raw(AVCodecContext *avctx)
diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 94b369dd59..8f223b1f42 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -37,7 +37,22 @@
#define LZF_LITERAL_MAX (1 << 5)
#define LZF_LONG_BACKREF 7 + 2
-int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
+
+static inline int lzf_realloc(uint8_t **buf, size_t *size, int addition, unsigned *allocated_size)
+{
+ void *ptr = av_fast_realloc(*buf, allocated_size, *size + addition);
+
+ if (!ptr) {
+ av_freep(buf); //probably not needed
+ return AVERROR(ENOMEM);
+ }
+ *buf = ptr;
+ *size += addition;
+
+ return 0;
+}
+
+int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size)
{
int ret = 0;
uint8_t *p = *buf;
@@ -49,8 +64,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
if (s < LZF_LITERAL_MAX) {
s++;
if (s > *size - len) {
- *size += s + *size /2;
- ret = av_reallocp(buf, *size);
+ ret = lzf_realloc(buf, size, s, allocated_size);
if (ret < 0)
return ret;
p = *buf + len;
@@ -75,8 +89,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
return AVERROR_INVALIDDATA;
if (l > *size - len) {
- *size += l + *size / 2;
- ret = av_reallocp(buf, *size);
+ ret = lzf_realloc(buf, size, l, allocated_size);
if (ret < 0)
return ret;
p = *buf + len;
diff --git a/libavcodec/lzf.h b/libavcodec/lzf.h
index 0ad73d9f79..e61ebff727 100644
--- a/libavcodec/lzf.h
+++ b/libavcodec/lzf.h
@@ -24,6 +24,6 @@
#include "bytestream.h"
-int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size);
+int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, size_t *size, unsigned *allocated_size);
#endif /* AVCODEC_LZF_H */
diff --git a/libavcodec/notchlc.c b/libavcodec/notchlc.c
index 246a3e0174..d99de1810e 100644
--- a/libavcodec/notchlc.c
+++ b/libavcodec/notchlc.c
@@ -40,7 +40,8 @@ typedef struct NotchLCContext {
unsigned uncompressed_size;
uint8_t *lzf_buffer;
- int64_t lzf_size;
+ size_t lzf_size;
+ unsigned lzf_alloc_size;
unsigned texture_size_x;
unsigned texture_size_y;
@@ -490,7 +491,7 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
return AVERROR_PATCHWELCOME;
if (s->format == 0) {
- ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size);
+ ret = ff_lzf_uncompress(gb, &s->lzf_buffer, &s->lzf_size, &s->lzf_alloc_size);
if (ret < 0)
return ret;
--
2.49.1
From 274064a5c740afd80aebfe461e6222ddbec2a13a Mon Sep 17 00:00:00 2001
From: Lynne <dev@lynne.ee>
Date: Mon, 11 Aug 2025 22:26:35 +0900
Subject: [PATCH 379/434] aacdec_usac: use RefStruct to track unfinished
extension buffers
Extensions in AAC USAC can be stored across multiple frames (mainly to keep CBR compliance).
This means that we need to reallocate a buffer when new data is received, accumulate the bitstream data,
and so on until the end of extension flag is signalled and the extension can be decoded.
This is made more complicated by the way in which the AAC channel layout switching is performed.
After decades of evolution, our AAC decoder evolved to double-buffer its entire configuration.
All changes are buffered, verified, and applied, on a per-frame basis if required, in often
random order.
Since we allocate the extension data on heap, this means that if configuration is applied,
in order to avoid double-freeing, we have to keep track of what we've allocated.
It should be noted that extensions which are spread in multiple frames are generally rare,
so an optimization to introduce av_refstruct_realloc() wouldn't generally be useful across the codebase.
Therefore, a copy is good enough for now.
Thanks to Michael Niedermayer for additional fixing.
Fixes: double free
Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit c05fc27dd33b361eb0105157ab7d3a01c2ffa782)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aac/aacdec.c | 28 +++++++++++++++++++++++++---
libavcodec/aac/aacdec.h | 4 ++--
libavcodec/aac/aacdec_usac.c | 32 ++++++++++++++++++++------------
3 files changed, 47 insertions(+), 17 deletions(-)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 4920f5e77f..325e52834f 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -62,6 +62,7 @@
#include "libavutil/opt.h"
#include "libavutil/tx.h"
#include "libavutil/version.h"
+#include "libavcodec/refstruct.h"
/*
* supported tools
@@ -421,6 +422,26 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
return layout;
}
+static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src)
+{
+ int i;
+
+ for (i = 0; i < src->usac.nb_elems; i++) {
+ AACUsacElemConfig *src_e = &src->usac.elems[i];
+ AACUsacElemConfig *dst_e = &dst->usac.elems[i];
+ /* dst_e->ext.pl_buf is guaranteed to be set to src_e->ext.pl_buf
+ * upon this function's return */
+ ff_refstruct_replace(&dst_e->ext.pl_buf, src_e->ext.pl_buf);
+ }
+
+ /* Unref all additional buffers to close leaks */
+ for (; i < dst->usac.nb_elems; i++)
+ ff_refstruct_unref(&dst->usac.elems[i].ext.pl_buf);
+
+ /* Set all other properties */
+ *dst = *src;
+}
+
/**
* Save current output configuration if and only if it has been locked.
*/
@@ -429,7 +450,7 @@ static int push_output_configuration(AACDecContext *ac)
int pushed = 0;
if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
- ac->oc[0] = ac->oc[1];
+ copy_oc(&ac->oc[0], &ac->oc[1]);
pushed = 1;
}
ac->oc[1].status = OC_NONE;
@@ -443,7 +464,8 @@ static int push_output_configuration(AACDecContext *ac)
static void pop_output_configuration(AACDecContext *ac)
{
if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) {
- ac->oc[1] = ac->oc[0];
+ copy_oc(&ac->oc[1], &ac->oc[0]);
+
ac->avctx->ch_layout = ac->oc[1].ch_layout;
ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,
ac->oc[1].status, 0);
@@ -1110,7 +1132,7 @@ static av_cold int decode_close(AVCodecContext *avctx)
AACUSACConfig *usac = &oc->usac;
for (int j = 0; j < usac->nb_elems; j++) {
AACUsacElemConfig *ec = &usac->elems[j];
- av_freep(&ec->ext.pl_data);
+ ff_refstruct_unref(&ec->ext.pl_buf);
}
}
diff --git a/libavcodec/aac/aacdec.h b/libavcodec/aac/aacdec.h
index e5a79a7139..b3763fdccc 100644
--- a/libavcodec/aac/aacdec.h
+++ b/libavcodec/aac/aacdec.h
@@ -344,7 +344,7 @@ typedef struct AACUsacElemConfig {
uint8_t payload_frag;
uint32_t default_len;
uint32_t pl_data_offset;
- uint8_t *pl_data;
+ uint8_t *pl_buf;
} ext;
} AACUsacElemConfig;
@@ -353,7 +353,7 @@ typedef struct AACUSACConfig {
uint16_t core_frame_len;
uint16_t stream_identifier;
- AACUsacElemConfig elems[64];
+ AACUsacElemConfig elems[MAX_ELEM_ID];
int nb_elems;
struct {
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index 3e5d31676c..6612523043 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -24,12 +24,13 @@
#include "aacdec_ac.h"
#include "libavcodec/aacsbr.h"
-
#include "libavcodec/aactab.h"
-#include "libavutil/mem.h"
#include "libavcodec/mpeg4audio.h"
#include "libavcodec/unary.h"
+#include "libavutil/mem.h"
+#include "libavcodec/refstruct.h"
+
/* Number of scalefactor bands per complex prediction band, equal to 2. */
#define SFB_PER_PRED_BAND 2
@@ -1574,7 +1575,6 @@ static int parse_audio_preroll(AACDecContext *ac, GetBitContext *gb)
static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
GetBitContext *gb)
{
- uint8_t *tmp;
uint8_t pl_frag_start = 1;
uint8_t pl_frag_end = 1;
uint32_t len;
@@ -1601,18 +1601,26 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
if (pl_frag_start)
e->ext.pl_data_offset = 0;
- /* If an extension starts and ends this packet, we can directly use it */
+ /* If an extension starts and ends this packet, we can directly use it below.
+ * Otherwise, we have to copy it to a buffer and accumulate it. */
if (!(pl_frag_start && pl_frag_end)) {
- tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len);
- if (!tmp) {
- av_free(e->ext.pl_data);
+ /* Reallocate the data */
+ uint8_t *tmp_buf = ff_refstruct_alloc_ext(e->ext.pl_data_offset + len,
+ FF_REFSTRUCT_FLAG_NO_ZEROING,
+ NULL, NULL);
+ if (!tmp_buf)
return AVERROR(ENOMEM);
- }
- e->ext.pl_data = tmp;
+
+ /* Copy the data over only if we had saved data to begin with */
+ if (e->ext.pl_buf)
+ memcpy(tmp_buf, e->ext.pl_buf, e->ext.pl_data_offset);
+
+ ff_refstruct_unref(&e->ext.pl_buf);
+ e->ext.pl_buf = tmp_buf;
/* Readout data to a buffer */
for (int i = 0; i < len; i++)
- e->ext.pl_data[e->ext.pl_data_offset + i] = get_bits(gb, 8);
+ e->ext.pl_buf[e->ext.pl_data_offset + i] = get_bits(gb, 8);
}
e->ext.pl_data_offset += len;
@@ -1624,7 +1632,7 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
GetBitContext *gb2 = gb;
GetBitContext gbc;
if (!(pl_frag_start && pl_frag_end)) {
- ret = init_get_bits8(&gbc, e->ext.pl_data, pl_len);
+ ret = init_get_bits8(&gbc, e->ext.pl_buf, pl_len);
if (ret < 0)
return ret;
@@ -1642,7 +1650,7 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e,
/* This should never happen */
av_assert0(0);
}
- av_freep(&e->ext.pl_data);
+ ff_refstruct_unref(&e->ext.pl_buf);
if (ret < 0)
return ret;
--
2.49.1
From 84bcf54e92d10982e8635fd6818c5bac49d83410 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 9 Sep 2025 01:43:59 +0200
Subject: [PATCH 380/434] Update for 7.1.2
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 147 +++++++++++++++++++++++++++++++++++++++++++++++++++
RELEASE | 2 +-
doc/Doxyfile | 2 +-
3 files changed, 149 insertions(+), 2 deletions(-)
diff --git a/Changelog b/Changelog
index 4b35e446cd..54e8b46fc2 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,153 @@
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
+version 7.1.2:
+ aacdec_usac: use RefStruct to track unfinished extension buffers
+ avcode: Use av_fast_realloc() in ff_lzf_uncompress()
+ avcodec/dxv: Check coded_height, to avoid invalid av_clip()
+ avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame
+ avformat/lrcdec: Fix fate-sub-lrc-ms-remux on x86-32
+ avcodec/sanm: Check w,h,left,top
+ avcodec/utvideodec: Clear plane_start array
+ fftools/ffmpeg_mux_init: Use 64bit for score computation in map_auto_video()
+ libavfilter/dnn/dnn_backend_tf: Remove redundant av_freep() to avoid double free
+ avcodec/dxv: Use av_fast_realloc() for op_data
+ avcodec/dxv: Use av_fast_realloc() and clear all new space
+ avcodec/dxv: Clear ctex
+ avcodec/dxv: Check that we initialize op_data
+ avcodec/exr: Check for pixel type consistency in DWA
+ avcodec/d3d12va_encode: fix label followed by a declaration warning
+ avcodec/libvorbisdec: avoid overflow when assinging sample rate from long to int
+ avcodec/g726: init missing sample rate
+ avformat/lrcdec: limit input timestamp range to avoid overflows
+ avcodec/scpr3: Clear clr
+ avcodec/ilbcdec: Clear cbvec when used with create_augmented_vector()
+ avcodec/jpeg2000dec: Make sure the 4 extra bytes allocated are initialized
+ avfilter/avf_showcqt: fix unbounded index when copying to fft_data
+ avcodec/aac/aacdec_usac: Limit sfo from noise offset to be above -200
+ avcodec/aacsbr_template: Check ilb
+ avcodec/utvideodec: Set B for the width= 1 case
+ avcodec/ffv1: Clear state on alloc
+ avcodec/jpeg2000dec: implement cdef remapping during pixel format matching
+ avcodec/jpeg2000dec: move cdef default check into get_siz()
+ avcodec/exr: Check rle_raw_data and surroundings
+ avcodec/exr: Dont access outside xsize/ysize
+ examples: Add check and replace av_free() to avoid potential memory errors
+ libavcodec/tests/snowenc: Add av_free() to avoid memory leak
+ libavfilter/af_firequalizer: Add check for av_malloc_array()
+ libavcodec/videotoolbox_vp9: Move av_malloc() to avoid memory leak
+ avcodec/mpc8: init avctx->sample_rate
+ avcodec/cbs_h266_syntax_template: fix out of bounds access
+ avformat/libopenmpt: fix seeking weirdness
+ avformat/hls: add cmfv/cmfa exceptions
+ avformat/lrcdec: support arbitrary precision timestamp
+ libavcodec/tests/motion: Add check for avcodec_alloc_context3()
+ avcodec/tests/avpacket: Add av_free() to avoid memory leak
+ examples: Add av_freep to avoid potential memory leak
+ avcodec/tests/avpacket: Add av_packet_free() to avoid memory leak
+ avcodec/fits: Clear naxis
+ avcodec/vqavideo; Check bytestream2_get_buffer() reading next_codebook_buffer
+ avcodec/lzf: Check for input space
+ avcodec/imc: Clear padding of buf16
+ avcodec/iff: Clear ham_buf
+ avcodec/cri: Check bytestream2_get_buffer() for end
+ avcodec/cri: Factor read_len out
+ avformat/dashdec: Allocate space for appended "/"
+ avcodec/mpegvideo_dec: Fix lowres=3 field select interlaced mpeg4 frame
+ avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
+ avcodec/shorten: Clear the additionally allocated space on realloc
+ avformat/vqf: Ensure that comm_chunk is fully read
