FFmpeg

Recent Commits

• Michael Niedermayer(19 Sept 26)

  avutil/tests/opt: copy options into a memdup'ed object holding a custom channel layout

• James Almer(23 Sept 26)

  avutil/opt: do not free a custom channel map the source still points to av_opt_copy() documents that after it returns, allocated options in src and dst no longer alias each other, even when dst was memdup'ed from src. For AV_OPT_TYPE_CHLAYOUT it passed such aliased layouts straight to av_channel_layout_copy(), which frees the custom map in dst and then copies from the now freed map in src. Handle this in opt_copy_elem(), like the AV_OPT_TYPE_DICT case, by forgetting the aliased map in dst before the copy. Fixes: heap-use-after-free Fixes: BTOI3sLHWE0g Found-by: Joshua Rogers <[email protected]>

• Michael Niedermayer(06 Oct 26)

  avcodec/dvbsubenc: Reserve 4 bytes of line overhead in dvb_encode_rle8() Since 74f470c05c a line ends with two 0x00 bytes before the 0xf0, so the worst case line needs 4 bytes besides the pixel codes, not 3. Fixes: out of array write Fixes: RzTpnrDqkaCQ Out of array write Replicated through API with ASAN Regression since: 74f470c05c Found during triage of the security report IRdTPagGrTLk

• Michael Niedermayer(06 Oct 26)

  avcodec/dvbsubenc: Account for the full CLUT segment header Fixes: out of array write Fixes: IRdTPagGrTLk Heap out of array write Replicated through UnModified FFmpeg with ASAN Found-by: Secbuddy, Tencent Keen Security Lab (tested by kvartet)

• Michael Niedermayer(06 Oct 26)

  avcodec/flicvideo: byte swap the decoded pixels in big endian FLI_BRUN The swap read the packet at frame offsets instead of the decoded line, past the end of the packet for frames larger than it. That this reads past the packet was found during triage of the security report bQcit4JdHaHN. Fixes: out of array read Fixes: bQcit4JdHaHN Found-by: Joey Tang <[email protected]> Out of array read Replicated through Modified FFmpeg with ASAN Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x

• Michael Niedermayer(06 Oct 26)

  avcodec/flicvideo: decrement pixel_countdown in the big endian FLI_BRUN byte swap Fixes: out of array write Fixes: bQcit4JdHaHN Found-by: Joey Tang <[email protected]> Out of array write Replicated through Modified FFmpeg with ASAN Segmentation fault Replicated through UnModified FFmpeg (s390x) with qemu-s390x

• Michael Niedermayer(29 Sept 26)

  avformat/id3v2enc: initialize tag length in ff_id3v2_start Reset the length accumulator when starting a new tag, so the encoding context need not be zeroed by the caller and can be reused after finish. Existing callers already supply zeroed contexts, so their output is unchanged. Clarify that start initializes the encoding context. Add a sample-free FATE test for ID3v2.3 and ID3v2.4 with zeroed, reused, and explicitly nonzero length accumulators. Compare the declared tag length with the bytes written using a reference file. Addresses the internal initialization improvement requested in #24035; this does not change the public muxer lifecycle contract. Assisted-by: Fairy

• Kacper Michajłow(08 Oct 26)

  fftools/textformat: remove the unused DefaultContext from the ini writer Signed-off-by: Kacper Michajłow <[email protected]>

• Kacper Michajłow(08 Oct 26)

  fftools/textformat: derive the default writer's nesting from the section flags The per-level flag was set for nested sections and never cleared. Signed-off-by: Kacper Michajłow <[email protected]>

• Kacper Michajłow(08 Oct 26)

  fftools/textformat: assemble each compact row in a buffer Collect the fields of a row and the lines of the rows nested in it, write them when the row ends, and write the separator before each field. This fixes rows fused with the previous one after a typed element had printed at the same level, the blank line after the timecode rows of a frame, fields printed on a separator-led line after nested rows, and the doubled or trailing separators of empty rows and empty inline arrays, which the tmcd refs encoded. Signed-off-by: Kacper Michajłow <[email protected]>

