Remux two short streams from an existing sample, the second one with a
70000-byte comment header, and demux their concatenation.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
When a chained Vorbis stream starts, its three header packets are
packed into new extradata with 16-bit size prefixes. A header larger
than 65535 bytes, typically a comment header with embedded cover art,
gets its size truncated, so the Vorbis parser cannot be reinitialized
and demuxing fails with "Failed to re-initialize Vorbis parser". The
audio of the new chained stream and everything after it is lost.
Use Xiph lacing instead, as vorbis_header() already does for the
initial extradata.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
This is still slightly abstraction-violating in that it needs the op list
to set up the plane mapping, image view formats and to know if the source
is interlaced or not. I don't have a good solution to these issues at
the moment, but at the very least, this decouples the actual codegen
from changes to the SwsOp layout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
They are currently emitted identically to an explicit zero row, which is
wrong - a zero row would not be masked as it contains an operation (setting
the component to zero *is* an explicit operation; only leaving it untouched
is an implicit noop).
And also emit a 1 coefficient in the expected location in the data matrix.
I have verified that the resulting x86 and NEON kernels are bit-identical.
Signed-off-by: Niklas Haas <git@haasn.dev>
These are entirely unneeded; prerequisite to the following fix, which fixes
the wrong `zero` mask for the masked identity rows.
Signed-off-by: Niklas Haas <git@haasn.dev>
The current CPU-based backends don't suffer any penalty or consequence
of intermixing integers and float operations on the same registers. However,
this is not a universal assumption - in particular, SPIR-V expects fully
typed operations.
In theory, older x86 CPUs also have a penalty for switching from float to
int, but ENOCARE.
Signed-off-by: Niklas Haas <git@haasn.dev>
Commits 0cd75dbfa0 and 27e94281d1 added QueryInterface()
implementations that compare the requested interface against
IID_IUnknown. The Linux SDK defines it in LinuxCOM.h and the Windows
SDK gets it from the platform COM headers, but the macOS SDK uses
CoreFoundation's COM types from <CoreFoundation/CFPlugInCOM.h>, which
only provide IUnknownUUID as a CFUUIDRef. Since then, building with
--enable-decklink on macOS fails:
libavdevice/decklink_dec.cpp:138:43: error: use of undeclared
identifier 'IID_IUnknown'
libavdevice/decklink_dec.cpp:603:43: error: use of undeclared
identifier 'IID_IUnknown'
libavdevice/decklink_enc.cpp:120:39: error: use of undeclared
identifier 'IID_IUnknown'
libavdevice/decklink_enc.cpp:181:39: error: use of undeclared
identifier 'IID_IUnknown'
On macOS, REFIID is CFUUIDBytes, so derive IID_IUnknown from
IUnknownUUID with CFUUIDGetUUIDBytes(), the same definition used by
the macOS samples shipped with the DeckLink SDK. This avoids
duplicating the GUID bytes, and CFUUIDGetConstantUUIDWithBytes()
returns a constant that must not be released. The definition is
limited to __APPLE__, so Linux and Windows builds are unchanged.
Tested with DeckLink SDK 16.0 and Apple clang 21 on macOS arm64.
Signed-off-by: Jake Fineman <jake@wave.online>
With input_resizable enabled, get_output_ov() created partial_shape with
ov_partial_shape_create() and then passed the same variable to
ov_shape_to_partial_shape(), which allocates a new dims array and
overwrites the struct. The first allocation was never freed, so every
call leaked it, on the success path and on the two error returns in
between. The dims it was built from were never used.
Drop the ov_partial_shape_create() call and the dims array; the partial
shape is built from the model's input shape by ov_shape_to_partial_shape()
and freed after ov_model_reshape_single_input() as before.
The leak was introduced with the OpenVINO API 2.0 support in e79bd1f1b1.
Signed-off-by: Jake Fineman <jake@wave.online>
Fixes: p6PbEwU20LjP
Fixes: AISLE-2026-0150-00017
Fixes: use after free
Use after free Replicated through UnModified FFmpeg
Found-by: Joshua Rogers (AISLE)
The report suggested moving the old decoder and surfaces into a cleanup
object referenced by the outstanding frames, as the close path does.
mjpegdec releases a picture left over from a failed packet before
ff_get_format() tears down the VA context and the device the callback needs.
