Commit Graph

125615 Commits

Author SHA1 Message Date
Diego de Souza
c7546ce0ea avutil/pixfmt: add AV_PIX_FMT_CUARRAY for opaque CUDA block-linear surfaces
Add a new hardware pixel format representing opaque block-linear CUDA
arrays (CUarray). This format is used by NVDEC when decoding into
opaque surfaces registered with cuvidRegisterDecodeSurfaces, and can
be consumed directly by NVENC as CUDA array input without requiring
a pitch-linear copy.

Signed-off-by: Diego de Souza <ddesouza@nvidia.com>
2026-07-14 19:45:02 +00:00
Vignesh Venkat
5002b55ce7 fate/mov: Add fate test for t35 cdsc track
Signed-off-by: Vignesh Venkat <vigneshv@google.com>
2026-07-14 15:50:30 -03:00
James Almer
8a3e9147b6 avformat/mov: parse cdsc track references
Signed-off-by: James Almer <jamrial@gmail.com>
2026-07-14 15:50:30 -03:00
Vignesh Venkat
a302c9ae44 avformat/mov: Add itut-t35 data codec support
The specification for the T35MetaDataSampleEntry ('it35') box is
available in the "Draft text of ISO/IEC 14496-12 10th edition"
which can be found on the MPEG website:
https://www.mpeg.org/standards/MPEG-4/12/

Support the t35 track in mov and export the `t35_identifier`
as extradata and human readable sample description as the stream
description.

Signed-off-by: Vignesh Venkat <vigneshv@google.com>
2026-07-14 15:50:24 -03:00
Raja-89
312c830916 avfilter/dnn: auto-initialize nireq for Torch backend
Initialize ctx->nireq with av_cpu_count() / 2 + 1 when
unset, matching the TensorFlow and OpenVINO backends.

Create ctx->nireq THRequestItems in a loop instead of
hardcoding a single request, enabling concurrent async
inference requests for improved throughput.

Signed-off-by: Raja Rathour <imraja729@gmail.com>
2026-07-14 14:26:53 +00:00
lck
9287fc3bc9 lavc/mediacodecdec: rename MediaCodecH264DecContext to MediaCodecContext
The context structure was named specifically for H.264, but it's actually
used for multiple codecs (H.264, H.265, MPEG-4, etc.). Renaming it to
MediaCodecContext better reflects its actual usage and makes the code
more consistent.
2026-07-14 13:54:39 +00:00
Niklas Haas
150f7d15df swscale/uops_macros_gen: drop checkasm planar write hack
No longer needed since the new uops-based rewrite.
Here's hoping we won't need to revert it if these ops come up again
in the future.

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
e65dab2b59 swscale/tests/sws_ops: rewrite to test uops directly
Instead of awkwardly reverse-engineering each uop to reflect
it back to the corresponding SwsOp, this leverages the new
compile_uops() API to directly test the uop in question.

This is not only vastly simpler but also fixes several major
shortcomings with the previous design, such as always having
to keep the reflection code in sync for any newly added uop,
or not testing uops that get translated to a packed shuffle
fast path.

The major downside is that arch-specific uops can now no longer
be tested against the C reference unless we specifically add
a C reference function for each relevant uop; and also, that the
packed shuffle fast path is currently no longer tested by checkasm.
(But this will be fixed by my upcoming pshufb uop series)

Another downside is that this effectively disables testing for e.g.
aarch64, since it does not yet use the uops architecture.

$ time checkasm --test=sw_ops --repeat=10 # 1.85s -> 1.39s

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
909ca1d7ce swscale/x86/ops: add missing non-FMA SWS_UOP_LINEAR fallback
Needed for platforms without SSE4.1 support, as well as checkasm.

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
44e1b60c6a swscale/uops: consolidate SWS_UOP_{PERMUTE,COPY,MOVE}
Rather than having two uops for the C reference code and a separate
uop for the x86 backend, we can just implement the C reference
using the same register-register assignment logic.

This results in only slightly worse codegen, since the compiler is
smart enough to eliminate the unnecessary copies.

The main downside is the fact that we need to allocate extra stack space
to back-fill the remaining (unused) pointers. In theory, we could do this
more efficiently by re-using unused *input* registers directly, but that
would require a lot of reliance on compile-time constant folding teasing
apart the entire register index tracking loop and duplicate check, so this
is a useful middle ground.

On platforms like x86, we still don't care about the PERMUTE vs
COPY distinction, but it's also harmless (2-3 extra lines to
instantiate the underlying MOVE macro on both uop variants).

Finally, we need to add a mask to the move uops to keep track of which
outputs are actually needed (especially for checkasm). Though it does result
in the rather unfortunate downside that it bloats the names of the uop
names.

