Commit graph

122713 commits

Author SHA1 Message Date
Andreas Rheinhardt
7e3781e3ca avcodec/libcodec2: Remove always-false checks
Already checked via CODEC_SAMPLERATES and CODEC_SAMPLEFMTS.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-11 12:07:38 +01:00
Andreas Rheinhardt
12c2a4e117 avcodec: Don't set AVCodec.sample_fmts,ch_layouts for decoders
It is pointless for them given that these values will
be overridden by the decoder lateron anyway.
The only exceptions to this are scenarios where the decoder
actually checks request_sample_fmt or where there are both
fixed- and floating point decoders.

(IMO something like get_format() for audio would be better for
both cases.)

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-11 12:07:35 +01:00
Andreas Rheinhardt
028d9d3997 avcodec/sbcdec: Don't set encoder-only fields
ch_layouts, sample_fmts and supported_samplerates
are of no use for a decoder, so don't set them.
In this case this fixes an inconsistency:
ch_layouts contained mono and stereo, yet lateron
the AVCodecContext's ch_layout is always populated
with an AV_CHANNEL_ORDER_UNSPEC layout.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-11 12:07:31 +01:00
Andreas Rheinhardt
f648dd0e8a avcodec/adpcm: Don't set AVCodec.sample_fmts
It is unnecessary for a decoder (the sample fmt is
set lateron during init and the user has no choice
over this (even for the decoders where sample_fmts
contains two entries).

(This also fixes the ADPCM_DECODER macro: It's second
and third parameters were called "name" and "sample_fmts",
yet the second argument always contained the sample fmts.)

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-11 12:07:07 +01:00
Andreas Rheinhardt
3a7c09eb39 avcodec/x86/mpegvideoencdsp_init: Port draw_edges to SSSE3
Benchmarks:
draw_edges_8_1724_4_c:                                2672.2 ( 1.00x)
draw_edges_8_1724_4_mmx:                              3191.5 ( 0.84x)
draw_edges_8_1724_4_ssse3:                            2179.6 ( 1.23x)
draw_edges_8_1724_8_c:                                2852.3 ( 1.00x)
draw_edges_8_1724_8_mmx:                              3683.0 ( 0.77x)
draw_edges_8_1724_8_ssse3:                            2225.7 ( 1.28x)
draw_edges_8_1724_16_c:                               4169.4 ( 1.00x)
draw_edges_8_1724_16_mmx:                             4665.9 ( 0.89x)
draw_edges_8_1724_16_ssse3:                           2765.8 ( 1.51x)
draw_edges_128_407_4_c:                               1126.6 ( 1.00x)
draw_edges_128_407_4_mmx:                              943.9 ( 1.19x)
draw_edges_128_407_4_ssse3:                            925.7 ( 1.22x)
draw_edges_128_407_8_c:                               1208.8 ( 1.00x)
draw_edges_128_407_8_mmx:                             1119.1 ( 1.08x)
draw_edges_128_407_8_ssse3:                            997.8 ( 1.21x)
draw_edges_128_407_16_c:                              1352.4 ( 1.00x)
draw_edges_128_407_16_mmx:                            1368.7 ( 0.99x)
draw_edges_128_407_16_ssse3:                          1148.3 ( 1.18x)
draw_edges_1080_31_4_c:                                228.5 ( 1.00x)
draw_edges_1080_31_4_mmx:                              240.8 ( 0.95x)
draw_edges_1080_31_4_ssse3:                            226.7 ( 1.01x)
draw_edges_1080_31_8_c:                                411.1 ( 1.00x)
draw_edges_1080_31_8_mmx:                              432.9 ( 0.95x)
draw_edges_1080_31_8_ssse3:                            403.2 ( 1.02x)
draw_edges_1080_31_16_c:                              1121.2 ( 1.00x)
draw_edges_1080_31_16_mmx:                            1124.9 ( 1.00x)
draw_edges_1080_31_16_ssse3:                          1125.4 ( 1.00x)
draw_edges_1920_4_4_c:                                 310.8 ( 1.00x)
draw_edges_1920_4_4_mmx:                               311.6 ( 1.00x)
draw_edges_1920_4_4_ssse3:                             311.6 ( 1.00x)
draw_edges_1920_4_4_negstride_c:                       307.0 ( 1.00x)
draw_edges_1920_4_4_negstride_mmx:                     306.7 ( 1.00x)
draw_edges_1920_4_4_negstride_ssse3:                   306.7 ( 1.00x)
draw_edges_1920_4_8_c:                                 724.2 ( 1.00x)
draw_edges_1920_4_8_mmx:                               724.9 ( 1.00x)
draw_edges_1920_4_8_ssse3:                             717.3 ( 1.01x)
draw_edges_1920_4_8_negstride_c:                       719.2 ( 1.00x)
draw_edges_1920_4_8_negstride_mmx:                     717.1 ( 1.00x)
draw_edges_1920_4_8_negstride_ssse3:                   710.9 ( 1.01x)
draw_edges_1920_4_16_c:                               1752.9 ( 1.00x)
draw_edges_1920_4_16_mmx:                             1754.6 ( 1.00x)
draw_edges_1920_4_16_ssse3:                           1751.1 ( 1.00x)
draw_edges_1920_4_16_negstride_c:                     1783.2 ( 1.00x)
draw_edges_1920_4_16_negstride_mmx:                   1778.2 ( 1.00x)
draw_edges_1920_4_16_negstride_ssse3:                 1768.3 ( 1.01x)