Fixes: vMMlgSzb6MuU
Fixes: AISLE-2026-0150-00741
Fixes: memleak
Memleak Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The report suggested a free_frame_priv callback that destroys the still
tracked parameter and slice buffers.
The frame can hold the last reference to the frames context and with it to
the device context the hwaccel's free_frame_priv callback receives. vvc,
mpegvideo and the mjpeg close path released the frame first, and the av1,
vp8, vp9 and h264 picture replacement replaced it first; the other
decoders already release the private data first.
Found during triage/review of the security report AISLE-2026-R0043
Fixes: pzezUDNFoag5
Fixes: AISLE-2026-0150-00646
Fixes: memleak
Memleak Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The report suggested a free_frame_priv callback that frees
bitstream_buffers.
Fixes: KICdwlv5dwyY
Fixes: AISLE-2026-0150-00792
Fixes: use after free
Use after free Replicated through Modified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The report suggested clearing raw_image_buffer per packet and rejecting a
SOF that is not preceded by a SOI.
This was missed when the hwaccel_picture_private was made a buffer.
Fixes: YMGIFa63VNkS
Fixes: AISLE-2026-0150-00681
Fixes: memleak
Memleak Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
Cherry-picked from https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24652 where
the commit is part of the Vulkan MJPEG hwaccel. The Fixes, replication and
Found-by lines were added when applying it for the security report; the
start_frame() call keeps passing NULL as the preceding commits of that pull
request are not included.
Fixes: I8tidri5usIx
Fixes: AISLE-2026-0150-00880
Fixes: use after free
Use after free Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
GCC 14.4.0 and 16.2.1 report -Wstringop-overflow in angular prediction.
Unchecked block sizes and derived filter lengths could exceed the local
reference buffer. Require a power-of-two size from 4 to 64 and bound the
weak and bilinear filter lengths before writing. Prediction is unchanged
for sizes and lengths within those bounds.
Signed-off-by: lusoris <lusoris@proton.me>
The VP5/VP6 headers install new dimensions before vp56_size_changed() allocates the arrays for them. If resizing fails, leave the dimensions cleared so following frames cannot use the missing arrays, and preserve the allocation error for the caller.
Fixes: 24187
Assisted-by: Fairy
Convert the last MMX (mmx/mmxext) IDCT functions, idct8_dc_add_8,
idct_add8_422_8 (plus its plane and DC helpers) and
idct_dc_add_10, to SSE2. The DC_ADD macros are renamed to
DC_ADD_SSE2 (pshuflw, movq traffic) and shared with the
pre-existing sse2/avx IDCT_XMM path. The mmxext DC helper
tail-called from SSE2 functions is now XMM, which also removes
the MMX-state handoff without emms. Dispatch moves from
EXTERNAL_MMX/MMXEXT to EXTERNAL_SSE2.
checkasm h264dsp passes. identical performances.
Use angle 0, so the gain is exactly 1 inside dmax, and move the center
to the top left corner so that part of the frame lies beyond dmax and
must saturate. Cover the planar (yuv444p) and packed (rgb24) paths.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
In backward mode the gain is 1 / factor, but the factor is 0 for pixels
farther than dmax from the center (possible with x0/y0 or aspect), so
the gain is inf. inf * sample, or inf * 0 = NaN, is then converted to
int, which is undefined behaviour; on x86 these pixels come out black
instead of saturated.
For angles close to PI/2, the factor can also become small enough that
a finite backward gain produces sample values outside the range of int
before av_clip_uint8() is called. Bound the gain at 256 to keep these
conversions in range while preserving the saturated 8-bit output.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
LAME 3.101 adds pkg-config support, generating and installing lame.pc.
Its autotools build also replaces the bundled mpglib decoder with
external libmpg123. Static libmp3lame builds with decoding support
therefore require additional libraries when linking.
The existing check links only against libmp3lame and libm, ignoring
pkg-config metadata and failing with undefined mpg123_* references.
Try pkg-config first to obtain the compiler and linker flags, honoring
the configured pkg-config flags for static dependencies. Keep the
existing library check as a fallback for older LAME releases and other
installations without usable pkg-config metadata.
