June 2026 - ffmpeg-devel - lists.ffmpeg.org

[PR] libavformat/sbgdec: fix overflow check when parsing option -F (PR #23643)
by aolinf 29 Jun '26

29 Jun '26

PR #23643 opened by aolinf URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643.patch When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a UBSan runtime error like: "runtime error: 9e+26 is outside the range of representable values of type 'long'" Fix this by ensuring the parsed double value does not exceed the scaled equivalent of INT64_MAX. Signed-off-by: Aolin Feng <aolinf(a)google.com> # Summary of changes Briefly describe what this PR does and why.  From 874bf8316e4cc0fb7fcfa655a1ce66197662362d Mon Sep 17 00:00:00 2001 From: Aolin Feng <aolinf(a)google.com> Date: Mon, 29 Jun 2026 17:19:32 +0000 Subject: [PATCH] libavformat/sbgdec: fix overflow check when parsing option -F When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a UBSan runtime error like: "runtime error: 9e+26 is outside the range of representable values of type 'long'" Fix this by ensuring the parsed double value does not exceed the scaled equivalent of INT64_MAX. Signed-off-by: Aolin Feng <aolinf(a)google.com> --- libavformat/sbgdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 71cbad2dae..ffdc2abe8d 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -379,7 +379,7 @@ static int parse_options(struct sbg_parser *p) case 'F': FORWARD_ERROR(parse_optarg(p, opt, &oarg)); v = strtod(oarg.s, &tptr); - if (oarg.e != tptr) { + if (oarg.e != tptr || v > (double)INT64_MAX / AV_TIME_BASE * 1000) { snprintf(p->err_msg, sizeof(p->err_msg), "syntax error for option -F"); return AVERROR_INVALIDDATA; -- 2.52.0

1 0

[PR] libavformat/shared: make more robust against cache file corruption (PR #23642)
by Niklas Haas 29 Jun '26

29 Jun '26

PR #23642 opened by Niklas Haas (haasn) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23642 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23642.patch From 193f371efed20d31ccf7d9c4df2db743b0af86c9 Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Mon, 29 Jun 2026 17:35:13 +0200 Subject: [PATCH 1/2] avformat/shared: increase CRC size to 32-bits This increases the amount of corrupted data we can correctly detect as corrupted from (on average) 2 GiB to 128 TiB, at the default 32 KiB block size. Sponsored-by: nxtedition AB Signed-off-by: Niklas Haas <git(a)haasn.dev> --- libavformat/shared.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/libavformat/shared.c b/libavformat/shared.c index 7c8b17350c..0c99867796 100644 --- a/libavformat/shared.c +++ b/libavformat/shared.c @@ -79,7 +79,7 @@ static int hash_uri(uint8_t hash[HASH_SIZE], const char *uri) } #define HEADER_MAGIC MKTAG(u'\xFF', 'S', 'h', '$') -#define HEADER_VERSION 2 +#define HEADER_VERSION 3 enum BlockState { /* Reserved block state values */ @@ -93,9 +93,9 @@ enum BlockState { */ }; -static uint16_t get_block_crc(const uint8_t *block, size_t block_size) +static uint32_t get_block_crc(const uint8_t *block, size_t block_size) { - uint16_t crc = av_crc(av_crc_get_table(AV_CRC_16_ANSI), 0, block, block_size); + uint32_t crc = av_crc(av_crc_get_table(AV_CRC_32_ANSI), 0, block, block_size); switch (crc) { case BLOCK_NONE: case BLOCK_FAILED: @@ -107,7 +107,7 @@ static uint16_t get_block_crc(const uint8_t *block, size_t block_size) } typedef struct Block { - atomic_ushort state; /* enum BlockState */ + atomic_uint state; /* enum BlockState */ } Block; typedef struct Spacemap { @@ -601,7 +601,7 @@ static int shared_read(URLContext *h, unsigned char *buf, int size) return ret; Block *const block = &s->spacemap->blocks[block_id]; - unsigned short state = atomic_load_explicit(&block->state, memory_order_acquire); + unsigned state = atomic_load_explicit(&block->state, memory_order_acquire); int64_t pending_since = 0; int verify_read = 0, is_race = 0; @@ -622,10 +622,10 @@ retry: } } - uint16_t crc = get_block_crc(tmp, block_size); + uint32_t crc = get_block_crc(tmp, block_size); if (crc != state) { av_log(h, AV_LOG_ERROR, "Cache corruption detected for block 0x%"PRIx64" at " - "offset 0x%"PRIx64": expected CRC: 0x%04X, got: 0x%04X\n", + "offset 0x%"PRIx64": expected CRC: 0x%08X, got: 0x%08X\n", block_id, block_pos, state, crc); return AVERROR(EIO); } @@ -786,9 +786,9 @@ retry: memory_order_relaxed, memory_order_relaxed); } else { - uint16_t crc = get_block_crc(tmp, bytes_read); + uint32_t crc = get_block_crc(tmp, bytes_read); av_log(h, AV_LOG_TRACE, "Cached %d bytes to block 0x%"PRIx64" at " - "offset 0x%"PRIx64", CRC 0x%04X\n", bytes_read, block_id, + "offset 0x%"PRIx64", CRC 0x%08X\n", bytes_read, block_id, block_pos, crc); atomic_store_explicit(&block->state, crc, memory_order_release); } -- 2.52.0 From 46ed278fad7cd527081651a9c9cd39202ae51620 Mon Sep 17 00:00:00 2001 From: Niklas Haas <git(a)haasn.dev> Date: Mon, 29 Jun 2026 17:56:24 +0200 Subject: [PATCH 2/2] avformat/shared: add -retry_corrupt option Similar to -retry_failed, this retries blocks whose only crime is failing the CRC self-check. Sponsored-by: nxtedition AB Signed-off-by: Niklas Haas <git(a)haasn.dev> --- doc/protocols.texi | 5 +++++ libavformat/shared.c | 12 +++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/doc/protocols.texi b/doc/protocols.texi index 5f8cc8094d..d51c12d6f8 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -1621,6 +1621,11 @@ If true (the default), transient read errors from the underlying input stream are ignored and retried again. If false, any blocks that previously failed being read from will be treated as permanently inaccessible. +@item retry_corrupt +If true (the default), blocks whose contents fail the CRC integrity check are +re-fetched from the underlying input stream, overwriting the corrupt cached +data. If false, cache corruption is treated as a fatal read error. + @end table URL Syntax is diff --git a/libavformat/shared.c b/libavformat/shared.c index 0c99867796..96b0d8080b 100644 --- a/libavformat/shared.c +++ b/libavformat/shared.c @@ -152,6 +152,7 @@ typedef struct SharedContext { int read_only; int64_t timeout; int retry_errors; + int retry_corrupt; int verify; /* misc state */ @@ -627,6 +628,8 @@ retry: av_log(h, AV_LOG_ERROR, "Cache corruption detected for block 0x%"PRIx64" at " "offset 0x%"PRIx64": expected CRC: 0x%08X, got: 0x%08X\n", block_id, block_pos, state, crc); + if (s->retry_corrupt) + goto read_block; return AVERROR(EIO); } @@ -643,9 +646,11 @@ retry: return size; case BLOCK_FAILED: - if (!s->retry_errors) - return AVERROR(EIO); - av_fallthrough; + if (s->retry_errors) + goto read_block; + return AVERROR(EIO); + +read_block: case BLOCK_NONE: if (s->read_only) break; /* don't mark block as pending */ @@ -874,6 +879,7 @@ static const AVOption options[] = { { "cache_verify", "Verify correctness of the cache against the source", OFFSET(verify), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, .flags = D }, { "cache_timeout", "Time in us to wait before re-fetching pending blocks", OFFSET(timeout), AV_OPT_TYPE_INT64, {.i64 = 10000}, 0, INT64_MAX, .flags = D }, { "retry_errors", "Re-request blocks even if they previously failed", OFFSET(retry_errors), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, .flags = D }, + { "retry_corrupt", "Re-request blocks that fail the CRC check", OFFSET(retry_corrupt), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, .flags = D }, {0}, }; -- 2.52.0

