call_kernel() obtains the command buffer and compute encoder from
property getters (mtlQueue.commandBuffer, buffer.computeCommandEncoder),
which return autoreleased references under the non-ARC build, and then
releases them via ff_objc_release(). That is an over-release: when the
enclosing autorelease pool is drained, the objects are released a second
time and the process crashes with EXC_BAD_ACCESS in objc_release.
On current macOS this is reproducible with the ffmpeg CLI itself. The
filter thread's thread-local autorelease pool is popped during pthread
TSD cleanup at thread exit, so any run that used yadif_videotoolbox
crashes when the filter thread terminates:
ffmpeg -init_hw_device videotoolbox=vt -filter_hw_device vt \
-f lavfi -i testsrc2=size=640x480:rate=30 \
-vf setfield=tff,format=nv12,hwupload,yadif_videotoolbox,\
hwdownload,format=nv12 -frames:v 20 -f null -
Thread 11 Crashed:: vf#0:0
0 libobjc.A.dylib objc_release + 16
1 libobjc.A.dylib AutoreleasePoolPage::releaseUntil(objc_object**) + 204
2 libobjc.A.dylib objc_autoreleasePoolPop + 244
3 libobjc.A.dylib objc_tls_direct_base<...>::dtor_(void*) + 156
4 libsystem_pthread.dylib _pthread_tsd_cleanup + 620
5 libsystem_pthread.dylib _pthread_exit + 84
Host applications hit the same crash earlier, for example when a
dispatch queue drains its last-resort pool after a work item that ran
the filter.
Wrap the kernel invocation in @autoreleasepool and drop the manual
releases, making the pool pop the single balanced release and draining
the Metal transients once per frame. The ff_objc_release() calls on the
s->mtl* members in do_uninit() stay: those hold owned references
obtained from new* methods.
(cherry picked from commit 7f2e5cdd7c)
Limit the 8-bit column filter to the pixels remaining in the current slice. Pass slice_end - y at all three call sites so both the 8-bit and high-bit-depth column filters receive the correct remaining width. This handles partial 16-pixel blocks at frame and thread-slice boundaries. The non-column callbacks do not use this argument.
Fixes: #YWH-PGM40646-36
(cherry picked from commit 8b9e02cc17)
Fixes: out of array access
Fixes: division by zero
Fixes: vdfZuLhrGLdR
Found-by: zhang xingxing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 590fb407b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: division by zero
Fixes: tiny_16x8.h264
Fixes: W9IyRhjCcQxd
Found-by: zhang xingxing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c05ce65e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
vsnprintf() returns the number of characters that would have been written
when its output is truncated. Passing that value to avio_write() makes it
read beyond the 128-byte stack buffer for long metadata values.
Use avio_vprintf() to write the complete formatted string without the fixed
intermediate buffer.
Fixes: b0159af6bc
Signed-off-by: Yongqiang Tian <yqtian668@gmail.com>
(cherry picked from commit fd625f452c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: ndSS0e433gq
Found-by: Eunsoo Kim, Microsoft FORGE Labs
(cherry picked from commit 4d896a22dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
parse_channel_name() only rejects negative values on the named channel
path, while the numbered "c%d" path also checks against MAX_CHANNELS.
av_channel_from_string() accepts UNSD (512), UNK (768) and AMBI (1024),
and the id was then used directly to index used_in_ch[MAX_CHANNELS] on
the stack and pan->gain[out_ch_id][in_ch_id].
Before this change:
ffmpeg -f lavfi -i "anullsrc=cl=stereo" -af "pan=stereo|FL=AMBI" -f null -
af_pan.c:214:17: runtime error: index 1024 out of bounds for type 'int[64]'
The first out of bounds access is the read at the "reference twice"
check, so the symptom depends on what happens to be on the stack:
FL=UNK is silently accepted and produces silence, FL=UNSD reports
"Can not reference in channel 512 twice", and FL=AMBI aborts.
The check has to be at the caller and not in parse_channel_name(), which
is shared with the out channel path: there the named id is converted by
av_channel_layout_index_from_channel() into a layout index, so high ids
are legitimately supported and "pan=AMBI|AMBI=FL" works.
