The code reads a mask afer this check, meaning it expects NATIVE order, not
others.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7755d264bd)
Supporting PCM streams requires API changes present in newer releases that
can't be backported, so don't create invalid files.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1034b144ff)
The output stream no longer has extension sub-streams, so the
declared input profile, if it was set, is no longer valid.
Fixes issue #24388.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7dc71230a9)
To determine whether the colocated picture is field coded, the temporal
and spatial direct setup peek at
sl->ref_list[1][0].parent->mb_type[mb_xy] before mb_xy has been remapped
to the colocated field's parity. That row belongs to the current field's
parity, while await_reference_mb_row() above waited on the parity of the
referenced field, so whenever the two differ the load is unsynchronised
and with frame threading can observe macroblocks of a field that is
still being decoded.
Every macroblock of a field picture has MB_TYPE_INTERLACED set, so
checking field_picture first gives the same result in all correctly
synchronized cases without touching the mb_type array.
This also fixes few TSAN reported warnings.
Fixes: https://trac.ffmpeg.org/ticket/10891
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c3a8a223b29260dc170d41c62f9b3b33f6b97b2d)
h264_frame_start() clears h->er.cur_pic, and decode_nal_units() only sets
it again for pictures that are not field coded, right before running error
concealment. A second field goes through neither, so h->er.cur_pic keeps
pointing at whatever frame coded picture the context decoded earlier.
With frame threading the two fields of a pair are decoded by different
contexts, so whether this triggers depends on what the context that picks
up the second field decoded before, which is why the number of bogus
warnings varies between runs.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit f1d318e5eb2eb487d2be4b4b721b93ae76fd5ba7)
src/libavcodec/mips/cabac.h:160:77: error: instruction requires a CPU feature not currently enabled
160 | PTR_SUBU "%[tmp1], %[c_low], %[tmp1] \n\t"
| ^
<inline asm>:13:2: note: instantiated into assembly here
13 | movz $15, $13, $24
| ^
OpenBSD targets MIPS III ISA.
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit 9432f85830)
Previously only the first thread's context and the user-facing one had
it, so frames decoded by the remaining worker threads were missing
global side data whenever the per-frame state could not provide it, e.g.
extradata-derived HDR metadata after avcodec_flush_buffers().
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c48230eb86)
When a frame coded picture uses a complementary field pair as its
colocated picture, ff_h264_direct_ref_list_init() selects the field whose
POC is closest to the current one and stores it in col_parity. The direct
mode setup then remaps mb_xy to that parity and reads the colocated
mb_type, motion_val and ref_index from it.
await_reference_mb_row() waits on the field given by "ref_field_picture &&
ref_field", which is 1 for any such reference, since the pair is
referenced as a frame and ref->reference is 3. Only the bottom field is
therefore awaited, while the data is just as likely to be read from the
top one. With frame threading the two fields are decoded by different
threads, so the colocated data can be read while the field it belongs to
is still being decoded, yielding stale motion vectors and a corrupt
frame. await_references() already handles the same case correctly for
motion compensation.
Fixes sporadic failures of fate-h264-conformance-cabac_mot_picaff0_full,
where display frame 14.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit 274cb6731bd204e9537a7e588d4a3436fdf51b93)
The output stream no longer has Atmos metadata, so the
AV_PROFILE_TRUEHD_ATMOS profile, if it was set, is no longer valid.
Fixes issue #23195.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 86940d45af)
The output stream no longer has Atmos metadata, so the
AV_PROFILE_EAC3_DDP_ATMOS profile, if it was set, is no longer valid.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c77c0e580a)
The documentation for get_buffer2() states:
"This callback must use the frame values, not the codec context values, to
calculate the required buffer size."
Fixes wrong output on hbd LCEVC enhanced samples where the base stream is
8bit.
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e1c1b6c558)
It's not valid to call avio_close() on context that has not been open
with avio_open().
