During USAC decoding (ff_aac_usac_decode_frame), configuration elements
can be mapped and instantiated via che_configure(). For newly allocated
ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which
dynamically allocates ac->che[type][id]. However, che_configure did not
subsequently map the output pointer of the nested SingleChannelElement
elements back to their statically-sized internal ret_buf arrays, causing
a null pointer dereference during IMDCT windowing.
The fix explicitly initializes these pointers following allocation.
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
(cherry picked from commit 8319541103)
call_kernel() obtains the command buffer and compute encoder from
property getters (mtlQueue.commandBuffer, buffer.computeCommandEncoder),
which return autoreleased references under the non-ARC build, and then
releases them via ff_objc_release(). That is an over-release: when the
enclosing autorelease pool is drained, the objects are released a second
time and the process crashes with EXC_BAD_ACCESS in objc_release.
On current macOS this is reproducible with the ffmpeg CLI itself. The
filter thread's thread-local autorelease pool is popped during pthread
TSD cleanup at thread exit, so any run that used yadif_videotoolbox
crashes when the filter thread terminates:
ffmpeg -init_hw_device videotoolbox=vt -filter_hw_device vt \
-f lavfi -i testsrc2=size=640x480:rate=30 \
-vf setfield=tff,format=nv12,hwupload,yadif_videotoolbox,\
hwdownload,format=nv12 -frames:v 20 -f null -
Thread 11 Crashed:: vf#0:0
0 libobjc.A.dylib objc_release + 16
1 libobjc.A.dylib AutoreleasePoolPage::releaseUntil(objc_object**) + 204
2 libobjc.A.dylib objc_autoreleasePoolPop + 244
3 libobjc.A.dylib objc_tls_direct_base<...>::dtor_(void*) + 156
4 libsystem_pthread.dylib _pthread_tsd_cleanup + 620
5 libsystem_pthread.dylib _pthread_exit + 84
Host applications hit the same crash earlier, for example when a
dispatch queue drains its last-resort pool after a work item that ran
the filter.
Wrap the kernel invocation in @autoreleasepool and drop the manual
releases, making the pool pop the single balanced release and draining
the Metal transients once per frame. The ff_objc_release() calls on the
s->mtl* members in do_uninit() stay: those hold owned references
obtained from new* methods.
(cherry picked from commit 7f2e5cdd7c)
This amends 307983b292 to fix
building with older versions of mingw-w64.
The previously checked constant, SP_PROT_DTLS1_X_CLIENT, was
added in mingw-w64 in df36f5deda23192d0ee99ffd661ea36df924e667
in 2020, and is included in released versions since v8.0.0.
The new checked constant SECPKG_ATTR_DTLS_MTU was added in
mingw-w64 in 0792283787cca8fc27dd38671107c791c87f4db3 in 2021,
and first appeared in mingw-w64 v9.0.0.
This fixes building with mingw-w64 v8, which is the version bundled
in Ubuntu 22.04.
(cherry picked from commit f6bcd661f0)
When the furthest-behind stream is being fed by a demuxer that is also
feeding packets to a choked filter graph, we need to unchoke that filter
graph to prevent the demuxer from getting stuck trying to write packets to
the choked filter graph.
This situation can also apply recursively - if the demuxer is also writing
to a filtergraph that is also reading from a choked demuxer, there is a
similar deadlock.
Solve all such deadlocks by just brute-force recursively unchoking all
nodes that can somehow prevent this demuxer from writing packets. This
should normally not result in any change in behavior, unless audio/video
streams are badly desynchronized, in which case it may result in extra
memory usage from the too-far-ahead stream buffering packets inside the
muxer. (But this is, of course, preferable to a deadlock)
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20611
(cherry picked from commit 133a0bcb13)
The return value of MoveFileExW was not being correctly interpreted,
see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexw.
On Windows a failed rename over the file: protocol now surfaces as failed to rename file %s to %s:
Operation not permitted (ff_rename, libavformat/avio.c:867) plus an AVERROR(EPERM) return, where previously the muxer
reported success and the user was left with a missing or stale output file and no diagnostic. This affects the
write-to-temp-then-rename paths in hlsenc, dashenc, hdsenc, smoothstreamingenc, segment, and img2enc (e.g. HLS/DASH
playlist updates, -write_temp_file, segment list finalization).
Also, added unit tests to exercise the rename function.
Signed-off-by: Christopher Decker <chris.decker08@gmail.com>
(cherry picked from commit 94ff335d76)
Co-Authored-by: Fable 5
The encoded session parameters buffer was never freed, and both
GetEncodedVideoSessionParametersKHR error paths returned err, which
is always 0 at that point, reporting success on failure.