+ avformat/mov: make sure file_checksum is fully initialized
+ avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation
+ avformat/asfdec_f: Check amount of value read
+ avcodec/jpegxl_parser: add sanity check for frame size
+ avcodec/ffv1dec: don't check chroma_planes for f->colorspace > 0
+ avcodec/ffv1dec: don't add offsets to more NULL pointers
+ avformat/concatdec: Clip duration in one more case in get_best_effort_duration()
+ avcodec/ffv1dec: Check k in get_vlc_symbol()
+ avcodec/cfhd: Check idwt_buf size before allocation
+ avcodec/ivi: Check luma/chroma mb_size
+ avfilter/vaf_spectrumsynth: don't use uninitialized variable as scale
+ avcodec/motion_est: don't add offsets to NULL pointers
+ swscale/swscale_unscaled: don't add offsets to NULL pointers
+ avcodec/ffv1dec: don't add offsets to NULL pointers
+ libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc()
+ avcodec/psd: Move frame allocation after RLE processing
+ avcodec/smacker: Move buffer allocation to later
+ fftools/cmdutils: don't try to load arguments from file if not needed
+ avcodec/opus: don't materialize buf pointer from null
+ avfilter/avfilter: fix forwarding EOF for simple API filters in filter_activate_default
+ avcodec/speexdec: consider differing frame sizes in remaining space check
+ lavc/vvc: Fix condition for using default scaling factor
+ avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()
+ avformat/iff: Check nb_channels == 0 in CHNL
+ avcodec/osq: Request a coding mode 2 sample
+ avcodec/osq: Switch back to av_ceil_log2()
+ avcodec/osq: Add note about update_stats() count
+ avcodec/osq: Fix signed integer overflow in update_stats()
+ avcodec/mss2dsp: use FF_PTR_ADD to add offsets to a pointer
+ avformat/movenc: fix writing reserved bits in EC3SpecificBox
+ avcodec/hevc/hevcdec: Check num_entry_point_offsets
+ avcodec/speexdec: Pass and check remaining packets to decode functions
+ swscale/swscale_unscaled: use 8 line alignment for planarCopyWrapper with dithering
+ aacenc_tns: clamp filter direction energy measurement
+ fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated
+ avformat/iamf_parse: prevent overreads in update_extradata
+ avformat/iamf_parse: increase PutBytes buffer when writing AAC extradata
+ avformat/matroskadec: check that channels fit in signed 32bit int
+ avcodec/takdec: Check remaining space for first predictors
+ avcodec/svq3: Check there are bits left before decompression
+ avcodec/sonic: Check num_taps
+ avformat/imf_cpl: fix indention after previous commit
+ avformat/imf_cpl: do not continue looping forever
+ avformat/mov: reject negative ELST durations
+ avformat/avidec: Ignore duplicate GAB2
+ MAINTAINERS: Add entry for samples-request
+ avcodec/h264_mb: Fix tmp_cr for arm
+ avcodec/vorbisdec: Dont treat overread as error
+ avcodec/hevc/ps: Fix dependant layer id check
+ avformat/iff: Check nb_channels == 0 in MHDR
+ tests/fate/filter-video: Fix dependancy for codecview
+ postproc/postprocess_template: fix dering with a 16x16 image
+ libpostproc: check minimum size
+ avformat/hls: Fix flash1.bogulus.cfd support
+ avformat/hls: Split allowed_segment_extensions off allowed_extensions
+ avformat/hls: Fix Youtube AAC
+ avformat/hls: add fmp4 to allowed_extensions
+ avformat/hls: Add ec3 to allowed_extensions
+ avformat/hls: Add cmfv and cmfa to allowed_extensions
+ postproc/postprocess_template: fix handling of first row of dering_C
+ postproc/postprocess_template: Fix reading uninitialized pixels in dering_C()
+ configure: Clearer documentation for "disable-safe-bitstream-reader"
+ avcodec/osq: avoid undefined negation
+ swscale/output: Fix integer overflow in yuv2gbrp_full_X_c()
+ avcodec/libtheora: fix setting keyframe_mask
+ doc: replace http/git by https urls
+ Revert "avformat/mpegts: update stream info when PMT ES stream_type changes"
+ avformat/matroska: Support JPEG2000 for demuxing
+ avformat/matroskadec: Fix VfW extradata size
+ configure: Use MSYSTEM_CARCH for default arch on msys2
+ avcodec/lcevcdec: don't try to write to output frames directly
+ avfilter/avfiltergraph: fix regression in picking channel layout
+ avformat/mpegts: update stream info when PMT ES stream_type changes
+ avcodec/libzvbi-teletextdec: change new lines to \n in ASS header
+ avformat/wavdec: increase requested probe score for codec probe
+ avcodec/h264_slice: insert LCEVC side data before get_buffer() call
+ avformat/hls: Fix get key file error
+ avcodec/bsf/h264_mp4toannexb: Fix mixed bitstream format
+ avformat/mov: Reduce seek when interleaved_read is disabled
+ avfilter/vf_setparams: Fix chroma_location being cleared
+ configure: Enable -fno-common for Darwin targets, avoid linker warnings
+ configure: Only try to use the -no_warn_duplicate_libraries flag on Darwin
+ configure: Silence Xcode warnings about duplicate libraries
+ avcodec/mediacodecdec_common: Workaround MTK broken crop implementation
+ avcodec/Makefile: include aom_film_grain.o file for h264_sei component
+ lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang v2
+ lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang
+ avcodec/libsvtav1: unbreak build with latest svtav1
+ fftools/ffmpeg_filter: also remove display matrix side data from buffered frames
+
+
version 7.1.1:
avformat/hls: Partially revert "reduce default max reload to 3"
avformat/mov: (v4) fix get_eia608_packet
diff --git a/RELEASE b/RELEASE
index 21c8c7b46b..a8a1887568 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-7.1.1
+7.1.2
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 16f3a78735..abae13898b 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
-PROJECT_NUMBER = 7.1.1
+PROJECT_NUMBER = 7.1.2
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
--
2.49.1
From 31ec50c8b33c5c99649ffc986b4e60c15a038080 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 10 Sep 2025 09:31:48 -0300
Subject: [PATCH 381/434] avcodec/mjpegdec: use ff_frame_new_side_data() to
export display matrix
Otherwise, the user requested priority of packet side data will be ignored.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/mjpegdec.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index ef4fc075b2..9438184ae5 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -2865,15 +2865,15 @@ the_end:
AVFrameSideData *sd = NULL;
if (orientation >= 2 && orientation <= 8) {
- int32_t *matrix;
-
- sd = av_frame_new_side_data(frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9);
- if (!sd) {
+ ret = ff_frame_new_side_data(avctx, frame, AV_FRAME_DATA_DISPLAYMATRIX, sizeof(int32_t) * 9, &sd);
+ if (ret < 0) {
av_log(avctx, AV_LOG_ERROR, "Could not allocate frame side data\n");
- return AVERROR(ENOMEM);
+ return ret;
}
+ }
- matrix = (int32_t *)sd->data;
+ if (sd) {
+ int32_t *matrix = (int32_t *)sd->data;
switch (orientation) {
case 2:
--
2.49.1
From 8def1608e402a8e08a0d8a34d30e4193c935ed66 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 18 Aug 2025 12:22:09 -0300
Subject: [PATCH 382/434] fftools/ffmpeg_demux: ensure the display_rotation
option is honored
If requested, it should have priotity over any coded value.
Fixes ticket #11649.
Signed-off-by: James Almer <jamrial@gmail.com>
---
fftools/ffmpeg_demux.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c
index d44dce1119..7d87422eee 100644
--- a/fftools/ffmpeg_demux.c
+++ b/fftools/ffmpeg_demux.c
@@ -67,6 +67,7 @@ typedef struct DemuxStream {
int reinit_filters;
int autorotate;
int apply_cropping;
+ int force_display_matrix;
int wrap_correction_done;
@@ -1168,6 +1169,7 @@ static int add_display_matrix_to_stream(const OptionsContext *o,
AVFormatContext *ctx, InputStream *ist)
{
AVStream *st = ist->st;
+ DemuxStream *ds = ds_from_ist(ist);
AVPacketSideData *sd;
double rotation = DBL_MAX;
int hflip = -1, vflip = -1;
@@ -1202,6 +1204,8 @@ static int add_display_matrix_to_stream(const OptionsContext *o,
hflip_set ? hflip : 0,
vflip_set ? vflip : 0);
+ ds->force_display_matrix = 1;
+
return 0;
}
@@ -1429,6 +1433,15 @@ static int ist_add(const OptionsContext *o, Demuxer *d, AVStream *st, AVDictiona
av_dict_set_int(&ds->decoder_opts, "apply_cropping",
ds->apply_cropping && ds->apply_cropping != CROP_CONTAINER, 0);
+ if (ds->force_display_matrix) {
+ char buf[32];
+ if (av_dict_get(ds->decoder_opts, "side_data_prefer_packet", NULL, 0))
+ buf[0] = ',';
+ else
+ buf[0] = '\0';
+ av_strlcat(buf, "displaymatrix", sizeof(buf));
+ av_dict_set(&ds->decoder_opts, "side_data_prefer_packet", buf, AV_DICT_APPEND);
+ }
/* Attached pics are sparse, therefore we would not want to delay their decoding
* till EOF. */
if (ist->st->disposition & AV_DISPOSITION_ATTACHED_PIC)
--
2.49.1
From 8627b7c7978268899373081d1d6965a142b794a7 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 10 Sep 2025 09:41:39 -0300
Subject: [PATCH 383/434] Changelog: update
Signed-off-by: James Almer <jamrial@gmail.com>
---
Changelog | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Changelog b/Changelog
index 54e8b46fc2..c64d281e24 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,8 @@ Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 7.1.2:
+ fftools/ffmpeg_demux: ensure the display_rotation option is honored
+ avcodec/mjpegdec: use ff_frame_new_side_data() to export display matrix
aacdec_usac: use RefStruct to track unfinished extension buffers
avcode: Use av_fast_realloc() in ff_lzf_uncompress()
avcodec/dxv: Check coded_height, to avoid invalid av_clip()
--
2.49.1
From dc2728474ea56cb52d9f9d7fd62504185149bd67 Mon Sep 17 00:00:00 2001
From: Patrick Wang <mail6543210@gmail.com>
Date: Fri, 29 Aug 2025 02:58:16 +0800
Subject: [PATCH 384/434] fftools/ffmpeg: fix gracefully shutdown
d119ae2fd82a494d9430ff4d4fc262961a68c598 removed the loop-breaking condition
received_sigterm.
Thus, signals no longer gracefully shutdown ffmpeg.
Fixes: #10834
Signed-off-by: Patrick Wang <mail6543210@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7173e982ec815dcf70999c8683c465b99ce249c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
fftools/ffmpeg.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fftools/ffmpeg.c b/fftools/ffmpeg.c
index 420ba3c6e4..99668ada18 100644
--- a/fftools/ffmpeg.c
+++ b/fftools/ffmpeg.c
@@ -789,8 +789,6 @@ static int check_keyboard_interaction(int64_t cur_time)
{
int i, key;
static int64_t last_time;
- if (received_nb_signals)
- return AVERROR_EXIT;
/* read_key() returns 0 on EOF */
if (cur_time - last_time >= 100000) {
key = read_key();
@@ -874,6 +872,9 @@ static int transcode(Scheduler *sch)
while (!sch_wait(sch, stats_period, &transcode_ts)) {
int64_t cur_time= av_gettime_relative();
+ if (received_nb_signals)
+ break;
+
/* if 'q' pressed, exits */
if (stdin_interaction)
if (check_keyboard_interaction(cur_time) < 0)
--
2.49.1
From 483015d6ce5e720e71bed66814d353d656f37356 Mon Sep 17 00:00:00 2001
From: Andrey Semashev <andrey.semashev@gmail.com>
Date: Tue, 2 Sep 2025 01:07:05 +0300
Subject: [PATCH 385/434] avcodec/librsvgdec: fix compilation with librsvg
2.50.3
This fixes compilation with librsvg 2.50.3: error: viewport undeclared
This was a regression since commit
86ed68420d3b60439d0b7767c53d0fdc1deb7277.
Fixes #10722.
Reviewed-by: Leo Izen <leo.izen@gmail.com>
(cherry picked from commit 9ee7796c540ce9cec3fdff0dd246de842228707b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/librsvgdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/librsvgdec.c b/libavcodec/librsvgdec.c
index c328fbc774..f0566eb5d8 100644
--- a/libavcodec/librsvgdec.c
+++ b/libavcodec/librsvgdec.c
@@ -90,8 +90,6 @@ static int librsvg_decode_frame(AVCodecContext *avctx, AVFrame *frame,
goto end;
avctx->pix_fmt = AV_PIX_FMT_RGB32;
- viewport.width = dimensions.width;
- viewport.height = dimensions.height;
ret = ff_get_buffer(avctx, frame, 0);
if (ret < 0)
@@ -116,6 +114,8 @@ static int librsvg_decode_frame(AVCodecContext *avctx, AVFrame *frame,
cairo_restore(crender);
#if LIBRSVG_MAJOR_VERSION > 2 || LIBRSVG_MAJOR_VERSION == 2 && LIBRSVG_MINOR_VERSION >= 52
+ viewport.width = dimensions.width;
+ viewport.height = dimensions.height;
gret = rsvg_handle_render_document(handle, crender, &viewport, &error);
#else
cairo_scale(crender, dimensions.width / (double)unscaled_dimensions.width,
--
2.49.1
From 1b08c6c95e3f19452566b8aae7a0288b39d05161 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Tue, 2 Sep 2025 18:04:11 +0800
Subject: [PATCH 386/434] doc/examples/vaapi_encode: fix invalid check on
fwrite
enc_pkt->size is 0 after av_packet_unref, which makes the check invalid.