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-11 11:15:06 +01:00
Michael Niedermayer
4f97e52042 avformat/cafdec: Check nb_entries in read_info_chunk()
Fixes: Timeout
Fixes: 477315122/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5274792315125760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-11 01:17:30 +00:00
Andreas Rheinhardt
f6d89a7bed avformat/spdif: Make enum IEC61937DataType at least 16bits
Fixes the spdif-dca-master FATE-test when compiling with
-fshort-enums.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
f0392c908c avcodec/flacenc: Use int for AV_OPT_TYPE_INT
Necessary for -fshort-enums.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
b08e849af8 avfilter/lavfutils: Avoid AVDictionary
Set thread_type directly instead.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
373c86bac8 swscale/utils: Improve type-safety
SwsContext.{src,dst}_format is int (but uses enum AVPixelFormat)
values, so the accesses need to be performed using an int
for -fshort-enums support.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
fb8a12db17 avutil/opt: Improve type-safety
In particular, make this code -fshort-enums compatible.
The branch can be optimized away by compilers when
sizeof(enum AVPixelFormat) == sizeof(enum AVSampleFormat).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
2273902be8 avfilter/lavfutils: Avoid copying frame in ff_load_image()
Return the data in an AVFrame instead. This is what several users
({find,cover}_rect*) want anyway. This also avoids accessing
AVFrame.format (an int) via an enum AVPixelFormat*.

*: This commit actually avoids two frame copies For find_rect:
av_frame_clone() contained an implicit alloc+copy.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
31173f148c avfilter/vf_removelogo: Properly handle allocation error
Don't rely on av_image_copy_plane() handling a NULL dst
gracefully.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:46 +01:00
Andreas Rheinhardt
0c7424e817 avfilter/filters: Restrict ff_fmt_is_in() to enum AVPixelFormat
Also rename it to ff_pixfmt_is_in(). This is more type-safe;
in particular, it is required to support -fshort-enum.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 19:44:43 +01:00
Andreas Rheinhardt
bf44a683eb fftools/ffmpeg_mux_init: Improve type-safety
This makes fftools -fshort-enums compatible.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 16:36:58 +01:00
Andreas Rheinhardt
fcfb33922f avformat/cafenc: don't keep track of nb packets ourselves
Just reuse AVStream.nb_frames.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 11:32:56 +01:00
Andreas Rheinhardt
96475bfa21 avformat/cafenc: Simplify writing pakt box
Assemble it already in caf_write_packet(). This has the advantage
of reducing the amount of buffers used; it also allows to avoid
a seek when writing the trailer and avoids function call overhead
(for the avio_w8(); it also reduces codesize).

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-10 11:31:17 +01:00
Michael Niedermayer
38230db7b9
avcodec/vp9: Reallocate on resolution change which does not change tile_cols
Fixes: out of array access on resolution change with slices threads
Fixes: VULN-10/poc.ivf

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 01:30:42 +01:00
Michael Niedermayer
521d18cea3
avformat/img2dec: Check avio_size() for failure
More complete fix for #YWH-PGM40646-32

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 01:19:00 +01:00
Michael Niedermayer
19c78cd6d9
avformat/mpegtsenc: Check remaining space in SDT
Fixes: out of array access
Fixes: VULN-8

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 01:07:19 +01:00
Michael Niedermayer
ca1c1f29ce
avformat/img2enc: Check split planes packet size
Fixes: out of array read
Fixes: VULN-6/poc.raw

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 00:54:41 +01:00
Michael Niedermayer
b740b85872
avformat/yuv4mpegen: Sanity check input packet frame dimensions
Fixes: out of array access if a filter-graph is used the injects changing dimensions

