Commit Graph
125880 Commits
Author SHA1 Message Date
Michael Niedermayer cc82fdfbd4 avcodec/vulkan/ffv1_dec_setup: reject a remap that produces zero entries 2026-07-31 19:37:52 +00:00
Michael Niedermayer 533a3c254d avcodec/vulkan/ffv1_dec_setup: act on the slice header rejection 2026-07-31 19:37:52 +00:00
Michael Niedermayer 56743898d2 avcodec/ffv1dec: reject a remap that produces zero entries 2026-07-31 19:37:52 +00:00
Michael Niedermayer 8ab8b4fabe avcodec/ffv1dec: mark the slice damaged when its remap fails 2026-07-31 19:37:52 +00:00
Michael Niedermayer 5d4d3bdc61 avcodec/pgssubdec: always give an output rect a palette
Fixes: NULL pointer dereference
Fixes: poc_null_deref.sup
Fixes: Fobbab5Vtlr3
Found-by: VRI with 图龙锋
2026-07-31 13:34:50 +00:00
Dan Dennedy 66a8c37582 scale_d3d11: Fix hw_frame_ctx reference leak
This fixes #20995. The reference is taken twice and assigned to the same pointer (see above in the same function). Only the latter is needed.
2026-07-31 13:29:24 +00:00
younengxiao 0dd50ec535 avfilter/dnn: initialize DNNData at the config_input call sites
vf_dnn_processing.c and vf_dnn_detect.c both declare an uninitialized
DNNData model_input before using it. This commit initialize it.

Signed-off-by: younengxiao <steven.xiao@amd.com>
2026-07-31 13:21:29 +00:00
Michael Niedermayer db05df9d13 avcodec/cfhd: reject transform-2 output wider than the plane
Fixes: out of array access
Fixes: cfhd_transform2_output_width_oob.avi
Fixes: MimvoaEVpKow
Found-by: Adrian Junge (vurlo)
2026-07-31 13:18:57 +00:00
shadowcaster3 ad53728984 avformat/mpegtsenc: add mpegts_pcr_pid option for separate PCR PID
Add a new muxer option mpegts_pcr_pid that generates PCR on a dedicated
adaptation-field-only PID, separate from any elementary stream.

ISDB-T 1seg receivers require PCR on a standalone PID. When PCR shares
the video PID, these receivers acquire the service but refuse to decode
video and audio. This is standard practice in Japanese digital
terrestrial broadcasting per ARIB TR-B14.

When mpegts_pcr_pid is set to a valid PID value:
- PCR packets are generated as adaptation-field-only packets on the
  specified PID at the interval set by pcr_period
- The video stream adaptation fields do not carry PCR flags
- The PMT PCR_PID field is set to the specified PID

When mpegts_pcr_pid is -1 (default): existing behavior is unchanged.

The existing mpegts_insert_pcr_only function is refactored into a
parameterized mpegts_insert_pcr_only_pid(s, pid, cc, discontinuity)
to avoid code duplication.

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/23649
Signed-off-by: shadowcaster3 <vasyl.samoilov@gmail.com>
2026-07-31 06:25:59 +00:00
Zuxy Meng a83c6ad946 libavcodec/x86/h264_intrapred: Base-4 numbers for shuffling immediates
0xee -> q3232 for example for better readability

Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
2026-07-30 22:41:04 -07:00
Zuxy Meng 43efff09ee libavcodec/x86/h264_intrapred: xmmN -> mN, movdqa -> mova
Use m aliases instead of xmm registers directly so that certain macros
can work (e.g. SWAP); likewise replace movdqa with mova

Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
2026-07-30 22:41:04 -07:00
Abdessamie a441a2eb38 avformat/rtsp: clear authentication on cross-origin redirects
RTSP redirects retain URL credentials and authentication state when a
Location URI changes to another origin. This can forward reusable
credentials to a server with a different scheme, host, or port.

Clear the stored credentials and authentication state when the redirect
crosses an origin boundary. Preserve them for same-origin redirects.

