Commit graph

54284 commits

Author SHA1 Message Date
David Korczynski
331b3e9dea avcodec/on2avc: reject subframe count whose * SUBFRAME_SIZE product overflows 32-bit
Found-by: Anthropic agents; validated and reported by Ada Logics.
Signed-off-by: David Korczynski <david@adalogics.com>
2026-06-10 02:15:53 +00:00
Diego de Souza
0a7c5e507b avcodec/nvenc: fix compatibility with Video Codec SDK 13.1
NV_ENC_CLOCK_TIMESTAMP_SET was changed in SDK 13.1: countingType was
replaced by countingTypeLSB and countingTypeMSB.

Signed-off-by: Diego de Souza <ddesouza@nvidia.com>
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2026-06-10 01:28:40 +02:00
James Almer
9eb6f2f450 avcodec/aacenc: fix PCE layouts for 7.1 and 7.1(wide)
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-09 15:33:20 -03:00
Lynne
4406f5ba5b
prores_raw: document vendor-specific metadata location 2026-06-10 02:38:36 +09:00
Lynne
4cf96187e4
prores_raw: set frame crop fields
Some sensors or cameras put junk in the frame boundaries. We should
crop them out.
2026-06-10 02:38:35 +09:00
Lynne
0def4ceb18
prores_raw: export raw camera color data values 2026-06-10 02:38:35 +09:00
Jun Zhao
cfa3ceac7a lavc/hevc: add aarch64 NEON for angular modes 10 and 26
Add NEON-optimized implementations for HEVC angular intra prediction
modes 10 (pure horizontal) and 26 (pure vertical) at 8-bit depth.

Mode 10 (Horizontal):
- Broadcasts left[y] to fill each row using ld2r/ld4r for efficiency
- Applies edge smoothing for luma blocks smaller than 32x32

Mode 26 (Vertical):
- Copies top reference row to all output rows
- Applies edge smoothing for luma blocks smaller than 32x32

Edge smoothing uses uhsub+usqadd to compute the filtered result
directly in 8-bit, avoiding widening to 16-bit intermediates.

The C pred_angular wrappers are made non-static with ff_ prefix to
allow the NEON dispatch to fall back to C for modes not yet optimized.
This will be reverted once all angular modes are implemented.

Note: since pred_angular[] is a per-size function pointer (not
per-mode), checkasm benchmarks will show '_neon' for all 33 modes
even though only modes 10/26 are truly accelerated; unoptimized
modes show ~1.0x speedup as they pass through the NEON wrapper to
the C fallback with negligible overhead.

Speedup over C on Apple M4 (checkasm --bench, 15-run average):

  Mode 10 (Horizontal):
    4x4: 4.66x    8x8: 5.80x    16x16: 16.86x    32x32: 24.89x

  Mode 26 (Vertical):
    4x4: 1.16x    8x8: 1.83x    16x16: 2.45x    32x32: 4.50x

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
2026-06-07 23:29:33 +00:00
Jun Zhao
3ec0f14f7d avcodec/h264_ps: set default SAR, remove stale workaround
Set sps->vui.sar to {0,1} (unspecified) before the VUI parsing
block, matching the HEVC pattern at hevc_ps.c.  The old
zero-init-to-1 workaround is now unreachable and is removed.

Suggested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
2026-06-07 18:55:16 +00:00
Jun Zhao
e598463b3d avcodec/h2645_vui: interpret a degenerate SAR as unspecified
Per ITU-T H.264 (ISO/IEC 14496-10) Annex E.2.1 and ITU-T H.265
(ISO/IEC 23008-2) Annex E.3.1, when sar_width or sar_height is zero
the sample aspect ratio shall be considered unspecified. Internally
ffmpeg represents an unspecified SAR as 0/1, while fractions with a
zero denominator are not handled properly (den=0 is silently changed
to den=1 in h264_ps.c, turning an invalid 20480/0 into a "valid" but
impossibly extreme 20480/1); so we bridge the gap by replacing x/0
with 0/1 at the VUI parsing layer.

An av_log warning is added so an invalid SAR in the bitstream is
diagnosed rather than silently overwritten.

This fixes a problem with some video files provided by game
OddBallers when executed with Wine/Proton, which report SAR 20480/0.