1 0

[PATCH] avformat/mtv: validate computed frame rate
by albab-hasan 29 Jun '26

29 Jun '26

the frame rate is derived from audio_br and audio_subsegments via integer division. if audio_br is small enough that the result truncates to zero, avpriv_set_pts_info() silently ignores the call, leaving the video stream with an invalid timebase. --- libavformat/mtv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/mtv.c b/libavformat/mtv.c index c888443b7a..10be0faf7e 100644 --- a/libavformat/mtv.c +++ b/libavformat/mtv.c @@ -155,8 +155,10 @@ static int mtv_read_header(AVFormatContext *s) audio_subsegments * (MTV_AUDIO_PADDING_SIZE + MTV_ASUBCHUNK_DATA_SIZE) + mtv->img_segment_size; mtv->video_fps = (mtv->audio_br / 4) / audio_subsegments; - - // FIXME Add sanity check here + if (!mtv->video_fps) { + av_log(s, AV_LOG_ERROR, "Invalid frame rate\n"); + return AVERROR_INVALIDDATA; + } // all systems go! init decoders -- 2.43.0

1 0

[PR] avformat/rtpdec: fix dropped payload after reordering-queue delivery (PR #23640)
by Torbjörn Einarsson 29 Jun '26

29 Jun '26

PR #23640 opened by Torbjörn Einarsson (tobbee) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23640 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23640.patch # Summary of changes When receiving RTP with multiple MPEG-2 TS packets in the payload, some TS packets were silently dropped whenever an RTP packet carried a PES boundary (a PUSI (Payload Unit Start Indicator) on a TS packet other than the first in the payload) and that packet was delivered out of the RTP reordering queue. In practice this happened for a simple packet reordering. ## Fix Update s->prev_ret inside the loop so that the first packets after a PUSI are not dropped. ## A New Test To reproduce the issue, there is a standalone test program, `libavformat/tests/rtpdec.c`, that may be dropped if deemed unnecessary. It drives the real MPEG-2 TS depacketizer with full-size RTP packets (12-byte header + 7x188-byte TS packets) by driving the same packets twice, once in order and once with one adjacent pair reordered, without dropping any packet. A correct depacketizer delivers identical PES data both ways; before the fix the reordered run is short by the dropped tail. Build and run: make libavformat/tests/rtpdec && ./libavformat/tests/rtpdec From d4bf590cc018af2a04e00d6695ba83ad58d33a09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torbjo=CC=88rn=20Einarsson?= <torbjorn(a)einarssons.se> Date: Mon, 29 Jun 2026 14:23:50 +0200 Subject: [PATCH] avformat/rtpdec: fix dropped payload after reordering-queue delivery MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ff_rtp_parse_packet() drains a depacketizer's internally buffered data on the follow-up buf==NULL call only while s->prev_ret > 0. The "while (rv < 0 && has_next_packet(s))" reordering loop delivered queued packets without updating s->prev_ret, so when a packet was returned from that loop, prev_ret kept its stale negative value and the next buf==NULL call was routed into the (now empty) reordering queue instead of back into the depacketizer. For MPEG-2 TS this drops data: when an RTP payload carries a payload unit start indicator (PUSI) on a TS packet other than the first, the depacketizer returns the finished PES, buffers the rest of the payload and returns 1, expecting a buf==NULL call to fetch the remainder. A plain continuation payload (no PUSI, the common case) completes no PES and returns < 0, which is enough to enter the loop above; if the next queued packet carries a mid-payload PUSI, its buffered tail (the TS packets from the PUSI onwards) is never drained and is lost. A single reordered pair of packets triggers this, so the loss occurs rather frequently, not only under heavy reordering. Update s->prev_ret inside the loop and add libavformat/tests/rtpdec.c, which drives the real MPEG-TS depacketizer with full 7x188-byte RTP packets and checks that an in-order and a reordered delivery of the same packets yield identical PES data. Signed-off-by: Torbjörn Einarsson <torbjorn(a)einarssons.se> --- libavformat/Makefile | 1 + libavformat/rtpdec.c | 4 +- libavformat/tests/.gitignore | 1 + libavformat/tests/rtpdec.c | 277 +++++++++++++++++++++++++++++++++++ 4 files changed, 282 insertions(+), 1 deletion(-) create mode 100644 libavformat/tests/rtpdec.c diff --git a/libavformat/Makefile b/libavformat/Makefile index 752436cf5f..cd1ca0fbfc 100644 --- a/libavformat/Makefile +++ b/libavformat/Makefile @@ -781,6 +781,7 @@ TESTPROGS = id3v2 \ seek \ url \ seek_utils +TESTPROGS-$(CONFIG_RTPDEC) += rtpdec # async \ FIFO-MUXER-TESTPROGS-$(CONFIG_NETWORK) += fifo_muxer diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c index 3fd817f93c..47ecb46d91 100644 --- a/libavformat/rtpdec.c +++ b/libavformat/rtpdec.c @@ -930,8 +930,10 @@ int ff_rtp_parse_packet(RTPDemuxContext *s, AVPacket *pkt, return -1; rv = rtp_parse_one_packet(s, pkt, bufptr, len); s->prev_ret = rv; - while (rv < 0 && has_next_packet(s)) + while (rv < 0 && has_next_packet(s)) { rv = rtp_parse_queued_packet(s, pkt); + s->prev_ret = rv; + } return rv ? rv : has_next_packet(s); } diff --git a/libavformat/tests/.gitignore b/libavformat/tests/.gitignore index f9aac1f9e0..b7a4c70014 100644 --- a/libavformat/tests/.gitignore +++ b/libavformat/tests/.gitignore @@ -4,6 +4,7 @@ /movenc /noproxy /rtmpdh +/rtpdec /seek /srtp /url diff --git a/libavformat/tests/rtpdec.c b/libavformat/tests/rtpdec.c new file mode 100644 index 0000000000..1480337bfe --- /dev/null +++ b/libavformat/tests/rtpdec.c @@ -0,0 +1,277 @@ +/* + * Copyright (c) 2026 Torbjörn Einarsson + * + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * FFmpeg is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with FFmpeg; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +/* + * Regression test for ff_rtp_parse_packet() and the RTP reordering queue, + * exercised through the real MPEG-2 TS depacketizer (rtpdec_mpegts.c) with + * realistic full-size RTP packets (12-byte RTP header + 7 * 188-byte TS + * packets, i.e. the common 1328-byte MPEG-TS-over-RTP packet). + * + * The MPEG-TS depacketizer consumes an RTP payload only up to the point where + * a payload unit start indicator (PUSI) closes the current PES. If that PUSI + * sits on a TS packet other than the first in the RTP payload, the depacketizer + * returns the finished PES, buffers the rest of the payload internally and + * returns 1, expecting the caller to fetch the rest with a follow-up + * buf == NULL call. A plain continuation RTP payload (no PUSI, the common case + * in a video stream) completes no PES and makes the depacketizer return < 0. + * + * ff_rtp_parse_packet() routes the follow-up buf == NULL call back into the + * depacketizer (to drain its buffer) only while s->prev_ret > 0. When a packet + * is delivered from the "while (rv < 0 && has_next_packet(s))" reordering loop, + * prev_ret used not to be updated, so after such a delivery the buffered tail + * (the TS packets from the mid-payload PUSI onwards) was never drained and got + * dropped. + * + * This needs nothing more exotic than a single reordered pair of packets: a + * continuation packet (returns < 0) parsed while a mid-PUSI packet (returns 1) + * is waiting in the queue is enough to enter that loop -- which is why the loss + * was observed very frequently, not only on heavy reordering. + * + * The test feeds the exact same packets twice -- once in order (the reference; + * the in-order path never enters