Fix regression from 3e4bfff2.
Co-Authored-by: Jin Bo <jinbo@loongson.cn>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit 09856e4e483f14125d38e5c84e908f623bb1a888)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
doc/examples/vaapi_encode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/doc/examples/vaapi_encode.c b/doc/examples/vaapi_encode.c
index ff3ebb1e2b..330a6524ef 100644
--- a/doc/examples/vaapi_encode.c
+++ b/doc/examples/vaapi_encode.c
@@ -88,7 +88,7 @@ static int encode_write(AVCodecContext *avctx, AVFrame *frame, FILE *fout)
enc_pkt->stream_index = 0;
ret = fwrite(enc_pkt->data, enc_pkt->size, 1, fout);
av_packet_unref(enc_pkt);
- if (ret != enc_pkt->size) {
+ if (!ret) {
ret = AVERROR(errno);
break;
}
--
2.49.1
From f893221c8d89cb798b829bebe71d55e1a3f242fd Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 14 Sep 2025 00:32:13 +0200
Subject: [PATCH 387/434] Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 3 +++
1 file changed, 3 insertions(+)
diff --git a/Changelog b/Changelog
index c64d281e24..b8f15aabb7 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,9 @@ Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 7.1.2:
+ doc/examples/vaapi_encode: fix invalid check on fwrite
+ avcodec/librsvgdec: fix compilation with librsvg 2.50.3
+ fftools/ffmpeg: fix gracefully shutdown
fftools/ffmpeg_demux: ensure the display_rotation option is honored
avcodec/mjpegdec: use ff_frame_new_side_data() to export display matrix
aacdec_usac: use RefStruct to track unfinished extension buffers
--
2.49.1
From 8bb4f60459ec4663476be11cc0fe294d705fa7dd Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 15 Sep 2025 22:18:52 -0300
Subject: [PATCH 388/434] avcodec/x86/pngdsp: add missing emms at the end of
add_png_paeth_prediction
Fixes unpredictable behavior with floats.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 57a29f2e7dd2374a1df27316c6cf7c0225e86758)
---
libavcodec/x86/pngdsp.asm | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/x86/pngdsp.asm b/libavcodec/x86/pngdsp.asm
index efaf652cd4..10a1fd648b 100644
--- a/libavcodec/x86/pngdsp.asm
+++ b/libavcodec/x86/pngdsp.asm
@@ -151,6 +151,7 @@ cglobal add_png_paeth_prediction, 5, 7, %1, dst, src, top, w, bpp, end, cntr
dec cntrq
jge .bpp_loop
POP dstq
+ emms
RET
%endmacro
--
2.49.1
From ab0545969279dc832d431500be11f61e3dadcf91 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 16 Sep 2025 13:56:18 -0300
Subject: [PATCH 389/434] avcodec/decode: sync initial_pict_type and
intra_only_flag with thread worker's avctx
Regression since 5acbdd2264d3b90dc11369f9e031e762f260882e, which removed
setting both values from PerThreadContext.
Given the pthread code calls ff_decode_receive_frame_internal() on the frame,
any value set before it will be overwritten, so instead sync each thread's
DecodeContext and let ff_decode_receive_frame_internal() handle these values.
Fixes issue #20534.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 26f4230082dad1a6a0f2384694037562f73bb2fd)
---
libavcodec/decode.c | 2 ++
libavcodec/pthread_frame.c | 11 -----------
2 files changed, 2 insertions(+), 11 deletions(-)
diff --git a/libavcodec/decode.c b/libavcodec/decode.c
index 828013197c..d8d3bd4d11 100644
--- a/libavcodec/decode.c
+++ b/libavcodec/decode.c
@@ -2329,6 +2329,8 @@ void ff_decode_internal_sync(AVCodecContext *dst, const AVCodecContext *src)
const DecodeContext *src_dc = decode_ctx(src->internal);
DecodeContext *dst_dc = decode_ctx(dst->internal);
+ dst_dc->initial_pict_type = src_dc->initial_pict_type;
+ dst_dc->intra_only_flag = src_dc->intra_only_flag;
ff_refstruct_replace(&dst_dc->lcevc, src_dc->lcevc);
}
diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c
index 1b1b96623f..5b4b0b342c 100644
--- a/libavcodec/pthread_frame.c
+++ b/libavcodec/pthread_frame.c
@@ -115,10 +115,6 @@ typedef struct PerThreadContext {
int hwaccel_threadsafe;
atomic_int debug_threads; ///< Set if the FF_DEBUG_THREADS option is set.
-
- /// The following two fields have the same semantics as the DecodeContext field
- int intra_only_flag;
- enum AVPictureType initial_pict_type;
} PerThreadContext;
/**
@@ -821,13 +817,6 @@ static av_cold int init_thread(PerThreadContext *p, int *threads_to_free,
AVCodecContext *copy;
int err;
- p->initial_pict_type = AV_PICTURE_TYPE_NONE;
- if (avctx->codec_descriptor->props & AV_CODEC_PROP_INTRA_ONLY) {
- p->intra_only_flag = AV_FRAME_FLAG_KEY;
- if (avctx->codec_type == AVMEDIA_TYPE_VIDEO)
- p->initial_pict_type = AV_PICTURE_TYPE_I;
- }
-
atomic_init(&p->state, STATE_INPUT_READY);
copy = av_memdup(avctx, sizeof(*avctx));
--
2.49.1
From a337e8f86a9c2c9740da6a9960a5cb855c109c6b Mon Sep 17 00:00:00 2001
From: Brad Smith <brad@comstyle.com>
Date: Sat, 20 Sep 2025 23:06:08 -0400
Subject: [PATCH 390/434] libavutil/arm: Make use of elf_aux_info() on
FreeBSD/OpenBSD
- FreBSD/OpenBSD have elf_aux_info() on arm
- Wrap AT_HWCAP as the value is different for BSD vs Linux (16 vs 25)
(cherry picked from commit cdae5c3639f4adcd289e643a203d43d4e01d87f5)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/arm/cpu.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/libavutil/arm/cpu.c b/libavutil/arm/cpu.c
index b84882005a..8ec28143d7 100644
--- a/libavutil/arm/cpu.c
+++ b/libavutil/arm/cpu.c
@@ -31,18 +31,20 @@
CORE_FLAG(VFPV3) | \
CORE_FLAG(NEON))
-#if defined __linux__ || defined __ANDROID__
+#if defined __linux__ || defined __ANDROID__ || HAVE_ELF_AUX_INFO
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include "libavutil/avstring.h"
-#if HAVE_GETAUXVAL
+#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
#include <sys/auxv.h>
#endif
+#ifndef AT_HWCAP
#define AT_HWCAP 16
+#endif
/* Relevant HWCAP values from kernel headers */
#define HWCAP_VFP (1 << 6)
@@ -54,7 +56,7 @@
static int get_auxval(uint32_t *hwcap)
{
-#if HAVE_GETAUXVAL
+#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO
unsigned long ret = ff_getauxval(AT_HWCAP);
if (ret == 0)
return -1;
@@ -65,6 +67,7 @@ static int get_auxval(uint32_t *hwcap)
#endif
}
+#if defined __linux__ || defined __ANDROID__
static int get_hwcap(uint32_t *hwcap)
{
struct { uint32_t a_type; uint32_t a_val; } auxv;
@@ -117,6 +120,7 @@ static int get_cpuinfo(uint32_t *hwcap)
fclose(f);
return 0;
}
+#endif
int ff_get_cpu_flags_arm(void)
{
@@ -124,8 +128,10 @@ int ff_get_cpu_flags_arm(void)
uint32_t hwcap;
if (get_auxval(&hwcap) < 0)
+#if defined __linux__ || defined __ANDROID__
if (get_hwcap(&hwcap) < 0)
if (get_cpuinfo(&hwcap) < 0)
+#endif
return flags;
#define check_cap(cap, flag) do { \
--
2.49.1
From 8320e6b4155d4488e3ed2665a05d2b2f389fa20d Mon Sep 17 00:00:00 2001
From: Brad Smith <brad@comstyle.com>
Date: Mon, 22 Sep 2025 07:28:21 -0400
Subject: [PATCH 391/434] libavutil/arm: Rename the HWCAP defines
Rename the HWCAP defines to use the same naming scheme as AArch64 and PPC.
(cherry picked from commit ced4a6ebc9e7cd92d0ca9b9fb8f9d1013d23cbfa)
Signed-off-by: Brad Smith <brad@comstyle.com>
---
libavutil/arm/cpu.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/libavutil/arm/cpu.c b/libavutil/arm/cpu.c
index 8ec28143d7..2e2977efc9 100644
--- a/libavutil/arm/cpu.c
+++ b/libavutil/arm/cpu.c
@@ -47,12 +47,12 @@
#endif
/* Relevant HWCAP values from kernel headers */
-#define HWCAP_VFP (1 << 6)
-#define HWCAP_EDSP (1 << 7)
-#define HWCAP_THUMBEE (1 << 11)
-#define HWCAP_NEON (1 << 12)
-#define HWCAP_VFPv3 (1 << 13)
-#define HWCAP_TLS (1 << 15)
+#define HWCAP_ARM_VFP (1 << 6)
+#define HWCAP_ARM_EDSP (1 << 7)
+#define HWCAP_ARM_THUMBEE (1 << 11)
+#define HWCAP_ARM_NEON (1 << 12)
+#define HWCAP_ARM_VFPv3 (1 << 13)
+#define HWCAP_ARM_TLS (1 << 15)
static int get_auxval(uint32_t *hwcap)
{
@@ -101,19 +101,19 @@ static int get_cpuinfo(uint32_t *hwcap)
while (fgets(buf, sizeof(buf), f)) {
if (av_strstart(buf, "Features", NULL)) {
if (strstr(buf, " edsp "))
- *hwcap |= HWCAP_EDSP;
+ *hwcap |= HWCAP_ARM_EDSP;
if (strstr(buf, " tls "))
- *hwcap |= HWCAP_TLS;
+ *hwcap |= HWCAP_ARM_TLS;
if (strstr(buf, " thumbee "))
- *hwcap |= HWCAP_THUMBEE;
+ *hwcap |= HWCAP_ARM_THUMBEE;
if (strstr(buf, " vfp "))
- *hwcap |= HWCAP_VFP;
+ *hwcap |= HWCAP_ARM_VFP;
if (strstr(buf, " vfpv3 "))
- *hwcap |= HWCAP_VFPv3;
+ *hwcap |= HWCAP_ARM_VFPv3;
if (strstr(buf, " neon ") || strstr(buf, " asimd "))
- *hwcap |= HWCAP_NEON;
+ *hwcap |= HWCAP_ARM_NEON;
if (strstr(buf, " fp ")) // Listed on 64 bit ARMv8 kernels
- *hwcap |= HWCAP_VFP | HWCAP_VFPv3;
+ *hwcap |= HWCAP_ARM_VFP | HWCAP_ARM_VFPv3;
break;
}
}
@@ -135,7 +135,7 @@ int ff_get_cpu_flags_arm(void)
return flags;
#define check_cap(cap, flag) do { \
- if (hwcap & HWCAP_ ## cap) \
+ if (hwcap & HWCAP_ARM_ ## cap) \
flags |= AV_CPU_FLAG_ ## flag; \
} while (0)
--
2.49.1
From 8f77695e65a69c8009804e9d457762d2d394403d Mon Sep 17 00:00:00 2001
From: Sean McGovern <gseanmcg@gmail.com>
Date: Thu, 16 Jan 2025 16:30:52 -0500
Subject: [PATCH 392/434] avcodec/svq1enc: restrict Altivec acceleration to
big-endian POWER configurations
This was disabled in da60b99a8857d5ca236f32c1799a066e0135a866 and then
accidentally re-enabled in 172b0e2e88832822632841e8e0d3794f974cbc93.
