This commit adds an interpolation setting to the AVOptions
structure, allowing the user to choose which method they
would like to use. For modules, this is fairly important.
Most modules use lo-fi samples (read: 8khz 8-bit possibly
adpcm) which can sound terrible when mixing using high
quality interpolation algorithms. This becomes especially
prevalent in chiptune compositions, where hi-fi
interpolation completely changes the sound.
Virtually any value is accepted by libopenmpt, but only
[1,2,4,8] produce any tangible difference in output. All
other values seemingly get routed to the default, which
is equivalent to passing 8 (8-tap windowed sinc).
Signed-off-by: Paper <paper@tflc.us>
When a fragment's samples are inserted into the index exactly at a stream's current sample, current_sample is left on the first inserted entry, and tts_index is never moved with the shifted timing entries, so after a seek a stream moves back to the start of the loaded fragment or gets the composition offset of another sample.
Advance current_sample and tts_index past the inserted entries, and roll tts_index back with current_sample when a truncated trun is trimmed.
The seek in fate-mov-mp4-frag-chapters-seek now returns the same packets and timestamps as a read without the fragment index.
With seek_individually, the last stream seeked sets next_root_atom, so a chapter track whose samples all sit in the first fragment makes mov_read_packet() read every fragment from the start of the file before it reaches the seeked sample.
Resume reading from the earliest fragment any stream that is read landed in, which keeps the fragments that a lagging audio track still needs and ignores the chapter track.
The seek in fate-mov-mp4-frag-chapters-seek no longer restarts from the beginning of the file.
Mux the chapters of vorbis_chapter_extension_demo.ogg with generated audio and B-frame video into a fragmented MP4, then seek to 8 s with use_mfra_for=pts and read 40 packets across one fragment boundary.
The reference records the current behaviour, where the read starts at 2 s without audio because the chapter track's seek leaves the fragment index on the first fragment.
Without engine_type, frc_amf uses the runtime's default DX12 engine even
on a DX11 AMF context. The interpolated frames then come back as DX12
surfaces, and the filter runs about three times slower. Select
FRC_ENGINE_DX11 on a DX11 context whose device has feature level 11_1 or
higher, and keep an explicit engine_type. The DX11 engine fails Init()
on 11_0, which is what hwcontext_d3d11va creates, so those devices keep
the default.
Assisted-by: Claude Opus 5.5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
A colocated field picture always takes the field branch, but macroblocks
that were never decoded in a broken field picture keep a stale mb_type
without MB_TYPE_INTERLACED. The later IS_INTERLACED(mb_type_col[0])
check then picked the frame to frame path with the field remapping,
which reads the colocated motion vectors past the end of the picture.
Set the flag on the colocated type whenever the field branch is taken,
decoded macroblocks have it already.
Fixes: heap-buffer-overflow (read)
Fixes: 553213954/clusterfuzz-testcase-minimized-fuzzer_loadfile_mkv-6112026834042880
Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
f_metadata.c opens its output file with avio_open() and writes it
with avio_vprintf(). metadata_filter_deps and ametadata_filter_deps
list avformat, but the conditional library dependency list has no
entry for either filter, so a build with only one of them enabled sets
avfilter_FFLIBS=avutil and a shared libavfilter has no libavformat
NEEDED entry; a consumer linked with -Wl,--no-allow-shlib-undefined
fails on the avio symbols.
With these entries avfilter_FFLIBS=avformat avcodec avutil and the
consumer links and runs with LD_BIND_NOW=1.
Signed-off-by: lusoris <lusoris@proton.me>
scale_vulkan calls sws_alloc_context(), sws_scale_frame() and
sws_free_context(), and scale_vulkan_filter_deps lists swscale, but
the conditional library dependency list has no entry for the filter.
A build with only this filter enabled sets avfilter_FFLIBS=avutil, so
a shared libavfilter has no libswscale NEEDED entry and a consumer
linked with -Wl,--no-allow-shlib-undefined fails on the three sws_*
symbols.
With this entry avfilter_FFLIBS=swscale avutil and the consumer links
and runs with LD_BIND_NOW=1. A standalone scale_vulkan build also
needs scale_eval.o, which "avfilter/Makefile: add missing objects for
standalone Vulkan filters" adds.
