Fixes: NwCWHv3RIJff
Fixes: use of uninitialized memory
Use of uninitialized memory Replicated through API with MSAN
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24851
A negative width, height or nb_colors, or more colors than the 256
entry palette holds, is caller misuse.
Fixes: tOTDK93gpiC1
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24913
Region width and height are 16 bit fields (ETSI EN 300 743, 7.2.3);
Fixes: tOTDK93gpiC1
Fixes: out of array write
Fixes: signed integer overflow
Out of array write Replicated through API with ASAN
Signed integer overflow Replicated through API with UBSAN
Region width truncated to 16 bits Replicated through API with plain output check
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24913
Volunteer for testing welcome
Fixes: Qc9DRRq5X1KU
Fixes: signed integer overflow
Signed integer overflow Replicated through Modified FFmpeg with UBSAN
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24589
Distinguishes it from the many other process() functions in swscale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Failures from ff_vk_create_imageviews_fmt() and friends were ignored,
leading to descriptors being updated with uninitialized image views.
Discard the execution and bail out instead. SwsPassFunc has no way to
return errors, so just log them for now.
Signed-off-by: Niklas Haas <git@haasn.dev>
Move the count of arithmetic instructions emitted by
insert_bitexact_linear() into a helper, and assert that it matches the
number of IDs actually allocated, since the NoContraction decorations
are reserved and written based on this count.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Constants and buffers were collected into flat arrays and consumed via
running counters, which had to be kept in sync by hand between the
constant definition pass, the decoration pass and the code generation
loop. Store them in a struct indexed by the op instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
The image descriptor array was reused for the buffer descriptors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Only its FFVulkanOpsCtx was used, which is already passed separately.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Since the float placeholder value was changed to 0.0, f32_p and f32_0 are
the same constant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Filters are only ever merged into planar reads, so the packed filtered
read path and the buffers for filtered writes can never be used.
Standalone filter ops do reach the backend, since compile_subpass() first
tries to compile the unsplit op list. However, code generation has never
supported them and fails with ENOTSUP, after which the list is split at the
filter. The filter buffers allocated and uploaded for them were thus wasted
on every such attempt, and were not accounted for in the descriptor set
bindings either.
Implementing in-line filtering in the future (e.g. via shared memory) would
need its own buffer setup and code generation regardless, since the taps
would no longer be read directly from the source image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Fix indentation and alignment of continuation lines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
The filtered read always accumulates and returns floats, so any other
output type would be silently misinterpreted by the following ops.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
The input image variable was only defined when the pass contains a read,
but was unconditionally decorated and listed in the entrypoint interface,
referencing an undefined ID and producing invalid SPIR-V.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Instead of hard-coding the layout of the in_vars[] array, give the fixed
variables names and build the entrypoint interface list by appending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
The shader only uses 32-bit integer types and never accesses 8-bit storage
buffers, so the Int8, Int16 and StorageBuffer8BitAccess capabilities are
not needed. Declaring them requires the device to support the
corresponding features.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Failures were silently returning 0, leaving behind an unallocated buffer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
GNU binutils spells the MMI instructions pxor, pand, por, pnor, ssrld
and sslld as xor, and, or, nor, dsrl and dsll on floating point
registers, with -march=loongson2e/2f/3a and since 2.32 with
-mloongson-mmi; the p-named entries in its opcode table are the R5900
instructions on general purpose registers. The other 43 p-named MMI
instructions FFmpeg uses are spelled the same by everyone. Loongson's
gcc toolchain accepts both spellings (ebedd26eef), the binutils 2.24
of their cross-gcc-4.9.3-n64-loongson-rc6.1 only the GNU ones.
Since 903c5d58f0 configure probes pxor and so silently disables MMI
with every GNU binutils. Probe Loongson's spelling first and fall
back to the GNU one together with assembler macros that define the
six names, as asmdefs.h already does for parse_r. The macros assemble
to the same encodings as the GNU spelling with binutils 2.24, 2.28
and 2.42.
The GNU fallback is limited to little-endian mips64: the MMI code does
not build for O32 and its unaligned loads assume little-endian.
Compare one-thread conversion with 2, 3, 7 and 16 threads for five even
frame heights, including cases that otherwise produce odd slices. Cover
NV12, NV21, YUV420P, YUVA420P and YUV422P to packed and planar RGB,
including both byte orders of the 16-bit formats.
Exercise both dynamic and initialized legacy swscale contexts. Disable
dithering so the AArch64 selector must supply its own slice alignment
for planar inputs as well. Compare within each implementation to avoid
requiring identical color conversion rounding across architectures.
Print mismatching row counts for FATE to compare with its reference.
