Fixes: u1TxsBfg36kp/testcase/two_b.mp4 / gen_au.py gen_mp4.py
Fixes: u1TxsBfg36kp
Fixes: AISLE-2026-0150-00084
Fixes: assertion failure
Assertion failure Replicated through UnModified FFmpeg
Found-by: Joshua Rogers (AISLE)
The report suggested returning the NAL unit together with the found
block and inserting into its list, and replacing the assertion by a
runtime check.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: Zc8wjsgxLWvu
Fixes: AISLE-2026-0150-00562
Fixes: signed integer overflow, division by zero
Division by zero Replicated through UnModified FFmpeg with ASAN and UBSAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Add a filter that removes side data of the given types from packets and from
the stream, or keeps only the packets carrying side data of any of the given
types, as the select mode of the sidedata frame filter does for frames, but
with a list of types. The types are named by their handle, as option
constants joined with '+'.
Inject APP0..APP15 segments from a length-prefixed sidecar into each
MJPEG packet after SOI. A zero-length record passes the packet through.
An APP1-only payload retains the existing APP0; a payload starting with
APP0 replaces an APP0 located immediately after SOI.
Consume records in packet arrival order, with a 16 MiB record limit.
Missing or invalid records return an error. Remember sidecar read and
validation errors so later packets cannot consume a rejected record's
payload as metadata. Flushing neither rewinds the sidecar nor clears
this error; closing the context does not read ahead.
Count every consumed input packet in diagnostics, distinguish I/O errors
from truncated records, include the open error text for a sidecar that
cannot be opened, and document the sidecar and lifecycle contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Reinhard Nißl <rnissl@gmx.de>
Assisted-by: Fairy
Deletes all filler bytes in the stream:
- Filler PBUs.
- Filler at end of frame PBUs.
- Dummy bytes trailing in tile data.
- Filler at end of AU info PBUs.
- Filler at end of metadata PBUs.
- Filler metadata payloads.
When an input packet already contains in-band VPS/SPS/PPS parameter sets,
hevc_mp4toannexb still prepended extradata parameter sets before IRAP NALUs,
causing duplicate parameter sets at keyframes.
Avoid duplication by indexing extradata parameter sets in a hash table and
checking in-band parameter sets against it, suppressing any extradata
parameter set whose payload is already present in-band. Declarative SEIs
from extradata are always preserved. Packet-side matching attempts are
bounded to prevent CPU amplification, and redundant linear scans are
pruned with an emitted_types mask. Topological ordering dependencies
(e.g. PPS after SPS, and Prefix SEI barrier before pending parameter sets)
are strictly preserved.
Extradata is parsed in two passes with a single allocation, capping the
total number of NAL units to prevent memory amplification from malformed inputs.
Update the fate-hevc-bsf-mp4toannexb test reference accordingly.
Fixes: ticket #24637
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Drop packets outside a range given as a pts, dts, packet index, millisecond or
duration bound, trimming a packet that straddles a boundary through skip
samples side data for audio and shifted timestamps otherwise.
Set preroll to export the packets a decoder needs to start on a cut made inside
a group of pictures, flagged for discard so the frames it produces still begin
at the bound.
The output stream no longer has extension sub-streams, so the
declared input profile, if it was set, is no longer valid.
Fixes issue #24388.
Signed-off-by: James Almer <jamrial@gmail.com>
The output stream no longer has Atmos metadata, so the
AV_PROFILE_TRUEHD_ATMOS profile, if it was set, is no longer valid.
Fixes issue #23195.
Signed-off-by: James Almer <jamrial@gmail.com>
The output stream no longer has Atmos metadata, so the
AV_PROFILE_EAC3_DDP_ATMOS profile, if it was set, is no longer valid.
Signed-off-by: James Almer <jamrial@gmail.com>
Each pending packet consumes up to poc_diff tree nodes when it is
output, so the packets in the FIFO can consume at most nb_pending nodes
in total. Frames whose tree lookup misses on output leave their nodes
behind, and damaged or crafted streams can make that happen
indefinitely, growing the tree without limit.
Track the node count and insertion order, keep the leftovers of up to
MAX_DAMAGED_FRAMES frames and beyond that evict the nodes unconsumed
the longest. Timestamps of valid frames are unaffected unless more
frames than that are damaged. No eviction is done at EOF, where nodes
are deliberately kept to regenerate timestamps from.
Of all h264/hevc conformance samples only MR3_TANDBERG_B.264 triggers
evictions, and no sample changes output.