Signed-off-by: lusoris <lusoris@proton.me>
A WebVTT segment contains every cue shown during its period (RFC 8216,
3.5), so a cue that reaches into the next segment appears in both. Keep
the cues of the previous segment and drop the ones the current segment
repeats, so each cue is delivered once. The kept cues read before the
media position was known move onto it once it is, so the comparison is on
one timeline. Nothing is repeated across a discontinuity, so the kept cues
are dropped when the opened segment has another discontinuity sequence
number (RFC 8216, 4.3.3.3), which also covers a boundary that already left
a live playlist.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Discard the cues of a subtitle playlist by their end time when seeking
or when the playlist is enabled during playback, so a cue that is on
screen at the target is delivered instead of the next one starting after
it.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
The cue times of a subtitle playlist are on the MPEG-TS timeline, and
the first cue of a segment says nothing about where the segment starts,
so use an offset of 0 instead of deriving one from the first cue, which
made a seek skip the cues within that offset.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Set the timestamp_map option of the webvtt demuxer for the subtitle
segments in place of prefer_hls_mpegts_pts, which no demuxer has, so the
cue times land on the MPEG-TS timeline of the audio and video. That time
is on the 33 bit PES clock, so each cue is put on the period of that clock
nearest to the position of the media, which is read first when both are
enabled. A cue read without any media does not become that position, and
a cue still buffered when the media is enabled is placed relative to it
before it is returned.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
HLS WebVTT segments carry an X-TIMESTAMP-MAP header that maps a cue time
to an MPEG-TS time of the other renditions (RFC 8216, 3.5). With
timestamp_map set, add the offset it gives to the cue timestamps, and use
the 90 kHz MPEG-TS time base for the stream so that the mapping stays
exact. Skip the header when it comes in a block of its own instead of
ending the parsing there.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Audio from 10 s with WebVTT segments mapping cue time 0 to 10 s, a cue
that spans three segments and a seek into the second segment.
Note tests are ugly with printf generation, but this is the only way to
get full HLS test to work, it's not a single file that we could upload
to fate samples server.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
The keyframe flag was only being set when looping, and not when seeking
back.
Use ctx->first_anmf_offset to detect first keyframe instead of trying
to count cur_frame.
Set pkt->pos to the start of the ANMF chunk (before the header) after
av_get_packet() is called. This fixes seeking and the warning message:
Skipping chunk: [0][0][0][0]
Copy the pixels of the row and write zero padding instead.
Fixes: out of array read
Fixes: 3w9JM5wjYYJx
Fixes: AISLE-2026-0150-00370
Out of array read Replicated through API with ASAN
Found-by: Joshua Rogers (AISLE)
Only 10 and 16 bit output exist for RGB48, reject everything else
at init.
Fixes: NULL pointer dereference
Fixes: cPU32SjSff6g
Fixes: AISLE-2026-0150-00374
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
Encode the pixels of the plane and a zero padding byte instead.
Fixes: out of array read
Fixes: oHpVCeufOIJY
Fixes: AISLE-2026-0150-00405
Out of array read Replicated through API with ASAN
Found-by: Joshua Rogers (AISLE)
A failed allocation of the remap buffer was ignored and a packet
holding only the header returned.
Found during the review of the fix for 8onJqhybXBbq.
Fixes: out of array write
Fixes: 8onJqhybXBbq
Fixes: AISLE-2026-0150-00715
Out of array write Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
Fixes: out of array read
Fixes: bDSjy2ewIh1A
Fixes: AISLE-2026-0150-00823
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The horizontal scaler intermediate buffer holds signed 16-bit samples
that can be negative when scaling with filters that have negative lobes
(such as bicubic). The 16-pixel and 8-pixel NEON vector loops in
ff_yuv2planeX_10_neon treat src as signed int16_t via smlal, but the
scalar tail loop for remaining (dstW % 8) pixels used unsigned ldrh
before sxtw, interpreting negative intermediate values as large positive
values around 65536 and saturating output pixels.
Use ldrsh instead of ldrh so negative intermediate samples are properly
sign-extended in the scalar tail loop.
