From f459c56b0fe3b35f1e21951791df0f111d1dbbcf Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Tue, 24 Sep 2024 18:21:05 +0200 Subject: [PATCH 001/290] tests/fate/hevc: use bitexact scaling flags for fate-hevc-mv-switch Makes the results consistent across platforms. (cherry picked from commit 9dc0edd4546bebfa451233b12548a8caa4a399ab) Signed-off-by: Anton Khirnov --- tests/fate/hevc.mak | 2 +- tests/ref/fate/hevc-mv-switch | 296 +++++++++++++++++----------------- 2 files changed, 149 insertions(+), 149 deletions(-) diff --git a/tests/fate/hevc.mak b/tests/fate/hevc.mak index 6d8865ea66..7f7ec43902 100644 --- a/tests/fate/hevc.mak +++ b/tests/fate/hevc.mak @@ -283,7 +283,7 @@ $(TARGET_SAMPLES)/hevc-conformance/LS_A_Orange_2.bit|$\ $(TARGET_SAMPLES)/hevc/mv_nuh_layer_id.bit|$\ $(TARGET_SAMPLES)/hevc-conformance/NoOutPrior_B_Qualcomm_1.bit|$\ $(TARGET_SAMPLES)/hevc-conformance/MVHEVCS_A.bit -fate-hevc-mv-switch: CMD = framecrc -i "concat:$(INPUT)" -fps_mode passthrough -map 0:vidx:0 -map 0:vidx:1 +fate-hevc-mv-switch: CMD = framecrc -i "concat:$(INPUT)" -fps_mode passthrough -map 0:vidx:0 -map 0:vidx:1 -sws_flags +accurate_rnd+bitexact FATE_HEVC-$(call FRAMECRC, HEVC, HEVC, CONCAT_PROTOCOL) += fate-hevc-mv-switch # multiview stream, select view by position diff --git a/tests/ref/fate/hevc-mv-switch b/tests/ref/fate/hevc-mv-switch index 0fc3630637..40d7f29ad2 100644 --- a/tests/ref/fate/hevc-mv-switch +++ b/tests/ref/fate/hevc-mv-switch @@ -17,156 +17,156 @@ 0, 6, 6, 1, 149760, 0x2eacf616 0, 7, 7, 1, 149760, 0x06322ce2 0, 8, 8, 1, 149760, 0xf14aa104 -0, 9, 9, 1, 149760, 0xc948dcba +0, 9, 9, 1, 149760, 0x9e1cf00a 1, 10, 10, 1, 24576, 0xf8f638da -0, 11, 11, 1, 149760, 0x674e34b1 +0, 11, 11, 1, 149760, 0x6d584d2c 1, 12, 12, 1, 24576, 0xd22675a4 -0, 13, 13, 1, 149760, 0x41d3acd6 +0, 13, 13, 1, 149760, 0x8b21be89 1, 14, 14, 1, 24576, 0x60da42e6 -0, 15, 15, 1, 149760, 0x55a5b835 +0, 15, 15, 1, 149760, 0x3946d0ec 1, 16, 16, 1, 24576, 0xe0577f6e -0, 17, 17, 1, 149760, 0xc6958049 +0, 17, 17, 1, 149760, 0x70859214 1, 18, 18, 1, 24576, 0x8d9944bd -0, 19, 19, 1, 149760, 0x94b37050 -0, 20, 20, 1, 149760, 0xed72a560 -0, 21, 21, 1, 149760, 0xd0ccac61 -0, 22, 22, 1, 149760, 0x6cc2d7fa -0, 23, 23, 1, 149760, 0x3a02b5ba -0, 24, 24, 1, 149760, 0xce7ef09c -0, 25, 25, 1, 149760, 0xa518fc05 -0, 26, 26, 1, 149760, 0x01d238fe -0, 27, 27, 1, 149760, 0x5f5012fa -0, 28, 28, 1, 149760, 0x5b8e7405 -0, 29, 29, 1, 149760, 0xcc2e5b33 -0, 30, 30, 1, 149760, 0x590a6890 -0, 31, 31, 1, 149760, 0x9c7b189f -0, 32, 32, 1, 149760, 0xd0752ef4 -0, 33, 33, 1, 149760, 0x367513ce -0, 34, 34, 1, 149760, 0xb64c209d -0, 35, 35, 1, 149760, 0x6e50994c -0, 36, 36, 1, 149760, 0x8276cce4 -0, 37, 37, 1, 