With input_resizable enabled, get_output_ov() created partial_shape with
ov_partial_shape_create() and then passed the same variable to
ov_shape_to_partial_shape(), which allocates a new dims array and
overwrites the struct. The first allocation was never freed, so every
call leaked it, on the success path and on the two error returns in
between. The dims it was built from were never used.
Drop the ov_partial_shape_create() call and the dims array; the partial
shape is built from the model's input shape by ov_shape_to_partial_shape()
and freed after ov_model_reshape_single_input() as before.
The leak was introduced with the OpenVINO API 2.0 support in e79bd1f1b1.
Signed-off-by: Jake Fineman <jake@wave.online>
In backward mode the gain is 1 / factor, but the factor is 0 for pixels
farther than dmax from the center (possible with x0/y0 or aspect), so
the gain is inf. inf * sample, or inf * 0 = NaN, is then converted to
int, which is undefined behaviour; on x86 these pixels come out black
instead of saturated.
For angles close to PI/2, the factor can also become small enough that
a finite backward gain produces sample values outside the range of int
before av_clip_uint8() is called. Bound the gain at 256 to keep these
conversions in range while preserving the saturated 8-bit output.
Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
Both libavfilter and libswscale currently put framepool.o in their regular
OBJS, defining the same four ff_frame_pool_* symbols. Loading both static
archives in full therefore fails with multiple definitions.
Move the implementation and internal header to libavutil. Include the
object in its STLIBOBJS when either consumer is enabled, and use SHLIBOBJS
for the private copies in libavfilter and libswscale. This preserves
independent builds and shared-library symbol visibility without adding
an inter-library dependency or exposing a new public API.
Verified whole-archive links with both consumers, and with each consumer
configured independently. Shared builds pass fate-filter-rgbtestsrc-gbrp12
and fate-filter-rgbtestsrc-gbrap12; static and shared video scaling and
audio volume smoke tests produce identical frame checksums. Also checked
static consumers linked against shared dependencies.
Fixes: 6c89a30ecdFixes: #25419
Assisted-by: Fairy
Windows Graphics Capture only delivers a frame when the captured content
changes, so a static source makes gfxcapture output nothing at all. An
fps filter after it cannot help, since it has no later frame to
duplicate up to, and anything muxed alongside stalls as well.
Add a dup_frames option, like ddagrab has. When no new frame arrived
within one 1/max_framerate interval, output a new reference to the last
frame, or a black frame before the source delivered its first one.
Repeats are stamped with their deadline in the QPC clock, the same clock
as SystemRelativeTime, and the next deadline counts from the previous
one, so timer overshoot shows up neither in the timestamps nor in the
rate. A captured frame timestamped at or before the last output is
bumped to keep timestamps increasing.
The new option is on by default, since the current behaviour is arguably
surprising and clashes with how a lot of the filter chain and the
fftools work.
Signed-off-by: Rafael Henrique Gonçalves de Oliveira <rafaelh9six@gmail.com>
Co-authored-by: Timo Rothenpieler <timo@rothenpieler.org>
run_on_wgc_thread() reused one callback state for every call and reset
its cancel flag each time. A callback that timed out while still queued
could then run after the next call's reset, through references to the
earlier caller's stack. Each call now gets its own state, which the
queued callback keeps alive.
Signed-off-by: Rafael Henrique Gonçalves de Oliveira <rafaelh9six@gmail.com>
The immediate context is shared with the rest of the hw device's users,
and AVD3D11VADeviceContext's lock is what serializes calls on it.
Signed-off-by: Rafael Henrique Gonçalves de Oliveira <rafaelh9six@gmail.com>
Fixes: out of array write
Fixes: z4YbWg6eX0Hr
Found during triage/review of the security report 0fHkOzVCAhre
Out of array write Replicated through UnModified FFmpeg with ASAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: 8Vo2w4S3WNCd
Found during triage/review of the security report 0fHkOzVCAhre
Out of array read Replicated through UnModified FFmpeg with ASAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: out of array read
Fixes: 0fHkOzVCAhre
Fixes: swarm-OOB-read-in-combed-score-when-height-3-df4610
Found-by: zhang xingxing <2388969553@qq.com>
A height check in config_input() was suggested in the report.
Out of array read Replicated through UnModified FFmpeg with ASAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The whisper filter exposes segment timestamps and text in JSON but omits the language selected by whisper.cpp. Clients consuming multilingual transcripts cannot distinguish the language of each transcription chunk without detecting it again.
Read whisper_full_lang_id() after each successful transcription and include its language code in JSON segments when available. This leaves the configured language and audio-frame metadata unchanged. Document that the code applies to the whole chunk, not to individual segments.
Tested with a minimal --enable-whisper build, make fate (without external SAMPLES), and a local WAV transcription using a multilingual tiny model.