This fixes use of custom IO. (io_open / io_close2 callbacks)
Note that by default io_close2 is set to io_close2_default() which calls
avio_close(), so default case will work the same as before.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a7e802c8f)
Currently, the aacencdsp checkasm tests fails for many seeds,
if the C code has been built with x87 math. This happens because
the excess precision of x87 math can make it end up rounding
to a different integer, and the checkasm tests checks that the
output integers match exactly between C and assembly.
One such failing case is "tests/checkasm/checkasm --test=aacencdsp
41" when compiled with GCC. When compiled with Clang, the test
seed 21 produces a failure.
To avoid the issue, we need to limit the precision of intermediates
to their nominal float range, matching the assembly implementations.
This can be achieved when compiling with GCC, by just adding a single
cast.
To observe the effect of this cast, compile the following
snippet,
int cast(float a, float b) {
return (int)
#ifdef CAST
(float)
#endif
(a + b);
}
with "gcc -m32 -std=c17 -O2", with/without -DCAST. For x86_64
cases (without the "-m32"), the cast doesn't make any difference
on the generated code.
This cast would seem to not have any effect, as a binary expression
with float inputs also would have the type float.
However, if compiling with GCC with -fexcess-precision=standard,
the cast forces limiting the precision according to the language
standard here - according to the GCC docs [1]:
> When compiling C or C++, if -fexcess-precision=standard is
> specified then excess precision follows the rules specified in
> ISO C99 or C++; in particular, both casts and assignments cause
> values to be rounded to their semantic types (whereas -ffloat-store
> only affects assignments). This option is enabled by default for
> C or C++ if a strict conformance option such as -std=c99 or
> -std=c++17 is used.
Ffmpeg's configure scripts enables -std=c17 by default.
This only helps with GCC though - the cast doesn't make any
difference for Clang. (Although, upstream Clang seems to default
to SSE math, while Ubuntu provided Clang defaults to x87 math.)
Limiting the precision with Clang would require casting to volatile
float for both intermediates here - and that does have a code
generation effect on all architectures.
[1] https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
(cherry picked from commit 3ea6c2fe25)
This function overreads the input plane for odd dimensions, because the
chroma plane is always rounded up, which means (xy << subsample) + 1 exceeds
the actual alpha plane size.
To verify:
valgrind ffmpeg -pix_fmt yuva420p -f lavfi -i color -vf \
"scale=1x1,format=yuva420p,scale=alphablend=uniform_color,format=yuv420p \
-vframes 1 -f null -
Fixes: https://trac.ffmpeg.org/ticket/11692
(cherry picked from commit b7946098b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Right now it is possible for the pointer for the current frame to
be set in the context even when it could not be properly set up;
this does not influence the ordinary ref frames, but only
VP8Context.prev_frame. And since this code has been ported to the
ProgressFrame API in d48d7bc434,
this leads to segfaults, because the ProgressFrame API is less
forgiving than the ThreadFrame API (waiting on an uninitialized
ProgressFrame segfaults, waiting on an uninitialized ThreadFrame
is a no-op (the code behaves as if frame-threading is not in use)).
Fix this by maintaining the consistency of the frame pointers
in the context (by setting them later).
Fixes: NULL pointer dereference
Fixes: 68192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP8_fuzzer-6180311026171904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 494061a49a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
If decoding with hwaccel, but decoding fails, these pointers
are null at this point.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a27f3c590f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The patch adds support for dstw values ending in 2, 4, 6, 8, 10, 12, and 14,
which fixes the out-of-bounds write problem.
(cherry picked from commit a6206a31ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: ada-3-poc.mpd
Found-by: Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b99c6fc8c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
uyvytoyuv422 converts packed UYVY, whose macroblocks are pixel pairs, and
the SIMD code only handled even widths. On an odd width the trailing half
macroblock made the kernel write past the end of the Y/U/V destinations:
the AVX512ICL masked tail dropped the odd pixel and the fall-through
re-entered the SIMD loop, writing a full mmsize*2 chunk past the planes
(127 bytes of Y, 63 of U and 63 of V); the sse2/avx/avx2 scalar tail
wrote one byte past the Y plane.