AVERROR_PATCHWELCOME is used because these are valid AVChannel values
that af_pan cannot represent: for named input channels the gain matrix is
indexed by the raw id, and the renumbering loop in config_props() is
bounded by MAX_CHANNELS as well, so such a mapping never worked.
The in_ch_id < 0 half is currently unreachable and only kept for symmetry
with the out channel check above.
Regression since 1f96db959c, which dropped
the "channel_id >= MAX_CHANNELS" part of the check when converting to the
new channel layout API.
Reported-by: karnakarreddi
Fixes: #22963
Signed-off-by: iSold Leo <s@qwqlog.com>
(cherry picked from commit f02c4372ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This reverts commit 795bccdaf5.
The heap-buffer-overflow was a symptom of the >8 bit boundary
conditions bug fixed in the previous commit. This workaround is no
longer needed.
This restores spatial-only interpolation of the whole frame for the
first and last fields, instead of running the temporal edge filter
against cloned reference frames on the outermost lines. Because of that
first frame references are updated to pre-fix values.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 3cd408c2a6e5a7de8b6d641dedd12d523b94014c)
The mrefs/prefs boundary conditions scaled the y limits by the number of
bytes per sample, even though the ref offsets are already expressed in
elements. For content deeper than 8 bits this clamped perfectly valid
in-bounds line taps.
Found by validating the libplacebo GPU port against this filter, which
matches exactly on 16-bit content everywhere except these lines.
This changes the output for >8 bit content on the affected lines.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 7d96c87a7382fed8d571748d6ed5c1869c192c31)
When the filter graph is torn down early (e.g. at EOF with -frames:v),
the main thread calls dnn_free_model and destroys the request queue
while async inference threads may still be running. When a detached
thread finishes and tries to push its result back to the destroyed
queue, it triggers a segmentation fault.
Add ff_dnn_wait_requests() to dnn_backend_common which blocks
until all allocated request items (ctx->nireq) have been safely
returned to the request_queue. Call it from dnn_free_model in the
torch, tensorflow, openvino, and onnx backends before destroying the queue.
(cherry picked from commit b52c71e438)
Co-Authored-by: Fable 5
This fixes#20995. The reference is taken twice and assigned to the same pointer (see above in the same function). Only the latter is needed.
(cherry picked from commit 66a8c37582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit e38b5d15bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size
before allocate_3dlut() validates it, which can overflow int.
Use the validated lutsize2 computed by allocate_3dlut() instead.
Fixes: signed integer overflow
(cherry picked from commit 92cd5c9781)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 9aj_hqdn3d_dynamic_res.mjpg / 9aj_generate_hqdn3d_dynamic_res_mjpg.py
Fixes: wWDsy2oDvMuR
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit f0f634b658)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py
Fixes: VRAXYvKtmKa8
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit a7e38b617b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py
Fixes: 3MleMXjGZvu3
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit 24c322fdb2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Two runtime paths could compute out-of-range source coordinates for
degenerate projection geometry, causing heap-buffer-overflow reads
Fixes: out of array read
Fixes: assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a73d648f6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: assertion failure
Fixes: mQzloVqnivHQ
Found-by: Anthony Hurtado
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3712addc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array access
Fixes: JbvzNObhorBp
Fixes: 030e140145 (lavfi: add quirc filter)
Found-by: Adrian Junge (vurlo)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4da9812e25)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The hand written boundary mirroring reflected an out of range index only
once, which is insufficient when the image dimension is smaller than the
filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8
and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(),
which mirrors repeatedly and stays in range for any dimension.
Fixes: out of array access
Fixes: repro.sh
Fixes: HuQn51lLiVJX
Fixes: 38aea9b041 (avfilter: add vif filter)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56309e476a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: error: no type named 'system_error' in namespace 'std'
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c6498178bb)
Since the input and output format can differ (e.g. 444 -> 420), we need to
reference the correct subsampling for the partially applied filter.
Keep track of this in the CUDATex itself.
Signed-off-by: Niklas Haas <git@haasn.dev>
(cherry picked from commit 01972b4f85)
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
Instead of going via an AVFrame at all. This will allow us to fix the
intermediate chroma plane size for split downscaling.
Signed-off-by: Niklas Haas <git@haasn.dev>
(cherry picked from commit 420a9e90b8)
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