149760, 0xb292ac8f -0, 38, 38, 1, 149760, 0x57de9d2c -0, 39, 39, 1, 149760, 0xe8533f38 -0, 40, 40, 1, 149760, 0xde9b536d -0, 41, 41, 1, 149760, 0x83173b1d -0, 42, 42, 1, 149760, 0x853a83a4 -0, 43, 43, 1, 149760, 0x481af1bf -0, 44, 44, 1, 149760, 0x27221abb -0, 45, 45, 1, 149760, 0x094eac00 -0, 46, 46, 1, 149760, 0x3f3a27c8 -0, 47, 47, 1, 149760, 0x8f19b2af -0, 48, 48, 1, 149760, 0x93e7e591 -0, 49, 49, 1, 149760, 0x0c531ab8 -0, 50, 50, 1, 149760, 0x3456ef8a -0, 51, 51, 1, 149760, 0xfee2ec1e -0, 52, 52, 1, 149760, 0x76b4b750 -0, 53, 53, 1, 149760, 0xa48bb670 -0, 54, 54, 1, 149760, 0x3dee7cac -0, 55, 55, 1, 149760, 0x2b20561d -0, 56, 56, 1, 149760, 0xd3c5bf9f -0, 57, 57, 1, 149760, 0x2e87d747 -0, 58, 58, 1, 149760, 0x9952760b -0, 59, 59, 1, 149760, 0xa3f5cbda -0, 60, 60, 1, 149760, 0x56e3f94d -0, 61, 61, 1, 149760, 0x902f743f -0, 62, 62, 1, 149760, 0xeffcfd85 -0, 63, 63, 1, 149760, 0xe7fc31b2 -0, 64, 64, 1, 149760, 0x2e876286 -0, 65, 65, 1, 149760, 0x6358b0b2 -0, 66, 66, 1, 149760, 0x3e569a4d -1, 67, 67, 1, 24576, 0xa18c481f -0, 68, 68, 1, 149760, 0x641cbce0 -1, 69, 69, 1, 24576, 0x9ee94df2 -0, 70, 70, 1, 149760, 0x0357d35c -1, 71, 71, 1, 24576, 0x60c55365 -0, 72, 72, 1, 149760, 0xe9b5b077 -1, 73, 73, 1, 24576, 0x8951536a -0, 74, 74, 1, 149760, 0x3b9c605f -1, 75, 75, 1, 24576, 0xfea04ba5 -0, 76, 76, 1, 149760, 0x16d7028b -1, 77, 77, 1, 24576, 0x78094226 -0, 78, 78, 1, 149760, 0xf4896eff -1, 79, 79, 1, 24576, 0xacf9314e -0, 80, 80, 1, 149760, 0xc90de4b9 -1, 81, 81, 1, 24576, 0x6a6b1c87 -0, 82, 82, 1, 149760, 0x2ec258ad -1, 83, 83, 1, 24576, 0x9f360661 -0, 84, 84, 1, 149760, 0x3bf720ef -1, 85, 85, 1, 24576, 0x52e80514 -0, 86, 86, 1, 149760, 0x67eab73f -1, 87, 87, 1, 24576, 0xe10df48c -0, 88, 88, 1, 149760, 0x020e17ce -1, 89, 89, 1, 24576, 0x71fbdd03 -0, 90, 90, 1, 149760, 0xcd677640 -1, 91, 91, 1, 24576, 0x1d08c3f6 -0, 92, 92, 1, 149760, 0x194cfbc1 -1, 93, 93, 1, 24576, 0x4b93b6ca -0, 94, 94, 1, 149760, 0x740f6261 -1, 95, 95, 1, 24576, 0x0dea9c12 -0, 96, 96, 1, 149760, 0x104b3175 -1, 97, 97, 1, 24576, 0x195a92da -0, 98, 98, 1, 149760, 0xc8fd17d1 -1, 99, 99, 1, 24576, 0x55dd870b -0, 100, 100, 1, 149760, 0x6f4e7787 -1, 101, 101, 1, 24576, 0x7e6b905b -0, 102, 102, 1, 149760, 0xe853418e -1, 103, 103, 1, 24576, 0x0f3fad1d -0, 104, 104, 1, 149760, 0x3dba3e4e -1, 105, 105, 1, 24576, 0xe724d536 -0, 106, 106, 1, 149760, 0xba0b4c38 -1, 107, 107, 1, 24576, 0xb212fed4 -0, 108, 108, 1, 149760, 0x28f8ef1d -1, 109, 109, 1, 24576, 0x3bb423ce -0, 110, 110, 1, 149760, 0xb5d92e4e -1, 111, 111, 1, 24576, 0x20f432db -0, 112, 112, 1, 149760, 0xbaa0d0a2 -1, 113, 113, 1, 24576, 0x27412981 -0, 114, 114, 1, 149760, 0x0acde200 -1, 115, 115, 1, 24576, 0xb7f70143 -0, 116, 116, 1, 