December 2025 - ffmpeg-cvslog

[ffmpeg] hwcontext_vulkan: add support for implict DRM sync for export (branch master)
by Russell Greene 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 38e89fe502 hwcontext_vulkan: add support for implict DRM sync for export 38e89fe502 is described below commit 38e89fe5022888f552dce95d168a60900ccffd17 Author: Russell Greene <russellgreene8(a)gmail.com> AuthorDate: Fri Nov 28 23:04:57 2025 -0700 Commit: Lynne <dev(a)lynne.ee> CommitDate: Wed Dec 31 15:53:20 2025 +0000 hwcontext_vulkan: add support for implict DRM sync for export When a frame is exported to DRM, it may be written to to read to in an asyncronous fashion. Make sure, on unmap of a Vulkan frame that was mapped to DRM, to import any fences that were put on the dmabuf --- libavutil/hwcontext_vulkan.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libavutil/hwcontext_vulkan.c b/libavutil/hwcontext_vulkan.c index a7b6d8d4ca..57311652c0 100644 --- a/libavutil/hwcontext_vulkan.c +++ b/libavutil/hwcontext_vulkan.c @@ -3528,7 +3528,7 @@ fail: } static int vulkan_map_from_drm_frame_sync(AVHWFramesContext *hwfc, AVFrame *dst, - const AVFrame *src, int flags) + const AVDRMFrameDescriptor *desc, int flags) { int err; VkResult ret; @@ -3538,8 +3538,6 @@ static int vulkan_map_from_drm_frame_sync(AVHWFramesContext *hwfc, AVFrame *dst, AVVulkanDeviceContext *hwctx = &p->p; FFVulkanFunctions *vk = &p->vkctx.vkfn; - const AVDRMFrameDescriptor *desc = (AVDRMFrameDescriptor *)src->data[0]; - #ifdef DMA_BUF_IOCTL_EXPORT_SYNC_FILE if (p->vkctx.extensions & FF_VK_EXT_EXTERNAL_FD_SEM) { VkCommandBuffer cmd_buf; @@ -3659,6 +3657,7 @@ static int vulkan_map_from_drm(AVHWFramesContext *hwfc, AVFrame *dst, { int err = 0; AVVkFrame *f; + const AVDRMFrameDescriptor *desc = (AVDRMFrameDescriptor *)src->data[0]; if ((err = vulkan_map_from_drm_frame_desc(hwfc, &f, src, flags))) return err; @@ -3673,7 +3672,7 @@ static int vulkan_map_from_drm(AVHWFramesContext *hwfc, AVFrame *dst, if (err < 0) goto fail; - err = vulkan_map_from_drm_frame_sync(hwfc, dst, src, flags); + err = vulkan_map_from_drm_frame_sync(hwfc, dst, desc, flags); if (err < 0) return err; @@ -4077,6 +4076,10 @@ static void vulkan_unmap_to_drm(AVHWFramesContext *hwfc, HWMapDescriptor *hwmap) { AVDRMFrameDescriptor *drm_desc = hwmap->priv; + /* on unmap from DRM, make sure to import sync objects so that we are sync'd with any work that was + * done on the buffer while exported. We don't know if who used the dmabuf did reads or writes, so protect against both */ + vulkan_map_from_drm_frame_sync(hwfc, hwmap->source, drm_desc, AV_HWFRAME_MAP_READ | AV_HWFRAME_MAP_WRITE); + for (int i = 0; i < drm_desc->nb_objects; i++) close(drm_desc->objects[i].fd);