The code in question was never properly adapted for litte-endian mode.
refs: trac/10955
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4322be512b2bd6c7d8ee61a2b0230546f3107be0)
---
libavcodec/ppc/svq1enc_altivec.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavcodec/ppc/svq1enc_altivec.c b/libavcodec/ppc/svq1enc_altivec.c
index 5721bede34..78c79a68dc 100644
--- a/libavcodec/ppc/svq1enc_altivec.c
+++ b/libavcodec/ppc/svq1enc_altivec.c
@@ -29,7 +29,7 @@
#include "libavcodec/svq1encdsp.h"
-#if HAVE_ALTIVEC
+#if HAVE_ALTIVEC && HAVE_BIGENDIAN
static int ssd_int8_vs_int16_altivec(const int8_t *pix1, const int16_t *pix2,
intptr_t size)
{
@@ -69,14 +69,14 @@ static int ssd_int8_vs_int16_altivec(const int8_t *pix1, const int16_t *pix2,
return u.score[3];
}
-#endif /* HAVE_ALTIVEC */
+#endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */
av_cold void ff_svq1enc_init_ppc(SVQ1EncDSPContext *c)
{
-#if HAVE_ALTIVEC
+#if HAVE_ALTIVEC && HAVE_BIGENDIAN
if (!PPC_ALTIVEC(av_get_cpu_flags()))
return;
c->ssd_int8_vs_int16 = ssd_int8_vs_int16_altivec;
-#endif /* HAVE_ALTIVEC */
+#endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */
}
--
2.49.1
From bd4191a5670563c1062a7b357058cba5f726abc6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 27 Oct 2025 16:18:17 -0300
Subject: [PATCH 393/434] avformat/demux: pass new extradata to the parser
The parser API doesn't work with packets, only raw data, so in order for it to
be made aware of new extradata propagated through packet side data we need to
pass it in some other form, namely, replacing the main extradata and ensuring
it will be parsed by restarting the parser.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavformat/demux.c | 28 ++++++++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
diff --git a/libavformat/demux.c b/libavformat/demux.c
index 4fd22c4934..2796209239 100644
--- a/libavformat/demux.c
+++ b/libavformat/demux.c
@@ -1159,7 +1159,10 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
AVPacket *out_pkt = si->parse_pkt;
AVStream *st = s->streams[stream_index];
FFStream *const sti = ffstream(st);
+ const AVPacketSideData *sd = NULL;
const uint8_t *data = pkt->data;
+ uint8_t *extradata = sti->avctx->extradata;
+ int extradata_size = sti->avctx->extradata_size;
int size = pkt->size;
int ret = 0, got_output = flush;
@@ -1168,6 +1171,16 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
compute_pkt_fields(s, st, sti->parser, pkt, AV_NOPTS_VALUE, AV_NOPTS_VALUE);
}
+ if (pkt->side_data_elems)
+ sd = av_packet_side_data_get(pkt->side_data, pkt->side_data_elems,
+ AV_PKT_DATA_NEW_EXTRADATA);
+ if (sd) {
+ av_assert1(size && !flush);
+
+ sti->avctx->extradata = sd->data;
+ sti->avctx->extradata_size = sd->size;
+ }
+
while (size > 0 || (flush && got_output)) {
int64_t next_pts = pkt->pts;
int64_t next_dts = pkt->dts;
@@ -1261,6 +1274,11 @@ static int parse_packet(AVFormatContext *s, AVPacket *pkt,
}
fail:
+ if (sd) {
+ sti->avctx->extradata = extradata;
+ sti->avctx->extradata_size = extradata_size;
+ }
+
if (ret < 0)
av_packet_unref(out_pkt);
av_packet_unref(pkt);
@@ -1353,6 +1371,11 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
st->event_flags |= AVSTREAM_EVENT_FLAG_NEW_PACKETS;
+ int new_extradata = !!av_packet_side_data_get(pkt->side_data, pkt->side_data_elems,
+ AV_PKT_DATA_NEW_EXTRADATA);
+ if (new_extradata)
+ sti->need_context_update = 1;
+
/* update context if required */
if (sti->need_context_update) {
if (avcodec_is_open(sti->avctx)) {
@@ -1363,8 +1386,9 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt)
return ret;
}
- /* close parser, because it depends on the codec */
- if (sti->parser && sti->avctx->codec_id != st->codecpar->codec_id) {
+ /* close parser, because it depends on the codec and extradata */
+ if (sti->parser &&
+ (sti->avctx->codec_id != st->codecpar->codec_id || new_extradata)) {
av_parser_close(sti->parser);
sti->parser = NULL;
}
--
2.49.1
From 24c44c34dcc7fb99f057280c347b7a5f4a5ae150 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 27 Oct 2025 11:13:20 -0300
Subject: [PATCH 394/434] avcodec/mlpdec: don't depend on context channel
layout when setting substream masks
If avctx->ch_layout is unset (as it's allowed and even expeced by the
AV_CODEC_CAP_CHANNEL_CONF flag), the code setting substream masks will fail for
stereo and mono layouts unless a downmix channel was requested.
Fix this by deriving the mask with coded values only.
Fixes issue #20764.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 530ca627a325a0f77859a6a7d8baa05395767d56)
---
libavcodec/mlpdec.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index e85dac36a7..e69e4442d2 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -318,8 +318,10 @@ static av_cold int mlp_decode_init(AVCodecContext *avctx)
av_channel_layout_uninit(&avctx->ch_layout);
avctx->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_5POINT1;
}
- else
+ else {
av_log(avctx, AV_LOG_WARNING, "Invalid downmix layout\n");
+ av_channel_layout_uninit(&m->downmix_layout);
+ }
}
ff_thread_once(&init_static_once, init_static);
@@ -452,26 +454,22 @@ static int read_major_sync(MLPDecodeContext *m, GetBitContext *gb)
}
m->substream[1].mask = mh.channel_layout_thd_stream1;
if (mh.channels_thd_stream1 == 2 &&
- mh.channels_thd_stream2 == 2 &&
- m->avctx->ch_layout.nb_channels == 2)
+ mh.channels_thd_stream2 == 2)
m->substream[0].mask = AV_CH_LAYOUT_STEREO;
if ((substr = (mh.num_substreams > 1)))
m->substream[0].mask = AV_CH_LAYOUT_STEREO;
if (mh.num_substreams == 1 &&
mh.channels_thd_stream1 == 1 &&
- mh.channels_thd_stream2 == 1 &&
- m->avctx->ch_layout.nb_channels == 1)
+ mh.channels_thd_stream2 == 1)
m->substream[0].mask = AV_CH_LAYOUT_MONO;
if (mh.num_substreams > 2)
if (mh.channel_layout_thd_stream2)
m->substream[2].mask = mh.channel_layout_thd_stream2;
else
m->substream[2].mask = mh.channel_layout_thd_stream1;
- if (m->avctx->ch_layout.nb_channels > 2)
- if (mh.num_substreams > 2)
- m->substream[1].mask = mh.channel_layout_thd_stream1;
- else
- m->substream[mh.num_substreams > 1].mask = mh.channel_layout_thd_stream2;
+ if (mh.num_substreams == 2 && (!m->downmix_layout.nb_channels ||
+ m->downmix_layout.nb_channels > 2))
+ m->substream[1].mask = mh.channel_layout_thd_stream2;
}
m->needs_reordering = mh.channel_arrangement >= 18 && mh.channel_arrangement <= 20;
--
2.49.1
From bcef9167268961bd6cbb214278f9cdef3837843f Mon Sep 17 00:00:00 2001
From: Bin Peng <pengbin@visionular.com>
Date: Fri, 24 Oct 2025 15:58:08 +0800
Subject: [PATCH 395/434] lavc/aarch64: Fix addp overflow in
ff_pred16x16_plane_neon_10
The mismatch between neon and C functions can be reproduced
using the following bitstream and command line on aarch64 devices.
wget https://streams.videolan.org/ffmpeg/incoming/replay_intra_pred_16x16.h264
./ffmpeg -cpuflags 0 -threads 1 -i replay_intra_pred_16x16.h264 -f framemd5 -y md5_ref
./ffmpeg -threads 1 -i replay_intra_pred_16x16.h264 -f framemd5 -y md5_neon
Signed-off-by: Bin Peng <pengbin@visionular.com>
(cherry picked from commit 3115c0c0e6c27c689a02a7267dcf8e61fa2ac425)
---
libavcodec/aarch64/h264pred_neon.S | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/libavcodec/aarch64/h264pred_neon.S b/libavcodec/aarch64/h264pred_neon.S
index d0999938ef..795d2ce540 100644
--- a/libavcodec/aarch64/h264pred_neon.S
+++ b/libavcodec/aarch64/h264pred_neon.S
@@ -489,10 +489,10 @@ function ff_pred16x16_plane_neon_10, export=1
mul v2.8h, v2.8h, v0.8h
mul v3.8h, v3.8h, v0.8h
addp v2.8h, v2.8h, v3.8h
- addp v2.8h, v2.8h, v2.8h
- addp v2.4h, v2.4h, v2.4h
- sshll v3.4s, v2.4h, #2
- saddw v2.4s, v3.4s, v2.4h
+ saddlp v2.4s, v2.8h
+ addp v2.4s, v2.4s, v2.4s
+ shl v3.4s, v2.4s, #2
+ add v2.4s, v3.4s, v2.4s
rshrn v4.4h, v2.4s, #6
trn2 v5.4h, v4.4h, v4.4h
add v2.4h, v4.4h, v5.4h
@@ -506,14 +506,13 @@ function ff_pred16x16_plane_neon_10, export=1
sxtl v6.4s, v5.4h // c
mov v0.h[0], wzr
- mul v0.8h, v0.8h, v4.h[0]
dup v16.4s, v2.s[0]
dup v17.4s, v2.s[0]
dup v2.8h, v4.h[0] // b
dup v3.4s, v6.s[0] // c
sshll v2.4s, v2.4h, #3 // b * 8
- saddw v16.4s, v16.4s, v0.4h
- saddw2 v17.4s, v17.4s, v0.8h
+ smlal v16.4s, v0.4h, v4.h[0]
+ smlal2 v17.4s, v0.8h, v4.h[0]
sub v3.4s, v3.4s, v2.4s
mov w3, #16
--
2.49.1
From 5418fbb7f44a7b63aec5ea768c6069045078d5fd Mon Sep 17 00:00:00 2001
From: Niklas Haas <git@haasn.dev>
Date: Sat, 27 Sep 2025 20:02:07 +0200
Subject: [PATCH 396/434] fftools/ffmpeg_sched: prevent demuxers from getting
stuck
When the furthest-behind stream is being fed by a demuxer that is also
feeding packets to a choked filter graph, we need to unchoke that filter
graph to prevent the demuxer from getting stuck trying to write packets to
the choked filter graph.
This situation can also apply recursively - if the demuxer is also writing
to a filtergraph that is also reading from a choked demuxer, there is a
similar deadlock.
Solve all such deadlocks by just brute-force recursively unchoking all
nodes that can somehow prevent this demuxer from writing packets. This
should normally not result in any change in behavior, unless audio/video
streams are badly desynchronized, in which case it may result in extra
memory usage from the too-far-ahead stream buffering packets inside the
muxer. (But this is, of course, preferable to a deadlock)
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20611
Backported-From: 133a0bcb1385f3214e501970f0ced52dcde906cb
---
fftools/ffmpeg_sched.c | 46 +++++++++++++++++++++++++++++++++++++++++-
1 file changed, 45 insertions(+), 1 deletion(-)
diff --git a/fftools/ffmpeg_sched.c b/fftools/ffmpeg_sched.c
index ef0b6e2897..6b338409a0 100644
--- a/fftools/ffmpeg_sched.c
+++ b/fftools/ffmpeg_sched.c
@@ -1242,6 +1242,45 @@ int sch_mux_sub_heartbeat_add(Scheduler *sch, unsigned mux_idx, unsigned stream_
return 0;
}
+static void unchoke_for_stream(Scheduler *sch, SchedulerNode src);
+
+// Unchoke any filter graphs that are downstream of this node, to prevent it
+// from getting stuck trying to push data to a full queue
+static void unchoke_downstream(Scheduler *sch, SchedulerNode *dst)
+{
+ SchFilterGraph *fg;
+ SchDec *dec;
+ SchEnc *enc;
+ switch (dst->type) {
+ case SCH_NODE_TYPE_DEC:
+ dec = &sch->dec[dst->idx];
+ for (int i = 0; i < dec->nb_outputs; i++)
+ unchoke_downstream(sch, dec->outputs[i].dst);
+ break;
+ case SCH_NODE_TYPE_ENC:
+ enc = &sch->enc[dst->idx];
+ for (int i = 0; i < enc->nb_dst; i++)
+ unchoke_downstream(sch, &enc->dst[i]);
+ break;
+ case SCH_NODE_TYPE_MUX:
+ // muxers are never choked
+ break;
+ case SCH_NODE_TYPE_FILTER_IN:
+ fg = &sch->filters[dst->idx];
+ if (fg->best_input == fg->nb_inputs) {
+ fg->waiter.choked_next = 0;
+ } else {
+ // ensure that this filter graph is not stuck waiting for
+ // input from a different upstream demuxer
+ unchoke_for_stream(sch, fg->inputs[fg->best_input].src_sched);
+ }
+ break;
+ default:
+ av_assert0(!"Invalid destination node type?");
+ break;
+ }
+}
+
static void unchoke_for_stream(Scheduler *sch, SchedulerNode src)
{
while (1) {
@@ -1249,7 +1288,12 @@ static void unchoke_for_stream(Scheduler *sch, SchedulerNode src)
// fed directly by a demuxer (i.e. not through a filtergraph)
if (src.type == SCH_NODE_TYPE_DEMUX) {
- sch->demux[src.idx].waiter.choked_next = 0;
+ SchDemux *demux = &sch->demux[src.idx];
+ if (demux->waiter.choked_next == 0)
+ return; // prevent infinite loop
+ demux->waiter.choked_next = 0;
+ for (int i = 0; i < demux->nb_streams; i++)
+ unchoke_downstream(sch, demux->streams[i].dst);
return;
}
--
2.49.1
From 26115ca03dd65e7e1b83e274293590f163320f86 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Date: Fri, 11 Jul 2025 22:58:26 +0200
Subject: [PATCH 397/434] avformat/aviobuf: Keep checksum_ptr consistent in
avio_seek()
Otherwise it might be > buf_ptr in which case ffio_get_checksum()
could segfault (s->buf_ptr - s->checksum_ptr would be negative
which would be converted to something very big when converted
to unsigned for the update_checksum callback).
