January 2025 - FFmpeg-trac - lists.ffmpeg.org

#11396(undetermined:new): filter_complex pipeline "segment; guided; concat" sometimes fails assertion
by FFmpeg 03 Jan '25

03 Jan '25

#11396: filter_complex pipeline "segment;guided;concat" sometimes fails assertion -------------------------------------+------------------------------------- Reporter: breunigs | Type: defect Status: new | Priority: normal Component: | Version: git- undetermined | master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- To reproduce, run the following a couple of times: {{{ ffmpeg -f lavfi -i testsrc2 -f lavfi -i testsrc2 \ -filter_complex '[0]segment=timestamps=10[a][b]; [b][1]guided=guidance=on[c]; [a][c]concat=n=2' \ -f matroska - | \ head >/dev/null }}} It sometimes outputs {{{Assertion mainpic failed at libavfilter/framesync.c:401}}} instead of the expected {{{Conversion failed!}}} I'm not sure why it doesn't reproduce sometimes. Adding {{{-threads 1 -filter_threads 1 -filter_complex_threads 1}}} to the CLI makes no difference, i.e. the bug can still be reproduced sometimes. A full stacktrace for the reproducer looks like this: {{{ #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 #1 0x00007f7d02c9debf in __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78 #2 0x00007f7d02c49c82 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007f7d02c324f0 in __GI_abort () at ./stdlib/abort.c:79 #4 0x00005568e8114f13 in ff_framesync_dualinput_get () at libavfilter/framesync.c:401 #5 0x00005568e81fe551 in process_frame () at libavfilter/vf_guided.c:319 #6 0x00005568e8114d46 in ff_framesync_activate () at libavfilter/framesync.c:364 #7 0x00005568e81feae5 in activate () at libavfilter/vf_guided.c:409 #8 0x00005568e80f6a89 in ff_filter_activate () at libavfilter/avfilter.c:1430 #9 0x00005568e80fc278 in ff_filter_graph_run_once () at libavfilter/avfiltergraph.c:1488 #10 0x00005568e80fdd76 in push_frame () at libavfilter/buffersrc.c:183 #11 0x00005568e80fe560 in av_buffersrc_close () at libavfilter/buffersrc.c:283 #12 0x00005568e80874f4 in send_eof () at fftools/ffmpeg_filter.c:2731 #13 0x00005568e8088443 in filter_thread () at fftools/ffmpeg_filter.c:3039 #14 0x00005568e80a18fd in task_wrapper () at fftools/ffmpeg_sched.c:2534 #15 0x00007f7d02c9c112 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447 #16 0x00007f7d02d1a8f8 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 }}} captured from {{{ ffmpeg version N-118231-g2f4ec16836 Copyright (c) 2000-2025 the FFmpeg developers built with gcc 14 (Debian 14.2.0-6) configuration: --enable-version3 --enable-gpl --enable-frei0r --enable- libx264 --disable-doc --disable-ffplay --disable-ffprobe --enable-debug=1 --disable-stripping --disable-optimizations --extra-cflags='-O0 -g' --extra-ldflags=-g libavutil 59. 54.101 / 59. 54.101 libavcodec 61. 28.100 / 61. 28.100 libavformat 61. 9.104 / 61. 9.104 libavdevice 61. 4.100 / 61. 4.100 libavfilter 10. 6.101 / 10. 6.101 libswscale 8. 13.100 / 8. 13.100 libswresample 5. 4.100 / 5. 4.100 libpostproc 58. 4.100 / 58. 4.100 }}} This fails for a Debian release version (i.e. not built by me) as well: {{{ ffmpeg version 7.1-3 Copyright (c) 2000-2024 the FFmpeg developers built with gcc 14 (Debian 14.2.0-7) configuration: --prefix=/usr --extra-version=3 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --disable-libmfx --disable- omx --enable-gnutls --enable-libaom --enable-libass --enable-libbs2b --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable- libglslang --enable-libgme --enable-libgsm --enable-libharfbuzz --enable- libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-librubberband --enable-libshine --enable- libsnappy --enable-libsoxr --enable-libspeex --enable-libtheora --enable- libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-openal --enable-opencl --enable-opengl --disable-sndio --enable-libvpl --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-ladspa --enable-libbluray --enable-libcaca --enable-libdvdnav --enable-libdvdread --enable-libjack --enable-libpulse --enable-librabbitmq --enable-librist --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libx264 --enable-libzmq --enable-libzvbi --enable-lv2 --enable-sdl2 --enable- libplacebo --enable-librav1e --enable-pocketsphinx --enable-librsvg --enable-libjxl --enable-shared libavutil 59. 39.100 / 59. 39.100 libavcodec 61. 19.100 / 61. 19.100 libavformat 61. 7.100 / 61. 7.100 libavdevice 61. 3.100 / 61. 3.100 libavfilter 10. 4.100 / 10. 4.100 libswscale 8. 3.100 / 8. 3.100 libswresample 5. 3.100 / 5. 3.100 libpostproc 58. 3.100 / 58. 3.100 }}} - I checked as far back as bf0f996c1283731e56a7986a08002baa8ae5064c (~2021-09), which still has this issue. - The issue goes away if not both {{{in[0].before}}} and {{{in[0].after}}} are set to {{{EXT_INFINITY}}}. - I am able to reproduce this outside vf_guided using another (not upstreamed) filter, so it doesn't seem to be strictly related to vf_guided. It's just the only filter that sets before=after=EXT_INFINITY. - shorter timestamps for vf_segment seem to fix the issue, or at least make it very hard to reproduce. I was able to break it with values as low as segment=timestamps=4.99 but not below. - replacing vf_segment with e.g. vf_split "fixes" the issue. So does removing the concat filter (and writing both outputs to files or stdout) - adding a {{{-frames:v 100}}} after the filters also fixes the issue. The number of frames needs to reasonably small, e.g. increasing the frames to 150 already shows the issue for me. -- Ticket URL: <https://trac.ffmpeg.org/ticket/11396> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1