Based on patch by Giovanni Mascellani <gmascellani@codeweavers.com>.
Fixes: ticket #23321

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
2026-06-07 18:55:16 +00:00
Andreas Rheinhardt
bb49197ede avcodec/liboapvenc: Remove dimension change check
If this were to be checked, it should be checked generically,
not in every single encoder.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
Andreas Rheinhardt
0faa43ae6c avcodec/liboapvenc: Use av_image_copy2() to avoid cast
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
Andreas Rheinhardt
bf47563bd8 avcodec/liboapvenc: Remove always-false checks
Already checked in encode_preinit_video().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
Andreas Rheinhardt
80ea2d1487 avcodec/liboapvenc: Return directly when possible
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
Andreas Rheinhardt
67855a7234 avcodec/liboapvenc: Use av_unreachable for unreachable default cases
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
Andreas Rheinhardt
9791c4d183 avcodec/liboapvenc: Don't set AVCodec.pix_fmts directly
Instead use CODEC_PIXFMTS. Avoids deprecation warnings
from Clang and simplifies the removal of AVCodec.pix_fmts.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-07 17:53:44 +02:00
James Almer
d1faab734d avcodec/dcadec: map Lw/Rw to FLC/FRC
Some 7.1 DTS files seem to signal Lw/Rw channels that the decoder has been
mapping to SL/SR, despite the macro for the mask being called 7_1_WIDE.
This resulted in said samples reporting the same native layout as actual 7.1
samples with Lsr/Rsr/Lss/Rss (mapped to BL/BR/SL/SR).

If we were to be strict, Lw/Rw would map to WR/WL, but that would result in an
unusual native layout. Instead, lets map them to FLC/FRC, which will result in
the more common 7.1(wide) native layout.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-07 10:24:42 -03:00
Michael Niedermayer
04e2341056 avcodec/adpcm: fix signed integer overflow in get_nb_samples()
Fixes: signed integer overflow: 314572800 * 8 cannot be represented in type 'int'

Tighten the guard to INT_MAX/14, which covers the largest expansion
factor used in the function currently.

Found-by: Jiale Yao <19888972804@163.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-07 02:57:25 +00:00
David Korczynski
1e9984772b avcodec/fastaudio: reject subframes count whose * 256 product overflows 32-bit
fastaudio_decode() computes
    subframes = pkt->size / (40 * channels);
    frame->nb_samples = subframes * 256;
both as 32-bit signed multiplications. When pkt->size is large enough
to make subframes >= 2^24, the second multiplication overflows the
signed int range and frame->nb_samples wraps to a small value.
ff_get_buffer() then sizes the audio plane for that wrapped sample
count, while the decoder loop at line 152 still iterates the full
(unwrapped) subframes count, performing a 1024-byte memcpy per
subframe per channel. The 27th iteration (or first iteration with
nb_samples=0) writes one byte past the per-plane allocation,
yielding the ASan heap-buffer-overflow WRITE at libavcodec/fastaudio
.c:171 reported as ANT-2026-03891.

Reject the subframes value whose *256 product would overflow before
performing the multiplication. The bound INT_MAX / 256 (= 8388607)
keeps the existing two's-complement semantics of every reachable
input and rejects only the configurations that would have wrapped.

Reproducer: a crafted AVI declaring one mono audio chunk of
671_088_680 bytes (sparse) with the decoder forced via
'ffmpeg -c:a fastaudio -i evil.avi'.

Found-by: Anthropic agents; validated and reported by Ada Logics.