Fixes ticket #11233.
Reported-by: Du4t
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 987c955cd7e972d9940284fa6ae7187ac858ebb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/aviobuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 6a74c1ce68..9041280e77 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -308,7 +308,7 @@ int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)
ctx->seek_count++;
if (!s->write_flag)
s->buf_end = s->buffer;
- s->buf_ptr = s->buf_ptr_max = s->buffer;
+ s->checksum_ptr = s->buf_ptr = s->buf_ptr_max = s->buffer;
s->pos = offset;
}
s->eof_reached = 0;
--
2.49.1
From d94cce9ee060c0799c0d74d747b11ca657426943 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 11 Sep 2025 20:12:55 +0200
Subject: [PATCH 398/434] avcodec/mjpegdec: Explain buf_size/width/height check
Suggested-by: Ramiro
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61b6877637041a1f817ad9811c839b0feae2b8af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mjpegdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 9438184ae5..94fc0377f0 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -343,6 +343,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
av_log(s->avctx, AV_LOG_DEBUG, "sof0: picture: %dx%d\n", width, height);
if (av_image_check_size(width, height, 0, s->avctx) < 0)
return AVERROR_INVALIDDATA;
+
+ // A valid frame requires at least 1 bit for DC + 1 bit for AC for each 8x8 block.
if (s->buf_size && (width + 7) / 8 * ((height + 7) / 8) > s->buf_size * 4LL)
return AVERROR_INVALIDDATA;
--
2.49.1
From b40c6910255085f661c6ed53b9abd3efb8698c53 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 18 Sep 2025 21:28:04 +0200
Subject: [PATCH 399/434] avcodec/exr: Round dc_w/h up
Without rounding them up there are too few dc coeffs for the blocks.
We do not know if this way of handling odd dimensions is correct, as we have
no such DWA sample.
thus we ask the user for a sample if she encounters such a file
Fixes: out of array access
Fixes: BIGSLEEP-445392027-crash.exr
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c911e0001115bbda904ad103b12c27b9a3c0c265)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 20b2cfdc7e..cfff8f9114 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -987,8 +987,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
int64_t version, lo_usize, lo_size;
int64_t ac_size, dc_size, rle_usize, rle_csize, rle_raw_size;
int64_t ac_count, dc_count, ac_compression;
- const int dc_w = td->xsize >> 3;
- const int dc_h = td->ysize >> 3;
+ const int dc_w = (td->xsize + 7) >> 3;
+ const int dc_h = (td->ysize + 7) >> 3;
GetByteContext gb, agb;
int skip, ret;
int have_rle = 0;
@@ -1021,6 +1021,10 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
return AVERROR_INVALIDDATA;
}
+ if (td->xsize % 8 || td->ysize % 8) {
+ avpriv_request_sample(s->avctx, "odd dimensions DWA");
+ }
+
bytestream2_init(&gb, src + 88, compressed_size - 88);
skip = bytestream2_get_le16(&gb);
if (skip < 2)
--
2.49.1
From 3934ab4ee2a2390cf0778c6e64014d0af8659a51 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 18 Sep 2025 17:32:46 +0200
Subject: [PATCH 400/434] avcodec/exr: check ac_size
Fixes: out of array read
Fixes: dwa_uncompress.py.crash.exr
The code will read from the ac data even if ac_size is 0, thus that case
is not implemented and we ask for a sample and error out cleanly
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e078826da6f2a1dffa25162121b43b272f5e5fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index cfff8f9114..40b6cd70d9 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1016,6 +1016,11 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
)
return AVERROR_INVALIDDATA;
+ if (ac_size <= 0) {
+ avpriv_request_sample(s->avctx, "Zero ac_size");
+ return AVERROR_INVALIDDATA;
+ }
+
if ((uint64_t)rle_raw_size > INT_MAX) {
avpriv_request_sample(s->avctx, "Too big rle_raw_size");
return AVERROR_INVALIDDATA;
--
2.49.1
From 638cafa70b18581f4bc482ac2cf57b55d3a311d5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 19 Sep 2025 00:18:30 +0200
Subject: [PATCH 401/434] avcodec/exr: Check that DWA has 3 channels
The implementation hardcodes access to 3 channels, so we need to check that
Fixes: out of array access
Fixes: BIGSLEEP-445394503-crash.exr
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7896cc67c13037abba8941e39a74c56d26b775a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 40b6cd70d9..c90d12b618 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1000,6 +1000,11 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
if (version != 2)
return AVERROR_INVALIDDATA;
+ if (s->nb_channels < 3) {
+ avpriv_request_sample(s->avctx, "Gray DWA");
+ return AVERROR_PATCHWELCOME;
+ }
+
lo_usize = AV_RL64(src + 8);
lo_size = AV_RL64(src + 16);
ac_size = AV_RL64(src + 24);
--
2.49.1
From a6ac0c6841c5205393513961ad9cdc3a8ba17b35 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 9 Oct 2025 00:31:10 -0300
Subject: [PATCH 402/434] avcodec/hevc/sei: prevent storing a potentially bogus
num_ref_displays value in HEVCSEITDRDI
Fixes: 439711052/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4956250308935680
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d448d6d1a0a4cdc76499c137742fdd8b30b9e7de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/hevc/sei.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavcodec/hevc/sei.c b/libavcodec/hevc/sei.c
index e11a33773c..1af6ca2716 100644
--- a/libavcodec/hevc/sei.c
+++ b/libavcodec/hevc/sei.c
@@ -152,6 +152,8 @@ static int decode_nal_sei_timecode(HEVCSEITimeCode *s, GetBitContext *gb)
static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitContext *gb)
{
+ unsigned num_ref_displays;
+
s->prec_ref_display_width = get_ue_golomb(gb);
if (s->prec_ref_display_width > 31)
return AVERROR_INVALIDDATA;
@@ -161,10 +163,10 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
if (s->prec_ref_viewing_dist > 31)
return AVERROR_INVALIDDATA;
}
- s->num_ref_displays = get_ue_golomb(gb);
- if (s->num_ref_displays > 31)
+ num_ref_displays = get_ue_golomb(gb);
+ if (num_ref_displays > 31)
return AVERROR_INVALIDDATA;
- s->num_ref_displays += 1;
+ s->num_ref_displays = num_ref_displays + 1;
for (int i = 0; i < s->num_ref_displays; i++) {
int length;
--
2.49.1
From 19877054e340e2babb7ef0d00e81c12bfeb19391 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 13 Oct 2025 14:32:45 +0200
Subject: [PATCH 403/434] swscale/output: Fix integer overflow in
yuv2ya16_X_c_template()
Found-by: colod colod <colodcolod7@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c6b7f9483a38657c9be824572b4c0c45d4d9fef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libswscale/output.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libswscale/output.c b/libswscale/output.c
index 2172e4b53b..1ddbee9b2b 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -965,7 +965,7 @@ yuv2ya16_X_c_template(SwsContext *c, const int16_t *lumFilter,
int A = 0xffff;
for (j = 0; j < lumFilterSize; j++)
- Y += lumSrc[j][i] * lumFilter[j];
+ Y += lumSrc[j][i] * (unsigned)lumFilter[j];
Y >>= 15;
Y += (1<<3) + 0x8000;
@@ -974,7 +974,7 @@ yuv2ya16_X_c_template(SwsContext *c, const int16_t *lumFilter,
if (hasAlpha) {
A = -0x40000000 + (1<<14);
for (j = 0; j < lumFilterSize; j++)
- A += alpSrc[j][i] * lumFilter[j];
+ A += alpSrc[j][i] * (unsigned)lumFilter[j];
A >>= 15;
A += 0x8000;
--
2.49.1
From ceae7a83532260170b110f954d8ae4d53e0f004a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 24 Oct 2025 20:29:23 +0200
Subject: [PATCH 404/434] avformat/rtpenc_h264_hevc: Check space for
nal_length_size in ff_rtp_send_h264_hevc()
Fixes: memcpy with negative size
Fixes: momo_trip-poc/input
Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d03483bd265b68db00c9b90f6f48dcf61c5c300d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtpenc_h264_hevc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/rtpenc_h264_hevc.c b/libavformat/rtpenc_h264_hevc.c
index 4d222dca75..38d508fe8f 100644
--- a/libavformat/rtpenc_h264_hevc.c
+++ b/libavformat/rtpenc_h264_hevc.c
@@ -196,6 +196,9 @@ void ff_rtp_send_h264_hevc(AVFormatContext *s1, const uint8_t *buf1, int size)
r1 = ff_nal_mp4_find_startcode(r, end, s->nal_length_size);
if (!r1)
r1 = end;
+ // Check that the last is not truncated
+ if (r1 - r < s->nal_length_size)
+ break;
r += s->nal_length_size;
} else {
while (!*(r++));
--
2.49.1
From e86132d237b3777cdf47b3a73d55a78621bd8dce Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 6 Aug 2025 12:49:49 +0200
Subject: [PATCH 405/434] avcodec/vlc: Clear val8/16 in vlc_multi_gen() by
av_mallocz()
Fixes: use of uninitialized memory
Fixes: 427814450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer-646512196065689
Fixes: 445961558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5515158672965632
the multi vlc code will otherwise return uninitialized data. Now one can argue that this data should
not be used, but on errors this data can remain ...
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8ffec5bf9a2803f55cc0822a97b7815f24bee83)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/vlc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index f46ecbb55e..7209724dc2 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -527,7 +527,7 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
if (ret < 0)
return ret;
- multi->table = av_malloc(sizeof(*multi->table) << nb_bits);
+ multi->table = av_mallocz(sizeof(*multi->table) << nb_bits);
if (!multi->table)
goto fail;
--
2.49.1
From 56913de807303c6c4e5ba693c04dbe5cc73225d8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 7 Oct 2025 01:58:34 +0200
Subject: [PATCH 406/434] avcodec/g723_1enc: Make min_err 64bit
This is intending to fix the case described in https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/thread/AAZ7GJPPUJI5SCVTDGJ6QL7UUEP56WOM/
Where FCBParam optim is used uninitialized
a min_err of 1<<30, allows the struct to be never initilialized as all
err (which is int32_t) can be larger than min_err. By increasing min_err
above the int32_t range this is no longer possible
Untested, as i do not have the testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>i
(cherry picked from commit 909af3a571da830cc70a34f0c3946379bd12dfbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/g723_1.h | 2 +-
libavcodec/g723_1enc.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/g723_1.h b/libavcodec/g723_1.h
index 521f220b2a..f3cd32e37d 100644
--- a/libavcodec/g723_1.h
+++ b/libavcodec/g723_1.h
@@ -108,7 +108,7 @@ typedef struct HFParam {
* Optimized fixed codebook excitation parameters
*/
typedef struct FCBParam {
- int min_err;
+ int64_t min_err;
int amp_index;
int grid_index;
int dirac_train;
diff --git a/libavcodec/g723_1enc.c b/libavcodec/g723_1enc.c
index be80153130..d686c4befa 100644
--- a/libavcodec/g723_1enc.c
+++ b/libavcodec/g723_1enc.c
@@ -1013,7 +1013,7 @@ static void fcb_search(G723_1_ChannelContext *p, int16_t *impulse_resp,
int pulse_cnt = pulses[index];
int i;
- optim.min_err = 1 << 30;
+ optim.min_err = 1LL << 31;
get_fcb_param(&optim, impulse_resp, buf, pulse_cnt, SUBFRAME_LEN);
if (p->pitch_lag[index >> 1] < SUBFRAME_LEN - 2) {
--
2.49.1
From c0bf64e0093027c3ab56ff86a69aada9fd30c572 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 30 Oct 2025 23:05:57 +0100
Subject: [PATCH 407/434] avformat/rtmpproto_ Check tcurl and flashver length
Fixes: out of array accesses
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a64e037429f20873ec48f6c82aa145ab448e1399)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtmpproto.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 91f18b6088..8055a9fbee 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -2833,6 +2833,12 @@ reconnect:
"FMLE/3.0 (compatible; %s)", LIBAVFORMAT_IDENT);
}
}
+ if ( strlen(rt->flashver) > FLASHVER_MAX_LENGTH
+ || strlen(rt->tcurl ) > TCURL_MAX_LENGTH
+ ) {
+ ret = AVERROR(EINVAL);
+ goto fail;
+ }
rt->receive_report_size = 1048576;
rt->bytes_read = 0;
--
2.49.1
From 6f179470b20ff7839e67ef601a2f4e01bac615d7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 30 Oct 2025 23:20:41 +0100
Subject: [PATCH 408/434] avformat/rtmpproto: consider command line argument
lengths
Fixes: out of array access
Fixes: zeropath/rtmp-2025-10
Found-by: Joshua Rogers <joshua@joshua.hu>
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83e0298de217a7108ee703806d6380e554007972)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtmpproto.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 8055a9fbee..8a568271c8 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -163,6 +163,13 @@ static int handle_chunk_size(URLContext *s, RTMPPacket *pkt);
static int handle_window_ack_size(URLContext *s, RTMPPacket *pkt);
static int handle_set_peer_bw(URLContext *s, RTMPPacket *pkt);
+static size_t zstrlen(const char *c)
+{
+ if(c)
+ return strlen(c);
+ return 0;
+}
+