Fixes: cross-origin credential disclosure
Fixes: rtsp_redirect_auth_leak_poc.py
Fixes: VaKaPOnfN02z
2026-07-31 04:01:32 +00:00
Michael Niedermayer 2c18311d59 avcodec/dovi_rpuenc: normalize vdr_dm_metadata_present to 0/1 2026-07-31 04:00:56 +00:00
Kenan Alghythee f1ed338541 avcodec/dovi_rpuenc: validate the data mapping before generation
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-31 04:00:56 +00:00
Michael Niedermayer 79e10e5196 avcodec/dovi_rpudec: bound num_x/y_partitions
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-31 04:00:56 +00:00
Kenan Alghythee 372a611913 avcodec/dovi_rpuenc: validate vdr_rpu_id from the input metadata
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-31 04:00:56 +00:00
Kenan Alghythee 534f16d866 avcodec/bsf/dovi_rpu: handle update_rpu() returning no RPU
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-31 04:00:56 +00:00
Michael Niedermayer e38b5d15bd avfilter/af_arnndn: pad the DCT input buffers to the read length
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-31 04:00:18 +00:00
Andreas Rheinhardt 5f832b7b3f avcodec/x86/h264_intrapred: Avoid shuffles
We only need the shuffle a byte in the lower quadword;
also notice that we don't need the clamping provided
by packuswb as these values are averages of byte values.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-07-30 23:31:33 +02:00
Andreas Rheinhardt 27a90f6ad4 avcodec/x86/h264_intrapred: Reduce number of regs in pred4x4_tm_vp8_8
Avoids saving and restoring volatile xmm registers on Windows;
no change in benchmarks here (on Unix64).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-07-30 23:31:33 +02:00
Andreas Rheinhardt c6bd6abb59 avcodec/x86/h264_intrapred: Report accurate number of registers used
The pred{8x8,16x16}_plane functions only use five xmm register.
The inflated number of seven (which leads to saving and restoring
xmm6 on Win64) has been introduced in
d20f133ef9, probably because
the mmx version of these functions used seven mmx register.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2026-07-30 23:31:33 +02:00
James Almer 86940d45af avcodec/bsf/truehd_core: clear profile value on init()
The output stream no longer has Atmos metadata, so the
AV_PROFILE_TRUEHD_ATMOS profile, if it was set, is no longer valid.

Fixes issue #23195.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-07-30 13:19:39 +00:00
James Almer c77c0e580a avcodec/bsf/eac3_core: clear profile value on init()
The output stream no longer has Atmos metadata, so the
AV_PROFILE_EAC3_DDP_ATMOS profile, if it was set, is no longer valid.

Signed-off-by: James Almer <jamrial@gmail.com>
2026-07-30 13:19:39 +00:00
wangnov 2ae2413488 avcodec/vp8, vp9: warn when native decoders ignore WebM alpha
WebM VP8/VP9 alpha is a second bitstream attached via a Matroska
BlockAdditional element (BlockAddID 1). Only the libvpx wrapper
decoders merge it into the output frame; the native vp8/vp9 decoders
have no code path for it and silently return an opaque frame.

Warn once per decoder instance instead of failing silently, pointing
at the decoder that does support it. The av_log_once() state is
synchronized across frame-thread contexts to avoid duplicate warnings
with frame threading.

Reported in https://trac.ffmpeg.org/ticket/11165 and
https://github.com/renpy/renpy/issues/1402.