Signed-off-by: Marvin Scholz <epirat07@gmail.com>
fill_model_input_tf() pops a LastLevelTaskItem from lltask_queue and
stores it in request->lltask, but nothing frees it once the inference
has completed. The next fill_model_input_tf() on the same request just
overwrites the pointer, so only the last lltask of each request is
released, by destroy_request_item() when the model is freed. Every
inference therefore leaks one lltask, apart from the last one of each
of the nireq requests, with both async=0 and async=1.
Free it in infer_completion_callback() before the request is pushed
back to request_queue, as the OpenVINO backend does in its completion
callback. Also free it on the failure paths of execute_model_tf() and
dnn_flush_tf(), where the popped lltask is dropped in the same way. No
inference thread is running on any of these paths. av_freep() resets
the pointer, so the av_freep() in destroy_request_item() is still safe.
Signed-off-by: Jake Fineman <jake@wave.online>
Fixes: use of uninitialized memory
Fixes: t1Iyw4k7bw8h
Fixes: AISLE-2026-0150-00465
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers (AISLE)
Short payloads are accepted since d2a0464fc2 and ab7d38f970.
Fixes: use of uninitialized memory
Fixes: Eivz8cYLGnrh
Fixes: AISLE-2026-0150-00238, AISLE-2026-0150-00058
Use of uninitialized memory Replicated through UnModified FFmpeg with Valgrind
Found-by: Joshua Rogers (AISLE)
Fixes: NULL pointer dereference
Fixes: signed integer overflow
Fixes: LV4ZEjFMTZt7
Fixes: AISLE-2026-0150-00644
NULL pointer dereference Replicated through API with ASAN and UBSAN
Found-by: Joshua Rogers (AISLE)
Like the x86 versions, these may read and write past the end, here by
up to 15 bytes. The main loops process eight vectors per iteration;
with four, the in-order Cortex-A510 stalls on the latency of the prefix
sums, and add_left_pred_int16 was only 1.25x faster than C there.
checkasm --bench (CPU cycles via perf), seed 12345 (width 983), on a
Dimensity 9000:
Cortex-X2 Cortex-A710 Cortex-A510
add_gradient_pred_c: 2138.4 2183.6 4450.3
add_gradient_pred_neon: 225.7 (9.48x) 380.3 (5.74x) 711.6 (6.25x)
add_left_pred_int16_c: 1926.4 1941.4 2112.0
add_left_pred_int16_neon: 370.6 (5.20x) 630.6 (3.08x) 1058.6 (2.00x)
add_left_pred_rnd_acc_c: 1056.5 1029.6 1743.4
add_left_pred_rnd_acc_neon: 201.9 (5.23x) 347.5 (2.96x) 585.2 (2.98x)
add_left_pred_zero_c: 1056.0 1029.2 1742.3
add_left_pred_zero_neon: 201.8 (5.23x) 347.5 (2.96x) 585.2 (2.98x)
and on a Google Tensor (Pixel 6a):
Cortex-X1 Cortex-A76 Cortex-A55
add_gradient_pred_c: 2137.4 2848.2 6892.2
add_gradient_pred_neon: 238.2 (8.97x) 408.2 (6.98x) 1117.5 (6.17x)
add_left_pred_int16_c: 1935.0 2177.2 3950.8
add_left_pred_int16_neon: 398.0 (4.86x) 664.4 (3.28x) 1690.0 (2.34x)
add_left_pred_rnd_acc_c: 1059.7 1533.9 2967.1
add_left_pred_rnd_acc_neon: 214.5 (4.94x) 378.2 (4.06x) 925.4 (3.21x)
add_left_pred_zero_c: 1059.8 1533.9 2967.1
add_left_pred_zero_neon: 214.5 (4.94x) 378.2 (4.06x) 925.4 (3.21x)
Signed-off-by: Gyula Sebok <gyula.sbk@gmail.com>
The buffer only had 8 bytes of padding, while the SIMD versions of
add_left_pred read whole vectors, up to the next multiple of 32 bytes
with AVX2.
Signed-off-by: Gyula Sebok <gyula.sbk@gmail.com>
Only 0xFF was tested, while the decoders use masks up to 0xFFFF
(HuffYUV up to 16 bits, UtVideo 10 bits, MagicYUV 10 to 14 bits).
Test the masks for all bit depths from 8 to 16.
Signed-off-by: Gyula Sebok <gyula.sbk@gmail.com>
1 + rnd() % 16*128 is parsed as 1 + (rnd() % 16) * 128, which only
gives 16 different widths, all of them 1 modulo 128. Use 1..2048, as
intended in 78193e6490.