static int add_tracked_method(RTMPContext *rt, const char *name, int id)
{
int err;
@@ -327,7 +334,16 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
int ret;
if ((ret = ff_rtmp_packet_create(&pkt, RTMP_SYSTEM_CHANNEL, RTMP_PT_INVOKE,
- 0, 4096 + APP_MAX_LENGTH)) < 0)
+ 0, 4096 + APP_MAX_LENGTH
+ + strlen(rt->auth_params) + strlen(rt->flashver)
+ + zstrlen(rt->enhanced_codecs)/5*7
+ + zstrlen(rt->swfurl)
+ + zstrlen(rt->swfverify)
+ + zstrlen(rt->tcurl)
+ + zstrlen(rt->auth_params)
+ + zstrlen(rt->pageurl)
+ + zstrlen(rt->conn)*3
+ )) < 0)
return ret;
p = pkt.data;
@@ -1900,7 +1916,9 @@ static int write_status(URLContext *s, RTMPPacket *pkt,
if ((ret = ff_rtmp_packet_create(&spkt, RTMP_SYSTEM_CHANNEL,
RTMP_PT_INVOKE, 0,
- RTMP_PKTDATA_DEFAULT_SIZE)) < 0) {
+ RTMP_PKTDATA_DEFAULT_SIZE
+ + strlen(status) + strlen(description)
+ + zstrlen(details))) < 0) {
av_log(s, AV_LOG_ERROR, "Unable to create response packet\n");
return ret;
}
--
2.49.1
From 2b2e23ff91fe48bd1683f255cad9773a91eac661 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 23:08:45 +0100
Subject: [PATCH 409/434] avformat/sctp: Check size in sctp_write()
Fixes: out of array access
No testcase
Found-by: Joshua Rogers <joshua@joshua.hu> with ZeroPath
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b98cea4bff2cbbb251b621a2b6c3ab76f814efa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/sctp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/sctp.c b/libavformat/sctp.c
index 9d9e90097e..f39ba7ebe0 100644
--- a/libavformat/sctp.c
+++ b/libavformat/sctp.c
@@ -334,6 +334,9 @@ static int sctp_write(URLContext *h, const uint8_t *buf, int size)
}
if (s->max_streams) {
+ if (size < 2)
+ return AVERROR(EINVAL);
+
/*StreamId is introduced as a 2byte code into the stream*/
struct sctp_sndrcvinfo info = { 0 };
info.sinfo_stream = AV_RB16(buf);
--
2.49.1
From 6381c606285bc98f3365c661ce3183d1cf98d800 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 19 Sep 2025 00:20:36 +0200
Subject: [PATCH 410/434] avcodec/exr: Simple check for available channels
The existing is_luma check is fragile as depending on the order
of channels it can be set or reset
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e8cf0377fee75de9ad2cc87385ab3e8f2c87143)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index c90d12b618..a1fb69aa97 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -174,6 +174,9 @@ typedef struct EXRContext {
int is_luma;/* 1 if there is an Y plane */
+#define M(chr) (1<<chr - 'A')
+ int has_channel; ///< combinatin of flags representing the channel codes A-Z
+
GetByteContext gb;
const uint8_t *buf;
int buf_size;
@@ -1595,6 +1598,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
s->is_tile = 0;
s->is_multipart = 0;
s->is_luma = 0;
+ s->has_channel = 0;
s->current_part = 0;
if (bytestream2_get_bytes_left(gb) < 10) {
@@ -1698,23 +1702,26 @@ static int decode_header(EXRContext *s, AVFrame *frame)
}
if (layer_match) { /* only search channel if the layer match is valid */
+ if (strlen(ch_gb.buffer) == 1) {
+ int ch_chr = av_toupper(*ch_gb.buffer);
+ if (ch_chr >= 'A' && ch_chr <= 'Z')
+ s->has_channel |= M(ch_chr);
+ av_log(s->avctx, AV_LOG_DEBUG, "%c\n", ch_chr);
+ }
+
if (!av_strcasecmp(ch_gb.buffer, "R") ||
!av_strcasecmp(ch_gb.buffer, "X") ||
!av_strcasecmp(ch_gb.buffer, "U")) {
channel_index = 0;
- s->is_luma = 0;
} else if (!av_strcasecmp(ch_gb.buffer, "G") ||
!av_strcasecmp(ch_gb.buffer, "V")) {
channel_index = 1;
- s->is_luma = 0;
} else if (!av_strcasecmp(ch_gb.buffer, "Y")) {
channel_index = 1;
- s->is_luma = 1;
} else if (!av_strcasecmp(ch_gb.buffer, "B") ||
!av_strcasecmp(ch_gb.buffer, "Z") ||
!av_strcasecmp(ch_gb.buffer, "W")) {
channel_index = 2;
- s->is_luma = 0;
} else if (!av_strcasecmp(ch_gb.buffer, "A")) {
channel_index = 3;
} else {
@@ -1790,6 +1797,20 @@ static int decode_header(EXRContext *s, AVFrame *frame)
s->current_channel_offset += 4;
}
}
+ if (!((M('R') + M('G') + M('B')) & ~s->has_channel)) {
+ s->is_luma = 0;
+ } else if (!((M('X') + M('Y') + M('Z')) & ~s->has_channel)) {
+ s->is_luma = 0;
+ } else if (!((M('Y') + M('U') + M('V')) & ~s->has_channel)) {
+ s->is_luma = 0;
+ } else if (!((M('Y') ) & ~s->has_channel) &&
+ !((M('R') + M('G') + M('B') + M('U') + M('V') + M('X') + M('Z')) & s->has_channel)) {
+ s->is_luma = 1;
+ } else {
+ avpriv_request_sample(s->avctx, "Uncommon channel combination");
+ ret = AVERROR(AVERROR_PATCHWELCOME);
+ goto fail;
+ }
/* Check if all channels are set with an offset or if the channels
* are causing an overflow */
--
2.49.1
From a4a27d464588e51429981ec653299fd5cff8e290 Mon Sep 17 00:00:00 2001
From: veygax <veyga@veygax.dev>
Date: Sun, 2 Nov 2025 02:35:40 +0000
Subject: [PATCH 411/434] avcodec/exr: use tile dimensions in pxr24 UINT case
update the switch statement for EXR_UINT in pxr24_uncompress to
correctly use the tile width td->xsize instead of using the full window
width s->xdelta. s->delta is larger than td->xsize which lead to two
buffer overflows when interacting with the ptr variable in the same
switch statement.
Fixes: out of bounds read and write
Found-by: veygax's insomnia network (INSOMNIA-1)
Signed-off-by: veygax <veyga@veygax.dev>
(cherry picked from commit 162f75b5e6798b385bb3eadd8280eff52d03cf29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index a1fb69aa97..ac02e09dfb 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -743,12 +743,12 @@ static int pxr24_uncompress(const EXRContext *s, const uint8_t *src,
break;
case EXR_UINT:
ptr[0] = in;
- ptr[1] = ptr[0] + s->xdelta;
- ptr[2] = ptr[1] + s->xdelta;
- ptr[3] = ptr[2] + s->xdelta;
- in = ptr[3] + s->xdelta;
+ ptr[1] = ptr[0] + td->xsize;
+ ptr[2] = ptr[1] + td->xsize;
+ ptr[3] = ptr[2] + td->xsize;
+ in = ptr[3] + td->xsize;
- for (j = 0; j < s->xdelta; ++j) {
+ for (j = 0; j < td->xsize; ++j) {
uint32_t diff = ((uint32_t)*(ptr[0]++) << 24) |
(*(ptr[1]++) << 16) |
(*(ptr[2]++) << 8 ) |
--
2.49.1
From 92a1f67e01c86056c5929ae8f80b3bcdee095a67 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 8 Nov 2025 01:17:46 +0100
Subject: [PATCH 412/434] avcodec/exr: spelling
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d80f8f36513ebff05c537adbe756e36036f80074)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/exr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index ac02e09dfb..c9d22435f4 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -175,7 +175,7 @@ typedef struct EXRContext {
int is_luma;/* 1 if there is an Y plane */
#define M(chr) (1<<chr - 'A')
- int has_channel; ///< combinatin of flags representing the channel codes A-Z
+ int has_channel; ///< combination of flags representing the channel codes A-Z
GetByteContext gb;
const uint8_t *buf;
--
2.49.1
From 4e8fb530ef79dec2cf2783dfa10ae2d9b869e8ed Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 17:32:56 +0100
Subject: [PATCH 413/434] avformat/http: Fix off by 1 error
Fixes: out of array access
Fixes: zeropath/off-by-one-one-byte
Found-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b518c027a0cb8d89c586fe241cc99b1c20bc0f50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/http.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/http.c b/libavformat/http.c
index ec60bc0b17..b674171d3c 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -1849,7 +1849,7 @@ static int store_icy(URLContext *h, int size)
ret = http_read_stream_all(h, data, len);
if (ret < 0)
return ret;
- data[len + 1] = 0;
+ data[len] = 0;
if ((ret = av_opt_set(s, "icy_metadata_packet", data, 0)) < 0)
return ret;
update_metadata(h, data);
--
2.49.1
From 51b5e19aa5346377b7f75d00d7db97665c835108 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:17:27 +0100
Subject: [PATCH 414/434] avformat/rtpdec_rfc4175: Fix memleak of sampling
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af3dee313223c722c34e8231cd6859188928a6e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtpdec_rfc4175.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index d6260ab69e..c41e4f19e0 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -128,7 +128,7 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
data->width = atoi(value);
else if (!strncmp(attr, "height", 6))
data->height = atoi(value);
- else if (!strncmp(attr, "sampling", 8))
+ else if (data->sampling == NULL && !strncmp(attr, "sampling", 8))
data->sampling = av_strdup(value);
else if (!strncmp(attr, "depth", 5))
data->depth = atoi(value);
--
2.49.1
From f1b3d804db08509fa122bb56fa28f52cb7ae42ac Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:28:49 +0100
Subject: [PATCH 415/434] avformat/rtpdec_rfc4175: Check dimensions
Fixes: out of array access
Fixes: zeropath/int_overflow_in_rtpdec_rfc4175
Found-by: Joshua Rogers <joshua@joshua.hu>
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4e0d5ed48aa9c0e11b9ddeea8c2d14632314089)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtpdec_rfc4175.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index c41e4f19e0..4ad69500aa 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -24,6 +24,7 @@
#include "avio_internal.h"
#include "rtpdec_formats.h"
#include "libavutil/avstring.h"
+#include "libavutil/imgutils.h"
#include "libavutil/mem.h"
#include "libavutil/pixdesc.h"
#include "libavutil/parseutils.h"
@@ -186,6 +187,9 @@ static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index,
if (ret < 0)
return ret;
+ ret = av_image_check_size(data->width, data->height, 0, s);
+ if (ret < 0)
+ return ret;
if (!data->sampling || !data->depth || !data->width || !data->height)
return AVERROR(EINVAL);
@@ -296,6 +300,9 @@ static int rfc4175_handle_packet(AVFormatContext *ctx, PayloadContext *data,
if (data->interlaced)
line = 2 * line + field;
+ if (line >= data->height)
+ return AVERROR_INVALIDDATA;
+
/* prevent ill-formed packets to write after buffer's end */
copy_offset = (line * data->width + offset) * data->pgroup / data->xinc;
if (copy_offset + length > data->frame_size || !data->frame)
--
2.49.1
From a218e6a6e5bfbd35319d72e25b8980ed311948a9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 16:27:56 +0100
Subject: [PATCH 416/434] avformat/rtpdec_rfc4175: Only change PayloadContext
on success
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c03e49dd1d8ee2dd21c24002dfac95644c830498)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/rtpdec_rfc4175.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index 4ad69500aa..b49fc55d2d 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -23,6 +23,7 @@
#include "avio_internal.h"
#include "rtpdec_formats.h"
+#include "libavutil/avassert.h"
#include "libavutil/avstring.h"
#include "libavutil/imgutils.h"
#include "libavutil/mem.h"
@@ -173,33 +174,39 @@ static int rfc4175_parse_fmtp(AVFormatContext *s, AVStream *stream,
}
static int rfc4175_parse_sdp_line(AVFormatContext *s, int st_index,
- PayloadContext *data, const char *line)
+ PayloadContext *data_arg, const char *line)
{
const char *p;
if (st_index < 0)
return 0;
+ av_assert0(!data_arg->sampling);
+
if (av_strstart(line, "fmtp:", &p)) {
AVStream *stream = s->streams[st_index];
+ PayloadContext data0 = *data_arg, *data = &data0;
int ret = ff_parse_fmtp(s, stream, data, p, rfc4175_parse_fmtp);
+ if (!data->sampling || !data->depth || !data->width || !data->height)
+ ret = AVERROR(EINVAL);
+
if (ret < 0)
- return ret;
+ goto fail;
ret = av_image_check_size(data->width, data->height, 0, s);
if (ret < 0)
- return ret;
-
- if (!data->sampling || !data->depth || !data->width || !data->height)
- return AVERROR(EINVAL);
+ goto fail;
stream->codecpar->width = data->width;
stream->codecpar->height = data->height;
ret = rfc4175_parse_format(stream, data);
av_freep(&data->sampling);
-
+ if (ret >= 0)
+ *data_arg = *data;
+fail:
+ av_freep(&data->sampling);
return ret;
}
--
2.49.1
From 0f843a8f6227159cd764f965bf64075c89d62155 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 13 Jul 2025 01:34:17 +0200
Subject: [PATCH 417/434] avcodec/osq: Fix 32bit sample overflow
Fixes: signed integer overflow: 2147483565 + 128 cannot be represented in type 'int'
Fixes: 428055715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6358069900804096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08816b93760f43433a07e980fa9eeab4135de78c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/osq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index fbb879ec8d..39743acbcc 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -390,7 +390,7 @@ static int osq_decode_block(AVCodecContext *avctx, AVFrame *frame)
int32_t *src = s->decode_buffer[ch] + OFFSET;
for (int n = 0; n < nb_samples; n++)
- dst[n] = av_clip_uint8(src[n] + 0x80);
+ dst[n] = av_clip_uint8(src[n] + 0x80ll);
}
break;
case AV_SAMPLE_FMT_S16P:
--
2.49.1
From 431e580424d434e7debc755f1e7c0cb5d1172a7f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 8 Nov 2025 23:22:56 +0100
Subject: [PATCH 418/434] avcodec/utvideodec: Set B for the width= 1 case in