1 0

[ffmpeg] avformat/img2dec: reject input images too big to fit into a single packet (branch master)
by Timo Rothenpieler 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new f6a95c7eb7 avformat/img2dec: reject input images too big to fit into a single packet f6a95c7eb7 is described below commit f6a95c7eb786f895812adaaa08d2fe91c4d4caf8 Author: Timo Rothenpieler <timo(a)rothenpieler.org> AuthorDate: Wed Dec 31 03:41:21 2025 +0100 Commit: Timo Rothenpieler <timo(a)rothenpieler.org> CommitDate: Wed Dec 31 14:37:58 2025 +0000 avformat/img2dec: reject input images too big to fit into a single packet Not entirely sure if it should instead use some entirely different approach here, given that images exceeding 2GB don't seem that crazy to me, but so far processing such images results in a heap overflow, since the size addition overflows and a much too small packet is allocated and its size never checked again when writing into it. Fixes #YWH-PGM40646-32 --- libavformat/img2dec.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 8f1c9013ca..586634c0c3 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -365,8 +365,10 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) VideoDemuxData *s = s1->priv_data; AVBPrint filename; int i, res; - int size[3] = { 0 }, ret[3] = { 0 }; - AVIOContext *f[3] = { NULL }; + int ret[3] = { 0 }; + int64_t size[3] = { 0 }; + int64_t total_size; + AVIOContext *f[3] = { NULL }; AVCodecParameters *par = s1->streams[0]->codecpar; av_bprint_init(&filename, 0, AV_BPRINT_SIZE_UNLIMITED); @@ -456,7 +458,17 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } } - res = av_new_packet(pkt, size[0] + size[1] + size[2]); + total_size = size[0]; + if (total_size > INT64_MAX - size[1]) + return AVERROR_INVALIDDATA; + total_size += size[1]; + if (total_size > INT64_MAX - size[2]) + return AVERROR_INVALIDDATA; + total_size += size[2]; + if (total_size > INT_MAX) + return AVERROR_INVALIDDATA; + + res = av_new_packet(pkt, total_size); if (res < 0) { goto fail; }

1 0

[ffmpeg] branch master updated (eea648ef1d -> 58bd5ad630)
by ffmpeg-git 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from eea648ef1d avutil/hwcontext_vulkan: fix logic error when checking for encode support new d70c6cb511 hwcontext_vulkan: enable subgroup extended types new bb30126349 hwcontext_vulkan: enable the explicit shader workgroup extension new 9f3a04d2f6 vulkan: use HOST_CACHED memory flag only if such a heap exists new b7d2469e4c vulkan_functions: add vkCmdDispatchBase new 95baff9b61 vulkan: add ff_vk_buf_barrier() new eeeae0e0af vulkan_ffv1: use ff_vk_buf_barrier() new 9ab3e962b4 nlmeans_vulkan: use ff_vk_buf_barrier() new f956e9817c ffv1enc_vulkan: use ff_vk_buf_barrier() new c3e117670d vulkan_prores: use ff_vk_buf_barrier() new c3530d9a70 vulkan: remove FFVkBuffer.stage and access new 7f2783dcef vulkan_prores_raw: avoid long lines new 58bd5ad630 vulkan/prores_raw_idct: use the same prores_idct method for loading coeffs The 12 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/ffv1enc_vulkan.c | 227 ++++++++++++++------------------- libavcodec/vulkan/prores_raw_idct.comp | 26 ++-- libavcodec/vulkan_encode.c | 2 +- libavcodec/vulkan_ffv1.c | 90 ++++++------- libavcodec/vulkan_prores.c | 44 ++----- libavcodec/vulkan_prores_raw.c | 29 +++-- libavfilter/vf_nlmeans_vulkan.c | 179 ++++++++++---------------- libavutil/hwcontext_vulkan.c | 12 +- libavutil/vulkan.c | 6 +- libavutil/vulkan.h | 25 +++- libavutil/vulkan_functions.h | 2 + libavutil/vulkan_loader.h | 1 + 12 files changed, 285 insertions(+), 358 deletions(-)

2 12

[ffmpeg] branch master updated (991ba3fbac -> eea648ef1d)
by ffmpeg-git 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 991ba3fbac avcodec/qsvdec: fix refcount leak in two-stage QSV init new 0a8b915b04 avcodec/vulkan_decode: fix logic error when checking for encode support new 20ac8c3688 avfilter/vulkan_filter: fix logic error when checking for encode support new eea648ef1d avutil/hwcontext_vulkan: fix logic error when checking for encode support The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/vulkan_decode.c | 8 ++++---- libavfilter/vulkan_filter.c | 4 ++-- libavutil/hwcontext_vulkan.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-)