the buggy loop) and once with one adjacent + * pair swapped -- and checks that both deliver identical PES data. No packet is + * ever lost, so a correct depacketizer must recover everything. + */ + +#include <stdio.h> +#include <string.h> + +#include "libavutil/mem.h" +#include "libavutil/intreadwrite.h" +#include "libavformat/avformat.h" +#include "libavformat/rtpdec.h" +#include "libavformat/rtpdec_formats.h" + +#define TS_SIZE 188 +#define TS_PAYLOAD 184 /* TS_SIZE - 4-byte TS header */ +#define TS_PER_RTP 7 /* 12 + 7*188 = 1328-byte RTP packets */ +#define RTP_HEADER_SIZE 12 +#define RTP_PAYLOAD (TS_PER_RTP * TS_SIZE) +#define MP2T_PT 33 /* static RTP payload type for MPEG-2 TS*/ +#define QUEUE_SIZE 2 /* reordering enabled, small jitter buf */ + +#define ES_PID 0x0100 +#define PES_STREAM_ID 0xe0 /* a video stream id */ +#define PES_HDR_SIZE 9 /* 00 00 01 id len(2) flags(2) hdrlen */ + +/* PES payload sizes that map onto a whole number of TS packets: + * first packet carries PES_HDR_SIZE + (TS_PAYLOAD - PES_HDR_SIZE) ES bytes, the + * rest carry TS_PAYLOAD each. 17 TS packets -> 175 + 16*184 ES bytes. */ +#define PES_TS_PACKETS 17 +#define PES_ES_LEN ((TS_PAYLOAD - PES_HDR_SIZE) + (PES_TS_PACKETS - 1) * TS_PAYLOAD) + +/* PES boundary layout (one PES per access unit), 35 TS packets = 5 RTP packets: + * PES_0 : TS 0..16 (PUSI on TS 0) + * PES_1 : TS 17..33 (PUSI on TS 17, mid RTP packet 2) + * PES_2 : TS 34 (PUSI on TS 34, closes PES_1; PES_2 left pending) + * => RTP 1 (TS 7..13) is pure continuation, RTP 2 (TS 14..20) carries the + * mid-payload PUSI. Swapping their arrival order triggers the bug. */ +#define NB_TS_PACKETS 35 +#define NB_RTP_PACKETS (NB_TS_PACKETS / TS_PER_RTP) /* 5 */ + +/* Start sequence numbers away from 0: ff_rtp_parse_packet() treats s->seq == 0 + * as "no packet seen yet" and bypasses the reordering queue for it. */ +#define SEQ_BASE 100 + +typedef struct Output { + int sizes[64]; + int nb; + uint8_t bytes[1 << 16]; + int total; +} Output; + +/* ------------------------------------------------------------------ */ +/* MPEG-TS stream construction */ +/* ------------------------------------------------------------------ */ + +static void put_ts_packet(uint8_t *dst, int pusi, int cc, + const uint8_t *payload) +{ + dst[0] = 0x47; /* sync byte */ + dst[1] = (pusi ? 0x40 : 0x00) | ((ES_PID >> 8) & 0x1f); + dst[2] = ES_PID & 0xff; + dst[3] = 0x10 | (cc & 0x0f); /* payload only, no AF */ + memcpy(dst + 4, payload, TS_PAYLOAD); +} + +/* Append one PES packet (header + es_len ES bytes) as TS packets. */ +static void add_pes(uint8_t *ts, int *off, int *cc, int *es_counter, int es_len) +{ + static const uint8_t pes_hdr[PES_HDR_SIZE] = { + 0x00, 0x00, 0x01, PES_STREAM_ID, + 0x00, 0x00, /* PES_packet_length 0 == unbounded */ + 0x80, 0x00, 0x00, /* '10' marker, no PTS/DTS, header_data_len 0 */ + }; + int es_done = 0, first = 1; + + while (es_done < es_len) { + uint8_t payload[TS_PAYLOAD]; + int p = 0, i, chunk; + + if (first) { + memcpy(payload, pes_hdr, PES_HDR_SIZE); + p = PES_HDR_SIZE; + } + chunk = TS_PAYLOAD - p; + for (i = 0; i < chunk; i++) + payload[p + i] = (uint8_t)((*es_counter)++ & 0xff); + + put_ts_packet(ts + *off, first, *cc, payload); + *off += TS_SIZE; + *cc = (*cc + 1) & 0x0f; + es_done += chunk; + first = 0; + } +} + +static void build_ts_stream(uint8_t *ts) +{ + int off = 0, cc = 0, es_counter = 0; + add_pes(ts, &off, &cc, &es_counter, PES_ES_LEN); /* PES_0: TS 0..16 */ + add_pes(ts, &off, &cc, &es_counter, PES_ES_LEN); /* PES_1: TS 17..33 */ + add_pes(ts, &off, &cc, &es_counter, TS_PAYLOAD - PES_HDR_SIZE); /* PES_2: TS 34 */ +} + +/* ------------------------------------------------------------------ */ +/* RTP feeding */ +/* ------------------------------------------------------------------ */ + +static void collect(AVPacket *pkt, Output *out) +{ + if (pkt->size > 0 && out->nb < FF_ARRAY_ELEMS(out->sizes) && + out->total + pkt->size <= (int)sizeof(out->bytes)) { + out->sizes[out->nb++] = pkt->size; + memcpy(out->bytes + out->total, pkt->data, pkt->size); + out->total += pkt->size; + } + av_packet_unref(pkt); +} + +/* Feed one freshly received RTP packet (carrying the block'th group of + * TS_PER_RTP TS packets, with RTP sequence number SEQ_BASE + block) and collect + * everything handed back, exactly as rtsp.c consumes ff_rtp_parse_packet(): + * a return value of 1 means "call again with buf == NULL". */ +static void feed(RTPDemuxContext *s, AVPacket *pkt, const uint8_t *ts_stream, + int block, Output *out) +{ + int len = RTP_HEADER_SIZE + RTP_PAYLOAD, ret; + uint8_t *buf = av_malloc(len); + uint8_t *bufptr = buf; + + if (!buf) + return; + buf[0] = RTP_VERSION << 6; /* V=2, no padding/ext/CSRC */ + buf[1] = MP2T_PT; /* no marker bit */ + AV_WB16(buf + 2, SEQ_BASE + block); + AV_WB32(buf + 4, 0); /* timestamp (unused) */ + AV_WB32(buf + 8, 0x0badf00d); /* ssrc */ + memcpy(buf + RTP_HEADER_SIZE, ts_stream + block * RTP_PAYLOAD, RTP_PAYLOAD); + + ret = ff_rtp_parse_packet(s, pkt, &bufptr, len); + while (ret == 1) { + collect(pkt, out); + ret = ff_rtp_parse_packet(s, pkt, NULL, 0); + } + if (ret == 0) + collect(pkt, out); + + if (bufptr) /* not taken by the queue */ + av_free(bufptr); +} + +static int run(const uint8_t *ts_stream, const int *order, Output *out) +{ + AVFormatContext *fmt = avformat_alloc_context(); + RTPDemuxContext *s; + PayloadContext *pc; + AVPacket *pkt; + int i; + + memset(out, 0, sizeof(*out)); + if (!fmt) + return AVERROR(ENOMEM); + + s = ff_rtp_parse_open(fmt, NULL, MP2T_PT, QUEUE_SIZE); + pc = av_mallocz(ff_mpegts_dynamic_handler.priv_data_size); + pkt = av_packet_alloc(); + if (!s || !pc || !pkt) { + av_packet_free(&pkt); + av_free(pc); + if (s) + ff_rtp_parse_close(s); + avformat_free_context(fmt); + return AVERROR(ENOMEM); + } + ff_mpegts_dynamic_handler.init(fmt, -1, pc); + ff_rtp_parse_set_dynamic_protocol(s, pc, &ff_mpegts_dynamic_handler); + + for (i = 0; i < NB_RTP_PACKETS; i++) + feed(s, pkt, ts_stream, order[i], out); + + av_packet_free(&pkt); + ff_mpegts_dynamic_handler.close(pc); + av_free(pc); + ff_rtp_parse_close(s); + avformat_free_context(fmt); + return 0; +} + +static void dump(const char *label, const Output *o) +{ + int i; + fprintf(stderr, " %-9s %d packet(s), %d bytes, sizes:", label, o->nb, o->total); + for (i = 0; i < o->nb; i++) + fprintf(stderr, " %d", o->sizes[i]); + fprintf(stderr, "\n"); +} + +int main(void) +{ + static uint8_t ts_stream[NB_TS_PACKETS * TS_SIZE]; + /* Block indices in arrival order; reordered swaps the continuation packet + * (block 1, TS 7..13) and the mid-PUSI packet (block 2, TS 14..20). No + * packet is dropped in either case. */ + static const int in_order[NB_RTP_PACKETS] = { 0, 1, 2, 3, 4 }; + static const int reordered[NB_RTP_PACKETS] = { 0, 2, 1, 3, 4 }; + Output ref, got; + + build_ts_stream(ts_stream); + + if (run(ts_stream, in_order, &ref) < 0 || + run(ts_stream, reordered, &got) < 0) { + fprintf(stderr, "test setup failed\n"); + return 2; + } + + if (ref.nb != got.nb || ref.total != got.total || + memcmp(ref.sizes, got.sizes, ref.nb * sizeof(ref.sizes[0])) || + memcmp(ref.bytes, got.bytes, ref.total)) { + fprintf(stderr, + "FAIL: reordering an RTP packet with a mid-payload PUSI dropped " + "MPEG-TS data.\n"); + dump("in-order:", &ref); + dump("reordered:", &got); + return 1; + } + + printf("OK: %d PES packets (%d bytes) recovered identically with and " + "without reordering\n", ref.nb, ref.total); + return 0; +} -- 2.52.0