Signed-off-by: wangnov <wangnov6@gmail.com>
2026-07-30 06:51:57 +00:00
Michael Niedermayer 05be98e3a2 doc/nut.texi: point at the latest spec in the git repository
subversion in 2026 is a bit odd
2026-07-30 04:47:51 +00:00
Michael Niedermayer a100d346da avformat/mov: bound sgpd sync entry_count by the atom size
Fixes: unbounded allocation
Fixes: ffmpeg-sgpd-sync-entry-count-alloc.mp4
Fixes: 4f7OaHqbUKh2
Found-by: Brian Lee, Youngjoon Kim (Georgia Tech SSLab)
2026-07-30 00:13:05 +00:00
Michael Niedermayer 2f234ea34c avcodec/tiff: reject inflate output shorter than the strip
Fixes: use of uninitialized memory
Fixes: tiff_short_deflate_heap_disclosure.tiff
Fixes: 1cRIkpUVMQtn
Found-by: Adrian Junge (vurlo)
2026-07-30 00:12:22 +00:00
panboxiaosa b57a3d028d avformat/mov: set video packet durations in presentation order
STTS sample deltas follow decode order, while AVPacket.duration is
defined as the interval to the next PTS in presentation order. Assigning
the deltas directly therefore produces incorrect packet durations for
VFR video with reordered frames.

After index construction and edit-list processing, sort samples by PTS
and set every duration with a following PTS from adjacent presentation
timestamps. This reorders STTS durations where possible and derives
intervals produced by the STTS/CTTS combination when necessary. Keep the
original timing table if allocation fails or timestamps are invalid.

Add FATE coverage for the official VFR H.264 sample and for a generated
MPEG-4 case whose presentation intervals are not a permutation of its
STTS deltas. Update the HEVC dts2pts CRA reference for the corrected
presentation-order durations.

Signed-off-by: panboxiaosa <panboxiaosa@gmail.com>
2026-07-29 23:49:33 +00:00
Michael Niedermayer cd1f545cf2 avcodec/rscc: do not leave uninitilized data when the input is too short
Fixes: use of uninitialized memory
Fixes: rscc_short_deflate_heap_disclosure.avi
Fixes: plB80py3i3Bu
Found-by: Adrian Junge (vurlo)
2026-07-29 21:20:49 +00:00
almogyalin 04ecca792f avformat/iamf_parse: fix inverted subblock duration validation
The check on variable subblock durations had an inverted comparison, rejecting valid multi-subblock parameters and failing to catch subblock durations exceeding the remaining time.
2026-07-29 21:08:37 +00:00
Michael Niedermayer 93f2a525ec avcodec/dvbsub_parser: avoid signed overflow in the capacity check
Fixes: signed integer overflow
Fixes: out of array access
Fixes: poc.wtv
Fixes: fJeEU9JwKwsR
Found-by: Adrian Junge (vurlo)
2026-07-29 21:07:17 +00:00
Omkhar Arasaratnam 83c6922826 avformat/tls_openssl: bind peer identity for numeric-IP verify
tls_open() installed a peer-identity target only when the URL host was
non-numeric. For a numeric-IP target the whole block was skipped, so
with verify=1 OpenSSL validated the chain to a trusted CA but bound no
identity, and any publicly-trusted certificate for any name was accepted
(e.g. tls://203.0.113.10?verify=1).

Run the identity block for every non-listening connection. Classify
s->host with the same getaddrinfo(AI_NUMERICHOST) rule tls.c uses. A
numeric host is pinned to the certificate's iPAddress SAN by handing
OpenSSL the parsed binary address via X509_VERIFY_PARAM_set1_ip();
everything else, including a verifyhost=<name> override, binds by name
via SSL_set1_host(). Passing the binary address rather than re-probing
the ASCII form pins legacy numeric spellings such as 2130706433 as IPs
instead of letting them fall back to hostname matching. SNI is still
suppressed for numeric transport hosts (RFC 6066 sec. 3) via
s->numerichost.

The identity target is installed unconditionally for non-listening
connections; whether the certificate is actually verified stays
controlled separately by SSL_CTX_set_verify() under s->verify, so
disabling verification keeps the prior behaviour. Sets AVERROR_EXTERNAL
with an explicit log line on failure.

dtls_open() sets s->is_dtls and then calls tls_open(), so DTLS client
connections run through the same identity block and are covered here.