Signed-off-by: Gyula Sebok <gyula.sbk@gmail.com>
The original implementation was slower than C on all tested cores.
The new version computes 8 outputs per iteration. The caller always
passes even start and end, which the x86 version also relies on, so
the tail only handles 4 and 2 outputs.
checkasm --bench (cycles, median of 7 runs). A55/A76/X1: Pixel 6a,
A510/A710/X2: Vivo Pad 2.
clang c neon_original neon_new
A55 900 2303 (0.39x) 576 (1.56x)
A76 302 550 (0.55x) 204 (1.48x)
X1 173 322 (0.54x) 109 (1.59x)
A510 952 2398 (0.40x) 459 (2.07x)
A710 262 498 (0.53x) 194 (1.35x)
X2 169 298 (0.57x) 106 (1.58x)
gcc c neon_original neon_new
A55 990 2301 (0.43x) 575 (1.72x)
A76 382 549 (0.69x) 205 (1.87x)
X1 208 322 (0.65x) 108 (1.91x)
A510 971 2395 (0.41x) 449 (2.16x)
A710 338 498 (0.68x) 194 (1.74x)
X2 202 298 (0.68x) 107 (1.89x)
5.1 HE-AAC decoding with -threads 1 is about 1-2.5% faster.
Signed-off-by: Gyula Sebok <gyula.sbk@gmail.com>
Four accumulators, as in scalarproduct_float. Eight were not faster at len 256.
checkasm --bench on Apple M4:
scalarproduct_double_c: 80.3
scalarproduct_double_neon: 21.8 ( 3.68x)
Signed-off-by: Patryk Darmofalski <darpat039@gmail.com>
vector_clip_int32 is based on the 32-bit ARM NEON version. Unrolling to
16 or 32 elements per iteration gave no measurable improvement over 8.
vector_clipf applies fmin before fmaxnm, so any NaN input, including a
signaling one, yields min as in C and as documented for av_clipf.
checkasm --bench on Apple M4:
vector_clip_int32_c: 1029.6
vector_clip_int32_neon: 180.7 ( 5.38x)
vector_clipf_c: 682.9
vector_clipf_neon: 190.8 ( 3.34x)
Signed-off-by: Patryk Darmofalski <darpat039@gmail.com>
Exercise empty input and short streams around the decode delay without requiring hardware. Print results for FATE comparison, including the EOF state and timestamp difference.
Assisted-by: Fairy
Fixes: K1QeU7Q1W8m1/testcase/vp9_driver.c
Fixes: K1QeU7Q1W8m1
Fixes: AISLE-2026-0150-00612
Out of array write Replicated through API with ASAN
Found-by: Joshua Rogers (AISLE)
The report suggested using linesize[2] for the V plane throughout the
decoder or rejecting unequal strides after get_buffer2().
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
H.266 8.3.2 requires num_ref_entries to be at least NumRefIdxActive.
Fixes: UfO9ZQ9qW76g/testcase/gdr_rpl2.bit
Fixes: UfO9ZQ9qW76g
Fixes: AISLE-2026-0150-00775
Fixes: division by zero
Division by zero Replicated through UnModified FFmpeg with UBSAN
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: sapW3mP74hBd/testcase/rpl_wrap.mp4
Fixes: sapW3mP74hBd
Fixes: AISLE-2026-0150-00723
Fixes: out of array write
Out of array write Replicated through UnModified FFmpeg with ASAN (i386 build)
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The AV1 specification requires the points to be strictly increasing,
and the AFGS1 scaling function is undefined for equal x values.
Fixes: xaXnd8wemUUh/testcase/afgs1_dup.hevc
Fixes: xaXnd8wemUUh
Fixes: AISLE-2026-0150-00067
Fixes: division by zero
Division by zero Replicated through UnModified FFmpeg with UBSAN
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: GPcB3jXFiizH/testcase/final_dear.hevc
Fixes: GPcB3jXFiizH
Fixes: AISLE-2026-0150-00055
Fixes: excessive CPU time
Excessive CPU time Replicated through UnModified FFmpeg with /usr/bin/time
Found-by: Joshua Rogers (AISLE)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Paper