Signed-off-by: Ruonan <yu_ruonan@outlook.com>
Probing a small fragment can reach EOF and set is_restart_needed before a
seek. dash_seek selects a new segment but leaves this flag set, so
read_data does not advance cur_seq_no at the next EOF. The selected
segment is then opened a second time.
Clear the pending restart along with the other segment read state before
reopening the component. Do this before probing the new segment, which
may legitimately set the flag again.
Add generated MP2 DASH tests comparing seek-to-zero and sequential packet
checksums and timestamps. The seek test emits 14 duplicate packets without
the reset; both tests produce the same 42 packets with it.
Fixes#25247
Assisted-by: Fairy
AV_PIX_FMT_FLAG_PLANAR does not exclude semi-planar formats such as
NV12, so they were split into .y/.U/.V files with corrupted chroma:
ffmpeg -f lavfi -i testsrc -frames:v 1 -pix_fmt nv12 \
-c:v rawvideo out.%03d.y
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
Both libavfilter and libswscale currently put framepool.o in their regular
OBJS, defining the same four ff_frame_pool_* symbols. Loading both static
archives in full therefore fails with multiple definitions.
Move the implementation and internal header to libavutil. Include the
object in its STLIBOBJS when either consumer is enabled, and use SHLIBOBJS
for the private copies in libavfilter and libswscale. This preserves
independent builds and shared-library symbol visibility without adding
an inter-library dependency or exposing a new public API.
Verified whole-archive links with both consumers, and with each consumer
configured independently. Shared builds pass fate-filter-rgbtestsrc-gbrp12
and fate-filter-rgbtestsrc-gbrap12; static and shared video scaling and
audio volume smoke tests produce identical frame checksums. Also checked
static consumers linked against shared dependencies.
Fixes: 6c89a30ecdFixes: #25419
Assisted-by: Fairy
A DTS:X stream in the standard presentation is DTS-HD Master Audio with a 7.1
bed and an extension at the end of every XLL frame, behind the syncword the
decoder already recognises (DCA_SYNCWORD_XLL_X). The extension is a 22-byte
header followed by a regular XLL channel set: four channels, every one coded
in full (no residual against the core), no speaker mask, its own NAVI table
with the frame's segment geometry, then a two-byte trailer. Its channels are
the front and rear height pairs, and the encoder folds each of them into the
bed speaker below it (L, R, Lsr, Rsr) at -3 dB, gain code 23170/32768, so the
7.1 bed plays them on players that ignore the extension.
The decoder now parses that channel set with the existing channel set code,
outputs 7.1.4 (TFL, TFR, TBL, TBR), and removes the fold from the bed at
output resolution. A "downmix" request for 7.1 keeps the bed as coded, heights
folded in, which is what the decoder output before; the requests for 5.1 and
stereo skip the extension as well, so their output is unchanged. Streams
without the extension are not affected. A frame whose extension does not
decode keeps the 7.1.4 layout with silent heights and the bed as coded, and
the frame still ends where it did before. The alternate presentations, which
carry objects behind DCA_SYNCWORD_XLL_X_IMAX, are not touched.
The format facts (header size, channel order, the fold) come from the public
analysis in harletty-bridge's dca crate and kristofferR's SpatialAudioBridge;
this is an implementation on FFmpeg's own XLL code, not a translation.
Signed-off-by: Vincent Herbst <superuser404@tuta.com>
ALSA capture can assemble a packet from multiple successful reads, possibly
across EAGAIN returns. The timestamp calculation still uses the frame count
from the final read, so it subtracts too little audio time. The same count
also supplies the wrong interval to the next time-filter update.
Use the completed packet's frame count for both calculations. A 7680-frame
packet assembled from two 3840-frame reads at 48 kHz otherwise receives a
first PTS 80 ms too late. Single-read packets retain the same calculation.
Reproduced with real ALSA short returns under ARM64 QEMU: a capture PCM
was primed by half a period, then read in nonblocking mode or interrupted
by SIGALRM while waiting for the remainder. No read return values were
changed in those tests. The fix also passes deterministic sample-order,
PTS, EAGAIN and XRUN recovery checks at 44.1, 48, 96 and 192 kHz.