Signed-off-by: Stefan Singer <stefan.singer@quartr.se>
The nsamples_max doubling can overflow int for an accepted delay, causing an undersized RDFT and an out-of-bounds write during kernel generation. Compare in int64_t so excessive delays take the existing error path.
Add a FATE check for the reported delay.
Fixes: #24344
Reported-by: yijan4845
Assisted-by: Fairy
The frames a filter in front of hwupload_cuda produces are allocated
with av_hwframe_get_transfer_buffer(), so that the upload reads from
memory the device transfers directly from.
Assisted-by: Claude
Check the request before reading its fields and use a context-free log for
the NULL case. This makes the documented EINVAL return reachable.
Assisted-by: Fairy
Fixes: WDZyf7w7BNU1
Fixes: NULL pointer dereference
NULL dereference after a failed allocation Replicated through API with ASAN
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Fixes: A3O7F4s10WXJ
Fixes: EINVAL on a format change
EINVAL on a format change Replicated through UnModified FFmpeg with a plain output diff
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Fixes: MxIcMabVhhFR
Fixes: command without effect
Command without effect Replicated through UnModified FFmpeg with a plain output diff
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24672
Fixes: fZnlZKlJmMn0
Fixes: wrong release time and asc level after a command
Wrong release time and asc level after a command Replicated through UnModified FFmpeg with a plain output diff
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24672
The fate-filter-metadata-cropdetect1/2 references change as the scans
now stop at the edge free lines next to the box.
Fixes: s7zfKOCXo4MJ
Fixes: wrong crop area with mode=mvedges
Wrong crop area with mode=mvedges Replicated through UnModified FFmpeg with a plain output diff
Found during triage of the security report VoiiaDYyhdfz
Found again by the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24623
This is not a security issue.
Fixes: 6HSeekmc6mV7
Fixes: 8YwigyLd85Gn
Fixes: swarm-Memory-leak-of-input-output-frames-on-ff_dnn_execute_model-failure-3a5cbe
Fixes: memleak
Memory leak Replicated through UnModified FFmpeg with LSan
Found-by: zhang xingxing <2388969553@qq.com>
Fixes: O0Cm42dvrP4l
Fixes: NULL pointer dereference
NULL pointer dereference Replicated through UnModified FFmpeg with UBSAN and gdb
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
Fixes: nC3u8khGyx61
Fixes: hang on teardown
Hang on teardown Replicated through UnModified FFmpeg with gdb
Hang on teardown Replicated through UnModified FFmpeg with gdb, a crafted 10240x10240 PNG, input_resizable=1 and vm.overcommit_memory=2
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
Fixes: cE2BMN6svM0X
Fixes: success reported after a failure
Success reported after a failure Replicated through UnModified FFmpeg with LSan
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
Fixes: o7gnt6oof6Qd
Fixes: use after free
Fixes: double free
Heap use after free after an allocation failure Replicated through UnModified FFmpeg with ASAN, the allocation failure injected through an LD_PRELOAD shim
Double free Replicated through UnModified FFmpeg with gdb, a crafted 8192x8192 PNG, input_resizable=1 and vm.overcommit_memory=2
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
Fixes: XPtsDsDMo2NW
Fixes: pointer formed two past the mapping
Pointer formed two past the mapping Replicated through Modified FFmpeg with an assertion
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24753
Fixes: qchet66gqCBs
Fixes: memleak
Memleak Replicated through UnModified FFmpeg with LSan, LCEVC_SendDecoderBase() failing through an LD_PRELOAD shim
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Fixes: lJDYwsOtMQXY
Fixes: EINVAL on every hardware frame
EINVAL on every hardware frame Replicated through UnModified FFmpeg with plain output
Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
This is not a security issue.
Fixes: oFKoC1YimRPu
Fixes: swarm-Memory-leak-qr--text-and-pexpr-fields-not-freed-in-uninit-5cc723
Found-by: zhang xingxing <2388969553@qq.com>
Memory leak Replicated through UnModified FFmpeg with LSAN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: NULL pointer dereference
Fixes: gJMHsT6GErl5
Regression since: 22652b576c
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN
Fixes: out of range float to int conversion
Fixes: signed integer overflow
Fixes: 4jtp2TTOoEsQ
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of range float to int conversion Replicated through UnModified FFmpeg with UBSAN
Signed integer overflow Replicated through UnModified FFmpeg with UBSAN
Fixes: out of array read
Fixes: Au41rSBM5kGS
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: out of array read
Fixes: Au41rSBM5kGS
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: out of array read
Fixes: Au41rSBM5kGS
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
Fixes: out of array read
Fixes: Au41rSBM5kGS
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
Kyle Swanson