Signed-off-by: David Korczynski <david@adalogics.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-06 21:32:08 +00:00
Michael Niedermayer
7c7ca349bc avcodec/vc2enc_dwt: avoid signed overflow in the 5/3 and Haar DWT
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-06 19:07:39 +00:00
Michael Niedermayer
5f91556215 avcodec/vc2enc_dwt: avoid signed overflow in the 9/7 DWT lifting
Fixes: 490488944/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-5310290362433536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-06 19:07:39 +00:00
Michael Niedermayer
b355200263 avcodec/mjpegdec: require progress in AVRn interlaced field loop
Fixes: Timeout
Fixes: 500554625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MEDIA100_fuzzer-5094103347167232
Fixes: 511253447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5780722463080448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-05 11:49:42 +00:00
Andreas Rheinhardt
56124f1e68 avcodec/exif: Remove version_major.h inclusion
Forgotten in d151d3aecb.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-05 03:02:04 +00:00
Andreas Rheinhardt
447a07fc12 avcodec/decode: Move exif declarations to exif_internal.h
It is (arguably) a slightly better place for them and avoids
a forward declaration of enum AVExifHeaderMode which is not possible
in ISO C before C23 (and requires specifying the underlying type
with C23).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-05 03:02:04 +00:00
Michael Niedermayer
ba825ce85f avcodec/mwsc: do not dereference a missing reference frame
Fixes: 493841393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MWSC_fuzzer-5079884677578752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-05 01:27:39 +00:00
Michael Niedermayer
32eb07bb83 avcodec/misc4: reject invalid sample rate
Fixes: AVERROR_BUG

Fixes: 493055111/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MISC4_fuzzer-5752676962074624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-05 01:16:31 +00:00
Hendrik Leppkes
89bdd9e1a5 avcodec/hevc: look for the DOVI RPU in all NALs, not just the last one
Some encoders seem to place the SEI suffix NAL at the very end, with the
RPU before it.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-05 01:08:08 +00:00
Andreas Rheinhardt
8c2c31f80c avcodec/utils: Don't attempt to derive CodecID name from de/encoders
The list of codec descriptors is supposed to encompass all codec IDs;
it certainly encompasses all codec IDs used by de/encoders (this is
checked in the avcodec test program which is run via FATE).
So the avcodec_find_decoder()/avcodec_find_encoder() are pointless.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-04 19:44:02 +00:00
Andreas Rheinhardt
e816b39fb2 avcodec/aacenc: Make AACPCEInfo smaller
Reduces sizeof(AACPCEInfo) from 296 to 120 bytes.
This reduces .rodata by 4576B here.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-06-04 19:17:43 +00:00
James Almer
1d45522806 avcodec/aacenc: remove excess initializers
pairing has only three elements.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-04 13:44:28 -03:00
James Almer
bca473e155 avcodec/aacenc: don't write SIDE position elements
Most parsers outright dislike anything being signaled as SIDE, as they expect layouts
to follow how ordering is pre-defined in non-0 channel_config values.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-04 14:18:35 +00:00
James Almer
55b510c702 avcodec/aacenc: fix signaled channel pairing for 6.1 PCE layout
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-04 14:18:35 +00:00
Anthony Hurtado
495b402f27 avcodec/diracdec: fix heap buffer overflow in edge_emu_buffer
Fixes: poc_dirac_v2_*
2026-06-03 23:37:46 +00:00
Michael Niedermayer
47f3996bdd avcodec/tdsc: propagate max_pixels to the JPEG tile decoder
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-03 20:35:41 +00:00
Michael Niedermayer
c1d3e8c46f avcodec/imm5: propagate max_pixels to the H264/HEVC sub-decoders
Fixes: 501794495/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IMM5_fuzzer-5192457796255744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-03 20:35:41 +00:00
Michael Niedermayer
cdba2d76dc avcodec/cri: propagate max_pixels to the JPEG tile decoder
Fixes: 489941776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-4845035614175232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-03 20:35:41 +00:00
Michael Niedermayer
3669a742dd avcodec/jpeglsdec: only apply color transform to decoded rows
Fixes: Timeout
Fixes: 503996733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_DEC_fuzzer-4948713016721408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-03 20:34:28 +00:00
David Korczynski
6d8f7882ae avcodec/adpcm: require block_align to be a multiple of channels in ADPCM_PSXC init
The ADPCM_PSXC block loop in adpcm_decode_frame() (libavcodec/adpcm.c:
2770) iterates 'block < avpkt->size / block_align' times and, for
each block, consumes
    channels * (1 + (block_align - 1) / channels)
input bytes via the *unchecked* bytestream2_get_byteu() reader. The
loop divides avpkt->size by block_align, so the loop bound is sound
only when the per-block consumption equals block_align — i.e. when
block_align is an exact multiple of channels. For any other
combination (e.g. block_align=9 with channels=8), each block consumes
more than block_align bytes; iterating avpkt->size/block_align
blocks then walks the input bytestream past avpkt->data +
avpkt->size, producing the heap-buffer-overflow READ at
libavcodec/bytestream.h:99 reported as ANT-2026-04052.

adpcm_decode_init() previously only enforced 'channels > 0' and
'block_align > 0' for PSXC. Tighten the init check to additionally
require 'block_align % channels == 0', which is the precise
invariant the decode loop depends on.