Fixes: unbounded memory growth with damaged streams
Co-Authored-By: Fable-5
alloc_and_insert_node() inserts the nodes for 2nd fields with
duration / poc_diff added to the timestamp, but the removal loop
compared all nodes of a frame against the unadjusted first timestamp,
so 2nd field nodes never matched and stayed in the tree until close.
Advance the compared timestamp the same way the insertion does.
Fixes: tree nodes leaking on every field coded frame
Co-Authored-By: Fable-5
hevc_queue_frame() collected all tree nodes of the current gop into a
fixed nodes[HEVC_MAX_DPB_SIZE * 2] array and asserted the count stayed
within it. For a crafted HEVC stream the tree can hold slightly more
same-gop nodes than that estimate (observed 34 vs 32), tripping the
av_assert0 and aborting. Link the matching nodes into a list through a
next pointer in the node instead; this has no size limit and needs
neither extra passes nor allocation.
Fixes: assertion failure
Fixes: 519466146/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5238235193475072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Co-Authored-By: Fable-5
Do not overwrite the output codecpar extradata after init(). Keep the currently active HEVC parameter sets in HEVCBSFContext instead.
When AV_PKT_DATA_NEW_EXTRADATA on an input packet carries hvcC extradata, convert it to Annex B, update the runtime extradata state, and remove the packet side data.
Also add a FATE test covering extradata reloads with hevc_mp4toannexb,hevc_metadata.
Removes the special -I flag specified in the avcodec/bsf/ subdirectory.
This makes code copy-pastable to other parts of the ffmpeg codebase, as
well as simplifying the build script.
It also reduces ambiguity, since there are many instances of same-named
header files existing in both libavformat/ and libavcodec/
subdirectories.
Reverts: 0e4dfa4709
Reapplies: 41b73ae883
Modifying the keys of a sorted structure, be that a tree or other
can lead to changes in the ordering and undefined behavior.
It can also lead to collisions with existing keys.
All these cases need to be handled unless there is a bug elsewhere
that would prevent them.
Fixes: out of array access
Fixes: 504281984/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-6032368162111488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Only used as AVBitStreamFilter.codec_ids. This avoids duplicating
it into lavf.
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
It doesn't hurt to keep track of filtered_size:
The end result will be ignored if extradata is not removed
from the bitstream.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Changes compared to the current version include:
1. We no longer use a dummy PutByteContext on the first pass
for checking whether there is extradata in the NALU. Instead
the first pass no longer writes anything to any PutByteContext
at all; the size information is passed via additional int*
parameters. (This no longer discards const when initializing
the dummy PutByteContext, fixing a compiler warning.)
2. We actually error out on invalid data in the first pass,
ensuring that the second pass never fails.
3. The first pass is used to get the exact sizes of both
the extradata and the filtered data. This obviates the need
for reallocating the buffers lateron. (It also means
that the extradata side data will have been allocated with
av_malloc (ensuring proper alignment) instead of av_realloc().)
4. The second pass now writes both extradata and (if written)
the filtered data instead of parsing the NALUs twice.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Fixes UB in the form or adding a 0 offset to a NULL pointer, and substracting a
NULL pointer from another.
Signed-off-by: James Almer <jamrial@gmail.com>
The buffers are allocated using the worst case scenario of the entire NALU
being written, when this is in many times not the case.
Signed-off-by: James Almer <jamrial@gmail.com>
The specification for LCEVC states that start codes may be three or four bytes
long except for the first NALU in an AU, which must be four bytes long.
Signed-off-by: James Almer <jamrial@gmail.com>
The specification for H.26{4,5,6} states that start codes may be three or four
bytes long long except for the first NALU in an AU, and for NALUs of parameter
set types, which must be four bytes long.
This is checked by ff_cbs_h2645_unit_requires_zero_byte(), which is made
available outside of CBS for this change.
Signed-off-by: James Almer <jamrial@gmail.com>
Given we rewrite these NALUs to remove the encoded data blocks to export as extradata,
we need to do the inverse to remove SC, GC and AI blocks to export as filtered data in
packes.
Signed-off-by: James Almer <jamrial@gmail.com>
write_lcevc_nalu() is meant only for IDR and NON_IDR NALUs. For everything else, just
copy it unchanged.
Signed-off-by: James Almer <jamrial@gmail.com>
AVOption with AV_OPT_TYPE_INT assumes the field is int (4 bytes),
but enum size is implementation-defined and may be smaller.
This can cause memory corruption when AVOption writes 4 bytes
to a field that is only 1-2 bytes, potentially overwriting
adjacent struct members.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
Michael Niedermayer