The op lists change to reflect the new representation, e.g.:

 rgb24 16x16 -> bgr24 16x16:
   [ u8 +++X] SWS_OP_READ         : 3 elem(s) packed >> 0
     min: {0 0 0 _}, max: {255 255 255 _}
   [ u8 +++X] SWS_OP_SWIZZLE      : 2103
     min: {0 0 0 _}, max: {255 255 255 _}
   [ u8 XXXX] SWS_OP_WRITE        : 3 elem(s) packed >> 0
     ('X' unused, 'z' byteswapped, '=' copied, '$' const, '+' integer, '0' zero)
  translated micro-ops:
     u8_read_packed_xyz
-    u8_permute_zyxw
+    u8_permute_xyzw_txz_xzt
     u8_write_packed_xyz

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
b3a998699c swscale/x86/ops: add micro-op dump to compile_uops_x86() as well
This was only done in compile_uops_c(). Add it here as well for consistency.
Long-term I want to move this code to ops_dispatch.c, but that requires
moving the packed shuffle solver there as well, which is still WIP.

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
bb553f9160 swscale/x86/ops: implement compile_uops()
This also splits off the mmsize determination to a separate helper,
to make the code a bit more reusable.

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
33d183a473 swscale/ops_dispatch: add SwsOpBackend.compile_uops()
This can be used as an alternative to the existing compile() backend, that
takes SwsUOpList instead of SwsOpList.

Down the line, I plan on also moving the uops translation to the dispatch
layer itself, but this requires some further changes which have not yet
been merged, so this commit represents a stopgap solution.

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
17a9a59333 swscale/x86/ops: avoid direct reliance on ops metadata
Instead, use the new metadata introduced in the previous commit. The
motivating reason here is a desire to stop taking a direct SwsOpList from
the backends altogether.

In theory, we could still recover this information from the `uops` list
itself, but that would require far more boilerplate than simply having
uops.c generate it using existing SwsOpsList helpers.

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
670324675f swscale/uops: add extra convenience metadata for the backends
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Niklas Haas
2dbcec5222 swscale/ops_dispatch: remove outdated comment
Missed by 228ef8d97b.

Signed-off-by: Niklas Haas <git@haasn.dev>
2026-07-14 12:24:01 +00:00
Andreas Rheinhardt
8bea614d98 avcodec/x86/sbcdsp: Avoid shift
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-07-14 10:01:08 +02:00
Andreas Rheinhardt
f769e433a3 Revert "tests/checkasm/vp9dsp: Allow to run only a subset of tests"
This reverts commit 7bc35b8426.
The aim of this patch can now be achieved via checkasm's
--function pattern matching.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-07-14 10:01:08 +02:00
Michael Niedermayer
58d39e99e2 avformat/concatdec: Check recursion depth
This variant is easy backportable but is concatdec specific

Fixes: self_ref.ffconcat
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Rediscovered-by: Anxious Koisi
Fixes: RWHkT0ASFMNI
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-14 04:52:18 +02:00
Michael Niedermayer
597036b692 avformat: Add recursion limit
This is a generic recursion limit that is not specific to a demuxer
it does change public API which makes this unsuitable for backporting

Fixes: self_ref.ffconcat

Reported-by: Yuhao Jiang <danisjiang@gmail.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-13 19:35:48 +00:00
Timo Rothenpieler
a633df56a4 avcodec/d3d12va_vp9: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
1307db3d3c avcodec/d3d12va_vc1: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
26a9f9b3ae avcodec/d3d12va_mpeg2: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
fea3f13a1c avcodec/d3d12va_hevc: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
19e81f9260 avcodec/d3d12va_h264: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
7309ad9fd7 avcodec/d3d12va_av1: check slice bitstream size against available buffer size 2026-07-13 21:13:25 +02:00
Timo Rothenpieler
e1ef95c779 avcodec/d3d12va_av1: check size of frame bitstream against available buffer size 2026-07-13 21:13:25 +02:00
Michael Niedermayer
ba55f425fd avcodec/hevc: Fix integer overflow in WPP entry point range check
Fixes: out of array access
Fixes: poc.hevc / make_poc.py
Fixes: 83WY4xnR87vb
Fixes: dad354f38d (avcodec/hevc: Check max ctb addresses for WPP)
Found-by: VulnForge Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-13 18:36:11 +00:00
Michael Niedermayer
de771bd527 avformat/ty: don't let the Series2 AC3 trim underflow the packet size
Fixes: negative-size-param
Fixes: ty-s2-ac3-negative-size-single-file.ffconcat / create_poc.py
Fixes: g0qeE6KvrjZi
Found-by: Adrian Junge (vurlo)
2026-07-13 18:29:44 +00:00
Michael Niedermayer
a7e38b617b avfilter/vf_swaprect: size the temp row buffer for the widest plane
Fixes: out of array access
Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py
Fixes: VRAXYvKtmKa8
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
2026-07-13 18:22:46 +00:00
Michael Niedermayer
cff4a69294 avfilter: add latticepal filter
Convert packed 24/32-bit RGB/BGR/RGBA/BGRA input to PAL8 using a per-frame palette
whose colors are placed on a face-centered cubic lattice (realized as the
scaled D3/D4 checkerboard lattice), with a user-supplied density controlling
the number of lattice steps spanning one color axis.