1 0

[PR] [release/7.1] avformat/demux: use io_close2 when closing avformat (PR #23639)
by Jan Ekström 29 Jun '26

29 Jun '26

PR #23639 opened by Jan Ekström (jeeb) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23639 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23639.patch It's not valid to call avio_close() on context that has not been open with avio_open(). This fixes use of custom IO. (io_open / io_close2 callbacks) Note that by default io_close2 is set to io_close2_default() which calls avio_close(), so default case will work the same as before. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1a7e802c8f970e76807f08c3d3fb3513ae5a4882) # Summary of changes Briefly describe what this PR does and why.  From 998de74adf861c26df557e220996faa959419549 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sat, 17 May 2025 05:50:28 +0200 Subject: [PATCH] avformat/demux: use io_close2 when closing avfromat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's not valid to call avio_close() on context that has not been open with avio_open(). This fixes use of custom IO. (io_open / io_close2 callbacks) Note that by default io_close2 is set to io_close2_default() which calls avio_close(), so default case will work the same as before. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1a7e802c8f970e76807f08c3d3fb3513ae5a4882) --- libavformat/demux.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/demux.c b/libavformat/demux.c index df4fc3461e..9be5651f76 100644 --- a/libavformat/demux.c +++ b/libavformat/demux.c @@ -389,11 +389,10 @@ void avformat_close_input(AVFormatContext **ps) if (ffifmt(s->iformat)->read_close) ffifmt(s->iformat)->read_close(s); + ff_format_io_close(s, &pb); avformat_free_context(s); *ps = NULL; - - avio_close(pb); } static void force_codec_ids(AVFormatContext *s, AVStream *st) -- 2.52.0

1 0

[PR] [release/6.1] avformat/demux: use io_close2 when closing avformat (PR #23638)
by Jan Ekström 29 Jun '26

29 Jun '26

PR #23638 opened by Jan Ekström (jeeb) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23638 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23638.patch It's not valid to call avio_close() on context that has not been open with avio_open(). This fixes use of custom IO. (io_open / io_close2 callbacks) Note that by default io_close2 is set to io_close2_default() which calls avio_close(), so default case will work the same as before. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1a7e802c8f970e76807f08c3d3fb3513ae5a4882) # Summary of changes Briefly describe what this PR does and why.  From f814e6bd2ac0d1b487849d44c1d6ec6dd58e2dbd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93(a)gmail.com> Date: Sat, 17 May 2025 05:50:28 +0200 Subject: [PATCH] avformat/demux: use io_close2 when closing avfromat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's not valid to call avio_close() on context that has not been open with avio_open(). This fixes use of custom IO. (io_open / io_close2 callbacks) Note that by default io_close2 is set to io_close2_default() which calls avio_close(), so default case will work the same as before. Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 1a7e802c8f970e76807f08c3d3fb3513ae5a4882) --- libavformat/demux.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/demux.c b/libavformat/demux.c index 60f491e550..2fc6c211cc 100644 --- a/libavformat/demux.c +++ b/libavformat/demux.c @@ -390,11 +390,10 @@ void avformat_close_input(AVFormatContext **ps) if (s->iformat->read_close) s->iformat->read_close(s); + ff_format_io_close(s, &pb); avformat_free_context(s); *ps = NULL; - - avio_close(pb); } static void force_codec_ids(AVFormatContext *s, AVStream *st) -- 2.52.0

1 0

[PR] avutil/hwcontext_cuda: fix yuv420p V/U plane overlap in cuda_get_buffer() (PR #23637)
by nyanmisaka 29 Jun '26

29 Jun '26

PR #23637 opened by nyanmisaka URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23637 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23637.patch # Summary of changes Odd-height yuv420p result in incorrect calculations of the U-plane address offset. The last row of the V-plane overlapped with and was overwritten by the first row of the U-plane, leading to chroma artifacts. ``` ffmpeg -init_hw_device cuda=cu -filter_hw_device cu -f lavfi -i \ testsrc=s=1920x1081,format=yuv420p -vf hwupload -c:v hevc_nvenc \ -vframes 1 -y <OUTPUT> ``` Signed-off-by: nyanmisaka <nst799610810(a)gmail.com> Inspired by ffe0104 <img src="/attachments/7abec1e4-9608-4a0a-a423-e3a6347a6795" height="250"> From 209747824d9862be43c2c09ce6571e35a692074f Mon Sep 17 00:00:00 2001 From: nyanmisaka <nst799610810(a)gmail.com> Date: Mon, 29 Jun 2026 15:32:00 +0800 Subject: [PATCH] avutil/hwcontext_cuda: fix yuv420p V/U plane overlap in cuda_get_buffer() Odd-height yuv420p result in incorrect calculations of the U-plane address offset. The last row of the V-plane overlapped with and was overwritten by the first row of the U-plane, leading to chroma artifacts. ``` ffmpeg -init_hw_device cuda=cu -filter_hw_device cu -f lavfi -i \ testsrc=s=1920x1081,format=yuv420p -vf hwupload -c:v hevc_nvenc \ -vframes 1 -y <OUTPUT> ``` Signed-off-by: nyanmisaka <nst799610810(a)gmail.com> --- libavutil/hwcontext_cuda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/hwcontext_cuda.c b/libavutil/hwcontext_cuda.c index 6342683a17..f93bdcab9c 100644 --- a/libavutil/hwcontext_cuda.c +++ b/libavutil/hwcontext_cuda.c @@ -209,7 +209,7 @@ static int cuda_get_buffer(AVHWFramesContext *ctx, AVFrame *frame) if (ctx->sw_format == AV_PIX_FMT_YUV420P) { frame->linesize[1] = frame->linesize[2] = frame->linesize[0] / 2; frame->data[2] = frame->data[1]; - frame->data[1] = frame->data[2] + frame->linesize[2] * (ctx->height / 2); + frame->data[1] = frame->data[2] + frame->linesize[2] * AV_CEIL_RSHIFT(ctx->height, 1); } frame->format = AV_PIX_FMT_CUDA; -- 2.52.0

