January 2024 - ffmpeg-devel - lists.ffmpeg.org

[PATCH v4] lavu/hwcontext_vaapi: Use vaMapBuffer2 for mapping image buffers
by David Rosca 28 Apr '24

28 Apr '24

This allows some optimizations in driver, such as not having to read back the data if write-only mapping is requested. --- v4: overwrite + note about vaMapBuffer libva fallback libavutil/hwcontext_vaapi.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavutil/hwcontext_vaapi.c b/libavutil/hwcontext_vaapi.c index 558fed94c6..435f10a7f3 100644 --- a/libavutil/hwcontext_vaapi.c +++ b/libavutil/hwcontext_vaapi.c @@ -799,6 +799,9 @@ static int vaapi_map_frame(AVHWFramesContext *hwfc, VAStatus vas; void *address = NULL; int err, i; +#if VA_CHECK_VERSION(1, 21, 0) + uint32_t vaflags = 0; +#endif surface_id = (VASurfaceID)(uintptr_t)src->data[3]; av_log(hwfc, AV_LOG_DEBUG, "Map surface %#x.\n", surface_id); @@ -882,7 +885,16 @@ static int vaapi_map_frame(AVHWFramesContext *hwfc, } } +#if VA_CHECK_VERSION(1, 21, 0) + if (flags & AV_HWFRAME_MAP_READ) + vaflags |= VA_MAPBUFFER_FLAG_READ; + if (flags & AV_HWFRAME_MAP_WRITE) + vaflags |= VA_MAPBUFFER_FLAG_WRITE; + // On drivers not implementing vaMapBuffer2 libva calls vaMapBuffer instead. + vas = vaMapBuffer2(hwctx->display, map->image.buf, &address, vaflags); +#else vas = vaMapBuffer(hwctx->display, map->image.buf, &address); +#endif if (vas != VA_STATUS_SUCCESS) { av_log(hwfc, AV_LOG_ERROR, "Failed to map image from surface " "%#x: %d (%s).\n", surface_id, vas, vaErrorStr(vas)); -- 2.42.0

2 3

[PATCH 1/2] avformat/mov: rename avif fields to heif
by James Almer 13 Apr '24

13 Apr '24

They are no longer avif specific. Signed-off-by: James Almer <jamrial(a)gmail.com> --- libavformat/isom.h | 4 ++-- libavformat/mov.c | 28 ++++++++++++++-------------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/libavformat/isom.h b/libavformat/isom.h index b30b9da65e..90c4fb5530 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -325,8 +325,8 @@ typedef struct MOVContext { int item_id; int extent_length; int64_t extent_offset; - } *avif_info; - int avif_info_size; + } *heif_info; + int heif_info_size; int64_t hvcC_offset; int hvcC_size; int interleaved_read; diff --git a/libavformat/mov.c b/libavformat/mov.c index c6398d6d81..12e82c66a9 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4916,15 +4916,15 @@ static int mov_read_custom(MOVContext *c, AVIOContext *pb, MOVAtom atom) return ret; } -static int avif_add_stream(MOVContext *c, int item_id) +static int heif_add_stream(MOVContext *c, int item_id) { MOVStreamContext *sc; AVStream *st; int item_index = -1; if (c->fc->nb_streams) return AVERROR_INVALIDDATA; - for (int i = 0; i < c->avif_info_size; i++) - if (c->avif_info[i].item_id == item_id) { + for (int i = 0; i < c->heif_info_size; i++) + if (c->heif_info[i].item_id == item_id) { item_index = i; break; } @@ -4987,8 +4987,8 @@ static int avif_add_stream(MOVContext *c, int item_id) sc->stts_data[0].count = 1; // Not used for still images. But needed by mov_build_index. sc->stts_data[0].duration = 0; - sc->sample_sizes[0] = c->avif_info[item_index].extent_length; - sc->chunk_offsets[0] = c->avif_info[item_index].extent_offset; + sc->sample_sizes[0] = c->heif_info[item_index].extent_length; + sc->chunk_offsets[0] = c->heif_info[item_index].extent_offset; mov_build_index(c, st); return 0; @@ -5013,7 +5013,7 @@ static int mov_read_meta(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (c->is_still_picture_avif) { int ret; // Add a stream for the YUV planes (primary item). - if ((ret = avif_add_stream(c, c->primary_item_id)) < 0) + if ((ret = heif_add_stream(c, c->primary_item_id)) < 0) return ret; // For still AVIF images, the meta box contains all the // necessary information that would generally be provided by the @@ -7820,7 +7820,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } - if (c->avif_info) { + if (c->heif_info) { av_log(c->fc, AV_LOG_INFO, "Duplicate iloc box found\n"); return 0; } @@ -7841,16 +7841,16 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) } item_count = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); - c->avif_info = av_malloc_array(item_count, sizeof(*c->avif_info)); - if (!c->avif_info) + c->heif_info = av_malloc_array(item_count, sizeof(*c->heif_info)); + if (!c->heif_info) return AVERROR(ENOMEM); - c->avif_info_size = item_count; + c->heif_info_size = item_count; for (int i = 0; i < item_count; i++) { int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); if (avio_feof(pb)) return AVERROR_INVALIDDATA; - c->avif_info[i].item_id = item_id; + c->heif_info[i].item_id = item_id; if (version > 0) avio_rb16(pb); // construction_method. @@ -7867,8 +7867,8 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (rb_size(pb, &extent_offset, offset_size) < 0 || rb_size(pb, &extent_length, length_size) < 0) return AVERROR_INVALIDDATA; - c->avif_info[i].extent_length = extent_length; - c->avif_info[i].extent_offset = base_offset + extent_offset; + c->heif_info[i].extent_length = extent_length; + c->heif_info[i].extent_offset = base_offset + extent_offset; } } @@ -8502,7 +8502,7 @@ static int mov_read_close(AVFormatContext *s) av_freep(&mov->aes_decrypt); av_freep(&mov->chapter_tracks); - av_freep(&mov->avif_info); + av_freep(&mov->heif_info); return 0; } -- 2.43.0