#4591(avformat:new): attachments mjpeg are discovered wrongly as video stream and therefore h264 encoding is broken
by FFmpeg 03 Jan '25

03 Jan '25

#4591: attachments mjpeg are discovered wrongly as video stream and therefore h264 encoding is broken -------------------------------------+------------------------------------- Reporter: TheoMeister | Type: defect Status: new | Priority: important Component: avformat | Version: Keywords: attachments | Blocked By: video | Reproduced by developer: 0 Blocking: | Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: Encoding with libx264 broken since https://github.com/FFmpeg/FFmpeg/commit/511585ce7f7272e5069ef011d6be5f073d2… - reverting this patch makes it working again as before as the attachments are just copied and not h264 encoded (which is not desired). How to reproduce: Take the sample https://sourceforge.net/projects/matroska/files/test_files/cover_art.mkv and issue the following command: {{{ % ffmpeg -i cover_art.mkv -map 0:0 -map 0:1 -map 0:2 -map 0:3 -map 0:4 -map 0:5 -c:a copy -c:s copy -c:t copy -c:v libx264 -profile:v high -level 4.1 cover_art.mkv ffmpeg version 2.6.3 Copyright (c) 2000-2015 the FFmpeg developers built with gcc 4.8 (SUSE Linux) configuration: --shlibdir=/usr/lib64 --prefix=/usr --mandir=/usr/share/man --libdir=/usr/lib64 --enable-shared --disable- static --enable-debug --disable-stripping --extra-cflags='-fmessage- length=0 -grecord-gcc-switches -fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables -fasynchronous-unwind-tables -g' --enable-pic --optflags='-fmessage-length=0 -grecord-gcc-switches -fstack- protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables -fasynchronous- unwind-tables -g' --enable-gpl --enable-x11grab --enable-version3 --enable-pthreads --datadir=/usr/share/ffmpeg --enable-avfilter --enable- libpulse --enable-libwebp --enable-libvpx --enable-libopus --enable- libmp3lame --enable-libvorbis --enable-libtheora --enable-libspeex --enable-libxvid --enable-libx264 --enable-libx265 --enable- libschroedinger --enable-libgsm --enable-libopencore-amrnb --enable- libopencore-amrwb --enable-postproc --enable-libdc1394 --enable-librtmp --enable-libfreetype --enable-avresample --enable-libtwolame --enable- libvo-aacenc --enable-gnutls --enable-libass --enable-frei0r --enable- libcelt --enable-libcdio --enable-ladspa libavutil 54. 20.100 / 54. 20.100 libavcodec 56. 26.100 / 56. 26.100 libavformat 56. 25.101 / 56. 25.101 libavdevice 56. 4.100 / 56. 4.100 libavfilter 5. 11.102 / 5. 11.102 libavresample 2. 1. 0 / 2. 1. 0 libswscale 3. 1.101 / 3. 1.101 libswresample 1. 1.100 / 1. 1.100 libpostproc 53. 3.100 / 53. 3.100 Input #0, matroska,webm, from 'cover_art.mkv': Metadata: encoder : libebml2 v0.12.1 + libmatroska2 v0.11.1 creation_time : 2010-09-23 19:01:57 SAMPLE/TITLE : Trailer COPYRIGHT : ShowTime COPYRIGHT/URL : http://www.sho.com/ track : 5 DATE_RELEASE : 2010 SAMPLE/PART_NUMBER: 0 TITLE : Dexter Season 5 trailer ORIGINAL/URL : http://www.youtube.com/watch?v=CUbCMbW-BRE Duration: 00:02:36.00, start: 0.000000, bitrate: 2024 kb/s Stream #0:0: Audio: aac (LC), 44100 Hz, stereo, fltp (default) Stream #0:1: Video: h264 (High), yuv420p, 1272x720 [SAR 1:1 DAR 53:30], 24 fps, 24 tbr, 