1 0

[PR] avcodec/v4l2_m2m: add WMV3 decoder and fix VC1 pixel format mapping (PR #23636)
by ganqiuye 29 Jun '26

29 Jun '26

PR #23636 opened by ganqiuye URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23636 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23636.patch WMV3 (Simple/Main profile) bitstreams use V4L2_PIX_FMT_VC1_ANNEX_G, while VC-1 Advanced Profile uses V4L2_PIX_FMT_VC1_ANNEX_L. The existing mapping incorrectly associated AV_CODEC_ID_VC1 with VC1_ANNEX_G. Add wmv3_v4l2m2m_decoder and map WMV3 to VC1_ANNEX_G and VC1 to VC1_ANNEX_L in v4l2_fmt.c. Signed-off-by: ganqiuye <ganqiuye(a)gmail.com> # Summary of changes Briefly describe what this PR does and why.  From 3bbf8f0ab2c6659e290a95c1e36a9ed56d3f7714 Mon Sep 17 00:00:00 2001 From: ganqiuye <ganqiuye(a)gmail.com> Date: Mon, 29 Jun 2026 15:15:35 +0800 Subject: [PATCH] avcodec/v4l2_m2m: add WMV3 decoder and fix VC1 pixel format mapping WMV3 (Simple/Main profile) bitstreams use V4L2_PIX_FMT_VC1_ANNEX_G, while VC-1 Advanced Profile uses V4L2_PIX_FMT_VC1_ANNEX_L. The existing mapping incorrectly associated AV_CODEC_ID_VC1 with VC1_ANNEX_G. Add wmv3_v4l2m2m_decoder and map WMV3 to VC1_ANNEX_G and VC1 to VC1_ANNEX_L in v4l2_fmt.c. Signed-off-by: ganqiuye <ganqiuye(a)gmail.com> --- configure | 1 + libavcodec/Makefile | 1 + libavcodec/allcodecs.c | 1 + libavcodec/v4l2_fmt.c | 5 ++++- libavcodec/v4l2_m2m_dec.c | 1 + 5 files changed, 8 insertions(+), 1 deletion(-) diff --git a/configure b/configure index 785e23fb16..b46330b22b 100755 --- a/configure +++ b/configure @@ -3711,6 +3711,7 @@ vc1_cuvid_decoder_deps="cuvid" vc1_mmal_decoder_deps="mmal" vc1_qsv_decoder_select="qsvdec" vc1_v4l2m2m_decoder_deps="v4l2_m2m vc1_v4l2_m2m" +wmv3_v4l2m2m_decoder_deps="v4l2_m2m vc1_v4l2_m2m" vp8_cuvid_decoder_deps="cuvid" vp8_mediacodec_decoder_deps="mediacodec" vp8_mediacodec_encoder_deps="mediacodec" diff --git a/libavcodec/Makefile b/libavcodec/Makefile index 95ba308504..6fe6eb0c9d 100644 --- a/libavcodec/Makefile +++ b/libavcodec/Makefile @@ -790,6 +790,7 @@ OBJS-$(CONFIG_VC1_CUVID_DECODER) += cuviddec.o OBJS-$(CONFIG_VC1_MMAL_DECODER) += mmaldec.o OBJS-$(CONFIG_VC1_QSV_DECODER) += qsvdec.o OBJS-$(CONFIG_VC1_V4L2M2M_DECODER) += v4l2_m2m_dec.o +OBJS-$(CONFIG_WMV3_V4L2M2M_DECODER) += v4l2_m2m_dec.o OBJS-$(CONFIG_VC2_ENCODER) += vc2enc.o vc2enc_dwt.o diractab.o OBJS-$(CONFIG_VCR1_DECODER) += vcr1.o OBJS-$(CONFIG_VMDAUDIO_DECODER) += vmdaudio.o diff --git a/libavcodec/allcodecs.c b/libavcodec/allcodecs.c index 47eded261f..75552f9525 100644 --- a/libavcodec/allcodecs.c +++ b/libavcodec/allcodecs.c @@ -395,6 +395,7 @@ extern const FFCodec ff_wmv2_encoder; extern const FFCodec ff_wmv2_decoder; extern const FFCodec ff_wmv3_decoder; extern const FFCodec ff_wmv3image_decoder; +extern const FFCodec ff_wmv3_v4l2m2m_decoder; extern const FFCodec ff_wnv1_decoder; extern const FFCodec ff_xan_wc3_decoder; extern const FFCodec ff_xan_wc4_decoder; diff --git a/libavcodec/v4l2_fmt.c b/libavcodec/v4l2_fmt.c index 6df47e3f5a..d8c1494a0d 100644 --- a/libavcodec/v4l2_fmt.c +++ b/libavcodec/v4l2_fmt.c @@ -105,7 +105,10 @@ static const struct fmt_conversion { { AV_FMT(NONE), AV_CODEC(HEVC), V4L2_FMT(HEVC) }, #endif #ifdef V4L2_PIX_FMT_VC1_ANNEX_G - { AV_FMT(NONE), AV_CODEC(VC1), V4L2_FMT(VC1_ANNEX_G) }, + { AV_FMT(NONE), AV_CODEC(WMV3), V4L2_FMT(VC1_ANNEX_G) }, +#endif +#ifdef V4L2_PIX_FMT_VC1_ANNEX_L + { AV_FMT(NONE), AV_CODEC(VC1), V4L2_FMT(VC1_ANNEX_L) }, #endif }; diff --git a/libavcodec/v4l2_m2m_dec.c b/libavcodec/v4l2_m2m_dec.c index ba1fe769e0..cde8135162 100644 --- a/libavcodec/v4l2_m2m_dec.c +++ b/libavcodec/v4l2_m2m_dec.c @@ -264,5 +264,6 @@ M2MDEC(mpeg2, "MPEG2", AV_CODEC_ID_MPEG2VIDEO, NULL); M2MDEC(mpeg4, "MPEG4", AV_CODEC_ID_MPEG4, NULL); M2MDEC(h263, "H.263", AV_CODEC_ID_H263, NULL); M2MDEC(vc1 , "VC1", AV_CODEC_ID_VC1, NULL); +M2MDEC(wmv3, "WMV3", AV_CODEC_ID_WMV3, NULL); M2MDEC(vp8, "VP8", AV_CODEC_ID_VP8, NULL); M2MDEC(vp9, "VP9", AV_CODEC_ID_VP9, NULL); -- 2.52.0

1 0

[PR] WIP: avfilter/vf_overlay: add aarch64 NEON blend_row (yuv420) (PR #23633)
by damitha 29 Jun '26