3 7

Sovereign Tech Fund
by Michael Niedermayer 12 Apr '24

12 Apr '24

Hi all We are offered to apply for a sponsorship of FFmpeg by the Sovereign Tech Fund (STF). Please read the following to get a better understanding what STF is about: (In short it is about maintenance and sustainability, not features) https://www.sovereigntechfund.de/programs/applications As some probably already know, Thilo has worked with STF to work out many details of this. SPI will handle the financials for FFmpeg. Everyone willing to benefit from this sponsorship must not be a US sanctioned entity or in a US sanctioned country. And must sign a contractor agreement and simplified SoW with SPI. "A SOW purpose is to protect the contracted from doing a work and not getting paid, and to protect the contractor from paying for a work which wasn't wanted" At this point, what we need is a list of Projects so we can submit an application to STF at or before 12th Feb. (at the 14th they have a meeting and will review our submission) What STF told us, they need ATM is: - A scope of work for the project to defined before hand for the upcoming review and eventually a contract. It doesn’t have to be tied to specific people. - The contract STF will sign with SPI will be a service agreement based on that SOW and milestones. Payment of invoices will be contingent and after delivery (aka performance) of agreed upon milestones. My suggestion is that we create a Trac WIKI page similar to the ideas page for GSoC. On that page everyone can add a project idea. The requirement is that 1. it must fit in the goals and mission and all of STF 2. it must be about FFmpeg (IIUC non coding tasks are ok) 3. it must have a developer willing to do the work and a monetary amount as well as a expected time frame. Of course these don't need to be added at the same time you can add an idea and someone else can add herself as person doing the work. But for consideration it needs to contain all parts 4. The developer doing the work must be qualified. An easy way to ensure this, is that (s)he has at least 100 authored commits in FFmpeg. According to STF, April 1st is a possible start date for the work and STF would also like to know if the work will be finished in 2024 or 2025 for their budget. the SoW can be for example: "do X by date Y to receive Z", but according to SPI it can also be "only tasks X are eligible, invoices should be sent by date Y, and payment will not exceed the budget Z" "Ideally, it should also mention the parameters for how much each thing done is worth — eg. If you're paying for hours or for tasks, and how much — as the SOW is supposed to give the contracted person means to know how much they'll be paid for what they do." "SOW should also note that if no valid tasks are performed, no payment will be made." Next step. For each Project suggestion from the wiki page we will send a mail to the ML with a copy and paste of the project suggestion. Once an apparent consensus is reached. This is the communities opportunity to object or approve the suggestion. Anyone can call for a formal vote of the GA here too if they do not want to object/approve in public. But i hope we can avoid that overhead. All suggested project ideas will then be submitted to STF We have never done STF before so there likely will be some surprises and we may need to adjust in case we hit any issues. and I also didn't expect to be involved in this but i don't want to stand around and have the opportunity for FFmpeg lost There can be no late objections here to any project suggestions. Objections must be before a project suggestion is submitted to STF, objections after that cannot be considered! Also once the person doing the work reaches the agreed milestone. She will submit an invoice with stefano and my help to SPI/STF. (in the unlikely case of a dispute on reaching a milestone it would be decided by the technical committee if the milestone has been reached from FFmpegs point of view) Thanks -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB It is what and why we do it that matters, not just one of them.

