Found during triage/review of the security report NzELYSvufGfQ
(ANT-2026-324B3XNF), which does not report this.
Fixes: pointer overflow
Pointer overflow Replicated through UnModified FFmpeg with UBSAN
av_dynamic_hdr_plus_to_t35() uses caller-supplied counts as loop
bounds over fixed-size arrays. A count slightly above an array
length can make the write loop read out of bounds while the
payload remains well within AV_HDR_PLUS_MAX_PAYLOAD_SIZE.
Reject counts above the array bounds with AVERROR(EINVAL), since
these are caller-supplied fields rather than data parsed off the
wire. The checks are gated like the reads they guard: the
targeted-system-display and mastering-display peak-luminance
counts and the bezier anchors are only read when their respective
flags are set. Rejecting oversized counts also keeps the payload
within AV_HDR_PLUS_MAX_PAYLOAD_SIZE, but the size assertion is not
a substitute for validating the array bounds.
FATE cases cover every rejected count and, for gated counts,
out-of-range values with their flags clear, which must still
serialize.
Signed-off-by: luoye-cpu <3412829159@qq.com>
Four accumulators, as in scalarproduct_float. Eight were not faster at len 256.
checkasm --bench on Apple M4:
scalarproduct_double_c: 80.3
scalarproduct_double_neon: 21.8 ( 3.68x)
Signed-off-by: Patryk Darmofalski <darpat039@gmail.com>
Generalize the staging-buffer transfer path to use
ID3D12Device::GetCopyableFootprints() and the format's actual plane
count instead of hardcoding a two-plane NV12/P010/P012 layout. This
makes d3d12va_transfer_data() correct for single-plane packed RGB
formats as well as the existing semi-planar YUV ones.
Add the packed RGB formats bgra, rgba, x2bgr10 and rgbaf16 to
supported_formats, so hwupload/hwdownload and other libavutil
consumers can allocate and transfer d3d12 frames in those formats.
Signed-off-by: younengxiao <steven.xiao@amd.com>
The PPC SIMD code is selected at runtime, but configure added
-maltivec -mabi=altivec and -mvsx to CFLAGS, so GCC could emit AltiVec
and VSX instructions in any function. It does, so a default PPC32 build
crashes on CPUs without AltiVec. Collect the flags in ALTIVECFLAGS and
VSXFLAGS and add them only to the ALTIVEC-OBJS and VSX-OBJS objects and
to the header check of util_altivec.h. VSX is only enabled on
little-endian, where the AltiVec code loads and stores with VSX, so
there the AltiVec files get the VSX flags, as they did through CFLAGS.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
set_string_number() parses the operand of a "+x" or "-x" flags update as
a double and casts it to int64_t to OR it into, or mask it out of, the
current flags. Only the combined value then reaches the range check in
write_number(), so the operand itself was never validated:
- A value outside the int64_t range, or inf, makes the conversion
undefined behaviour (C17 6.3.1.4). UBSan reports it for
av_opt_set(ctx, "flags", "+77777777777777777777", 0), and what the
cast produces depends on the target: measured on AArch64, where it
saturates, "+1e20" happened to be rejected downstream while "-1e20"
was accepted.
- A fractional operand is silently truncated, so "+1.5" and "-1.5" are
accepted although "1.5" is refused as not being a valid set of flags.
Run the existing flags range check on the operand before the cast, so an
invalid operand returns AVERROR(ERANGE) exactly like an invalid absolute
value, as av_opt_set() documents, and add the four cases to fate-opt.
Reported by FuzzAnything-ORG with a UBSan trace.
Fixes#22389
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/471db1d323aaed50ff922f0da76ecc8e45c4e817
added armv6 optimizations and guarded the include with
#elif ARCH_ARM && HAVE_ARMV6
but guarded the code only with
#elif ARCH_ARM
causing a build error with armv5 toolchains:
libavutil/pixelutils.c: In function ‘av_pixelutils_get_sad_fn’:
libavutil/pixelutils.c:102:5: error: implicit declaration of function
‘ff_pixelutils_sad_init_arm’ [-Wimplicit-function-declaration]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
The EOTF scaled X and Z by the X/Y and Z/Y of the DCI white, the
reference projector of RP 431-2, which ST 428-1 does not define: it
fixes the transfer alone, 52.37/48 above the 48 cd/m2 white. Treat the
three channels alike, L = (Lw - Lb) * 52.37/48 * V^2.6 + Lb, through the
wrappers of the other SDR curves. Equal in each channel, the black is
neutral in RGB only. The black of X'Y'Z' has the white of its content,
which only the RGB it is decoded into knows, so the documentation asks
for Lb = 0 on X'Y'Z' samples and their black after that conversion. A
gray of the reference projector came out at the chromaticity (0.298,
0.366) instead of its own. Broken since 06f084468e.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
H.273 value 10, SMPTE ST 428-1 (CIE 1931 XYZ), lists red (X) at (1, 0),
green (Y) at (0, 1), blue (Z) at (0, 0) and the centre white at
(1/3, 1/3).