29 Jun '26

PR #23633 opened by damitha URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23633 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23633.patch Add neon .S implemention of vf_overlay. # Summary of changes Briefly describe what this PR does and why. NEON: - vf_overlay.overlay_row_44 [OK] - vf_overlay.overlay_row_20 [OK] overlay_row_44_c: 64.8 (1.00x) overlay_row_44_neon: 29.1 (2.22x) overlay_row_20_c: 96.9 (1.00x) overlay_row_20_neon: 47.4 (2.05x)  From f952a2697d26190a44194811c531a597867f2f1a Mon Sep 17 00:00:00 2001 From: Damitha Gunawardena <damitha.gunawardena(a)gmail.com> Date: Mon, 29 Jun 2026 12:49:20 +1000 Subject: [PATCH] avfilter/vf_overlay: add aarch64 NEON blend_row (yuv420) Add neon .S implemention of vf_overlay. --- libavfilter/aarch64/Makefile | 2 + libavfilter/aarch64/vf_overlay_init.c | 51 ++++++++ libavfilter/aarch64/vf_overlay_neon.S | 96 ++++++++++++++ libavfilter/vf_overlay.c | 3 + libavfilter/vf_overlay.h | 1 + tests/checkasm/Makefile | 1 + tests/checkasm/checkasm.c | 3 + tests/checkasm/checkasm.h | 1 + tests/checkasm/vf_overlay.c | 172 ++++++++++++++++++++++++++ 9 files changed, 330 insertions(+) create mode 100644 libavfilter/aarch64/vf_overlay_init.c create mode 100644 libavfilter/aarch64/vf_overlay_neon.S create mode 100644 tests/checkasm/vf_overlay.c diff --git a/libavfilter/aarch64/Makefile b/libavfilter/aarch64/Makefile index c7b7e18467..f93c46d242 100644 --- a/libavfilter/aarch64/Makefile +++ b/libavfilter/aarch64/Makefile @@ -1,7 +1,9 @@ OBJS-$(CONFIG_BWDIF_FILTER) += aarch64/vf_bwdif_init_aarch64.o OBJS-$(CONFIG_COLORDETECT_FILTER) += aarch64/vf_colordetect_init.o OBJS-$(CONFIG_NLMEANS_FILTER) += aarch64/vf_nlmeans_init.o +OBJS-$(CONFIG_OVERLAY_FILTER) += aarch64/vf_overlay_init.o NEON-OBJS-$(CONFIG_BWDIF_FILTER) += aarch64/vf_bwdif_neon.o NEON-OBJS-$(CONFIG_COLORDETECT_FILTER) += aarch64/vf_colordetect_neon.o NEON-OBJS-$(CONFIG_NLMEANS_FILTER) += aarch64/vf_nlmeans_neon.o +NEON-OBJS-$(CONFIG_OVERLAY_FILTER) += aarch64/vf_overlay_neon.o diff --git a/libavfilter/aarch64/vf_overlay_init.c b/libavfilter/aarch64/vf_overlay_init.c new file mode 100644 index 0000000000..1e7fb14fcc --- /dev/null +++ b/libavfilter/aarch64/vf_overlay_init.c @@ -0,0 +1,51 @@ +/* + * aarch64 NEON optimizations for the overlay filter (dispatch). + * + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or modify it under + * the terms of the GNU Lesser General Public License as published by the + * Free Software Foundation; either version 2.1, or (at your option) any + * later version. + * + * FFmpeg is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for + * more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with FFmpeg; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <stddef.h> +#include <stdint.h> +#include "libavutil/attributes.h" +#include "libavutil/cpu.h" +#include "libavutil/aarch64/cpu.h" +#include "libavutil/log.h" +#include "libavfilter/vf_overlay.h" + +int ff_overlay_row_44_neon(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); +int ff_overlay_row_20_neon(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); + +av_cold void ff_overlay_init_aarch64(AVFilterContext *ctx) +{ + OverlayContext *s = ctx->priv; + const AVFilterLink *main = ctx->inputs[0]; + const AVFilterLink *overlay = ctx->inputs[1]; + int cpu_flags = av_get_cpu_flags(); + + if (have_neon(cpu_flags) && + main->format == AV_PIX_FMT_YUV420P && + s->format == OVERLAY_FORMAT_YUV420 && + overlay->alpha_mode != AVALPHA_MODE_PREMULTIPLIED && + !s->main_has_alpha) { + s->blend_row[0] = ff_overlay_row_44_neon; + s->blend_row[1] = ff_overlay_row_20_neon; + s->blend_row[2] = ff_overlay_row_20_neon; + av_log(ctx, AV_LOG_VERBOSE, "overlay: aarch64 NEON blend_row enabled (yuv420).\n"); + } +} diff --git a/libavfilter/aarch64/vf_overlay_neon.S b/libavfilter/aarch64/vf_overlay_neon.S new file mode 100644 index 0000000000..a488ffa6f6 --- /dev/null +++ b/libavfilter/aarch64/vf_overlay_neon.S @@ -0,0 +1,96 @@ +/* + * aarch64 NEON overlay blend kernels. + * + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * FFmpeg is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with FFmpeg; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include "libavutil/aarch64/asm.S" + +/* d = FAST_DIV255(d*(255-a) + s*a), FAST_DIV255(x) = ((x+128)*257)>>16 + * uses umull/umlal straight from bytes and uzp2 for the >>16. + * + * int ff_overlay_row_44_neon(uint8_t *d, uint8_t *da, uint8_t *s, + * uint8_t *a, int w, ptrdiff_t alinesize) + * x0=d x1=da(unused) x2=s x3=a w4=w x5=alinesize(unused) + */ +function ff_overlay_row_44_neon, export=1 + mov w6, #0 + cmp w4, #8 + b.lt 2f + movi v6.8b, #0xff // 255 + movi v5.8h, #0x80 // 128 + mov w8, #257 + dup v7.8h, w8 + sub w7, w4, #8 // process while x <= w-8 +1: ldr d0, [x0, x6] // d + ldr d1, [x2, x6] // s + ldr d2, [x3, x6] // a + sub v3.8b, v6.8b, v2.8b // 255 - a + umull v4.8h, v0.8b, v3.8b // d*(255-a) + umlal v4.8h, v1.8b, v2.8b // + s*a + add v4.8h, v4.8h, v5.8h // + 128 + umull v16.4s, v4.4h, v7.h[0] // *257 (lo) + umull2 v17.4s, v4.8h, v7.h[0] // *257 (hi) + uzp2 v4.8h, v16.8h, v17.8h // high 16 of each = >>16 + uqxtn v4.8b, v4.8h + str d4, [x0, x6] + add x6, x6, #8 + cmp w6, w7 + b.le 1b +2: mov w0, w6 + ret +endfunc + +/* chroma 4:2:0: average a 2x2 alpha block per pixel; leave the right-edge + * column to the scalar remainder loop (process while x+8 < w). + * Same args; x5 = alpha linesize (used for the 2nd alpha row). + */ +function ff_overlay_row_20_neon, export=1 + mov w6, #0 + cmp w4, #9 + b.lt 2f + movi v6.8b, #0xff + movi v5.8h, #0x80 + mov w8, #257 + dup v7.8h, w8 + sub w7, w4, #9 +1: add x9, x3, x6, lsl #1 // a + 2*x (row0) + ld1 {v18.16b}, [x9] + add x10, x9, x5 // row1 (+alinesize) + ld1 {v19.16b}, [x10] + uaddlp v18.8h, v18.16b // a[2i]+a[2i+1] + uaddlp v19.8h, v19.16b + add v20.8h, v18.8h, v19.8h // 2x2 sum + ushr v20.8h, v20.8h, #2 // /4 = avg alpha + xtn v2.8b, v20.8h // back to bytes + ldr d0, [x0, x6] // d + ldr d1, [x2, x6] // s + sub v3.8b, v6.8b, v2.8b + umull v4.8h, v0.8b, v3.8b + umlal v4.8h, v1.8b, v2.8b + add v4.8h, v4.8h, v5.8h + umull v16.4s, v4.4h, v7.h[0] + umull2 v17.4s, v4.8h, v7.h[0] + uzp2 v4.8h, v16.8h, v17.8h + uqxtn v4.8b, v4.8h + str d4, [x0, x6] + add x6, x6, #8 + cmp w6, w7 + b.le 1b +2: mov w0, w6 + ret +endfunc diff --git a/libavfilter/vf_overlay.c b/libavfilter/vf_overlay.c index d627db0889..f56e380b82 100644 --- a/libavfilter/vf_overlay.c +++ b/libavfilter/vf_overlay.c @@ -835,6 +835,9 @@ static int init_slice_fn(AVFilterContext *ctx) break; } +#if ARCH_AARCH64 && HAVE_NEON + ff_overlay_init_aarch64(ctx); +#endif #if ARCH_X86 && HAVE_X86ASM