2 3

[ffmpeg] avcodec/qsvdec: fix refcount leak in two-stage QSV init (branch master)
by hajin-chung 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 991ba3fbac avcodec/qsvdec: fix refcount leak in two-stage QSV init 991ba3fbac is described below commit 991ba3fbac510690f335ba4db62e39ca6f7769b8 Author: hajin-chung <hajinchung1(a)gmail.com> AuthorDate: Tue Sep 16 17:13:01 2025 +0900 Commit: Zhao Zhili <quink(a)noreply.code.ffmpeg.org> CommitDate: Wed Dec 31 08:06:48 2025 +0000 avcodec/qsvdec: fix refcount leak in two-stage QSV init The temporary hw_frames_ctx created for header parsing was not being fully released, leading to a leak. Explicitly unreference the temporary context after use to resolve the leak. Signed-off-by: hajin-chung <hajinchung1(a)gmail.com> --- libavcodec/qsvdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/qsvdec.c b/libavcodec/qsvdec.c index 144cf5b9e9..a85c1785cf 100644 --- a/libavcodec/qsvdec.c +++ b/libavcodec/qsvdec.c @@ -202,6 +202,7 @@ static int qsv_init_session(AVCodecContext *avctx, QSVContext *q, mfxSession ses MFXClose(q->internal_qs.session); q->internal_qs.session = NULL; } + av_refstruct_unref(&q->frames_ctx.mids); av_buffer_unref(&q->frames_ctx.hw_frames_ctx); q->frames_ctx.hw_frames_ctx = av_buffer_ref(hw_frames_ref);

1 0

[ffmpeg] avcodec/exif.c: avoid buffer overflow with extra IFDs (branch master)
by Leo Izen 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg. The following commit(s) were added to refs/heads/master by this push: new 4bfac71ecd avcodec/exif.c: avoid buffer overflow with extra IFDs 4bfac71ecd is described below commit 4bfac71ecd96488dd2dcd5649e08edb039a17a8b Author: Leo Izen <leo.izen(a)gmail.com> AuthorDate: Thu Dec 25 15:49:05 2025 -0500 Commit: Leo Izen <leo.izen(a)gmail.com> CommitDate: Tue Dec 30 20:43:49 2025 -0500 avcodec/exif.c: avoid buffer overflow with extra IFDs Maliciously constructed input EXIF blocks could use the extra IFDs we set aside in noncontinugous ways, which will cause them to be written as subdirectories of IFD0 rather than existing IFDs. The base tag size is (correctly) excluded from the size calculation, but if they are being written as additional tags, the allocation will be too small and a write may overflow. Signed-off-by: Leo Izen <leo.izen(a)gmail.com> --- libavcodec/exif.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/libavcodec/exif.c b/libavcodec/exif.c index 0de543e35a..5ce402784c 100644 --- a/libavcodec/exif.c +++ b/libavcodec/exif.c @@ -798,13 +798,15 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, tput32(&pb, le, 8); } - int extras; - for (extras = 0; extras < FF_ARRAY_ELEMS(extra_ifds); extras++) { + int extras = 0; + for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++) { AVExifEntry *extra_entry = NULL; - uint16_t extra_tag = 0xFFFCu - extras; + uint16_t extra_tag = 0xFFFCu - i; ret = av_exif_get_entry(logctx, (AVExifMetadata *) ifd, extra_tag, 0, &extra_entry); - if (ret <= 0) + if (ret < 0) break; + if (!ret) + continue; av_log(logctx, AV_LOG_DEBUG, "found extra IFD tag: %04x\n", extra_tag); if (!ifd_new) { ifd_new = av_exif_clone_ifd(ifd); @@ -816,7 +818,7 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, AVExifMetadata *cloned = av_exif_clone_ifd(&extra_entry->value.ifd); if (!cloned) break; - extra_ifds[extras] = *cloned; + extra_ifds[extras++] = *cloned; /* don't use av_exif_free here, we want to preserve internals */ av_free(cloned); ret = av_exif_remove_entry(logctx, ifd_new, extra_tag, 0); @@ -824,12 +826,16 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, break; } + if (ret < 0) { + av_log(logctx, AV_LOG_ERROR, "error popping additional IFD: %s\n", av_err2str(ret)); + goto end; + } + next = bytestream2_tell_p(&pb); ret = exif_write_ifd(logctx, &pb, le, 0, ifd); if (ret < 0) { - av_buffer_unref(&buf); av_log(logctx, AV_LOG_ERROR, "error writing EXIF data: %s\n", av_err2str(ret)); - return ret; + goto end; } next += ret; @@ -840,8 +846,10 @@ int av_exif_write(void *logctx, const AVExifMetadata *ifd, AVBufferRef **buffer, tput32(&pb, le, next); bytestream2_seek_p(&pb, next, SEEK_SET); ret = exif_write_ifd(logctx, &pb, le, 0, &extra_ifds[i]); - if (ret < 0) - break; + if (ret < 0) { + av_log(logctx, AV_LOG_ERROR, "error writing additional IFD: %s\n", av_err2str(ret)); + goto end; + } next += ret; } @@ -853,6 +861,8 @@ end: av_freep(&ifd_new); for (int i = 0; i < FF_ARRAY_ELEMS(extra_ifds); i++) av_exif_free(&extra_ifds[i]); + if (ret < 0) + av_buffer_unref(&buf); return ret; }