1k tbn, 48 tbc (default) Stream #0:2: Video: mjpeg, yuvj444p(pc, bt470bg/unknown/unknown), 600x882 [SAR 300:300 DAR 100:147], 90k tbr, 90k tbn, 90k tbc Metadata: filename : cover.jpg mimetype : image/jpeg Stream #0:3: Video: mjpeg, yuvj444p(pc, bt470bg/unknown/unknown), 120x176 [SAR 300:300 DAR 15:22], 90k tbr, 90k tbn, 90k tbc Metadata: filename : small_cover.jpg mimetype : image/jpeg Stream #0:4: Video: mjpeg, yuvj444p(pc, bt470bg/unknown/unknown), 1067x600 [SAR 96:96 DAR 1067:600], 90k tbr, 90k tbn, 90k tbc Metadata: filename : cover_land.jpg mimetype : image/jpeg Stream #0:5: Video: mjpeg, yuvj444p(pc, bt470bg/unknown/unknown), 213x120 [SAR 96:96 DAR 71:40], 90k tbr, 90k tbn, 90k tbc Metadata: filename : small_cover_land.jpg mimetype : image/jpeg No pixel format specified, yuvj444p for H.264 encoding chosen. Use -pix_fmt yuv420p for compatibility with outdated media players. Last message repeated 3 times [libx264 @ 0x137bbe0] using SAR=1/1 [libx264 @ 0x137bbe0] using cpu capabilities: MMX2 SSE2Fast SSSE3 SSE4.2 [libx264 @ 0x137bbe0] profile High, level 4.1 [libx264 @ 0x137bbe0] 264 - core 142 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=6 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=24 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00 x264 [error]: high profile doesn't support 4:4:4 [libx264 @ 0x1373060] Error setting profile high. [libx264 @ 0x1373060] Possible profiles: baseline main high high10 high422 high444 Output #0, matroska, to '/tmp/cover_art1.mkv': Metadata: encoder : libebml2 v0.12.1 + libmatroska2 v0.11.1 ORIGINAL/URL : http://www.youtube.com/watch?v=CUbCMbW-BRE SAMPLE/TITLE : Trailer COPYRIGHT : ShowTime COPYRIGHT/URL : http://www.sho.com/ track : 5 DATE_RELEASE : 2010 SAMPLE/PART_NUMBER: 0 TITLE : Dexter Season 5 trailer Stream #0:0: Audio: aac, 44100 Hz, stereo (default) Stream #0:1: Video: h264 (libx264), yuv420p, 1272x720 [SAR 1:1 DAR 53:30], q=-1--1, 24 fps, 24 tbn, 24 tbc (default) Metadata: encoder : Lavc56.26.100 libx264 Stream #0:2: Video: h264, none, q=2-31, 128 kb/s, SAR 300:300 DAR 0:0, 90k fps Metadata: filename : cover.jpg mimetype : image/jpeg encoder : Lavc56.26.100 libx264 Stream #0:3: Video: h264, none, q=2-31, 128 kb/s, SAR 300:300 DAR 0:0, 90k fps Metadata: filename : small_cover.jpg mimetype : image/jpeg encoder : Lavc56.26.100 libx264 Stream #0:4: Video: h264, none, q=2-31, 128 kb/s, SAR 96:96 DAR 0:0, 90k fps Metadata: filename : cover_land.jpg mimetype : image/jpeg encoder : Lavc56.26.100 libx264 Stream #0:5: Video: h264, none, q=2-31, 128 kb/s, SAR 96:96 DAR 0:0, 90k fps Metadata: filename : small_cover_land.jpg mimetype : image/jpeg encoder : Lavc56.26.100 libx264 Stream mapping: Stream #0:0 -> #0:0 (copy) Stream #0:1 -> #0:1 (h264 (native) -> h264 (libx264)) Stream #0:2 -> #0:2 (mjpeg (native) -> h264 (libx264)) Stream #0:3 -> #0:3 (mjpeg (native) -> h264 (libx264)) Stream #0:4 -> #0:4 (mjpeg (native) -> h264 (libx264)) Stream #0:5 -> #0:5 (mjpeg (native) -> h264 (libx264)) Error while opening encoder for output stream #0:2 - maybe incorrect parameters such as bit_rate, rate, width or height }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/4591> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 12