(cherry picked from commit b672ae3905)
Co-Authored-by: Fable 5
When the filter graph is torn down early (e.g. at EOF with -frames:v),
the main thread calls dnn_free_model and destroys the request queue
while async inference threads may still be running. When a detached
thread finishes and tries to push its result back to the destroyed
queue, it triggers a segmentation fault.
Add ff_dnn_wait_requests() to dnn_backend_common which blocks
until all allocated request items (ctx->nireq) have been safely
returned to the request_queue. Call it from dnn_free_model in the
torch, tensorflow, openvino, and onnx backends before destroying the queue.
(cherry picked from commit b52c71e438)
Co-Authored-by: Fable 5
This fixes#20995. The reference is taken twice and assigned to the same pointer (see above in the same function). Only the latter is needed.
(cherry picked from commit 66a8c37582)
tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).
Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.
The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.
dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.
Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
(cherry picked from commit 83c6922826)
Each pending packet consumes up to poc_diff tree nodes when it is
output, so the packets in the FIFO can consume at most nb_pending nodes
in total. Frames whose tree lookup misses on output leave their nodes
behind, and damaged or crafted streams can make that happen
indefinitely, growing the tree without limit.
Track the node count and insertion order, keep the leftovers of up to
MAX_DAMAGED_FRAMES frames and beyond that evict the nodes unconsumed
the longest. Timestamps of valid frames are unaffected unless more
frames than that are damaged. No eviction is done at EOF, where nodes
are deliberately kept to regenerate timestamps from.
Of all h264/hevc conformance samples only MR3_TANDBERG_B.264 triggers
evictions, and no sample changes output.
Fixes: unbounded memory growth with damaged streams
Co-Authored-By: Fable-5
(cherry picked from commit dd941af8ac)
alloc_and_insert_node() inserts the nodes for 2nd fields with
duration / poc_diff added to the timestamp, but the removal loop
compared all nodes of a frame against the unadjusted first timestamp,
so 2nd field nodes never matched and stayed in the tree until close.
Advance the compared timestamp the same way the insertion does.
Fixes: tree nodes leaking on every field coded frame
Co-Authored-By: Fable-5
(cherry picked from commit 4133db39b2)
ff_dxva2_common_end_frame() adds a reference to the decoder to
frame->buf[], so that the decoder outlives the frames decoded with it.
It is called from the hwaccel end_frame() callback, which with frame
threading may run after ff_thread_finish_setup(). From that point on,
other threads may copy the frame: the H.264 decoder keeps a separate
AVFrame per picture in each thread and synchronizes them in
update_thread_context() with av_frame_replace(), which reads
frame->buf[] while the decoding thread may be writing to it. As noted
in fa77cb258b ("avcodec/h264dec: Fix data race when updating
decode_error_flags"), a decoding thread must not modify any field that
av_frame_ref() copies after ff_thread_finish_setup().
This has been observed as an intermittent access violation in
av_buffer_replace() when decoding H.264 with D3D11VA and frame
threading on Windows on Arm: the copying thread read a non-NULL
frame->buf[1] entry, but saw the fields of the AVBufferRef it points
to as zero, and dereferenced the NULL buffer pointer when incrementing
the reference count.
Store the decoder reference in FrameDecodeData.hwaccel_priv instead,
as nvdec does for its per-frame state. The decode data is attached to
frame->private_ref when the buffer is allocated, before
ff_thread_finish_setup(), and all references to the frame share it, so
update_thread_context() only takes a new reference to it. The decoder
reference is added to frame->buf[] by hwaccel_priv_post_process(),
which runs in the caller's thread when the frame is returned, so
returned frames keep the decoder alive. Since the decode data
is shared, the second field of a field pair no longer adds a second
decoder reference to the frame.
Signed-off-by: Diego de Souza <ddesouza@nvidia.com>
(cherry picked from commit 538d10d187)
Leave the existing one for non decoder-specific, post processing usage.
With this, scenarios like nvdec decoding can work algonside lcevc enhancement application.
Signed-off-by: James Almer <jamrial@gmail.com>
Limit the 8-bit column filter to the pixels remaining in the current slice. Pass slice_end - y at all three call sites so both the 8-bit and high-bit-depth column filters receive the correct remaining width. This handles partial 16-pixel blocks at frame and thread-slice boundaries. The non-column callbacks do not use this argument.