restore_median_planar_il()
Fixes: use of uninitialized memory
Fixes: 439878388/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer-5635866203848704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59db32b433ea9e7766ec7fac994860ed15d7ed7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/utvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index bc02ac44d5..098706b705 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -457,7 +457,7 @@ static void restore_median_planar_il(UtvideoContext *c, uint8_t *src, ptrdiff_t
// second line - first element has top prediction, the rest uses median
C = bsrc[-stride2];
bsrc[0] += C;
- A = bsrc[0];
+ A = B = bsrc[0];
for (i = 1; i < FFMIN(width, 16); i++) { /* scalar loop (DSP need align 16) */
B = bsrc[i - stride2];
bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C));
--
2.49.1
From efd6f75cfcc3f5d74537db793e3ca77887df54aa Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 31 Oct 2025 23:31:40 +0100
Subject: [PATCH 419/434] avcodec/mediacodecdec_common: Check that the input to
mediacodec_wrap_sw_audio_buffer() contains channel * sample_size
Fixes: out of array access
no testcase
Found-by: Joshua Rogers <joshua@joshua.hu> with ZeroPath
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41a9c6ec5f75d8737da3e38223b8c4e923703401)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mediacodecdec_common.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c
index 8a270f2f29..842a7d2bba 100644
--- a/libavcodec/mediacodecdec_common.c
+++ b/libavcodec/mediacodecdec_common.c
@@ -385,6 +385,12 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx,
goto done;
}
+ if (info->size % (sample_size * avctx->ch_layout.nb_channels)) {
+ av_log(avctx, AV_LOG_ERROR, "input is not a multiple of channels * sample_size\n");
+ ret = AVERROR(EINVAL);
+ goto done;
+ }
+
frame->format = avctx->sample_fmt;
frame->sample_rate = avctx->sample_rate;
frame->nb_samples = info->size / (sample_size * avctx->ch_layout.nb_channels);
--
2.49.1
From 6486588d79c5468bfe1077bb32e4db4e92094e1c Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 1 Nov 2025 01:29:32 +0100
Subject: [PATCH 420/434] avfilter/vf_drawtext: Account for bbox text seperator
Fixes: out of array access
no test case
Found-by: Joshua Rogers <joshua@joshua.hu> with ZeroPath
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad956ff076ea808e5d64c9ac17c1bfc1ba7d0cc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_drawtext.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c
index daaa1fd83a..232e4015fb 100644
--- a/libavfilter/vf_drawtext.c
+++ b/libavfilter/vf_drawtext.c
@@ -1017,7 +1017,7 @@ static av_cold int init(AVFilterContext *ctx)
av_log(ctx, AV_LOG_WARNING, "Multiple texts provided, will use text_source only\n");
av_free(s->text);
}
- s->text = av_mallocz(AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE *
+ s->text = av_mallocz((AV_DETECTION_BBOX_LABEL_NAME_MAX_SIZE + 1) *
(AV_NUM_DETECTION_BBOX_CLASSIFY + 1));
if (!s->text)
return AVERROR(ENOMEM);
--
2.49.1
From 73d003ae785bad81fe8c82b19152369054c6d2e6 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 19 Nov 2025 16:46:11 +0100
Subject: [PATCH 421/434] updatze for 7.1.3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 36 ++++++++++++++++++++++++++++++++++++
RELEASE | 2 +-
doc/Doxyfile | 2 +-
3 files changed, 38 insertions(+), 2 deletions(-)
diff --git a/Changelog b/Changelog
index b8f15aabb7..0d216e7782 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,42 @@
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
+version 7.1.3:
+ avfilter/vf_drawtext: Account for bbox text seperator
+ avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size
+ avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il()
+ avcodec/osq: Fix 32bit sample overflow
+ avformat/rtpdec_rfc4175: Only change PayloadContext on success
+ avformat/rtpdec_rfc4175: Check dimensions
+ avformat/rtpdec_rfc4175: Fix memleak of sampling
+ avformat/http: Fix off by 1 error
+ avcodec/exr: spelling
+ avcodec/exr: use tile dimensions in pxr24 UINT case
+ avcodec/exr: Simple check for available channels
+ avformat/sctp: Check size in sctp_write()
+ avformat/rtmpproto: consider command line argument lengths
+ avformat/rtmpproto_ Check tcurl and flashver length
+ avcodec/g723_1enc: Make min_err 64bit
+ avcodec/vlc: Clear val8/16 in vlc_multi_gen() by av_mallocz()
+ avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc()
+ swscale/output: Fix integer overflow in yuv2ya16_X_c_template()
+ avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI
+ avcodec/exr: Check that DWA has 3 channels
+ avcodec/exr: check ac_size
+ avcodec/exr: Round dc_w/h up
+ avcodec/mjpegdec: Explain buf_size/width/height check
+ avformat/aviobuf: Keep checksum_ptr consistent in avio_seek()
+ fftools/ffmpeg_sched: prevent demuxers from getting stuck
+ lavc/aarch64: Fix addp overflow in ff_pred16x16_plane_neon_10
+ avcodec/mlpdec: don't depend on context channel layout when setting substream masks
+ avformat/demux: pass new extradata to the parser
+ avcodec/svq1enc: restrict Altivec acceleration to big-endian POWER configurations
+ libavutil/arm: Rename the HWCAP defines
+ libavutil/arm: Make use of elf_aux_info() on FreeBSD/OpenBSD
+ avcodec/decode: sync initial_pict_type and intra_only_flag with thread worker's avctx
+ avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction
+
+
version 7.1.2:
doc/examples/vaapi_encode: fix invalid check on fwrite
avcodec/librsvgdec: fix compilation with librsvg 2.50.3
diff --git a/RELEASE b/RELEASE
index a8a1887568..1996c50447 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-7.1.2
+7.1.3
diff --git a/doc/Doxyfile b/doc/Doxyfile
index abae13898b..0493482049 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
-PROJECT_NUMBER = 7.1.2
+PROJECT_NUMBER = 7.1.3
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
--
2.49.1
From baee5f5e2751b61572abe23a8f8a0042d27c89e6 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 17 Jan 2025 00:05:31 -0300
Subject: [PATCH 422/434] avformat/avformat: also clear FFFormatContext packet
queue when closing a muxer
packet_buffer is used in mux.c, and if a muxing process fails at a point where
packets remained in said queue, they will leak.
Fixes ticket #11419
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c08d300481b8ebb846cd43a473988fdbc6793d1b)
---
libavformat/avformat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/avformat.c b/libavformat/avformat.c
index 06dcde0565..4f93887148 100644
--- a/libavformat/avformat.c
+++ b/libavformat/avformat.c
@@ -184,6 +184,7 @@ void avformat_free_context(AVFormatContext *s)
av_dict_free(&si->id3v2_meta);
av_packet_free(&si->pkt);
av_packet_free(&si->parse_pkt);
+ avpriv_packet_list_free(&si->packet_buffer);
av_freep(&s->streams);
av_freep(&s->stream_groups);
ff_flush_packet_queue(s);
--
2.49.1
From bdc11c44b15be12f8eebef1cb3bfcda240a31d00 Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 14 Nov 2025 16:23:10 +0800
Subject: [PATCH 423/434] avfilter/vf_drawtext: fix incorrect text length
From the doc of HarfBuzz, what hb_buffer_add_utf8 needs is the
number of bytes, not Unicode character:
hb_buffer_add_utf8(buf, text, strlen(text), 0, strlen(text));
Fix issue #20906.
(cherry picked from commit 9bc3c572eaaab559a7258c392528e7a1cad2a9b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_drawtext.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c
index 232e4015fb..d8737a2145 100644
--- a/libavfilter/vf_drawtext.c
+++ b/libavfilter/vf_drawtext.c
@@ -1395,7 +1395,6 @@ static int measure_text(AVFilterContext *ctx, TextMetrics *metrics)
DrawTextContext *s = ctx->priv;
char *text = s->expanded_text.str;
char *textdup = NULL, *start = NULL;
- int num_chars = 0;
int width64 = 0, w64 = 0;
int cur_min_y64 = 0, first_max_y64 = -32000;
int first_min_x64 = 32000, last_max_x64 = -32000;
@@ -1458,7 +1457,7 @@ continue_on_failed2:
TextLine *cur_line = &s->lines[line_count];
HarfbuzzData *hb = &cur_line->hb_data;
cur_line->cluster_offset = line_offset;
- ret = shape_text_hb(s, hb, start, num_chars);
+ ret = shape_text_hb(s, hb, start, p - start);
if (ret != 0) {
goto done;
}
@@ -1516,14 +1515,12 @@ continue_on_failed2:
if (w64 > width64) {
width64 = w64;
}
- num_chars = -1;
start = p;
++line_count;
line_offset = i + 1;
}
if (code == 0) break;
- ++num_chars;
}
metrics->line_height64 = s->face->size->metrics.height;
--
2.49.1
From 19bc0ef3f3ea33659ad9650e1424686c7931e44d Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 14 Nov 2025 16:53:07 +0800
Subject: [PATCH 424/434] avfilter/vf_drawtext: fix call GET_UTF8 with invalid
argument
For GET_UTF8(val, GET_BYTE, ERROR), val has type of uint32_t,
GET_BYTE must return an unsigned integer, otherwise signed
extension happened due to val= (GET_BYTE), and GET_UTF8 went to
the error path.
This bug incidentally cancelled the bug where hb_buffer_add_utf8
was being called with incorrect argument, allowing drawtext to
function correctly on x86 and macOS ARM, which defined char as
signed. However, on Linux and Android ARM environments, because
char is unsigned by default, GET_UTF8 now returns the correct
return, which unexpectedly revealed issue #20906.
(cherry picked from commit a5cc0e5c9e752f98e38c2a95a0893faeb1f78fa9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_drawtext.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c
index d8737a2145..dccc534bbc 100644
--- a/libavfilter/vf_drawtext.c
+++ b/libavfilter/vf_drawtext.c
@@ -1394,7 +1394,7 @@ static int measure_text(AVFilterContext *ctx, TextMetrics *metrics)
{
DrawTextContext *s = ctx->priv;
char *text = s->expanded_text.str;
- char *textdup = NULL, *start = NULL;
+ char *textdup = NULL;
int width64 = 0, w64 = 0;
int cur_min_y64 = 0, first_max_y64 = -32000;
int first_min_x64 = 32000, last_max_x64 = -32000;
@@ -1404,7 +1404,7 @@ static int measure_text(AVFilterContext *ctx, TextMetrics *metrics)
Glyph *glyph = NULL;
int i, tab_idx = 0, last_tab_idx = 0, line_offset = 0;
- char* p;
+ uint8_t *start, *p;
int ret = 0;
// Count the lines and the tab characters
--
2.49.1
From 87e1bea70b4ba3fc54e614298bcc3c415c042c2e Mon Sep 17 00:00:00 2001
From: Zhao Zhili <zhilizhao@tencent.com>
Date: Fri, 14 Nov 2025 17:23:22 +0800
Subject: [PATCH 425/434] avutil/common: cast GET_BYTE/GET_16BIT returned value
In case of GET_BYTE/GET_16BIT return signed value.
(cherry picked from commit 0ae8df5f2ceea82337a2456ef16f930faf160189)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavutil/common.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavutil/common.h b/libavutil/common.h
index 3b830daf30..bf23aa50b0 100644
--- a/libavutil/common.h
+++ b/libavutil/common.h
@@ -486,13 +486,13 @@ static av_always_inline av_const int av_parity_c(uint32_t v)
* to prevent undefined results.
*/
#define GET_UTF8(val, GET_BYTE, ERROR)\
- val= (GET_BYTE);\
+ val= (uint8_t)(GET_BYTE);\
{\
uint32_t top = (val & 128) >> 1;\
if ((val & 0xc0) == 0x80 || val >= 0xFE)\
{ERROR}\
while (val & top) {\
- unsigned int tmp = (GET_BYTE) - 128;\
+ unsigned int tmp = (uint8_t)(GET_BYTE) - 128;\
if(tmp>>6)\
{ERROR}\
val= (val<<6) + tmp;\
@@ -511,11 +511,11 @@ static av_always_inline av_const int av_parity_c(uint32_t v)
* typically a goto statement.
*/
#define GET_UTF16(val, GET_16BIT, ERROR)\
- val = (GET_16BIT);\
+ val = (uint16_t)(GET_16BIT);\
{\
unsigned int hi = val - 0xD800;\
if (hi < 0x800) {\
- val = (GET_16BIT) - 0xDC00;\
+ val = (uint16_t)(GET_16BIT) - 0xDC00;\
if (val > 0x3FFU || hi > 0x3FFU)\
{ERROR}\
val += (hi<<10) + 0x10000;\
--
2.49.1
From f46e514491172d15bd74b4abb1814cd2f05a763e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 21 Nov 2025 00:07:39 +0100
Subject: [PATCH 426/434] Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
Changelog | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Changelog b/Changelog
index 0d216e7782..baf2071723 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,10 @@ Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 7.1.3:
+ avutil/common: cast GET_BYTE/GET_16BIT returned value
+ avfilter/vf_drawtext: fix call GET_UTF8 with invalid argument
+ avfilter/vf_drawtext: fix incorrect text length
+ avformat/avformat: also clear FFFormatContext packet queue when closing a muxer
avfilter/vf_drawtext: Account for bbox text seperator
avcodec/mediacodecdec_common: Check that the input to mediacodec_wrap_sw_audio_buffer() contains channel * sample_size
avcodec/utvideodec: Set B for the width= 1 case in restore_median_planar_il()
--
2.49.1
From a66541324862703c2442e7f4ca501e9016c26769 Mon Sep 17 00:00:00 2001
From: Niklas Haas <git@haasn.dev>
Date: Wed, 24 Sep 2025 15:14:29 +0200
Subject: [PATCH 427/434] avfilter/buffersrc: add av_buffersrc_get_status()
There is currently no way for API users to know that a buffersrc is no longer
accepting input, except by trying to feed it a frame and seeing what happens.