#11389(avformat:new): heap-buffer-overflow at libavformat/dump.c:792:34 on ffmpeg
by FFmpeg 03 Jan '25

03 Jan '25

#11389: heap-buffer-overflow at libavformat/dump.c:792:34 on ffmpeg ----------------------------------+-------------------------------------- Reporter: 0x20z | Type: defect Status: new | Priority: important Component: avformat | Version: git-master Keywords: bugs | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ----------------------------------+-------------------------------------- Summary of the bug: Dear developers, I discovered a heap overflow vulnerability while using format conversion. The POC file is attached to the session, and the version of ffmpeg is N-118197-gbb85423142, master branch. please confirm. How to reproduce: {{{ git clone https://github.com/FFmpeg/FFmpeg.git cd FFmpeg ./configure --cc=clang --cxx=clang++ --toolchain=clang-asan --extra- cflags="-I$HOME/ffmpeg_build/include -O0 -fno-omit-frame-pointer -g" --extra-cxxflags="-O0 -fno-omit-frame-pointer -g" --extra- ldflags="-L$HOME/ffmpeg_build/include -fsanitize=address -fsanitize=undefined -lubsan" --disable-optimizations --disable-stripping --enable-cross-compile make -j30 }}} ASAN log: {{{ ================================================================= ==1366945==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x613000001db8 at pc 0x5c82931d7ca9 bp 0x7ffc11d48a90 sp 0x7ffc11d48a88 READ of size 8 at 0x613000001db8 thread T0 #0 0x5c82931d7ca8 (FFmpeg/ffmpeg+0x13f0ca8) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #1 0x5c82927865a3 (FFmpeg/ffmpeg+0x99f5a3) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #2 0x5c82927c8e0b (FFmpeg/ffmpeg+0x9e1e0b) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #3 0x5c82927f60ef (FFmpeg/ffmpeg+0xa0f0ef) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #4 0x7ee34e629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #5 0x7ee34e629e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #6 0x5c82926b7ce4 (FFmpeg/ffmpeg+0x8d0ce4) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) 0x613000001db8 is located 0 bytes to the right of 376-byte region [0x613000001c40,0x613000001db8) allocated by thread T0 here: #0 0x5c829273af56 in realloc (FFmpeg/ffmpeg+0x953f56) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #1 0x5c82934420cd (FFmpeg/ffmpeg+0x165b0cd) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #2 0x5c82931b05e8 (FFmpeg/ffmpeg+0x13c95e8) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #3 0x5c8292783233 (FFmpeg/ffmpeg+0x99c233) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #4 0x5c82927c8e0b (FFmpeg/ffmpeg+0x9e1e0b) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #5 0x5c82927f60ef (FFmpeg/ffmpeg+0xa0f0ef) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) #6 0x7ee34e629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-buffer-overflow (FFmpeg/ffmpeg+0x13f0ca8) (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c) Shadow bytes around the buggy address: 0x0c267fff8360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c267fff8370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa 0x0c267fff8380: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c267fff8390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff83a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c267fff83b0: 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa 0x0c267fff83c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c267fff83d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c267fff83e0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c267fff83f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c267fff8400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1366945==ABORTING }}} ffmpeg version: {{{ # ./ffmpeg -version ffmpeg version N-118197-gbb85423142 Copyright (c) 2000-2024 the FFmpeg developers built with Ubuntu clang version 14.0.0-1ubuntu1.1 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-asan --enable-cross-compile libavutil 59. 53.100 / 59. 53.100 libavcodec 61. 28.100 / 61. 28.100 libavformat 61. 9.102 / 61. 9.102 libavdevice 61. 4.100 / 61. 4.100 libavfilter 10. 6.101 / 10. 6.101 libswscale 8. 13.100 / 8. 13.100 libswresample 5. 4.100 / 5. 4.100 }}} Found by： {{{ Found by 0x20z }}} Thank you for your time and attention -- Ticket URL: <https://trac.ffmpeg.org/ticket/11389> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#10150(undetermined:new): Variable framerate with a maximum value
by FFmpeg 03 Jan '25