Fixes: #YWH-PGM40646-36
(cherry picked from commit 8b9e02cc17)
The decoder can't know where a seek landed, so the "delay_samples" way to
discard the decoder delay in the first frame is not truly viable, so it needs
to be removed.
Add a call to aacDecoder_DecodeFrame() with the AACDEC_CLRHIST flag set, as the
call to aacDecoder_SetParam() with the AAC_TPDEC_CLEAR_BUFFER setting was
seemingly not enough to truly flush all the fdkaac internal buffers.
Should fix issue #24527.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b894a6f7c1)
Shift timestamps when available, and take into account the caller requested
samples to be discarded alongside the decoder delay.
Should fix issue #24526.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c8595be8e6)
The code reads a mask afer this check, meaning it expects NATIVE order, not
others.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7755d264bd)
A format-only conversion leaves the auto use_filters value unresolved.
Regression since 5d0748243f.
Fix issue #23737
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit c57660fb18)
Assisted-by: Fairy
The capital V specifier as in '-c:V' is supposed to match only non-attached-pic video streams.
However, a user reported that apic streams were matched as well.
Confirmed by testing. Apparently a regression since before 3.4 (earliest ver I could test).
This happens because encoder selection occurs before stream dispositions are set.
Fixed by an initial assignment of disposition and retaining only the apic flag if present.
PR #24247
(cherry picked from commit 266fff15a0)
The output stream no longer has extension sub-streams, so the
declared input profile, if it was set, is no longer valid.
Fixes issue #24388.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7dc71230a9)
To determine whether the colocated picture is field coded, the temporal
and spatial direct setup peek at
sl->ref_list[1][0].parent->mb_type[mb_xy] before mb_xy has been remapped
to the colocated field's parity. That row belongs to the current field's
parity, while await_reference_mb_row() above waited on the parity of the
referenced field, so whenever the two differ the load is unsynchronised
and with frame threading can observe macroblocks of a field that is
still being decoded.
Every macroblock of a field picture has MB_TYPE_INTERLACED set, so
checking field_picture first gives the same result in all correctly
synchronized cases without touching the mb_type array.
This also fixes few TSAN reported warnings.
Fixes: https://trac.ffmpeg.org/ticket/10891
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c3a8a223b29260dc170d41c62f9b3b33f6b97b2d)
h264_frame_start() clears h->er.cur_pic, and decode_nal_units() only sets
it again for pictures that are not field coded, right before running error
concealment. A second field goes through neither, so h->er.cur_pic keeps
pointing at whatever frame coded picture the context decoded earlier.
With frame threading the two fields of a pair are decoded by different
contexts, so whether this triggers depends on what the context that picks
up the second field decoded before, which is why the number of bogus
warnings varies between runs.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit f1d318e5eb2eb487d2be4b4b721b93ae76fd5ba7)
src/libavcodec/mips/cabac.h:160:77: error: instruction requires a CPU feature not currently enabled
160 | PTR_SUBU "%[tmp1], %[c_low], %[tmp1] \n\t"
| ^
<inline asm>:13:2: note: instantiated into assembly here
13 | movz $15, $13, $24
| ^
OpenBSD targets MIPS III ISA.
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit 9432f85830)
Previously only the first thread's context and the user-facing one had
it, so frames decoded by the remaining worker threads were missing
global side data whenever the per-frame state could not provide it, e.g.
extradata-derived HDR metadata after avcodec_flush_buffers().
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c48230eb86)
When a frame coded picture uses a complementary field pair as its
colocated picture, ff_h264_direct_ref_list_init() selects the field whose
POC is closest to the current one and stores it in col_parity. The direct
mode setup then remaps mb_xy to that parity and reads the colocated
mb_type, motion_val and ref_index from it.
await_reference_mb_row() waits on the field given by "ref_field_picture &&
ref_field", which is 1 for any such reference, since the pair is
referenced as a frame and ref->reference is 3. Only the bottom field is
therefore awaited, while the data is just as likely to be read from the
top one. With frame threading the two fields are decoded by different
threads, so the colocated data can be read while the field it belongs to
is still being decoded, yielding stale motion vectors and a corrupt
frame. await_references() already handles the same case correctly for
motion compensation.
Fixes sporadic failures of fate-h264-conformance-cabac_mot_picaff0_full,
where display frame 14.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 274cb6731bd204e9537a7e588d4a3436fdf51b93)
The output stream no longer has Atmos metadata, so the
AV_PROFILE_TRUEHD_ATMOS profile, if it was set, is no longer valid.
Fixes issue #23195.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 86940d45af)