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-10 00:40:52 +01:00
Ramiro Polla
9ee6136ece avcodec/mjpegdec: remove start_code field from MJpegDecodeContext
Instead, pass it as a parameter to the only function that uses it.
2026-02-09 17:52:01 +00:00
Andreas Rheinhardt
1218a8a922 avcodec/rangecoder: Fix indentation
Forgotten after 832649986c
and d147b3d7ec.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-09 17:36:40 +00:00
James Almer
2e79453549 tests/fate/id3v2: don't use a reference file for fate-id3v2-invalid-tags
This fixes running the test under Valgrind, where more, unrelated lines are
printed, making the comparison fail.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-09 14:04:22 +00:00
Niklas Haas
be88553fc8 fftools/ffmpeg_demux: mirror DemuxStream name to AVFormatContext
Results in basically the same name, except less ambiguous because
it includes the input index.
2026-02-09 14:01:14 +00:00
Niklas Haas
f2b13f783a avformat: add AVFormatContext.name
Analog to AVFilterContext. May be used to set a custom logging name to
disambiguate multiple AVFormatContext instances in the logs.
2026-02-09 14:01:14 +00:00
Michael Niedermayer
9bfa1635ae avformat/iff: Error out with 0 channel loudspeaker configuration
Fixes: division by 0
Fixes: 478005965/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5748337088462848
Fixes: 472226169/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4528777763028992

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-09 04:25:04 +00:00
Ted Meyer
a58cb16e27 Fix overflow in STSD parser
Reset `sc->stsd_count` before parsing entries. This number doesn't get
reset, which means that multiple parse passes can increment it past the
`sc->extradata` array end and cause OOB writes.
2026-02-09 02:38:16 +00:00
James Almer
303fd126a8 avformat/iamf: replace av_assert0(0) with av_unreachable
Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
James Almer
8665748584 avformat/iamf_reader: sanitize block and subblock durations and count
Abort earlier if subblock durations are inconsistent with their containing block,
and ensure each subblock duration is at least 1.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
James Almer
34ac6f6b07 avformat/iamf_parse: sanitize block and subblock durations and count
Abort earlier if subblock durations are inconsistent with their containing block,
and ensure each subblock duration is at least 1.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
James Almer
706d4e4736 avutil/iamf: stop setting parameter definition block defaults
It was done for the sake of having subblock_duration not be zero as the spec
forbids that value, but harcoding it to any arbitrary value is no better
considering the user is meant to fill the entire structure.

This helps speeding up the function when trying to allocate a struct with a
huge amount of blocks.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-08 21:58:06 -03:00
Hassan Hany
273b161a98 avcodec/exif: skip EXIF entries with invalid TIFF field type 0
EXIF IFD entries with TIFF field type 0 are invalid per the specification.
Without a check, exif_read_values() fails to allocate entry->value,
causing an out of memory error.

This patch skips such entries early during parsing, allowing decoding
to continue normally.

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21623
2026-02-08 19:56:20 +00:00
Michael Niedermayer
5f84a7263e avcodec/adpcm: Check input buffer size
Larger values will lead to integer overflows in intermediates
No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-08 14:46:56 +00:00
Michael Niedermayer
a5007428e8
avformat/scd: Use ffio_read_size()
Fixes: use of uninitialized memory
Fixes: 471771529/clusterfuzz-testcase-minimized-ffmpeg_dem_SCD_fuzzer-5328203515494400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-02-08 02:25:14 +01:00
Niklas Haas
b8daba42cd avformat/http: report connection statistics
Helpful to track the impact of options like -multiple_requests, -probing_size
or -short_seek_size.
2026-02-07 10:02:36 +00:00
Niklas Haas
4f5d91e43f avformat/http: allow limiting initial request size
Sometimes, HTTP sources require a lot of seeking during probing / header
parsing (especially for formats like MXF). Currently, we need to completely
tear down and re-establish the connection most times this happens, which puts
a lot of stress on the network stack and also results in transmission of
possibly many unnecessary bytes.

This patch adds an option to allow FFmpeg to request partial ranges during
the initialization stage. This is done until the initial request size is fully
read, after which we fall back to the normal behavior (i.e. infinite streaming
via an unbounded request).

The usefulness of this is limited without also specifying -multiple_requests 1,
since otherwise there is little point to requesting partial ranges to begin
with. (However, it is semantically independent, so we keep it that way.)
2026-02-07 10:02:36 +00:00
Niklas Haas
e03b034e45 avformat/http: re-use keep-alive connection for small seeks
When the previous reply was a partial response (e.g. due to a seek to the
end of the file), and the remaining data from that partial response is
below the short seek size threshold, we can serve this seek by just draining
that data and re-using the existing connection.