03 Jan '25

#10150: Variable framerate with a maximum value -------------------------------------+------------------------------------- Reporter: Zoont | Type: defect Status: new | Priority: important Component: | Version: git- undetermined | master Keywords: fps | Blocked By: framerate vfr cfr vsync | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: I have been using the -fps_mode option together with -fps_max to to allow my videos to have variable framerate while at the same time limiting it to 30 fps, similar to how handbrake have a peak framerate setting. But now when I do that it gives this error message "//One of -r/-fpsmax was specified together a non-CFR -vsync/-fps_mode. This is contradictory.//". I found out that this was a recent change, specifically [https://github.com/FFmpeg/FFmpeg/commit/260f3918937463f1b90e1b77cba80b917f3… This] commit on git master. The description of this commit talks about how -r should always give constant framerate but it doesn't talk about -fpsmax. If this is intentional I would like to know how to achieve something like handbrake's peak framerate option with ffmpeg with this new restriction. Thanks in advance! How to reproduce: {{{ % ffmpeg -i input -fps_mode vfr -fpsmax 30 -c:v libx264 -crf 20 -c:a copy output ffmpeg version git-master built on 22/1/2023 }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10150> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 7

#11367(undetermined:new): Chroma artefacts on decoded VVC streams
by FFmpeg 02 Jan '25

02 Jan '25

#11367: Chroma artefacts on decoded VVC streams --------------------------------------+---------------------------------- Reporter: Elie Mora | Type: defect Status: new | Priority: normal Component: undetermined | Version: 7.1 Keywords: vvc | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | --------------------------------------+---------------------------------- Some chroma artefacts appear on decoded VVC streams using ffmpeg (or ffplay). The artefacts do not appear using the reference VTM model (tested on VTM-23.3) nor with any VVC-compatible stream analyzer. How to reproduce: {{{ % ffmpeg -i Visual720p_QP5000000.BIN visual_1280x720.yuv ffplay version 7.1-full_build-www.gyan.dev Copyright (c) 2003-2024 the FFmpeg developers built with gcc 14.2.0 (Rev1, Built by MSYS2 project) }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11367> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 7

#11392(avfilter:new): Null pointer dereference on malformed buffersink expression in filter graph
by FFmpeg 01 Jan '25