1 0

[ffmpeg] branch release/8.0 updated (e36046790a -> bfa334de42)
by ffmpeg-git 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch release/8.0 in repository ffmpeg. from e36046790a tests/fate/filter-video: add two feedback tests new af60dd8419 avformat/iamf_parse: fix setting denominator in AVIAMFLayer.demixing_matrix new 06fcee2e26 avformat/iamf_writer: fix writting some ambisonics fields in Audio Elements new bfa334de42 avformat/iamf_writer: check that stream count is consistent for ambisonic Audio Elements The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavformat/iamf_parse.c | 2 +- libavformat/iamf_writer.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)

2 3

[ffmpeg] branch release/7.1 updated (dac2a1116d -> 40b336e650)
by ffmpeg-git 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch release/7.1 in repository ffmpeg. from dac2a1116d fate/ffmpeg: remove comparison against ref from fix_sub_duration_heartbeat new bdfaec89fe avformat/iamf_parse: fix setting denominator in AVIAMFLayer.demixing_matrix new c0272bf654 avformat/iamf_writer: fix writting some ambisonics fields in Audio Elements new 40b336e650 avformat/iamf_writer: check that stream count is consistent for ambisonic Audio Elements The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavformat/iamf_parse.c | 2 +- libavformat/iamf_writer.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)

2 3

[ffmpeg] branch master updated (2298978b47 -> d7ee7ac20f)
by ffmpeg-git 31 Dec '25

31 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from 2298978b47 hwcontext_vulkan: Remove unnecessary validation filters new c6e7243f11 avutil/opt: fix av_opt_is_set_to_default() for array options with no default value new d7ee7ac20f avutil/iamf: remove default value from demixing_matrix_def The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavutil/iamf.c | 2 +- libavutil/opt.c | 2 ++ libavutil/version.h | 2 +- tests/ref/fate/opt | 6 +++--- 4 files changed, 7 insertions(+), 5 deletions(-)

2 2

[ffmpeg] branch master updated (aa80a7880b -> 2298978b47)
by ffmpeg-git 30 Dec '25

30 Dec '25

This is an automated email from the git hooks/post-receive script. Git pushed a change to branch master in repository ffmpeg. from aa80a7880b avcodec/jpegls: rename SOF48 to SOF55 new e41e21a1ec avutil/hwcontext_vulkan: Limit usages for lone DPBs new 24db09a881 lavc/vulkan_video: Restrict usages for image views new b8de254e8c lavc/vulkan_video: Restrict usages for image views new 531e184944 lavc/vulkan_video: Drop sampler new 2298978b47 hwcontext_vulkan: Remove unnecessary validation filters The 5 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: libavcodec/vulkan_decode.c | 11 ++++---- libavcodec/vulkan_encode.c | 6 ++-- libavcodec/vulkan_video.c | 41 ++++++--------------------- libavcodec/vulkan_video.h | 4 +-- libavutil/hwcontext_vulkan.c | 67 ++++++++++++++++++++++---------------------- 5 files changed, 53 insertions(+), 76 deletions(-)

2 5