The test fails before the preceding fixes on native AArch64 and on
32-bit ARM NEON, and passes afterwards on both. It also passes on
native x86-64.
Assisted-by: Fairy
The 32-bit ARM NEON YUV-to-RGB converters selected by
SET_FF_NVX_TO_RGBX_FUNC share the even-slice precondition with their
AArch64 counterparts: for vertically subsampled input they process two
luma rows per iteration, so an odd slice boundary picks the wrong
chroma phase and the last iteration writes one row past the slice end.
Threaded conversion produces such slices because the packed RGB
destination keeps dst_slice_align at one row.
Raise dst_slice_align when selecting these converters, mirroring the
preceding AArch64 change. YUV422P keeps full-height chroma and stays
single-row, so its alignment is unchanged.
Fixes: d6fdc78e91 ("sws: implement slice threading")
Assisted-by: Fairy
The NV12 and NV21 NEON converters need even slice boundaries, but the
RGB destination only requests one-row alignment. Threaded conversion
can therefore start on an odd luma row and use the wrong chroma phase.
The current two-row converters additionally write past odd slice ends.
Raise dst_slice_align when selecting a NEON converter, preserving any
larger existing alignment. This also covers planar 4:2:0 when dithering
options bypass the generic yuv2rgb selector's alignment assignment.
Update the assembly precondition comment to include graph dispatch.
Fixes#24266.
Fixes: d6fdc78e91 ("sws: implement slice threading")
Assisted-by: Fairy
These were hacked into the code as swizzles relying on the _UINT_PACK32 view
of the image to do the actual (un)packing, which only covered the 2:10:10:10
formats, and silently produced garbage on drivers lacking storage support
for those view formats (e.g. ANV).
Implement these operations properly, the way they were intended, by doing
the actual documented bit-packing operation instead whatever hacky
assumptions the swizzle was making.
Fixes fate-sws-unscaled-spirv on Intel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
This is not a security issue.
Fixes: 00smV7L5DOfY
Fixes: swarm-metadata_user_defined-data_size-underflows-on-payload_size-16-5ff8a8
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: oFKoC1YimRPu
Fixes: swarm-Memory-leak-qr--text-and-pexpr-fields-not-freed-in-uninit-5cc723
Found-by: zhang xingxing <2388969553@qq.com>
Memory leak Replicated through UnModified FFmpeg with LSAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Not replicated, compile tested only (mbedtls 3.6.2).
Fixes: T7EtPuJBKWqg
Fixes: swarm-Memory-leak-early-return-skips-mbedtls-resource-cleanup-a1d295
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: ORPoDnVi3BLg
Fixes: swarm-MD5-context-leaked-when-output-URL-open-fails-e4415f
Found-by: zhang xingxing <2388969553@qq.com>
Memory leak Replicated through UnModified FFmpeg with LSAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This is not a security issue.
Fixes: hlm9X3ZdVjBu
Fixes: swarm-Missing-buf_size-validation-in-dvbsub_parse_object_segment-a29b35
Found-by: zhang xingxing <2388969553@qq.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: dcrkQkffMQ8b
Fixes: swarm-Missing-bounds-check-on-last-frame-length-enables-heap-OOB-read-e00668
Found-by: zhang xingxing <2388969553@qq.com>
Out of array read Replicated through UnModified FFmpeg with ASAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The existing warning does not distinguish a forward timestamp outside the
Block's signed 16-bit range from a late packet that forces a backward
Cluster timestamp jump. Include the direction, stream index, incoming
timestamp, current Cluster timestamp and signed difference in milliseconds.
This addresses the diagnostic part of issue #24379. It does not change
packet interleaving or turn the condition into a muxing error.
Assisted-by: Fairy
copy_buffer_data() copied FFABS(linesize) bytes per row between the
software frame and the staging buffer. The last row of a plane does not
have to extend to the full linesize, so this read past the end of the
software frame on upload and wrote past it on download.
The staging path is always taken for frames with a negative linesize,
and by default for multi-plane formats on the NVIDIA proprietary driver,
where host image copies are disabled and host memory import is avoided.
Same issue as fixed for hwcontext_cuda in f07f02abb8.
Out of array read and write replicated through the API with ASAN.
Fixes: signed integer overflow
Fixes: out of array access
Fixes: pdA1vTaOO5Be
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24851
Signed integer overflow Replicated through API with UBSAN
Out of array access Replicated through API with ASAN
Fixes: out of array read
Fixes: DdI1HfjoEG1l
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: out of array access
Fixes: ZqshmgSdN2Q2
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24595
Out of array read and write Replicated through API with ASAN
Out of array read Replicated through UnModified FFmpeg with a guard page allocator