Only lattice points actually used by a frame enter its palette; if a frame
needs more than 256 of them, the filter will itearatively drop palettte
entries and reassign affected pixels until 256 color remain

lookup uses the Conway-Sloane rounding algorithm. Supported dithering
modes: none, ordered 8x8 bayer (swscale), Cluster & Void blue noise and
Floyd-Steinberg error diffusion.

Co-Authored-by: Fable-5
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-13 18:16:18 +00:00
Michael Niedermayer
f186c50cf5 avfilter/vf_floodfill: remove unneeded variables
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-13 17:14:54 +00:00
Michael Niedermayer
24c322fdb2 avfilter/vf_floodfill: size the point stack for the current frame
Fixes: out of array access
Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py
Fixes: 3MleMXjGZvu3
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
2026-07-13 17:14:54 +00:00
Michael Niedermayer
0089694c06 avfilter/vf_lut3d: compute size2 after the 3DLUTSIZE directive
Fixes: out of array access
Fixes: lut3d_poc/poc_3dlut2.dat
Fixes: 6p0ahHBxreqG
Found-by: SecBuddyF - Tencent KeenLab
2026-07-13 17:14:48 +00:00
Araz Iusubov
fc4b523596 avfilter/vf_vqe_amf: Add AMF Video Quality Enhancer filter 2026-07-13 16:40:41 +00:00
Lynne
b672ae3905 vulkan_encode: fix leak and swallowed errors in init_base_units()
The encoded session parameters buffer was never freed, and both
GetEncodedVideoSessionParametersKHR error paths returned err, which
is always 0 at that point, reporting success on failure.
2026-07-14 01:23:24 +09:00
Lynne
ddfa842088 vulkan_encode: destroy image views of queued pictures on uninit
ff_hw_base_encode_close() frees any pictures still in the encode
queue without invoking the encoder's free callback, leaking their
image views when an encoder is closed without fully draining it.
Also uninit the packet buffer pool before the base encode context,
rather than after.
2026-07-14 01:23:24 +09:00
Lynne
569674ac8d vulkan_encode: free CBS context, fragment and SEI buffers on close
The CBS context, its current access unit fragment, and the SEI
buffers were never freed, leaking the refcounted parameter set
clones stored in the CBS private data on every encoder teardown.
2026-07-14 01:23:21 +09:00
Michael Niedermayer
01a9a98f35 doc/developer.texi: update reviews section
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-07-13 16:13:47 +00:00
Michael Niedermayer
0c29cabc97 doc/infra.txt: add fairy 2026-07-13 16:13:47 +00:00
Cloud-LHY
fd3ee52fab avcodec/tdsc: unref the reference frame before reallocating on size change
Fixes: out of array access
Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py
Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py
Fixes: p9xG4xGf9P7H
Fixes: HQL7a1WgTdHZ
Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS
Found-by: Adrian Junge (vurlo)
2026-07-13 16:13:04 +00:00
Lynne
90436de5e1 vf_libplacebo: add missing avstring.h include
Otherwise compilation fails due to vulkan.h no longer including it.
2026-07-13 18:57:38 +09:00
Lynne
92f2e6374d configure: remove libshaderc and libglslang support
All of it is now gone.
2026-07-13 18:57:38 +09:00
Lynne
9e9ac0dcd9 vulkan: remove runtime shader compilation support
No longer needed.
2026-07-13 18:57:37 +09:00
Lynne
aa6aa4ec3e swscale: remove GLSL backend
No longer needed. The SPIR-V version is pretty clean and neat.
2026-07-13 18:57:37 +09:00
Lynne
6219d4fdd1 vf_scale_vulkan: port to compile-time SPIR-V generation
Same functionality as before, but cleaner.
2026-07-13 18:57:37 +09:00
Lynne
1a4250e924 avcodec: remove unneeded vulkan_spirv.h includes
Leftover crud from before the rewrite to compile-time SPIR-V.
2026-07-13 18:57:37 +09:00
Lynne
4b9c4b9cfb swscale/ops_dispatch: fix use-after-free when adding opaque ops passes
comp points into p, which is freed before comp->backend is read.
Use the copy taken before the free.
2026-07-13 18:57:37 +09:00
Lynne
b2b0429d15 swscale/vulkan: fix invalid SPIR-V generation for plane-remapped passes
The CLEAR codegen iterated components by value[i].den, while the
constants pass iterates by clear.mask; unmasked components may hold
leftover values with a nonzero denominator, consuming more constant
IDs than were registered and emitting ID 0 into the instruction
stream.

The image handle arrays were also sized by the number of planes an
op touches, but plane_src/plane_dst contain actual frame plane
indices, so a pass writing only e.g. the alpha plane references
handle 3 while only handle 0 was loaded.

Either results in invalid SPIR-V, which crashes RADV inside
spirv_to_nir when creating the shader object.
2026-07-13 18:57:37 +09:00
Michael Niedermayer
9c2aabaa34 avcodec/cavsdec: reject invalid start-code bitreader sizes
Fixes: NULL pointer dereference
Fixes: 4jy_poc_cavs.zip / poc_cavs.avi
Fixes: UH66Y8Om9F8X
Found-by: Jiale Yao <yaojiale02@163.com>
2026-07-13 01:08:09 +00:00