The arithmetic to process colors in premultiplied alpha is
completely different from the arithmetic for straight alpha.
Running a filter using straight arithmetic on premultiplied
will result in incorrect and sometimes invalid output.
Therefore, premultiplied alpha should only be selected for
filters that either explicitly support it or only use
elementary color arithmetic or none at all.
For other filters, automatic conversion will do its work.
This reverts commit 978a0821ee.
The stability of the negotiation process has never been studied
with multiple rounds.
It has always been documented to users that scale was the filter
to insert to manage format conversions. A second filter for
a specific type of conversion should never have been added:
the proper fix for the issue that this commit tried to fix is
to give scale the ability to handle premultiplication too.
Add a small synthetic TrueHD sample that exercises large MAT padding in
spdifenc. The sample covers both the input_timing path with padding above
MAT_FRAME_SIZE / 2 and the output_timing discontinuity path.
It also verifies queued MAT frame emission when one input packet completes
more than one MAT frame.
Signed-off-by: Nathan Lucas <nlucasgit@gmail.com>
Some TrueHD streams, particularly remuxes of seamless branching Blu-rays,
contain input_timing gaps that require more padding than the current
MAT_FRAME_SIZE / 2 limit allows. spdifenc treats this padding as
invalid and drops it, breaking MAT timing and IEC 61937 carrier cadence,
causing TrueHD/Atmos dropouts on some receivers.
Allow larger valid padding gaps and queue completed MAT buffers so the
muxer can preserve the carrier cadence while still writing at most one
MAT buffer per input packet.
Some branches also have discontinuous timing, so input_timing cannot be
directly used to compute padding at those boundaries. When output_timing
is available from a TrueHD restart header, use it to detect those
discontinuities and compute padding from the change in
output_timing - input_timing offset across the boundary instead.
Fixes: https://trac.ffmpeg.org/ticket/9569
Fixes: https://trac.ffmpeg.org/ticket/10948
See also: https://github.com/mpv-player/mpv/issues/9659
See also: https://github.com/mpv-player/mpv/issues/13943
Signed-off-by: Nathan Lucas <nlucasgit@gmail.com>
fix: vulnerability:019f3b84-90fb-737a-ae7a-b3e0219266fc
extract_segment_number() used strrchr(filename, '.') and immediately did
dot - 1 without checking for NULL. A segment URI with no extension would
cause undefined behavior (NULL pointer arithmetic) when resuming an
append_list playlist with subtitle variants.
Add a NULL check and return -1 early when no dot is found.
Fixes a crash/UB in HLS muxer resume path.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fad1c2d7e99c
The parse_playlist() path for opening a new child playlist (in == NULL)
directly called c->ctx->io_open(), bypassing the protocol whitelist and
file-extension checks that open_url() enforces. This allowed child URLs
from a master playlist to use protocols other than file/http/data or to
have disallowed extensions.
Route the !in branch through open_url() so that all child playlists are
subject to the same security policy as segment URLs.
Fixes a security bypass in HLS master playlist parsing.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
Fix: vulnerability:019f3b84-903b-75fb-a8de-fe6f84d6bc32
When parsing IV=0x... followed by a comma, end - ptr was passed directly
to av_strlcpy() as the destination size. Since iv_string is only 33 bytes
(KEYSIZE*2 + 1), a long IV token could overflow into adjacent heap data.
Use FFMIN(end - ptr + 1, sizeof(buf)) to cap the copy size to the actual
buffer size. Apply the same fix to key_uri parsing for consistency.
Fixes a heap buffer overflow in append_list mode when reading an existing
playlist with a crafted IV or URI token length.
Found-by: depthfirst
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
When the filter graph is torn down early (e.g. at EOF with -frames:v),
the main thread calls dnn_free_model and destroys the request queue
while async inference threads may still be running. When a detached
thread finishes and tries to push its result back to the destroyed
queue, it triggers a segmentation fault.
Add ff_dnn_wait_requests() to dnn_backend_common which blocks
until all allocated request items (ctx->nireq) have been safely
returned to the request_queue. Call it from dnn_free_model in the
torch, tensorflow, openvino, and onnx backends before destroying the queue.
Convert use of MMX to SSE2, also remove the SSSE3 impl. since we no
longer use palignr
Before:
pred8x8l_down_left_8_sse2: 18.0 ( 4.04x)
pred8x8l_down_left_8_ssse3: 16.2 ( 4.49x)
After:
pred8x8l_down_left_8_sse2: 14.2 ( 5.14x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Convert use of MMX to SSE2, also remove the SSSE3 impl. since we no
longer use palignr
Before:
pred8x8l_vertical_left_8_sse2: 17.3 ( 4.89x)
pred8x8l_vertical_left_8_ssse3: 15.0 ( 5.63x)
After:
pred8x8l_vertical_left_8_sse2: 11.8 ( 6.80x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Convert use of MMX to SSE2, also remove the SSSE3 impl. since we no
longer use palignr
Before:
pred8x8l_vertical_right_8_sse2: 24.1 ( 3.51x)
pred8x8l_vertical_right_8_ssse3: 20.8 ( 4.07x)
After:
pred8x8l_vertical_right_8_sse2: 19.5 ( 4.38x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Convert use of MMX to SSE2, also remove the SSSE3 impl. since we no
longer use palignr
Before:
pred8x8l_down_right_8_sse2: 26.4 ( 3.26x)
pred8x8l_down_right_8_ssse3: 23.0 ( 3.74x)
After:
pred8x8l_down_right_8_sse2: 19.7 ( 4.33x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Deprecate MMX. No change in performance. Also add test coverage in
checkasm.