16 122

[PATCH 1/3] avcodec/vvc/vvcdec: Do not submit frames without VVCFrameThread
by Michael Niedermayer 02 Apr '24

02 Apr '24

Such frames will crash when pthread functions are called on the NULL pointer Fixes: member access within null pointer of type 'VVCFrameThread' (aka 'struct VVCFrameThread') Fixes: 65160/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-4665241535119360 (partly) Fixes: 65636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5394745824182272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/vvc/vvcdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c index 540a05f8cf4..2fa6aa46d9b 100644 --- a/libavcodec/vvc/vvcdec.c +++ b/libavcodec/vvc/vvcdec.c @@ -910,6 +910,9 @@ static int vvc_decode_frame(AVCodecContext *avctx, AVFrame *output, if (ret < 0) return ret; + if (!fc->ft) + return avpkt->size; + ret = submit_frame(s, fc, output, got_output); if (ret < 0) return ret; -- 2.17.1

4 14

FFmpeg at NAB 2024
by Thilo Borgmann 31 Mar '24

31 Mar '24

Hi, FFmpeg will have a booth at the next NAB from April 14th to 17th 2024 in Las Vegas [1]! We reiceived an anonymous corporate sponsorship for the booth, so there are no costs for the FFmpeg project to it (and no obligations, of course). Any FFmpeg developer is welcome to join in and man the booth with me, especially any developers based in the US or other american countries! Share with us your broken workflows, unfulfilled requirements, ideas for enhancements and after show drinks at W4232 [2]! -Thilo [1] https://cloud.e.nabshow.com/2024/ [2] https://nab24.mapyourshow.com/8_0/exhview/?hallID=W&selectedBooth=W4232

6 10

[PATCH] libavformat/flac_picture: Don't return AVERROR_INVALIDDATA for errors with flac picture mimetype
by Will Cassella 28 Mar '24

28 Mar '24

In the case where the FLAC picture MIME type is not understood, fail to parse the picture silently rather than return AVERROR_INVALIDDATA. This originated from a bug reported in Chromium: https://crbug.com/1052821 Signed-off-by: Will Cassella <cassew(a)google.com> --- libavformat/flac_picture.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c index b33fee75b4..1acad9b251 100644 --- a/libavformat/flac_picture.c +++ b/libavformat/flac_picture.c @@ -68,8 +68,6 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t **bufp, int buf_size, if (len <= 0 || len >= sizeof(mimetype)) { av_log(s, AV_LOG_ERROR, "Could not read mimetype from an attached " "picture.\n"); - if (s->error_recognition & AV_EF_EXPLODE) - return AVERROR_INVALIDDATA; return 0; } if (len + 24 > bytestream2_get_bytes_left(&g)) { @@ -91,8 +89,6 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t **bufp, int buf_size, if (id == AV_CODEC_ID_NONE) { av_log(s, AV_LOG_ERROR, "Unknown attached picture mimetype: %s.\n", mimetype); - if (s->error_recognition & AV_EF_EXPLODE) - return AVERROR_INVALIDDATA; return 0; } -- 2.37.2.789.g6183377224-goog

5 6

[PATCH v1] avcodec/cbs_vp8: Use little endian in fixed()
by Dai, Jianhui J 27 Mar '24

27 Mar '24

This commit adds value range checks to cbs_vp8_read_unsigned_le, migrates fixed() to use it, and enforces little-endian consistency for all read methods. Signed-off-by: Jianhui Dai <jianhui.j.dai(a)intel.com> --- libavcodec/cbs_vp8.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/libavcodec/cbs_vp8.c b/libavcodec/cbs_vp8.c index 065156c248..7a0752019b 100644 --- a/libavcodec/cbs_vp8.c +++ b/libavcodec/cbs_vp8.c @@ -181,9 +181,11 @@ static int cbs_vp8_bool_decoder_read_signed( return 0; } -static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *gbc, - int width, const char *name, - const int *subscripts, uint32_t *write_to) +static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, + GetBitContext *gbc, int width, + const char *name, const int *subscripts, + uint32_t *write_to, uint32_t range_min, + uint32_t range_max) { int32_t value; @@ -200,6 +202,14 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g CBS_TRACE_READ_END(); + if (value < range_min || value > range_max) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "%s out of range: " + "%" PRIu32 ", but must be in [%" PRIu32 ",%" PRIu32 "].\n", + name, value, range_min, range_max); + return AVERROR_INVALIDDATA; + } + *write_to = value; return 0; } @@ -246,15 +256,16 @@ static int cbs_vp8_read_unsigned_le(CodedBitstreamContext *ctx, GetBitContext *g do { \ uint32_t value; \ CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, \ - SUBSCRIPTS(subs, __VA_ARGS__), &value)); \ + SUBSCRIPTS(subs, __VA_ARGS__), &value, \ + 0, MAX_UINT_BITS(width))); \ current->name = value; \ } while (0) #define fixed(width, name, value) \ do { \ uint32_t fixed_value; \ - CHECK(ff_cbs_read_unsigned(ctx, rw, width, #name, 0, &fixed_value, \ - value, value)); \ + CHECK(cbs_vp8_read_unsigned_le(ctx, rw, width, #name, 0, &fixed_value, \ + value, value)); \ } while (0) #define bc_unsigned_subs(width, prob, enable_trace, name, subs, ...) \ -- 2.25.1