The table had the monochromatic primaries of the CIE 1931 RGB space
instead.
Note that ST 428-1 only defines the encoding of the XYZ tristimulus
values and the transfer function. XYZ is absolute, so nothing in it
names the white the content was mastered to, and real DCDM content does
not have an equal-energy white. The standard reserves its headroom for
white points such as D55, D61 and D65, and the reference projector of RP
431-2 has DCI white. However, H.273 describes both the primaries (10)
(they shouldn't have) and the transfer (17) of such content, so follow
it here. For decoding, the mastering primaries can be given in place of
value 10 (e.g. AVCOL_PRI_SMPTE431 for a DCDM) with the ST 428-1 transfer
kept.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Both libavfilter and libswscale currently put framepool.o in their regular
OBJS, defining the same four ff_frame_pool_* symbols. Loading both static
archives in full therefore fails with multiple definitions.
Move the implementation and internal header to libavutil. Include the
object in its STLIBOBJS when either consumer is enabled, and use SHLIBOBJS
for the private copies in libavfilter and libswscale. This preserves
independent builds and shared-library symbol visibility without adding
an inter-library dependency or exposing a new public API.
Verified whole-archive links with both consumers, and with each consumer
configured independently. Shared builds pass fate-filter-rgbtestsrc-gbrp12
and fate-filter-rgbtestsrc-gbrap12; static and shared video scaling and
audio volume smoke tests produce identical frame checksums. Also checked
static consumers linked against shared dependencies.
Fixes: 6c89a30ecdFixes: #25419
Assisted-by: Fairy
A bottom-up software frame, as vflip produces, was handed to
cuMemcpy2DAsync() with its negative linesize as the pitch and copy
width, which the driver rejected, so uploading or downloading such a
frame failed.
The device only copies rows upwards through memory, so transfer such a
frame through a top-down copy of it in a transfer buffer.
Fixes: ogLupSp7oZ6D
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Assisted-by: Claude
The device transfers directly to and from page-locked host memory,
while pageable memory is copied through a buffer of the driver.
Pageable memory remains in use when page-locked memory cannot be
allocated and with ffnvcodec headers that lack cuMemHostAlloc().
As a page-locked source is read by the device after the upload
returns, uploads now wait for the transfer to complete, like downloads.
ffmpeg -hwaccel cuda -i hevc.mp4 -f null - on a RTX 5090, mean of 10
runs: 1080p 1773 -> 1855 fps, 2160p 497 -> 533 fps, 4320p 112 -> 124 fps.
Assisted-by: Claude
A destination frame without buffers was allocated anew for every
download. For large frames the allocation costs more than the
transfer.
ffmpeg -hwaccel cuda -i hevc.mp4 -f null - on a RTX 5090, mean of 10
runs: 2160p 390 -> 497 fps, 4320p 33 -> 112 fps, 1080p unchanged at
1772 fps.
Assisted-by: Claude
It allocates the buffers of a software frame used for a transfer to or
from a hardware frames context out of a pool kept by that context.
Assisted-by: Claude
ff_frame_get_video_buffer() lays a video frame out like
av_frame_get_buffer() does, but takes the buffer from a callback, so
that the memory can come from a pool or from a device specific
allocator.
Assisted-by: Claude
Print the child class tree of the IAMF AVClasses as returned by
av_opt_child_class_iterate() and look up options of the child classes
with av_opt_find2() and AV_OPT_SEARCH_CHILDREN | AV_OPT_SEARCH_FAKE_OBJ.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
The child_class_iterate callbacks of AVIAMFAudioElement,
AVIAMFSubmixElement and AVIAMFMixPresentation returned their single
child class only for a non-zero iteration state. The state starts at
zero, so they never returned anything, and av_opt_child_class_iterate()
and av_opt_find2() with AV_OPT_SEARCH_CHILDREN | AV_OPT_SEARCH_FAKE_OBJ
could not reach the AVIAMFLayer, AVIAMFParamDefinition and AVIAMFSubmix
options from these classes.
Return the child class on the first call instead.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
GNU binutils spells the MMI instructions pxor, pand, por, pnor, ssrld
and sslld as xor, and, or, nor, dsrl and dsll on floating point
registers, with -march=loongson2e/2f/3a and since 2.32 with
-mloongson-mmi; the p-named entries in its opcode table are the R5900
instructions on general purpose registers. The other 43 p-named MMI
instructions FFmpeg uses are spelled the same by everyone. Loongson's
gcc toolchain accepts both spellings (ebedd26eef), the binutils 2.24
of their cross-gcc-4.9.3-n64-loongson-rc6.1 only the GNU ones.