149760, 0x7388aad3 -1, 117, 117, 1, 24576, 0xf31acffb -0, 118, 118, 1, 149760, 0xbac95723 -1, 119, 119, 1, 24576, 0x283d8c2c -0, 120, 120, 1, 149760, 0x7633d4af -1, 121, 121, 1, 24576, 0x9fb08184 -0, 122, 122, 1, 149760, 0x836e54fc -1, 123, 123, 1, 24576, 0x09696ad1 -0, 124, 124, 1, 149760, 0x49096e63 -1, 125, 125, 1, 24576, 0x034e69c2 -0, 126, 126, 1, 149760, 0x98e14158 -1, 127, 127, 1, 24576, 0x1ce4882c -0, 128, 128, 1, 149760, 0x955a43e4 -1, 129, 129, 1, 24576, 0x490fda13 -0, 130, 130, 1, 149760, 0x3a76c087 -1, 131, 131, 1, 24576, 0x4c2e1c09 -0, 132, 132, 1, 149760, 0xa221e763 -1, 133, 133, 1, 24576, 0x82dd5f8b -0, 134, 134, 1, 149760, 0x1eb33f17 -1, 135, 135, 1, 24576, 0xcfb07d6b -0, 136, 136, 1, 149760, 0x13ef3914 -1, 137, 137, 1, 24576, 0xef468129 -0, 138, 138, 1, 149760, 0x2521b880 -1, 139, 139, 1, 24576, 0x24c970fa -0, 140, 140, 1, 149760, 0x78a4faf0 -1, 141, 141, 1, 24576, 0x6df14e99 -0, 142, 142, 1, 149760, 0xc5f71d65 -1, 143, 143, 1, 24576, 0x78f44854 -0, 144, 144, 1, 149760, 0x5dbc0a9f -1, 145, 145, 1, 24576, 0x5a7269fd -0, 146, 146, 1, 149760, 0x8ebfd7c3 -1, 147, 147, 1, 24576, 0xb1fd8924 -0, 148, 148, 1, 149760, 0xb45f0581 -1, 149, 149, 1, 24576, 0xa165b829 -0, 150, 150, 1, 149760, 0x3b84540b -1, 151, 151, 1, 24576, 0x694cf0e5 -0, 152, 152, 1, 149760, 0xec921f35 -1, 153, 153, 1, 24576, 0x2fef157b -0, 154, 154, 1, 149760, 0x7b23826a -1, 155, 155, 1, 24576, 0x62ea25dd -0, 156, 156, 1, 149760, 0x518d1f11 -1, 157, 157, 1, 24576, 0xfc02365e -0, 158, 158, 1, 149760, 0xc5e694a4 -1, 159, 159, 1, 24576, 0x073b3ebd -0, 160, 160, 1, 149760, 0xeb79c961 -1, 161, 161, 1, 24576, 0x5ee13be2 +0, 19, 19, 1, 149760, 0xd60e93f1 +0, 20, 20, 1, 149760, 0xb07cc873 +0, 21, 21, 1, 149760, 0x86eacff5 +0, 22, 22, 1, 149760, 0x259afb24 +0, 23, 23, 1, 149760, 0x225dd819 +0, 24, 24, 1, 149760, 0xfc47134c +0, 25, 25, 1, 149760, 0x15da1ece +0, 26, 26, 1, 149760, 0xb2ec5b6f +0, 27, 27, 1, 149760, 0xa18f35c6 +0, 28, 28, 1, 149760, 0x8fa8970f +0, 29, 29, 1, 149760, 0x25a87e60 +0, 30, 30, 1, 149760, 0x77c88c93 +0, 31, 31, 1, 149760, 0xcb673be3 +0, 32, 32, 1, 149760, 0x219f51e6 +0, 33, 33, 1, 149760, 0x59ea3783 +0, 34, 34, 1, 149760, 0x837644b5 +0, 35, 35, 1, 149760, 0x9b62bc7c +0, 36, 36, 1, 149760, 0xbb32efa8 +0, 37, 37, 1, 149760, 0x1a1bcf3f +0, 38, 38, 1, 149760, 0x9673c0e1 +0, 39, 39, 1, 149760, 0x7c6461e2 +0, 40, 40, 1, 149760, 0x0551768c +0, 41, 41, 1, 149760, 0xa5ce5d3a +0, 42, 42, 1, 149760, 0xe9caa587 +0, 43, 43, 1, 149760, 0xf38613ea +0, 44, 44, 1, 149760, 0x02083cce +0, 45, 45, 1, 149760, 0xd5f0ce4e +0, 46, 46, 1, 149760, 0xb9ed49cd +0, 47, 47, 1, 149760, 0xdbe0d518 +0, 48, 48, 1, 149760, 0x80f607ca +0, 49, 49, 1, 149760, 0x9f7e3d36 +0, 50, 50, 1, 149760, 