2 3

[PATCH 1/3] avformat/tmv: Check video chunk size
by Michael Niedermayer 26 Mar '24

26 Mar '24

This check matches the audio chunk check Fixes: Timeout Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/tmv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/tmv.c b/libavformat/tmv.c index ea39954190..18105f764e 100644 --- a/libavformat/tmv.c +++ b/libavformat/tmv.c @@ -103,6 +103,10 @@ static int tmv_read_header(AVFormatContext *s) char_cols = avio_r8(pb); char_rows = avio_r8(pb); tmv->video_chunk_size = char_cols * char_rows * 2; + if (!tmv->video_chunk_size) { + av_log(s, AV_LOG_ERROR, "invalid video chunk size\n"); + return AVERROR_INVALIDDATA; + } features = avio_r8(pb); if (features & ~(TMV_PADDING | TMV_STEREO)) { -- 2.17.1

5 10

[PATCH 1/3] avcodec/osq: Implement flush()
by Michael Niedermayer 26 Mar '24

26 Mar '24

Fixes: out of array access Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227491892887552 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268561729126400 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414805046788096 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538151088488448 Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608131540779008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavcodec/osq.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 435f3ea7f69..abe15c97f18 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -61,6 +61,15 @@ typedef struct OSQContext { int pkt_offset; } OSQContext; +static void osq_flush(AVCodecContext *avctx) +{ + OSQContext *s = avctx->priv_data; + + s->bitstream_size = 0; + s->pkt_offset = 0; + av_packet_unref(s->pkt); +} + static av_cold int osq_close(AVCodecContext *avctx) { OSQContext *s = avctx->priv_data; @@ -478,4 +487,5 @@ const FFCodec ff_osq_decoder = { AV_SAMPLE_FMT_S16P, AV_SAMPLE_FMT_S32P, AV_SAMPLE_FMT_NONE }, + .flush = osq_flush, }; -- 2.17.1

3 7

[PATCH 1/6] avformat/avidec: support huge durations
by Michael Niedermayer 25 Mar '24

25 Mar '24

Fixes: signed integer overflow: 109817402400 * 301990077 cannot be represented in type 'long long' Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6706191715139584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> --- libavformat/avidec.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 00bd7a98a9d..cfc693842b7 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -27,6 +27,7 @@ #include "libavutil/avstring.h" #include "libavutil/opt.h" #include "libavutil/dict.h" +#include "libavutil/integer.h" #include "libavutil/internal.h" #include "libavutil/intreadwrite.h" #include "libavutil/mathematics.h" @@ -476,7 +477,7 @@ static int calculate_bitrate(AVFormatContext *s) AVStream *st = s->streams[i]; FFStream *const sti = ffstream(st); int64_t duration; - int64_t bitrate; + int64_t bitrate = 0; for (j = 0; j < sti->nb_index_entries; j++) len += sti->index_entries[j].size; @@ -484,7 +485,14 @@ static int calculate_bitrate(AVFormatContext *s) if (sti->nb_index_entries < 2 || st->codecpar->bit_rate > 0) continue; duration = sti->index_entries[j-1].timestamp - sti->index_entries[0].timestamp; - bitrate = av_rescale(8*len, st->time_base.den, duration * st->time_base.num); + if (INT64_MAX / duration >= st->time_base.num) { + bitrate = av_rescale(8*len, st->time_base.den, duration * st->time_base.num); + } else { + AVInteger bitrate_i = av_div_i(av_mul_i(av_int2i(8*len), av_int2i(st->time_base.den)), + av_mul_i(av_int2i(duration), av_int2i(st->time_base.num))); + if (av_cmp_i(bitrate_i, av_int2i(INT64_MAX)) <= 0) + bitrate = av_i2int(bitrate_i); + } if (bitrate > 0) { st->codecpar->bit_rate = bitrate; } -- 2.17.1

5 19