[FFmpeg-devel] [PR] fix_av1 (PR #21468)

[Jun Zhao via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21468 opened by Jun Zhao (mypopydev)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21468
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21468.patch

Two commits: the first fixes missing padding for AV1 extradata in movenc by replacing av_memdup() with av_mallocz() + memcpy(), and the second extracts SAR from render_size in the AV1 parser for proper aspect ratio handling.


>From 3147e75bac677d5e269e708f9e9960989bdfdeae Mon Sep 17 00:00:00 2001
From: Jun Zhao <barryjzhao@tencent.com>
Date: Fri, 2 Jan 2026 10:35:22 +0800
Subject: [PATCH 1/2] lavc/av1_parser: Extract SAR from render_size

Extract the Sample Aspect Ratio (SAR) from render_width_minus_1 and
render_height_minus_1 in the sequence header.

The AV1 specification defines the render dimensions, which can be used
in conjunction with the coded dimensions to determine the pixel aspect
ratio. This ensures consistent aspect ratio handling for AV1 streams
encapsulated in containers like MP4 or MKV, as observed in the updated
FATE tests where SAR changes from 0/1 to 1/1.

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
---
 libavcodec/av1_parser.c                | 7 +++++++
 tests/ref/fate/av1-annexb-demux        | 2 +-
 tests/ref/fate/enhanced-flv-av1        | 2 +-
 tests/ref/fate/enhanced-flv-multitrack | 2 +-
 tests/ref/lavf-fate/av1.mkv            | 4 ++--
 tests/ref/lavf-fate/av1.mp4            | 4 ++--
 6 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/libavcodec/av1_parser.c b/libavcodec/av1_parser.c
index 32135a23cb..f221fee79f 100644
--- a/libavcodec/av1_parser.c
+++ b/libavcodec/av1_parser.c
@@ -134,6 +134,13 @@ static int av1_parser_parse(AVCodecParserContext *ctx,
             break;
         }
         ctx->picture_structure = AV_PICTURE_STRUCTURE_FRAME;
+
+        /* Extract SAR from render_height_minus_1 & render_width_minus_1 */
+        av_reduce(&avctx->sample_aspect_ratio.num,
+                  &avctx->sample_aspect_ratio.den,
+                  (int64_t)ctx->height * (frame->render_width_minus_1  + 1),
+                  (int64_t)ctx->width  * (frame->render_height_minus_1 + 1),
+                  INT_MAX);
     }
 