This can currently only happen when using keep-alive connections
(-multiple_requests 1) and seeking from the end of the file to somewhere
else, in which case the file's tail can be drained and the connection re-used.

Under other circumstances, however, we still need to force a reconnection,
because we do not yet send partial range requests. (This will be changed in the
following commit)

We need to take special care not to regress the existing fallback logic
for when `http_open_cnx` fails, so here is a quick case analysis:

non-drain path:
- identical to the current

soft drain fails: (ffurl_read error path)
- s->hd = old_hd = NULL
- http_open_cnx() always opens a new connection
- on failure, old buffer is restored and s->hd remains NULL

soft drain succeeds, http_open_cnx() fails:
- s->hd is set to NULL by http_open_cnx() failure path
- old_hd was never set, so remains NULL
- old buffer is restored, s->hd remains NULL

In either case, the outcome that any (previously valid) buffer is left as-is,
the offset is unchanged, and the connection ends up closed (s->hd == NULL).
This is okay to do after the previous change to http_buf_read, which allows
it to internally re-open the connection if needed.
2026-02-07 10:02:36 +00:00
Niklas Haas
bf1722a9c6 avformat/http: request more data after partial response
If the Content-Range indicates a smaller range than what we expected,
we should send a new request for the remainder before attempting to read
more.

Again, this commit is theoretically non-functional on its own, since any
conforming HTTP server should give us the entire range we asked for in the
first place, but it is semantically independent from and prepares us for the
following changes.
2026-02-07 10:02:36 +00:00
Niklas Haas
6336fa3335 avformat/http: return EIO if s->hd is NULL
This could conceivably happen currently if the user tries reading more
bytes after the last chunk has already been received. In this case,
we currently segfault - but simply returning AVERROR(EIO) seems more
reasonable and lets the higher end retry the connection in this case.
2026-02-07 10:02:36 +00:00
Niklas Haas
ca2c5ff412 avformat/http: parse range size from Content-Range header
In the event that the range returned is smaller than the true filesize, we
should only expect to receive that many bytes - not the entire rest of the
file.

This commit is theoretically non-functional on its own, since any conforming
HTTP server will always return us the full file range, but I wanted to split
it off from the subsequent changes in order to make review easier.
2026-02-07 10:02:36 +00:00
Niklas Haas
19cae9151c avformat/http: print error on HTTP response failure
This currently fails silently with zero indication of what the problem might
be, which tripped me up a bit while debugging.
2026-02-07 10:02:36 +00:00
Niklas Haas
5f95a1e714 avformat/http: fix noop seek check
This fails to consider the case of whence == SEEK_END and the resulting
offset happening to exactly match the current position.

Reorder the check to compute the target position first, then compare.
2026-02-07 10:02:36 +00:00
Brad Smith
c352a9ab02 avutil/cpu: add CPU feature detection for AArch64 CRC32 on OpenBSD
Signed-off-by: Brad Smith <brad@comstyle.com>
2026-02-06 14:24:01 -05:00
Andreas Rheinhardt
0fefecd53f Revert "avcodec/opus/parse: export the packet and extradata parsing functions"
This reverts commit aa20d7b3e8.

Adding these avpriv functions is absolutely overblown: Muxers
can get the desired duration in a few lines themselves.
In particular, using the parse functions from this file
necessitated parsing the extradata (and entailed exporting
the parsing function), although it was only used to know
whether the frames are self-delimiting, but everything of
interest to a muxer does not depend on this at all.

The commit to be reverted also made several structures
part of the ABI, which should be avoided in general.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-06 14:09:15 +01:00
Andreas Rheinhardt
12747e6296 avformat/matroskaenc: Parse Opus packet durations ourselves
This avoids avpriv functions from lavc/opus/parse.c
(which parse way more than we need, necessitating
parsing the extradata).
It furthermore makes the output of the muxer consistent,
i.e. no longer depending upon whether the Opus parser
or decoder are enabled (the avpriv functions would just
return AVERROR(ENOSYS)).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-06 14:05:14 +01:00
Andreas Rheinhardt
853843d86f avcodec/opus/parse: Move frame_duration tab into a file of its own
This is in preparation for duplicating it into libavformat.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-02-06 14:04:50 +01:00
James Almer
3ab8b976c1 avformat/matroskaenc: parse Opus packets to write proper durations
Before this patch, the last packet in the affected fate test would be written
without a BlockDuration element despite the packet's duration being shorter
than the Opus frame size.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-05 23:21:49 -03:00
James Almer
aa20d7b3e8 avcodec/opus/parse: export the packet and extradata parsing functions
Needed for the following commit.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-02-05 23:21:49 -03:00