Of course, this is not possible if the user does not *have* a frame to feed,
but may still wish to know if the filter is still accepting input or not.
Since passing `frame == NULL` to `av_buffersrc_add_frame()` is already treated
as closing the input, we are left with no choice but to introduce a new
function for this.
We don't explicitly return the result of `ff_outlink_get_status()` to avoid
leaking internal status codes, and instead translate them all to AVERROR(EOF).
Backported-from: 623669a02cd6cdc5598801bf31fd77199e61bae1
---
doc/APIchanges | 3 +++
libavfilter/buffersrc.c | 10 ++++++++++
libavfilter/buffersrc.h | 8 ++++++++
libavfilter/version.h | 2 +-
4 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/doc/APIchanges b/doc/APIchanges
index 924a2b279e..7795b6b2dd 100644
--- a/doc/APIchanges
+++ b/doc/APIchanges
@@ -2,6 +2,9 @@ The last version increases of all libraries were on 2024-03-07
API changes, most recent first:
+2025-09-xx - xxxxxxxxxx - lavfi 10.5.100 - buffersrc.h
+ Add av_buffersrc_get_status().
+
2024-09-23 - 6940a6de2f0 - lavu 59.38.100 - frame.h
Add AV_FRAME_DATA_VIEW_ID.
diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c
index ec5898fcf9..f9b2061948 100644
--- a/libavfilter/buffersrc.c
+++ b/libavfilter/buffersrc.c
@@ -283,6 +283,16 @@ int av_buffersrc_close(AVFilterContext *ctx, int64_t pts, unsigned flags)
return (flags & AV_BUFFERSRC_FLAG_PUSH) ? push_frame(ctx->graph) : 0;
}
+int av_buffersrc_get_status(AVFilterContext *ctx)
+{
+ BufferSourceContext *s = ctx->priv;
+
+ if (!s->eof && ff_outlink_get_status(ctx->outputs[0]))
+ s->eof = 1;
+
+ return s->eof ? AVERROR(EOF) : 0;
+}
+
static av_cold int init_video(AVFilterContext *ctx)
{
BufferSourceContext *c = ctx->priv;
diff --git a/libavfilter/buffersrc.h b/libavfilter/buffersrc.h
index 6f3344f445..4bc8fba14e 100644
--- a/libavfilter/buffersrc.h
+++ b/libavfilter/buffersrc.h
@@ -208,6 +208,14 @@ int av_buffersrc_add_frame_flags(AVFilterContext *buffer_src,
*/
int av_buffersrc_close(AVFilterContext *ctx, int64_t pts, unsigned flags);
+/**
+ * Returns 0 or a negative AVERROR code. Currently, this will only ever
+ * return AVERROR(EOF), to indicate that the buffer source has been closed,
+ * either as a result of av_buffersrc_close(), or because the downstream
+ * filter is no longer accepting new data.
+ */
+int av_buffersrc_get_status(AVFilterContext *ctx);
+
/**
* @}
*/
diff --git a/libavfilter/version.h b/libavfilter/version.h
index 4d8f28e512..523a7fe0a6 100644
--- a/libavfilter/version.h
+++ b/libavfilter/version.h
@@ -31,7 +31,7 @@
#include "version_major.h"
-#define LIBAVFILTER_VERSION_MINOR 4
+#define LIBAVFILTER_VERSION_MINOR 5
#define LIBAVFILTER_VERSION_MICRO 100
--
2.49.1
From 9e3030bc440e07887b787ae4a5bf407ff8548c75 Mon Sep 17 00:00:00 2001
From: Niklas Haas <git@haasn.dev>
Date: Wed, 24 Sep 2025 15:23:04 +0200
Subject: [PATCH 428/434] fftools/ffmpeg_filter: close all no-longer needed
inputs
Currently, the thread loop of ffmpeg_filter essentially works like this:
while (1) {
frame, idx = get_from_decoder();
err = send_to_filter_graph(frame);
if (err) { // i.e. EOF
close_input(idx);
continue;
}
while (filtered_frame = get_filtered_frame())
send_to_encoder(filtered_frame);
}
The exact details are not 100% correct since the actual control flow is a bit
more complicated as a result of the scheduler, but this is the general flow.
Notably, this leaves the possibility of leaving a no-longer-needed input
permanently open if the filter graph starts producing infinite frames (during
the second loop) *after* it finishes reading from an input, e.g. in a filter
graph like -af atrim,apad.
This patch avoids this issue by always querying the status of all filter graph
inputs and explicitly closing any that were closed downstream; after each round
of reading output frames. As a result, information about the filtergraph being
closed can now propagate back upstream, even if the filter is no longer
requesting any input frames (i.e. input_idx == fg->nb_inputs).
Fixes: https://trac.ffmpeg.org/ticket/11061
See-Also: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20457#issuecomment-6208
Backported-from: 38a5fcc02c2ef1bcb37d2e53eddde8eccc0c75ed
During backporting, I had to change the signature of `close_input()` to
`void close_input(FilterGraph *fg, int input_idx)` since this version of
FFmpeg does not contain a reference to the input index in the InputFilterPriv.
---
fftools/ffmpeg_filter.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c
index 3ef6818c72..4eec8fed7b 100644
--- a/fftools/ffmpeg_filter.c
+++ b/fftools/ffmpeg_filter.c
@@ -2365,6 +2365,18 @@ finish:
fps->dropped_keyframe |= fps->last_dropped && (frame->flags & AV_FRAME_FLAG_KEY);
}
+static void close_input(FilterGraph *fg, int input_idx)
+{
+
+ InputFilterPriv *ifp = ifp_from_ifilter(fg->inputs[input_idx]);
+ FilterGraphPriv *fgp = fgp_from_fg(ifp->ifilter.graph);
+
+ if (!ifp->eof) {
+ sch_filter_receive_finish(fgp->sch, fgp->sch_idx, input_idx);
+ ifp->eof = 1;
+ }
+}
+
static int close_output(OutputFilterPriv *ofp, FilterGraphThread *fgt)
{
FilterGraphPriv *fgp = fgp_from_fg(ofp->ofilter.graph);
@@ -3035,7 +3047,7 @@ static int filter_thread(void *arg)
if (ret == AVERROR_EOF) {
av_log(fg, AV_LOG_VERBOSE, "Input %u no longer accepts new data\n",
input_idx);
- sch_filter_receive_finish(fgp->sch, fgp->sch_idx, input_idx);
+ close_input(fg, input_idx);
continue;
}
if (ret < 0)
@@ -3052,6 +3064,13 @@ read_frames:
av_err2str(ret));
goto finish;
}
+
+ // ensure all inputs no longer accepting data are closed
+ for (int i = 0; fgt.graph && i < fg->nb_inputs; i++) {
+ InputFilterPriv *ifp = ifp_from_ifilter(fg->inputs[i]);
+ if (av_buffersrc_get_status(ifp->filter))
+ close_input(fg, i);
+ }
}
for (unsigned i = 0; i < fg->nb_outputs; i++) {
--
2.49.1
From a2a67282859904283f1008e1ce0a7f6bc1e71757 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 25 Nov 2025 10:26:27 -0300
Subject: [PATCH 429/434] avformat/iamf_parse: ensure each layout in an
scalable channel representation has an increasing number of channels
Fixes issue #21013
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 554ae5ada98cd44686ade995102d3aa2295d7b09)
---
libavformat/iamf_parse.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index a7a2b7deb5..b0a166ba1f 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -398,6 +398,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
.nb_channels = substream_count +
coupled_substream_count };
+ if (i && ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels)
+ return AVERROR_INVALIDDATA;
+
for (int j = 0; j < substream_count; j++) {
IAMFSubStream *substream = &audio_element->substreams[k++];
--
2.49.1
From 9403cdd6e86efa4992b9322436e07d76e32da66a Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Tue, 25 Nov 2025 12:42:30 -0300
Subject: [PATCH 430/434] avformat/iamf_parse: ensure the stream count in a
scalable channel representation is equal to the audio element's stream count
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit faa382e5b196f2acb5bc5b159aaf06682291328b)
---
libavformat/iamf_parse.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index b0a166ba1f..8ea9616ec7 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -414,6 +414,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
}
+ if (k != audio_element->nb_substreams)
+ return AVERROR_INVALIDDATA;
+
return 0;
}
--
2.49.1
From 46293e9905f1bfd0e4576c7a5ac41a92cc6f4c4d Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 24 Sep 2025 20:31:11 -0300
Subject: [PATCH 431/434] avfilter/framesync: don't attempt to rescale
AV_NOPTS_VALUE
Part of a fix for issue #20589.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavfilter/framesync.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/framesync.c b/libavfilter/framesync.c
index 0d5779f830..846d1c7e50 100644
--- a/libavfilter/framesync.c
+++ b/libavfilter/framesync.c
@@ -248,7 +248,7 @@ static void framesync_inject_frame(FFFrameSync *fs, unsigned in, AVFrame *frame)
av_assert0(!fs->in[in].have_next);
av_assert0(frame);
- pts = av_rescale_q(frame->pts, fs->in[in].time_base, fs->time_base);
+ pts = av_rescale_q_rnd(frame->pts, fs->in[in].time_base, fs->time_base, AV_ROUND_NEAR_INF | AV_ROUND_PASS_MINMAX);
frame->pts = pts;
fs->in[in].frame_next = frame;
fs->in[in].pts_next = pts;
--
2.49.1
From c0e599e9d83a80cf1002c62684ecd90ae8776efd Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Wed, 24 Sep 2025 20:31:26 -0300
Subject: [PATCH 432/434] avfilter/vf_scale: don't attempt to rescale
AV_NOPTS_VALUE
Finishes fixing issue #20589.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavfilter/vf_scale.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 3319428d9c..420dc13dc5 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -1119,7 +1119,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
goto err;
av_assert0(out);
- out->pts = av_rescale_q(fs->pts, fs->time_base, outlink->time_base);
+ out->pts = av_rescale_q_rnd(fs->pts, fs->time_base, outlink->time_base, AV_ROUND_NEAR_INF | AV_ROUND_PASS_MINMAX);
return ff_filter_frame(outlink, out);
err:
--
2.49.1
From f65fc0b13754c94d6185b1b18e604b8129d4f774 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 28 Nov 2025 09:51:36 -0300
Subject: [PATCH 433/434] avformat/iamf_parse: fix compilation error
Regression since a2a67282859904283f1008e1ce0a7f6bc1e71757.
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavformat/iamf_parse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 8ea9616ec7..8fe7e1bb0e 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -398,7 +398,7 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
.nb_channels = substream_count +
coupled_substream_count };
- if (i && ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels)
+ if (i && layer->ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels)
return AVERROR_INVALIDDATA;
for (int j = 0; j < substream_count; j++) {
--
2.49.1
From 1291bd52318ad29235d792530340b08bfab1fc5b Mon Sep 17 00:00:00 2001
From: Gyan Doshi <ffmpeg@gyani.pro>
Date: Sun, 28 Sep 2025 13:20:23 +0530
Subject: [PATCH 434/434] configure: unbreak glslang build
Don't unconditionally link to libSPVRemapper which was removed in 16.0 in 3a7f787
---
configure | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/configure b/configure
index 98b582a5d5..32b920240f 100755
--- a/configure
+++ b/configure
@@ -6917,12 +6917,16 @@ enabled libfontconfig && require_pkg_config libfontconfig fontconfig "fontco
enabled libfreetype && require_pkg_config libfreetype freetype2 "ft2build.h FT_FREETYPE_H" FT_Init_FreeType
enabled libfribidi && require_pkg_config libfribidi fribidi fribidi.h fribidi_version_info
enabled libharfbuzz && require_pkg_config libharfbuzz harfbuzz hb.h hb_buffer_create
-enabled libglslang && { check_lib spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
+if enabled libglslang; then
+ spvremap="-lSPVRemapper"
+ require_headers "glslang/build_info.h" && { test_cpp_condition glslang/build_info.h "GLSLANG_VERSION_MAJOR >= 16" && spvremap="" ; }
+ check_lib spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
-lglslang -lMachineIndependent -lGenericCodeGen \
- -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
+ ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
require spirv_compiler glslang/Include/glslang_c_interface.h glslang_initialize_process \
-lglslang -lMachineIndependent -lOSDependent -lHLSL -lOGLCompiler -lGenericCodeGen \
- -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ; }
+ ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ;
+fi
enabled libgme && { check_pkg_config libgme libgme gme/gme.h gme_new_emu ||
require libgme gme/gme.h gme_new_emu -lgme -lstdc++; }
enabled libgsm && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
reply other threads:[~2025-11-30 9:59 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=176449663490.39.9923581798435465624@2cb04c0e5124 \
--to=ffmpeg-devel@ffmpeg.org \
--cc=code@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git