Signed-off-by: Joonho Lee <mynameisjune111@gmail.com>
Set non-default values for the AC-3, E-AC-3 and fixed-point AC-3
decoder options, decode a frame so that the exported downmix fields
hold values set from the frame header, flush with
avcodec_flush_buffers(), and check that all values are still readable
afterwards. This is a regression test for the decoders forgetting
options such as drc_scale on flush.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
ac3_decode_flush() clears every field from frame_type to the end of
AC3DecodeContext with a single memset. Several fields backing AVOptions
(drc_scale, heavy_compression, target_level and
consistent_noise_generation, plus the exported downmix fields) were
located in that range, so avcodec_flush_buffers() silently zeroed them.
For drc_scale that does not even restore the default of 1.0,
effectively disabling dynamic range compression after any flush, e.g.
on seek.
Move all AVOption fields above the start of the flushable fields, next
to downmix_layout which was already kept there, so that flush only
resets actual decoding state. The exported downmix fields are written
from the frame header for every frame, so preserving them across flush
does not change decoding.
Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/25430
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Interlaced cascaded scaling otherwise skips every second line.
Technically, setting the field to FIELD_TOP here is unnecessary, but it
can't hurt to be explicit.
Signed-off-by: Niklas Haas <git@haasn.dev>
Copy the dts of the decoded packet to the frame. decode.c does this only
for decoders with the decode callback, so it got lost when 084b67f6e3
moved the decoder to the receive_frame API, and frames decoded from
packets that carry only a dts have had no timestamp since.
Fixes: 084b67f6e3
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Copy the dts of the decoded packet to the frame. decode.c does this only
for decoders with the decode callback, so it got lost when 6287ad1f9b
moved the decoder to the receive_frame API, and frames decoded from
packets that carry only a dts have had no timestamp since.
Fixes: 6287ad1f9b
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Fixes: xf78sw1plZNy
Fixes: AISLE-2026-0150-00556
Fixes: out of array write
Out of array write Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The check is the one given in the report's recommendation; analysis,
testcase and verification by Michael Niedermayer.
Fixes: j1Bk4Efn73Vz
Fixes: AISLE-2026-0150-00765
Fixes: out of array read
Out of array read Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers (AISLE)
The report suggested ordered subtraction checks.
Fixes: bmXNoLIHNO2l
Fixes: AISLE-2026-0150-00467
Fixes: memleak
Memleak Replicated through UnModified FFmpeg with ASAN
Regression since: c0bf1382a7
Found-by: Joshua Rogers (AISLE)
The report suggested routing these returns through the fail label.
Fixes: 28PPo4pFl31u
Fixes: AISLE-2026-0150-00699
Fixes: assertion failure
Assertion failure Replicated through UnModified FFmpeg with an ASAN build
Found-by: Joshua Rogers (AISLE)
The report suggested counting 0xff bytes only after the scan header.
Previously, the uop macros were generated from the union of uops over all
backends, so each backend would also instantiate uops that only the other
one can ever use. Split off a separate "x86" backend, and generate a separate
C header for it, together with its NASM macros in a single pass.
The x86 backend only enables SWS_UOP_FLAG_FMA on CPUs with FMA3, so generate
its uops both with and without FMA.
This does not reduce the checkasm coverage: the uops removed from
uops_macros.h are all LINEAR_FMA, READ_PLANAR_FV_FMA or RW_SHUFFLE, which
checkasm does not test, since the C reference backend cannot run them. The
only tests that disappear are the SSE4 and AVX2 variants of two U8 PERMUTE
kernels, which the x86 backend no longer builds because it never uses them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Allows generating the set of uops for a specific backend. For now, only a
single "c" backend is defined, which still covers the union of uops used by
all backends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Replaces the hack of running the C preprocessor over the C macros to produce
NASM syntax at build time. The generated file is now committed and checked by
FATE, as with uops_macros.h.
As a side effect, the DECL_* macros are now proper multi-line NASM macros,
so drop the parentheses around their arguments.
The FATE test is split up per generated file, with fate-sws-uops-macros
running all of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Niklas Haas <git@haasn.dev>
Martin Mirchev