01 Jan '25

#11392: Null pointer dereference on malformed buffersink expression in filter graph -------------------------------------+------------------------------------- Reporter: somehacker | Type: defect Status: new | Priority: minor Component: avfilter | Version: git- Keywords: null | master avfilter filter filters | Blocked By: Blocking: | Reproduced by developer: 1 Analyzed by developer: 1 | -------------------------------------+------------------------------------- Summary of the bug: There is a null pointer dereference introduced in commit b8bf2f4e1758a9f7f34160245b5f663d53159c2d when parsing a specially crafted filter graphs involving buffersinks. How to reproduce: {{{ % ffmpeg -i input -vf "abuffersink=::a" output ffmpeg version git-2024-12-27-5f38c82 Copyright (c) 2000-2024 the FFmpeg developers built with gcc 13 (Ubuntu 13.3.0-6ubuntu2~24.04) configuration: libavutil 59. 53.100 / 59. 53.100 libavcodec 61. 28.100 / 61. 28.100 libavformat 61. 9.102 / 61. 9.102 libavdevice 61. 4.100 / 61. 4.100 libavfilter 10. 6.101 / 10. 6.101 libswscale 8. 13.100 / 8. 13.100 libswresample 5. 4.100 / 5. 4.100 built on Description: Ubuntu 24.04.1 LTS (windows WSL) }}} This bug occurs regardless of the contents of the input file as the bug is in the processing of the filter graph command line argument. I discovered this bug via fuzzing the filter graph parsing. I wrote up a report of that here in a blog post: https://personnumber3377.github.io/projects/fuzzing_ffmpeg_avfilter_graph_p… #fixing-the-fuzzer . This bug is caused by this commit: https://github.com/FFmpeg/FFmpeg/commit/b8bf2f4e1758a9f7f34160245b5f663d531… because I tried with the previous commit and it did not crash with the same input. In the same blog post I also described my development of a fuzzer for these filter graphs, because looking at the codebase there doesn't appear to be such a fuzzer for filter graphs. Here is the output from my fuzzer: {{{ oof@elskun-lppri:~/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign$ ./target_graph_fuzzer final.bin INFO: Running with entropic power schedule (0xFF, 100). INFO: Seed: 1544958777 INFO: Loaded 1 modules (1514265 inline 8-bit counters): 1514265 [0x564dd6f9bc38, 0x564dd710d751), INFO: Loaded 1 PC tables (1514265 PCs): 1514265 [0x564dd710d758,0x564dd88288e8), ./target_graph_fuzzer: Running 1 inputs 1 time(s) each. Running: final.bin [Parsed_abuffersink_0 @ 0x511000000180] The "sample_fmts" option is deprecated: set the supported sample formats [Parsed_abuffersink_0 @ 0x511000000180] The "sample_rates" option is deprecated: set the supported sample rates [Parsed_abuffersink_0 @ 0x511000000180] The "ch_layouts" option is deprecated: set a '|'-separated list of supported channel layouts libavfilter/buffersink.c:208:25: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavfilter/buffersink.c:208:25 libavfilter/buffersink.c:208:24: runtime error: null pointer passed as argument 1, which is declared to never be null /usr/include/string.h:61:62: note: nonnull attribute specified here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavfilter/buffersink.c:208:24 AddressSanitizer:DEADLYSIGNAL ================================================================= ==459309==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fa74f5ce500 bp 0x7ffe69af11f0 sp 0x7ffe69af09b8 T0) ==459309==The signal is caused by a WRITE memory access. ==459309==Hint: address points to the zero page. #0 0x7fa74f5ce500 in __memset_avx2_unaligned_erms string/../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:378 #1 0x564dd174729e in __asan_memset (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x41ee29e) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) #2 0x564dd147507d in common_init /home/oof/ffmpegfuzzerthing/myfork/FFmpeg/libavfilter/buffersink.c:208:17 #3 0x564dd1964a90 in avfilter_init_dict /home/oof/ffmpegfuzzerthing/myfork/FFmpeg/libavfilter/avfilter.c:939:15 #4 0x564dd17e82ab in avfilter_graph_segment_init /home/oof/ffmpegfuzzerthing/myfork/FFmpeg/libavfilter/graphparser.c:634:19 #5 0x564dd17ecabc in avfilter_graph_parse_ptr /home/oof/ffmpegfuzzerthing/myfork/FFmpeg/libavfilter/graphparser.c:948:11 #6 0x564dd1787bae in LLVMFuzzerTestOneInput /home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/target_graph_fuzzer.c:104:11 #7 0x564dd1695174 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x413c174) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) #8 0x564dd167e2a6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x41252a6) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) #9 0x564dd1683d5a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x412ad5a) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) #10 0x564dd16ae516 in main (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x4155516) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) #11 0x7fa74f46f1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #12 0x7fa74f46f28a in __libc_start_main csu/../csu/libc-start.c:360:3 #13 0x564dd1678e74 in _start (/home/oof/ffmpegfuzzerthing/myfork/FFmpeg/tools/fuzzingcampaign/target_graph_fuzzer+0x411fe74) (BuildId: c1e736a748ca18c0ca919e9db2eaf1561ad2f67a) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/memset- vec-unaligned-erms.S:378 in __memset_avx2_unaligned_erms ==459309==ABORTING }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/11392> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1