ff_overlay_init_x86(ctx); #endif diff --git a/libavfilter/vf_overlay.h b/libavfilter/vf_overlay.h index 22e84362b7..44931b46fd 100644 --- a/libavfilter/vf_overlay.h +++ b/libavfilter/vf_overlay.h @@ -83,5 +83,6 @@ typedef struct OverlayContext { } OverlayContext; void ff_overlay_init_x86(AVFilterContext *ctx); +void ff_overlay_init_aarch64(AVFilterContext *ctx); #endif /* AVFILTER_OVERLAY_H */ diff --git a/tests/checkasm/Makefile b/tests/checkasm/Makefile index bf2d6b7ec2..d7dc00ee32 100644 --- a/tests/checkasm/Makefile +++ b/tests/checkasm/Makefile @@ -77,6 +77,7 @@ AVFILTEROBJS-$(CONFIG_HFLIP_FILTER) += vf_hflip.o AVFILTEROBJS-$(CONFIG_IDET_FILTER) += vf_idet.o AVFILTEROBJS-$(CONFIG_THRESHOLD_FILTER) += vf_threshold.o AVFILTEROBJS-$(CONFIG_NLMEANS_FILTER) += vf_nlmeans.o +AVFILTEROBJS-$(CONFIG_OVERLAY_FILTER) += vf_overlay.o AVFILTEROBJS-$(CONFIG_SOBEL_FILTER) += vf_convolution.o CHECKASMOBJS-$(CONFIG_AVFILTER) += $(AVFILTEROBJS-yes) diff --git a/tests/checkasm/checkasm.c b/tests/checkasm/checkasm.c index 8629f26788..e15e459532 100644 --- a/tests/checkasm/checkasm.c +++ b/tests/checkasm/checkasm.c @@ -339,6 +339,9 @@ static const struct { #if CONFIG_NLMEANS_FILTER { "vf_nlmeans", checkasm_check_nlmeans }, #endif + #if CONFIG_OVERLAY_FILTER + { "vf_overlay", checkasm_check_vf_overlay }, + #endif #if CONFIG_THRESHOLD_FILTER { "vf_threshold", checkasm_check_vf_threshold }, #endif diff --git a/tests/checkasm/checkasm.h b/tests/checkasm/checkasm.h index 43c158e97b..dc770bfa91 100644 --- a/tests/checkasm/checkasm.h +++ b/tests/checkasm/checkasm.h @@ -132,6 +132,7 @@ void checkasm_check_mpegvideo_unquantize(void); void checkasm_check_mpegvideoencdsp(void); void checkasm_check_nlmeans(void); void checkasm_check_opusdsp(void); +void checkasm_check_vf_overlay(void); void checkasm_check_pixblockdsp(void); void checkasm_check_pixelutils(void); void checkasm_check_png(void); diff --git a/tests/checkasm/vf_overlay.c b/tests/checkasm/vf_overlay.c new file mode 100644 index 0000000000..7c6f699c4e --- /dev/null +++ b/tests/checkasm/vf_overlay.c @@ -0,0 +1,172 @@ +/* + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * FFmpeg is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with FFmpeg; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <string.h> +#include "checkasm.h" +#include "libavutil/cpu.h" +#include "libavutil/mem_internal.h" + +#if ARCH_AARCH64 +#include "libavutil/aarch64/cpu.h" +#endif +#if ARCH_X86 +#include "libavutil/x86/cpu.h" +#endif + +/* blend_row signature, see OverlayContext::blend_row in libavfilter/vf_overlay.h */ +typedef int (*blend_row)(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); + +#if ARCH_AARCH64 +int ff_overlay_row_44_neon(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); +int ff_overlay_row_20_neon(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); +#endif +#if ARCH_X86 && HAVE_X86ASM +int ff_overlay_row_44_sse4(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); +int ff_overlay_row_20_sse4(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize); +#endif + +#define FAST_DIV255(x) ((((x) + 128) * 257) >> 16) + +#define WIDTH 359 +#define PAD 32 +/* two alpha samples per output pixel, two rows, plus slack for the SIMD overread */ +#define ASTRIDE (2 * WIDTH + PAD) + +/* straight-alpha blend, one alpha sample per pixel (Y / 4:4:4 plane) */ +static int ref_overlay_row_44(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize) +{ + for (int x = 0; x < w; x++) + d[x] = FAST_DIV255(d[x] * (255 - a[x]) + s[x] * a[x]); + return w; +} + +/* straight-alpha blend, 2x2 averaged alpha per pixel (4:2:0 chroma plane) */ +static int ref_overlay_row_20(uint8_t *d, uint8_t *da, uint8_t *s, uint8_t *a, + int w, ptrdiff_t alinesize) +{ + for (int x = 0; x < w; x++) { + int alpha = (a[2 * x] + a[2 * x + 1] + + a[2 * x + alinesize] + a[2 * x + 1 + alinesize]) >> 2; + d[x] = FAST_DIV255(d[x] * (255 - alpha) + s[x] * alpha); + } + return w; +} + +static blend_row get_row_44(void) +{ + int flags = av_get_cpu_flags(); +#if ARCH_AARCH64 + if (have_neon(flags)) + return ff_overlay_row_44_neon; +#elif ARCH_X86 && HAVE_X86ASM + if (EXTERNAL_SSE4(flags)) + return ff_overlay_row_44_sse4; +#endif + return ref_overlay_row_44; +} + +static blend_row get_row_20(void) +{ + int flags = av_get_cpu_flags(); +#if ARCH_AARCH64 + if (have_neon(flags)) + return ff_overlay_row_20_neon; +#elif ARCH_X86 && HAVE_X86ASM + if (EXTERNAL_SSE4(flags)) + return ff_overlay_row_20_sse4; +#endif + return ref_overlay_row_20; +} + +static void check_row_44(void) +{ + LOCAL_ALIGNED_32(uint8_t, d0, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, src, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, alpha, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, dst_ref, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, dst_new, [WIDTH + PAD]); + + declare_func(int, uint8_t *, uint8_t *, uint8_t *, uint8_t *, int, ptrdiff_t); + + for (int i = 0; i < WIDTH + PAD; i++) { + d0[i] = rnd() & 0xff; + src[i] = rnd() & 0xff; + alpha[i] = rnd() & 0xff; + } + + if (check_func(get_row_44(), "overlay_row_44")) { + for (int w = 1; w <= WIDTH; w++) { + int cref, cnew; + memcpy(dst_ref, d0, WIDTH + PAD); + memcpy(dst_new, d0, WIDTH + PAD); + cref = call_ref(dst_ref, NULL, src, alpha, w, 0); + cnew = call_new(dst_new, NULL, src, alpha, w, 0); + if (cnew > cref || memcmp(dst_ref, dst_new, cnew)) + fail(); + } + memcpy(dst_new, d0, WIDTH + PAD); + bench_new(dst_new, NULL, src, alpha, WIDTH, 0); + } +} + +static void check_row_20(void) +{ + LOCAL_ALIGNED_32(uint8_t, d0, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, src, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, alpha, [2 * ASTRIDE]); + LOCAL_ALIGNED_32(uint8_t, dst_ref, [WIDTH + PAD]); + LOCAL_ALIGNED_32(uint8_t, dst_new, [WIDTH + PAD]); + + declare_func(int, uint8_t *, uint8_t *, uint8_t *, uint8_t *, int, ptrdiff_t); + + for (int i = 0; i < WIDTH + PAD; i++) { + d0[i] = rnd() & 0xff; + src[i] = rnd() & 0xff; + } + for (int i = 0; i < 2 * ASTRIDE; i++) + alpha[i] = rnd() & 0xff; + + if (check_func(get_row_20(), "overlay_row_20")) { + for (int w = 1; w <= WIDTH; w++) { + int cref, cnew; + memcpy(dst_ref, d0, WIDTH + PAD); + memcpy(dst_new, d0, WIDTH + PAD); + cref = call_ref(dst_ref, NULL, src, alpha, w, ASTRIDE); + cnew = call_new(dst_new, NULL, src, alpha, w, ASTRIDE); + if (cnew > cref || memcmp(dst_ref, dst_new, cnew)) + fail(); + } + memcpy(dst_new, d0, WIDTH + PAD); + bench_new(dst_new, NULL, src, alpha, WIDTH, ASTRIDE); + } +} + +void checkasm_check_vf_overlay(void) +{ + check_row_44(); + report("overlay_row_44"); + + check_row_20(); + report("overlay_row_20"); +} -- 2.52.0