Reproducer: a crafted WAV header declaring channels=8, block_align=9
with the decoder forced via 'ffmpeg -c:a adpcm_psxc -i evil.wav'.

Found-by: Anthropic agents; validated and reported by Ada Logics.

Signed-off-by: David Korczynski <david@adalogics.com>
2026-06-03 20:33:19 +00:00
Zhao Zhili
520968debb avcodec/vc1dsp: always inline vc1_loop_filter
vc1_loop_filter() is only reached through the six C wrappers. Clang 14
keeps it out of line with plain static inline, adding a 224-byte stack
frame before the tiny bestcase path on rpi 5. gcc 12 already inlines
it.

rpi 5 clang 14:
                                before  after
vc1_v_loop_filter4_bestcase_c   27.2     8.3   (3.3x)
vc1_h_loop_filter4_bestcase_c   26.4    10.2   (2.6x)
vc1_v_loop_filter8_bestcase_c   32.5    20.3   (1.6x)
vc1_h_loop_filter8_bestcase_c   31.7    19.5   (1.6x)
vc1_v_loop_filter16_bestcase_c  42.1    33.2   (1.3x)
vc1_h_loop_filter16_bestcase_c  41.6    25.3   (1.6x)

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2026-06-03 10:41:08 +00:00
Zhao Zhili
200914853d aarch64/sbrdsp: unroll sum64x5 to 16 floats/iter
The C version is faster than the previous asm with clang and gcc > 12 on
rpi5, since compiler basically does the same unroll.

sum64x5_neon:             before          after
  Cortex-A76 (gcc 12.4):  72.3 (3.63x)    47.4 (5.56x)
  Cortex-A76 (gcc 14.2):  72.3 (0.69x)    47.4 (1.05x)
  Apple M1 (clang 16):     0.2 (0.98x)     0.2 (0.99x)

Signed-off-by: Zhao Zhili <quinkblack@foxmail.com>
2026-06-03 10:40:20 +00:00
Lynne
4d63e3dd4c
vulkan_ffv1: add Bayer encoder
Sponsored-by: Sovereign Tech Fund
2026-06-03 14:12:50 +09:00
Lynne
bade9e6bd0
vulkan_ffv1: detect float remap from pixfmt, not f->flt
The decode-shader picker fell over for integer remapped streams.

Sponsored-by: Sovereign Tech Fund
2026-06-03 14:12:50 +09:00
Lynne
713f191c24
vulkan_ffv1: add Bayer decoder
Sponsored-by: Sovereign Tech Fund
2026-06-03 14:12:50 +09:00
James Almer
151fe3a5ac avcodec/itut35: unref existing buffers before allocating new ones
Finishes fixing memleaks.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 23:24:19 -03:00
James Almer
9dd48f7d25 avcodec/itut35: add missing unref calls in ff_itut_t35_unref()
Fixes memleaks.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 23:23:32 -03:00
James Almer
a1e4aee2f0 avcodec/aac/aacdec: support height channels signaled with PCE
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 20:06:00 -03:00
James Almer
070bd112be avcodec/h2645_sei: use the ITU-T T35 parsing helpers
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 19:50:39 -03:00
James Almer
cf5284b491 avcodec/itut35: add support for HDR Vivid
Needed by h2645_sei.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 19:50:39 -03:00
James Almer
04ae5788df avcodec/itut35: add support for Active Format Description
Needed by h2645_sei.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 19:50:39 -03:00
James Almer
f1929d75a2 avcodec/itut35: add support for AOM film graim
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 19:50:39 -03:00
James Almer
c500c786ab avcodec/libaomdec: use the ITU-T T35 parsing helpers
Signed-off-by: James Almer <jamrial@gmail.com>
2026-06-02 19:50:39 -03:00