     switch (av1->bit_depth) {
diff --git a/tests/ref/fate/av1-annexb-demux b/tests/ref/fate/av1-annexb-demux
index 139a893ec1..77e0e378ab 100644
--- a/tests/ref/fate/av1-annexb-demux
+++ b/tests/ref/fate/av1-annexb-demux
@@ -3,7 +3,7 @@
 #media_type 0: video
 #codec_id 0: av1
 #dimensions 0: 300x300
-#sar 0: 0/1
+#sar 0: 1/1
 0,          0,          0,    48000,    12691, 0xf0adcc79
 0,      48000,      48000,    48000,     4975, 0x1742a45f, F=0x0
 0,      96000,      96000,    48000,      928, 0x7408be1a, F=0x0
diff --git a/tests/ref/fate/enhanced-flv-av1 b/tests/ref/fate/enhanced-flv-av1
index c50da5d430..b2a624e41e 100644
--- a/tests/ref/fate/enhanced-flv-av1
+++ b/tests/ref/fate/enhanced-flv-av1
@@ -3,7 +3,7 @@
 #media_type 0: video
 #codec_id 0: av1
 #dimensions 0: 320x176
-#sar 0: 0/1
+#sar 0: 1/1
 0,          0,          0,       41,     4718, 0xc4d912ec
 0,         42,         42,       41,     5109, 0xc065dd7d, F=0x0
 0,         83,         83,       41,      192, 0x160c5335, F=0x0
diff --git a/tests/ref/fate/enhanced-flv-multitrack b/tests/ref/fate/enhanced-flv-multitrack
index e3c5836bfa..f017e445ea 100644
--- a/tests/ref/fate/enhanced-flv-multitrack
+++ b/tests/ref/fate/enhanced-flv-multitrack
@@ -31,7 +31,7 @@
 #media_type 4: video
 #codec_id 4: av1
 #dimensions 4: 1920x1080
-#sar 4: 0/1
+#sar 4: 1/1
 #tb 5: 1/1000
 #media_type 5: audio
 #codec_id 5: flac
diff --git a/tests/ref/lavf-fate/av1.mkv b/tests/ref/lavf-fate/av1.mkv
index e6db3a814a..84924fe05c 100644
--- a/tests/ref/lavf-fate/av1.mkv
+++ b/tests/ref/lavf-fate/av1.mkv
@@ -1,3 +1,3 @@
-d875b42964dd55c8cea2e2752379d327 *tests/data/lavf-fate/lavf.av1.mkv
-55660 tests/data/lavf-fate/lavf.av1.mkv
+ba198efa114b4db3c9f772728f84978b *tests/data/lavf-fate/lavf.av1.mkv
+55656 tests/data/lavf-fate/lavf.av1.mkv
 tests/data/lavf-fate/lavf.av1.mkv CRC=0x7c27cc15
diff --git a/tests/ref/lavf-fate/av1.mp4 b/tests/ref/lavf-fate/av1.mp4
index 53b0cbe637..ef174589ba 100644
--- a/tests/ref/lavf-fate/av1.mp4
+++ b/tests/ref/lavf-fate/av1.mp4
@@ -1,3 +1,3 @@
-194cd796f3d28a890b516b2507f57180 *tests/data/lavf-fate/lavf.av1.mp4
-55960 tests/data/lavf-fate/lavf.av1.mp4
+d6afef355cf1bcf1a71b9cfb98c32fba *tests/data/lavf-fate/lavf.av1.mp4
+55976 tests/data/lavf-fate/lavf.av1.mp4
 tests/data/lavf-fate/lavf.av1.mp4 CRC=0x7c27cc15
-- 
2.49.1


>From 137b0370f371c76651395cdf505bf2a616aae7bb Mon Sep 17 00:00:00 2001
From: Jun Zhao <barryjzhao@tencent.com>
Date: Mon, 5 Jan 2026 21:47:22 +0800
Subject: [PATCH 2/2] lavf/movenc: fix missing padding for AV1 extradata

The extradata allocated in mov_write_single_packet() for AV1 was missing
the required AV_INPUT_BUFFER_PADDING_SIZE padding bytes. This could lead
to out-of-bounds reads when the extradata is parsed by bitstream readers.

Replace av_memdup() with av_mallocz() + memcpy() to ensure proper padding
is present and zeroed.

Reproduced with:
./ffmpeg -y -f lavfi -i "testsrc=duration=1:size=320x240:rate=30" -c:v libaom-av1 -cpu-used 8 -crf 50 test-av1.mp4

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
---
 libavformat/movenc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index e844be483c..649b9501d3 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -7205,9 +7205,11 @@ static int mov_write_single_packet(AVFormatContext *s, AVPacket *pkt)
         uint8_t *side = av_packet_get_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, &side_size);
         /* Overwrite extradata only on flush packets or when no extradata was available during init */
         if (side_size > 0 && (!pkt->size || !trk->extradata_size[trk->last_stsd_index])) {
-            void *newextra = av_memdup(side, side_size);
+            void *newextra;
+            newextra = av_mallocz(side_size + AV_INPUT_BUFFER_PADDING_SIZE);
             if (!newextra)
                 return AVERROR(ENOMEM);
+            memcpy(newextra, side, side_size);
             av_free(trk->extradata[trk->last_stsd_index]);
             trk->extradata[trk->last_stsd_index] = newextra;
             trk->extradata_size[trk->last_stsd_index] = side_size;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org