Since 903c5d58f0 configure probes pxor and so silently disables MMI
with every GNU binutils. Probe Loongson's spelling first and fall
back to the GNU one together with assembler macros that define the
six names, as asmdefs.h already does for parse_r. The macros assemble
to the same encodings as the GNU spelling with binutils 2.24, 2.28
and 2.42.
The GNU fallback is limited to little-endian mips64: the MMI code does
not build for O32 and its unaligned loads assume little-endian.
copy_buffer_data() copied FFABS(linesize) bytes per row between the
software frame and the staging buffer. The last row of a plane does not
have to extend to the full linesize, so this read past the end of the
software frame on upload and wrote past it on download.
The staging path is always taken for frames with a negative linesize,
and by default for multi-plane formats on the NVIDIA proprietary driver,
where host image copies are disabled and host memory import is avoided.
Same issue as fixed for hwcontext_cuda in f07f02abb8.
Out of array read and write replicated through the API with ASAN.
Fixes: out of array access
Fixes: ZqshmgSdN2Q2
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24595
Out of array read and write Replicated through API with ASAN
Out of array read Replicated through UnModified FFmpeg with a guard page allocator
Fixes: use of uninitialized memory
Fixes: f78pyZFASSy9
Regression since: bd68a61304
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24757
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Fixes: use of uninitialized memory
Fixes: yEDlrREdlez4
Regression since: bd68a61304
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24757
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Appends to already serialized init info side data, growing it with
av_fast_realloc(), so a demuxer can collect pssh records in linear time
without depending on the side data format.
On Windows the console paints warnings with attribute 14 (bright yellow).
The 8-color ANSI path used for a pipe emitted 0;33. Use intensity 1 for
AV_LOG_WARNING on Windows so the piped color matches the console.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Reinhard Nißl <rnissl@gmx.de>
This is the same principle as in dc54ec7a0d.
The imported sync file is used to order access relative to the external
operations but the frame itself may have been operated on within our
Vulkan context on a different queue, and we must synchronise against those
operations as well. That means waiting at VK_PIPELINE_STAGE_2_ALL_COMMANDS_BIT
rather than VK_PIPELINE_STAGE_2_NONE.
switch_layout() submits vkCmdPipelineBarrier2 on the compute queue. The
image was last written by vkCmdDecodeVideoKHR on the video queue, which
signals the frame timeline at VK_PIPELINE_STAGE_2_VIDEO_DECODE_BIT_KHR.
The layout transition is a write, and the cross-queue order is that
semaphore wait. VK_PIPELINE_STAGE_2_NONE names no stage, so the barrier
was outside the wait and raced VK_ACCESS_2_VIDEO_DECODE_WRITE_BIT_KHR
(SYNC-HAZARD-WRITE-AFTER-WRITE). Wait at
VK_PIPELINE_STAGE_2_ALL_COMMANDS_BIT so every command in the submission,
including the transition, happens after the signal.
av_des_crypt() and av_des_mac() accept a NULL src, but the loop still
added 8 to it for every block, which is undefined behavior.
Pointer arithmetic on NULL Replicated through UnModified FFmpeg with UBSAN
Found during triage of the security report f3cEzuDEDwTL
This is not a security issue, FFmpeg itself does not create such frames,
only an API user setting such a hw_frames_ctx on a frame can.
Reported in AISLE-2026-0100-00080 (F7BbuzcmJjqW), not replicated as no
OpenHarmony or Android build was available.
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Suggested-by: Joshua Rogers <joshua.rogers@aisle.com>
Timeout Replicated through API
Found during triage/review of OSS-Fuzz issue 561208791
Fixes: Timeout
Fixes: W8DJK4OR7cgk/flat300.bin / gen_flat.py
Fixes: W8DJK4OR7cgk
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: signed integer overflow
Fixes: P0BVJKDC5JLx
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24756
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
And export both functions. This is needed for a following change that will make
use of these functions from lavf.
Signed-off-by: James Almer <jamrial@gmail.com>
av_opt_copy() documents that after it returns, allocated options in src
and dst no longer alias each other, even when dst was memdup'ed from src.
For AV_OPT_TYPE_CHLAYOUT it passed such aliased layouts straight to
av_channel_layout_copy(), which frees the custom map in dst and then
copies from the now freed map in src.
Handle this in opt_copy_elem(), like the AV_OPT_TYPE_DICT case, by
forgetting the aliased map in dst before the copy.
Fixes: heap-use-after-free
Fixes: BTOI3sLHWE0g
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
av_frame_apply_cropping() returned AVERROR_BUG when the plane offset was
more aligned than crop_left, which is always the case for single-plane
formats with more than a byte per pixel (gray16, rgb48, 16-bit Bayer,
p010). The rounding that follows already handles it.
Useful for example for scenarios like wanting to serialize only options that
are not marked as deprecated.
Signed-off-by: James Almer <jamrial@gmail.com>
Michael Niedermayer