Found-by: Claude (Anthropic). Human-verified and reported by
Omkhar Arasaratnam <omkhar@linkedin.com>.
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
2026-07-29 20:37:16 +00:00
Raja-89 a234fc1130 avfilter/dnn: prevent crash on parameterless LibTorch models
When loading a TorchScript model that does not contain any learnable
parameters (e.g., a purely functional model), the Torch backend would
crash during inference. This occurred because the code attempted to
dereference the first iterator of the model's parameter list
`parameters().begin()` to determine the device, which results in
Undefined Behavior when the parameter list is empty.
This commit fixes the issue by determining the inference device directly
from the user-configured `ctx->device` string instead of probing the
model parameters, allowing parameterless models to execute safely.

Testing:
1. Generate a parameterless model:
cat << 'EOF' > generate_model.py
import torch
class DummyModel(torch.nn.Module):
    def forward(self, x):
        return x
scripted_model = torch.jit.script(DummyModel())
scripted_model.save("dummy_model.pt")
EOF
python3 generate_model.py
2. Run inference (previously crashed, now succeeds):
./ffmpeg -y -i input.mp4 -vf 'format=rgb24,dnn_processing=dnn_backend=torch:model=dummy_model.pt' -frames:v 5 -f null -
Signed-off-by: Raja Rathour <imraja729@gmail.com>
2026-07-29 12:37:03 +00:00
Julius Bairaktaris d43b1efd2e avfilter/vf_amf_common: fix component Init() format with hwaccel input frames
amf_init_filter_config() returned the hardware pixel format (e.g.
AV_PIX_FMT_D3D11) as in_format when the input link carries D3D11VA or
DXVA2 hw frames. av_av_to_amf_format() maps hw formats to
AMF_SURFACE_UNKNOWN, so every AMF filter failed its component Init()
with AMF_INVALID_ARG (VQEnhancer, FRC) or AMF_NOT_SUPPORTED
(Converter, HQScaler). Return the underlying software format instead,
which is already validated against AMF a few lines above. Apply the
same mapping to the default output sw format, which otherwise ends up
as the hw pixel format in hwframes_out->sw_format when the output link
uses a hwaccel format.

Fixes e.g.:
  ffmpeg -hwaccel d3d11va -hwaccel_output_format d3d11 -i in.mp4          -vf frc_amf -c:v hevc_amf out.mp4

Note: with D3D11VA input, the compute-based components (VQEnhancer,
HQScaler, VideoConverter) additionally require decode textures created
with D3D11_BIND_SHADER_RESOURCE, e.g.:
  -init_hw_device d3d11va=dx11:,SHADER=1 -hwaccel_device dx11
FRC and DXVA2 input work with default decode textures.
2026-07-29 08:52:27 +00:00
Zhao Zhili 6f82db5ad5 avcodec/videotoolboxenc: respect CMTime.timescale when computing timestamps
vtenc_cm_to_avpacket converts output CMSampleBuffer timestamps back
to codec timebase by dividing pts.value by avctx->time_base.num.
This relies on the output CMTime having the same timescale as the
one passed to VTCompressionSessionEncodeFrame. Apple does not
guarantee this, and the output timescale can differ from the input.