• Kacper Michajłow(08 Oct 26)

  fftools/graph/graphprint: record and replay the print calls of a graph Each graph prints itself from its own thread, and splicing the text that a separate formatter context wrote for the graph section into the final one only works for writers that print every field immediately. Record the calls instead and replay them into the context that prints everything at the end, so the writers see one consistent sequence. This removes the blank line after each graph in compact and csv output and numbers the graphs correctly in flat and ini output. Signed-off-by: Kacper Michajłow <[email protected]>

• Kacper Michajłow(08 Oct 26)

  fate: add compact output tests for program streams, timecode rows and printed graphs Signed-off-by: Kacper Michajłow <[email protected]>

• Niklas Haas(09 Oct 26)

  swscale/format: remove switch/case hack (cosmetic) Signed-off-by: Niklas Haas <[email protected]>

• Niklas Haas(09 Oct 26)

  swscale/format: reject XYZ<->RGB conversions Fixes: 2ed5830108f92093cffb696e88706f970ce6bc6b Signed-off-by: Niklas Haas <[email protected]>

• Niklas Haas(09 Oct 26)

  swscale/tests/swscale: don't bail on ENOTSUP in auxiliary conversions Somebody thought it was a good idea to implement XYZ<->XYZ but not XYZ<->YUV, so for an xyz -> xyz conversion, the main check succeeds while just the auxiliary conversions fail. Signed-off-by: Niklas Haas <[email protected]>

• Niklas Haas(09 Oct 26)

  swscale/tests/swscale: fix memleak on error Signed-off-by: Niklas Haas <[email protected]>

• Timo Rothenpieler(09 Oct 26)

  avformat/imfdec: don't busy-loop if non-Asset in Asset-list

• Marcos Ashton Iglesias(10 Sept 26)

  avcodec/x86/vc1dsp_inv_trans: add AVX2 vc1_inv_trans_8x8 Same arithmetic as the SSE2 version with the two column halves in the two 128-bit lanes, halving the instruction count. The measured gain is smaller because checkasm calls it in place on one block, so the 32 byte loads of a call wait for the 16 byte stores of the previous one. Eight registers would do, but it stays x86-64 only like the SSE2 version as it was not tested on x86-32. checkasm --bench on a Core Ultra 7 155H: vc1dsp.vc1_inv_trans_8x8_c: 120.8 vc1dsp.vc1_inv_trans_8x8_sse2: 90.8 ( 1.32x) vc1dsp.vc1_inv_trans_8x8_avx2: 85.1 ( 1.41x)

• Marcos Ashton Iglesias(10 Sept 26)

  avcodec/x86/vc1dsp_inv_trans: add SSE2 inverse transforms Add SSE2 vc1_inv_trans_4x4, 4x8, 8x4 and 8x8. x86 only had the DC variants; arm, aarch64, mips, loongarch and riscv already have all four. The 1-D passes use pmaddwd pairs into dwords, so the output is bit-identical to the C code for the whole coefficient range the spec allows, unlike the 16-bit aarch64/arm versions the checkasm test has to attenuate its inputs for; it passes here with the attenuation removed. Past a magnitude of 2912, or 3971 when the first pass is the 4-point one, that pass saturates where the C code wraps. The transforms that add to dest do not write the first pass back to block as the C code does. 4x4, 4x8 and 8x4 fit in eight registers; 8x8 keeps the whole block in registers and is x86-64 only. checkasm --bench on a Core Ultra 7 155H: vc1dsp.vc1_inv_trans_4x4_c: 111.1 vc1dsp.vc1_inv_trans_4x4_sse2: 17.0 ( 6.53x) vc1dsp.vc1_inv_trans_4x8_c: 142.5 vc1dsp.vc1_inv_trans_4x8_sse2: 44.9 ( 3.17x) vc1dsp.vc1_inv_trans_8x4_c: 192.8 vc1dsp.vc1_inv_trans_8x4_sse2: 38.0 ( 5.07x) vc1dsp.vc1_inv_trans_8x8_c: 120.8 vc1dsp.vc1_inv_trans_8x8_sse2: 90.8 ( 1.32x)

• BapToutatis(06 Oct 26)

  avformat/rtsp: limit the number of redirects Fixes: 2OgPp3duxpWM Found-by: BapToutatis Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers Signed-off-by: Michael Niedermayer <[email protected]>