pred8x8_dc_rv40_mmxext: 10.0 ( 1.24x)
pred8x8_dc_rv40_sse2: 10.0 ( 1.24x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Deprecate MMX. Remove the SSSE3 impl. since we no longer use palignr and
SSE2 is faster.
pred8x8l_horizontal_up_8_mmxext: 27.1 ( 2.30x)
pred8x8l_horizontal_up_8_ssse3: 23.9 ( 2.60x)
pred8x8l_horizontal_up_8_sse2: 20.9 ( 2.96x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
Deprecate MMX. Remove the SSSE3 impl. since we no longer use palignr. No
change in performance.
pred8x8l_horizontal_8_mmxext: 16.2 ( 1.44x)
pred8x8l_horizontal_8_ssse3: 15.6 ( 1.50x)
pred8x8l_horizontal_8_sse2: 15.8 ( 1.49x)
Signed-off-by: Zuxy Meng <zuxy.meng@gmail.com>
parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size
before allocate_3dlut() validates it, which can overflow int.
Use the validated lutsize2 computed by allocate_3dlut() instead.
Fixes: signed integer overflow
The MOV demuxer only handled the low four bits of ChannelLayout and
did not expose the DTS profile carried by StreamConstruction. It also
discarded the sample-entry channel count when ChannelLayout was zero.
Parse StreamConstruction, RepresentationType, and all 16 ChannelLayout
bits according to ETSI TS 102 114. Map StreamConstruction to the
corresponding FFmpeg DTS profile, and preserve the sample-entry channel
count for zero layouts unless RepresentationType explicitly signals two
encoded channels.
This also provides profile and channel metadata for encrypted samples
whose frame headers cannot be inspected.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
The documentation for get_buffer2() states:
"This callback must use the frame values, not the codec context values, to
calculate the required buffer size."
Fixes wrong output on hbd LCEVC enhanced samples where the base stream is
8bit.
Signed-off-by: James Almer <jamrial@gmail.com>
Block timestamps and durations are in Track Ticks, meaning they are scaled with both
Segment timescale and Track timescale.
Signed-off-by: James Almer <jamrial@gmail.com>
Remove the static supported_formats[] allowlist from hwcontext_cuda.
cuda_frames_get_constraints() now iterates all registered pixel formats
and includes every non-hwaccel, non-palette format. cuda_frames_init()
validates with av_pix_fmt_desc_get() instead of checking against the
allowlist.
Palette formats have a special-cased use of plane[1] for the palette itself
and it's not worth the hassle of supporting in an otherwise clean generic
copy loop.
Also add a roundtrip test that uploads a deterministic byte pattern to
CUDA, downloads it back, and verifies the data match. This tests all
non-hwaccel pixel formats. The test is gated on CONFIG_CUDA.
ops_asmgen.c contains common aarch64 asm generation code that will be
used by CPS backend and the JIT backend.
The standalone tool with CPS-specific code is now ops_static.c.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
This will serve multiple purposes:
- Allow JIT code to populate operands from a deduplicated data pool;
- Simplify the future implementation of integer linear operation, since
mul/mla take full vector registers as coefficients, and not elements.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
Use vtmp register index relative to the current matrix column instead
of reusing the position of the value from the packed data.
The i_coeff and derived values will be removed in the following commit.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
Refer to offset[i] or coeff[i][j] instead of position of the value from
the packed data.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
The save_mask setup makes copies of input data that would be clobbered
by the linear operation itself. This setup is not entirely necessary
with JIT, since we may have separate input and output vector registers,
so the code is moved into the setup function which will be CPS-only.
This doubles the amount of temp registers needed, since they must all
be copied before both loops.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
This change is done separately from the next commit (which uses the new
temp vectors in the linear op) to make it easier to track changes to
ops_neon.gen.S.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
For CPS these will continue being the same vector register numbers,
because of the fixed ABI, but for JIT we will be able to use different
input/output vector registers to implicitly perform swizzles.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
This changes nothing for the CPS code, but will allow the JIT compiler
to allocate and reorder vector registers without them being affected by
reshaping.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
Currently this is redundant, since all CPS functions share the same
frame.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
This changes little for the current CPS code, which has fairly simple
setup code. But in JIT we will factor out much more code from the main
loop into the setup section.
This also frees up the register used by exec (x0) earlier on, so it may
be reused earlier in JIT code.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
Currently, for CPS code, both masks are the same, similar to how the C
and x86 backends do it.
But the JIT compiler will have more precise input and output masks.
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Ramiro Polla <ramiro.polla@gmail.com>
Nicolas George
Michael Niedermayer
Nathan Lucas
Steven Liu
Raja-89
Guo Yejun
wang-bin
Zuxy Meng
Jun Zhao
Marcos Ashton Iglesias
James Almer
Zhao Zhili
Philip Langdale
Andreas Rheinhardt
Ramiro Polla