Use av_rescale_q with the actual CMTime timescale so that the
conversion is correct regardless of what timescale VideoToolbox
returns.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2026-07-29 04:37:36 +00:00
Zhao Zhili f3b1386707 avcodec/videotoolboxenc: check PTS validity before timestamp conversion 2026-07-29 04:37:36 +00:00
Michael Niedermayer 2b7e501242 avformat/codec2: avoid integer overflow in packet size and duration
Fixes: signed integer overflow
Fixes: 2jy_poc_codec2.zip / poc_codec2.raw
Fixes: jOQASNnOm6O7
Found-by: Jiale Yao <yaojiale02@163.com>
2026-07-29 02:03:25 +00:00
Kenan Alghythee 06fd4fd0e7 avfilter/vf_xpsnr: avoid a zero block size on small frames
Fixes: division by zero
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-29 00:42:47 +00:00
Kenan Alghythee e2bc6d88cd avcodec/cbs_av1: pad the ITU-T T.35 payload buffer
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
2026-07-28 18:04:35 +00:00
Kacper Michajłow f6fa0d3fda avformat/hls: refine first_timestamp from the first segment's packets
first_timestamp is taken from the first packet in mux order, which is
not necessarily the earliest timestamp in the segment. Lower it while
packets of that segment are still arriving, so the seek timeline is
anchored at the true segment start.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 18:01:18 +02:00
Kacper Michajłow 848fb754dd avformat/hls: don't discard target segment's first keyframe when seeking
Segment starts on the seek timeline are derived from EXTINF durations,
so the first keyframe of the target segment can have a slightly lower
DTS than the snapped seek position, in which case the packet discard
loop would skip it and resume playback one segment late. Make sure we
start at the very beginning of the stream in this case.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 18:01:18 +02:00
Kacper Michajłow 84bc576371 avformat/hls: set stream start_time for all playlist types
Rebase the first packet's timestamp onto the start of the segment list
regardless of playlist type, and report it as start_time. Previously
only EVENT playlists did this and live streams took start_time from the
first loaded segment at the live edge. Which is not correct as some
servers provide very deep (hours even) time shift in live playlist. The
evicted segments are already tracked by EXT-X-MEDIA-SEQUENCE. This
allows us to use all available segments, not only the future ones on
live playlist.

Also prefer PTS over DTS, as EXTINF durations and start_time are
presentation time.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 18:01:18 +02:00
Kacper Michajłow ede944b362 avformat/hls: allow seeking within live playlists
Live (and EVENT) playlists are seekable within the currently known
segment list. Seeks before the list start clamp to the oldest segment,
past the end to the live edge. Live playlist can evict old segments, we
track that by reading EXT-X-MEDIA-SEQUENCE. Previusly the code assumed
that the live playlist, don't have past segments, however some servers
has very deep usable timeshift.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 18:01:18 +02:00
Kacper Michajłow 2526ac4771 avformat/hls: use av_rescale_q instead of doing only denominator 2026-07-28 18:01:17 +02:00
Kacper Michajłow e822dd253b avformat/hls: remove else after break
To reduce unnecessary nesting.
2026-07-28 18:01:17 +02:00
Kacper Michajłow b449f86287 tests/fate/pcm: add fate-pcm_dvda test
Input is cut down version of https://samples.mplayerhq.hu/DVD-Audio/ats.AOB

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 17:55:33 +02:00
Kacper Michajłow ff818b87bf avformat/mpeg: fix demuxing of DVD-Audio LPCM
Substream 0xa0 packets without the DVD-Video dynamic range control
marker byte were assumed to be MLP, while in DVD-Audio AOBs substream
0xa0 always carries LPCM (MLP uses 0xa1), so hi-res LPCM streams were
misdetected and decoded as garbage. Classify them as PCM_DVDA and keep
the private stream header in the packet for the decoder to parse, as
its length is variable and it carries the audio format.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 17:55:33 +02:00
Kacper Michajłow 047eb18451 avcodec: add PCM DVD-Audio decoder
Decodes the LPCM variant found in DVD-Audio AOB streams. Unlike
DVD-Video LPCM it supports up to 192 kHz sample rates and splits
channels in two channel groups, which may use different quantization.
Samples are grouped in sets of 2 samples over all channels, with the
second channel group's data stored first within each set, as 16-bit
big-endian most significant parts followed by the remaining bits.

Based on information from expired US 6,580,671 patent et al.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 17:54:07 +02:00
Kacper Michajłow 88c8100e22 avcodec/pcm-dvd: rename long codec name to DVD-Video
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 17:39:23 +02:00
Kacper Michajłow cac3543529 avcodec/codec_desc: sync long_name with pcm-dvd.c
It was outdated for a long time.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
2026-07-28 17:39:23 +02:00