• Josef Schlehofer(28 Sept 26)

  configure: do not probe dcbzl when it is disabled The dcbzl probe runs unconditionally and re-enables dcbzl whenever the assembler accepts it, overriding --disable-dcbzl and the "disable dcbzl" in the e500 and e500v2 --cpu cases. e500 cores trap on dcbzl, so ffmpeg dies with SIGILL in ff_blockdsp_init_ppc() on a P2020 (e500v2) as soon as it opens an MPEG-2 decoder. Only run the probe when dcbzl is not disabled. Fixes: #24747 Suggested-by: Michael Niedermayer <[email protected]> Original-patch-by: Peter Krefting <[email protected]> Signed-off-by: Josef Schlehofer <[email protected]>

• Ruk Doe(15 Aug 26)

  fate/subtitles: add libaribcaption bitmap clear-screen test Add a regression test for the bitmap-mode clear handling in the libaribcaption wrapper. The sample (sub/aribcaption_clear.ts, 1128 bytes, synthetic) carries an ARIB STD-B24 profile A caption stream with: t=1s caption management data t=2s CS + one DRCS glyph -> visible caption (num_rects=1) t=3s TIME(1.0s) only -> zero regions, must not emit an event t=4s CS only -> empty subtitle event (num_rects=0) The reference contains exactly two SUBTITLE frames. Before the fix the CS-only statement produced no event (one frame); a region_count == 0 predicate would also erase on the TIME-only statement (three frames). The visible glyph is a DRCS pattern, so the result does not depend on installed fonts; the test passes on a system without any fonts. The test uses ffprobe -show_frames, so only num_rects and timestamps are compared; no rendered bitmap data enters the reference.

• Ruk Doe(10 Aug 26)

  avcodec/libaribcaption: emit empty subtitle on clear in bitmap mode An ARIB caption statement whose data units contain only CS (clear screen) decodes to a caption with the ARIBCC_CAPTIONFLAGS_CLEARSCREEN flag set and region_count == 0. In SUBTITLE_TEXT mode this is translated into a rect holding "" so that the previous caption is erased. In SUBTITLE_BITMAP mode nothing is rendered, the function returns 0 and *got_sub_ptr is left at 0, so the caller never learns that the caption ended. Broadcasters send such a statement at the end of every caption segment (for example when going to a commercial break). Combined with wait_duration == ARIBCC_DURATION_INDEFINITE, which maps to end_display_time = UINT32_MAX, the last caption of a segment stays on screen until the next one arrives - in a real recording that was 22 minutes later. Report an empty subtitle (num_rects = 0) when the clear-screen flag is set, which sub2video and the usual subtitle consumers already treat as "erase". The flag is tested instead of region_count == 0 because a statement containing only TIME also decodes to zero regions but must not erase the currently displayed caption.

• Dong Nguyen(05 Oct 26)

  avfilter/vf_deinterlace_d3d12: fix command allocator sync before reset The fix replaces the single allocator with a pool of allocators tagged with fence values, matching the pattern in d3d12va_encode.c. Each allocator is only reused after its fence value has been reached. This is a follow up action for issue report https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/24483. The current vf_deinterlace_d3d12 has similar issue: ID3D12CommandAllocator_Reset() was called each frame without checking that the GPU had finished using that allocator. If the GPU was still processing the previous frame's commands, resetting the allocator could corrupt or discard in flight work, leading to rendering errors or GPU faults.

• jinbo(01 Sept 26)

  swscale/loongarch: add LSX fast bilinear horizontal scale Add LoongArch LSX optimized implementations of the fast bilinear horizontal scaler (SWS_FAST_BILINEAR, hyscale_fast/hcscale_fast). The vectorized loop processes 8 destination pixels per iteration, computing the source offsets and interpolation weights in registers and gathering the input samples with vshuf_b over a 32-byte window. It covers scaling ratios down to 4x downscaling; beyond that the scalar loop is used. checkasm --bench on 3A5000 4 cores 2.5GHz: hcscale_fast_c: 99.7 hcscale_fast_lsx: 28.1 ( 3.55x) hyscale_fast_c: 51.1 hyscale_fast_lsx: 18.3 ( 2.78x) Performance with: $ ./ffmpeg -cpuflags lsx -f lavfi -i "smptebars=size=3840x2160:rate=30:duration=100,format=nv12" \ -threads 1 -vf "scale=1920:1080:sws_flags=fast_bilinear,format=bgra" -f null - before: 36fps after : 86fps