#5553(undetermined:new): IFF ANIM: support anims with sound
by FFmpeg 01 Jan '25

01 Jan '25

#5553: IFF ANIM: support anims with sound -------------------------------------+------------------------------------- Reporter: ami_stuff | Owner: Type: defect | Status: new Priority: normal | Component: Version: | undetermined unspecified | Keywords: Blocked By: | Blocking: Reproduced by developer: 0 | Analyzed by developer: 0 -------------------------------------+------------------------------------- more samples are here: https://www.datafilehost.com/d/ffed7001 {{{ C:\>ffmpeg -i EntWarp.sndanim out.avi ffmpeg version 3.0.git Copyright (c) 2000-2016 the FFmpeg developers built with gcc 4.6.2 (GCC) configuration: --disable-pthreads --enable-gpl --disable-ffprobe libavutil 55. 24.100 / 55. 24.100 libavcodec 57. 40.100 / 57. 40.100 libavformat 57. 36.100 / 57. 36.100 libavdevice 57. 0.101 / 57. 0.101 libavfilter 6. 45.100 / 6. 45.100 libswscale 4. 1.100 / 4. 1.100 libswresample 2. 0.101 / 2. 0.101 libpostproc 54. 0.100 / 54. 0.100 [iff @ 021ad1a0] Warning: not compiled with thread support, using thread emulati on Input #0, iff, from 'EntWarp.sndanim': Duration: N/A, bitrate: N/A Stream #0:0: Video: iff_ilbm (ANIM / 0x4D494E41), rgb0, 352x282, 20 fps, 60 tbr, 60 tbn [iff @ 02538c00] Warning: not compiled with thread support, using thread emulati on [mpeg4 @ 025af5c0] Warning: not compiled with thread support, using thread emula tion [avi @ 025380e0] Using AVStream.codec to pass codec parameters to muxers is depr ecated, use AVStream.codecpar instead. Output #0, avi, to 'out.avi': Metadata: ISFT : Lavf57.36.100 Stream #0:0: Video: mpeg4 (FMP4 / 0x34504D46), yuv420p, 352x282, q=2-31, 200 kb/s, 60 fps, 60 tbn Metadata: encoder : Lavc57.40.100 mpeg4 Side data: cpb: bitrate max/min/avg: 0/0/200000 buffer size: 0 vbv_delay: -1 Stream mapping: Stream #0:0 -> #0:0 (iff_ilbm (iff) -> mpeg4 (native)) Press [q] to stop, [?] for help [mpeg4 @ 025af5c0] ignoring invalid SAR: 0/0 Last message repeated 50 times frame= 51 fps=0.0 q=8.3 Lsize= 57kB time=00:00:02.71 bitrate= 172.7kbits/ s speed=34.8x video:48kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing ov erhead: 19.627884% }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/5553> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 6