Process only whole pairs and emit the trailing odd column from a small
per-row epilogue that matches uyvytoyuv422_c (ydst[w-1] = src[2w-1],
udst[cw-1] = src[2w-2], vdst[cw-1] = src[2w]).
All four SIMD variants are now bit-exact with the C reference for even and
odd widths and no longer overwrite the destination. Verified on AVX512ICL
hardware (Ryzen 9 9950X) with checkasm.
Found-by: Claude (Anthropic). Human-verified and reported by Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21782b7b31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
get_dc() divides the accumulated, OBMC-weighted DC by aa, the sum of the
squared OBMC weights taken over the in-plane pixels. When an OBMC block
falls entirely outside the plane - e.g. a tiny chroma plane after mcdeint
splits a frame into fields - no pixel contributes, aa stays 0 and the
ROUNDED_DIV() divides by zero (SIGFPE). ab is 0 in exactly the same case,
so the result degenerates to 0; return it directly.
Reproducible with the GPL mcdeint filter in slow/extra_slow mode, e.g.
ffmpeg -f lavfi -i testsrc=s=128x2 -vf mcdeint=mode=slow -f null -
Add a self-contained lavfi-based FATE regression test for the slow mode,
which previously crashed and is therefore not covered by the existing
sample-based fast/medium tests.
Fixes trac ticket #7779.
Signed-off-by: Bogdan Lisman <bogdan@pydevsolutions.com>
(cherry picked from commit a62d996927)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
For an edge block, get_block_rd() copies the full-OBMC-weight central
region directly from cur[] into the reconstruction. It moved one
boundary to block_w/block_h but overwrote the in-plane clip (x0/x1/y0/y1
computed earlier from the plane size) instead of intersecting with it.
When a plane is narrower than block_w - e.g. a tiny field/chroma plane
produced by the mcdeint filter - the right-edge case left x0 = block_w
while x1 stayed clipped to w - sx < block_w, so x1 - x0 became negative
and was passed to memcpy() as a huge size_t, crashing with SIGSEGV.
Intersect the moved boundaries with the existing clip so the copy region
stays inside the plane and the memcpy length can never be negative.
Reproducible with the GPL mcdeint filter in slow/extra_slow mode, e.g.
ffmpeg -f lavfi -i testsrc=s=5x32 -vf mcdeint=mode=slow -f null -
This is a separate crash from the get_dc() SIGFPE (ticket #7779) reached
through the same iterative_me() path. Add a lavfi-based FATE regression
test.
Signed-off-by: Bogdan Lisman <bogdan@pydevsolutions.com>
(cherry picked from commit 1168447626)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
(cherry picked from commit 99e1ecca36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
If s->stop is set, the return value would be overwritten
before being checked. This bug was introduced in the switch
to AV_TX in 014ace8f98.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 0992c19c30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit 5b98cea4 added a size < 2 guard to sctp_write() to prevent
out-of-bounds access when max_streams is enabled, but the identical
pattern in sctp_read() was not addressed.
When max_streams is non-zero, sctp_read() passes (buf + 2, size - 2)
to ff_sctp_recvmsg(). If size < 2, size - 2 wraps to a large value
on the implicit cast to size_t in the callee.
Add the same guard.
Signed-off-by: bird <6666242+bird@users.noreply.github.com>
(cherry picked from commit 5c3602abaa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
headers
With this change CBS and the decoder appear to be in sync.
Fixes: division by 0
Fixes: 501794431/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-4792576644546560
Fixes: 501898692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-4772278394224640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd290e2fcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Reproduced with a small output (e.g. size=2x2) under ASan.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d133b4a231)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