• jinbo(31 Aug 26)

  swscale/loongarch: add unscaled NV12/NV21 to 32-bit RGB conversions Add fast path for NV12/NV21 to RGBA/ARGB/BGRA/ABGR conversions. The LSX implementations are based on the unscaled YUV420P to RGBA/ARGB/ BGRA/ABGR conversions. The difference is that the NV12/NV21 load UV data from src[1], and then use `vshuf` to prepare the U and V data. The C reference implementations work as the runtime fallback when LSX is unavailable, and are mainly used by the checkasm yuv2rgb test to verify the LSX path. The LSX implementations use the fixed-point coefficient math, while the C references use the lookup tables like yuv2rgb_c_32, both differ by at most a couple of LSBs. checkasm --bench on 3A5000 4 cores 2.5GHz: nv21_bgra_8_c: 14.5 nv21_bgra_8_lsx: 7.6 ( 1.88x) nv21_bgra_128_c: 220.1 nv21_bgra_128_lsx: 35.6 ( 6.17x) nv21_bgra_1080_c: 1819.7 nv21_bgra_1080_lsx: 304.0 ( 5.98x) nv21_bgra_1920_c: 3236.6 nv21_bgra_1920_lsx: 510.8 ( 6.33x) Performance with: $ ./ffmpeg -cpuflags lsx -f lavfi -i "smptebars=size=3840x2160:rate=30:duration=100,format=nv12" \ -threads 1 -vf "format=bgra" -f null - before: 14fps after : 114fps

• zzhx2006(30 Sept 26)

  avcodec/libvvenc: Fix the spelling mistakes

• Diego de Souza(08 Oct 26)

  avcodec/dxva2: fix frame->buf[] data race with frame threading ff_dxva2_common_end_frame() adds a reference to the decoder to frame->buf[], so that the decoder outlives the frames decoded with it. It is called from the hwaccel end_frame() callback, which with frame threading may run after ff_thread_finish_setup(). From that point on, other threads may copy the frame: the H.264 decoder keeps a separate AVFrame per picture in each thread and synchronizes them in update_thread_context() with av_frame_replace(), which reads frame->buf[] while the decoding thread may be writing to it. As noted in fa77cb258b ("avcodec/h264dec: Fix data race when updating decode_error_flags"), a decoding thread must not modify any field that av_frame_ref() copies after ff_thread_finish_setup(). This has been observed as an intermittent access violation in av_buffer_replace() when decoding H.264 with D3D11VA and frame threading on Windows on Arm: the copying thread read a non-NULL frame->buf[1] entry, but saw the fields of the AVBufferRef it points to as zero, and dereferenced the NULL buffer pointer when incrementing the reference count. Store the decoder reference in FrameDecodeData.hwaccel_priv instead, as nvdec does for its per-frame state. The decode data is attached to frame->private_ref when the buffer is allocated, before ff_thread_finish_setup(), and all references to the frame share it, so update_thread_context() only takes a new reference to it. The decoder reference is added to frame->buf[] by hwaccel_priv_post_process(), which runs in the caller's thread when the frame is returned, so returned frames keep the decoder alive. Since the decode data is shared, the second field of a field pair no longer adds a second decoder reference to the frame. Signed-off-by: Diego de Souza <[email protected]>

• James Almer(01 Oct 26)

  avcodec/lcevcdec: add support for passing options Signed-off-by: James Almer <[email protected]>

• James Almer(01 Oct 26)

  avcodec: allow adding AVOption enabled but non-public fields to AVCodecContext Making AVCodecInternal fields AVOption enabled requires extra considerations in av_codec_context_class, and they will only be settable with an open context or by passing the options directly as part of avcodec_open2(). They also would require to allow searching children classes, which in the case of a fake object results in looking at every single underlying decoder/encoder option. Instead of that, extend AVCodecContext internally the same way we did for other contexts like AVFormatContext, and add fields outside the public part. Signed-off-by: James Almer <[email protected]>