1 0

[PR] avutil/hwcontext_vaapi: print DRM device path instead of index in log messages (PR #23632)
by add-uos-ffmpeg 29 Jun '26

29 Jun '26

PR #23632 opened by add-uos-ffmpeg URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23632 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23632.patch The verbose log messages in the DRM device discovery loop currently print the device index (e.g. "device 0") which is not directly useful for debugging since users cannot map the index to the actual device path. Change all log messages to print the full device path (e.g. "/dev/dri/renderD128") via the already-available path variable, consistent with the existing log at line 1780 that already uses %s/path. Also rename the local drmDevicePtr variable from 'device' to 'drm_dev' to avoid shadowing the outer function parameter 'const char *device'. Signed-off-by: zhanghongyuan <zhanghongyuan(a)uniontech.com> # Summary of changes Print DRM device paths instead of numeric indices in VAAPI discovery logs and rename local variable to avoid shadowing function parameter. - Before： ` Trying to use DRM render node for device 0.` - After： `Trying to use DRM render node for device /dev/dri/renderD128.` From be89f3c1716e6cbe2acb0937f2880c397188e2c1 Mon Sep 17 00:00:00 2001 From: zhanghongyuan <zhanghongyuan(a)uniontech.com> Date: Tue, 23 Jun 2026 21:37:31 +0800 Subject: [PATCH] avutil/hwcontext_vaapi: print DRM device path instead of index in log messages The verbose log messages in the DRM device discovery loop currently print the device index (e.g. "device 0") which is not directly useful for debugging since users cannot map the index to the actual device path. Change all log messages to print the full device path (e.g. "/dev/dri/renderD128") via the already-available path variable, consistent with the existing log at line 1780 that already uses %s/path. Also rename the local drmDevicePtr variable from 'device' to 'drm_dev' to avoid shadowing the outer function parameter 'const char *device'. Signed-off-by: zhanghongyuan <zhanghongyuan(a)uniontech.com> --- libavutil/hwcontext_vaapi.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/libavutil/hwcontext_vaapi.c b/libavutil/hwcontext_vaapi.c index 98130f9fb1..e51303b89a 100644 --- a/libavutil/hwcontext_vaapi.c +++ b/libavutil/hwcontext_vaapi.c @@ -1787,77 +1787,77 @@ static int vaapi_device_create(AVHWDeviceContext *ctx, const char *device, "for DRM render node.\n"); } else av_log(ctx, AV_LOG_VERBOSE, "Cannot open " - "DRM render node for device %d.\n", n); + "DRM render node for device %s.\n", path); break; } #if CONFIG_LIBDRM info = drmGetVersion(priv->drm_fd); if (!info) { av_log(ctx, AV_LOG_VERBOSE, - "Failed to get DRM version for device %d.\n", n); + "Failed to get DRM version for device %s.\n", path); close(priv->drm_fd); priv->drm_fd = -1; continue; } if (kernel_driver) { if (strcmp(kernel_driver->value, info->name)) { - av_log(ctx, AV_LOG_VERBOSE, "Ignoring device %d " + av_log(ctx, AV_LOG_VERBOSE, "Ignoring device %s " "with non-matching kernel driver (%s).\n", - n, info->name); + path, info->name); drmFreeVersion(info); close(priv->drm_fd); priv->drm_fd = -1; continue; } av_log(ctx, AV_LOG_VERBOSE, "Trying to use " - "DRM render node for device %d, " + "DRM render node for device %s, " "with matching kernel driver (%s).\n", - n, info->name); + path, info->name); drmFreeVersion(info); break; // drmGetVersion() ensures |info->name| is 0-terminated. } else if (!strcmp(info->name, "vgem")) { av_log(ctx, AV_LOG_VERBOSE, - "Skipping vgem node for device %d.\n", n); + "Skipping vgem node for device %s.\n", path); drmFreeVersion(info); close(priv->drm_fd); priv->drm_fd = -1; continue; } else if (vendor_id) { - drmDevicePtr device; + drmDevicePtr drm_dev; char drm_vendor[8]; - if (drmGetDevice(priv->drm_fd, &device)) { + if (drmGetDevice(priv->drm_fd, &drm_dev)) { av_log(ctx, AV_LOG_VERBOSE, - "Failed to get DRM device info for device %d.\n", n); + "Failed to get DRM device info for device %s.\n", path); close(priv->drm_fd); priv->drm_fd = -1; drmFreeVersion(info); continue; } - snprintf(drm_vendor, sizeof(drm_vendor), "0x%x", device->deviceinfo.pci->vendor_id); + snprintf(drm_vendor, sizeof(drm_vendor), "0x%x", drm_dev->deviceinfo.pci->vendor_id); if (strcmp(vendor_id->value, drm_vendor)) { - av_log(ctx, AV_LOG_VERBOSE, "Ignoring device %d " + av_log(ctx, AV_LOG_VERBOSE, "Ignoring device %s " "with non-matching vendor id (%s).\n", - n, vendor_id->value); - drmFreeDevice(&device); + path, vendor_id->value); + drmFreeDevice(&drm_dev); close(priv->drm_fd); priv->drm_fd = -1; drmFreeVersion(info); continue; } av_log(ctx, AV_LOG_VERBOSE, "Trying to use " - "DRM render node for device %d, " + "DRM render node for device %s, " "with matching vendor id (%s).\n", - n, vendor_id->value); - drmFreeDevice(&device); + path, vendor_id->value); + drmFreeDevice(&drm_dev); drmFreeVersion(info); break; } drmFreeVersion(info); #endif av_log(ctx, AV_LOG_VERBOSE, "Trying to use " - "DRM render node for device %d.\n", n); + "DRM render node for device %s.\n", path); break; } if (n >= max_devices) -- 2.52.0

1 0