0x7f73121f +0, 51, 51, 1, 149760, 0x4cff0e8b +0, 52, 52, 1, 149760, 0x638dd91d +0, 53, 53, 1, 149760, 0xe28dd86b +0, 54, 54, 1, 149760, 0xc2b89e3a +0, 55, 55, 1, 149760, 0xe8b67842 +0, 56, 56, 1, 149760, 0xc69fe16f +0, 57, 57, 1, 149760, 0xb8b5f913 +0, 58, 58, 1, 149760, 0x5fac972a +0, 59, 59, 1, 149760, 0x0306ed25 +0, 60, 60, 1, 149760, 0x94271af0 +0, 61, 61, 1, 149760, 0x11b795df +0, 62, 62, 1, 149760, 0x8f651e3e +0, 63, 63, 1, 149760, 0xdfb452f9 +0, 64, 64, 1, 149760, 0x686e83ff +0, 65, 65, 1, 149760, 0x56ced1b4 +0, 66, 66, 1, 149760, 0x8df69755 +1, 67, 67, 1, 24576, 0xa82c4bc6 +0, 68, 68, 1, 149760, 0x5245b9f0 +1, 69, 69, 1, 24576, 0x2d9451db +0, 70, 70, 1, 149760, 0x957cd0e6 +1, 71, 71, 1, 24576, 0x8b4b56c9 +0, 72, 72, 1, 149760, 0x1b01adc7 +1, 73, 73, 1, 24576, 0x4664573a +0, 74, 74, 1, 149760, 0xea035d18 +1, 75, 75, 1, 24576, 0x3f3d4f5a +0, 76, 76, 1, 149760, 0x965affa4 +1, 77, 77, 1, 24576, 0xaf034600 +0, 78, 78, 1, 149760, 0xa1456bd2 +1, 79, 79, 1, 24576, 0x7f5d3504 +0, 80, 80, 1, 149760, 0x5291e254 +1, 81, 81, 1, 24576, 0x59562099 +0, 82, 82, 1, 149760, 0xd97f564a +1, 83, 83, 1, 24576, 0xd8a609de +0, 84, 84, 1, 149760, 0x91a61e7f +1, 85, 85, 1, 24576, 0xcf5008ca +0, 86, 86, 1, 149760, 0xa268b503 +1, 87, 87, 1, 24576, 0x2c4af809 +0, 88, 88, 1, 149760, 0xd01c152d +1, 89, 89, 1, 24576, 0x8366e0e1 +0, 90, 90, 1, 149760, 0xbe51742d +1, 91, 91, 1, 24576, 0x381cc7e9 +0, 92, 92, 1, 149760, 0x15d4f93b +1, 93, 93, 1, 24576, 0x576bbadd +0, 94, 94, 1, 149760, 0x4a755f1b +1, 95, 95, 1, 24576, 0x3516a052 +0, 96, 96, 1, 149760, 0x630d2e54 +1, 97, 97, 1, 24576, 0xd9489703 +0, 98, 98, 1, 149760, 0x1c4c14cd +1, 99, 99, 1, 24576, 0xa84f8afa +0, 100, 100, 1, 149760, 0x831a7510 +1, 101, 101, 1, 24576, 0x4d32945c +0, 102, 102, 1, 149760, 0x9aac3ee7 +1, 103, 103, 1, 24576, 0x6b14b0d7 +0, 104, 104, 1, 149760, 0xd50d3baa +1, 105, 105, 1, 24576, 0xb05dd8b6 +0, 106, 106, 1, 149760, 0x92d549c6 +1, 107, 107, 1, 24576, 0xfd9a02ca +0, 108, 108, 1, 149760, 0x2232ec60 +1, 109, 109, 1, 24576, 0xa5b92802 +0, 110, 110, 1, 149760, 0x78092c24 +1, 111, 111, 1, 24576, 0x385e36de +0, 112, 112, 1, 149760, 0xe5c7cead +1, 113, 113, 1, 24576, 0xd4072d1a +0, 114, 114, 1, 149760, 0x1bf8dfd0 +1, 115, 115, 1, 24576, 0x43b30476 +0, 116, 116, 1, 149760, 0x117aa880 +1, 117, 117, 1, 24576, 0x79afd3bf +0, 118, 118, 1, 149760, 0xf4ee5505 +1, 119, 119, 1, 24576, 0x8d538ff9 +0, 120, 120, 1, 149760, 0x7b2bd220 +1, 121, 121, 1, 24576, 0x187a8509 +0, 122, 122, 1, 149760, 0xdbaf519b +1, 123, 123, 1, 24576, 0xd97f6ec7 +0, 124, 124, 1, 149760, 0x1a386b01 +1, 125, 125, 1, 24576, 0x13e16de1 +0, 126, 126, 1, 149760, 0xf0bc3e7d +1, 127, 127, 1, 24576, 0x27628c3b +0, 128, 128, 1, 149760, 0xb2ba417b +1, 129, 129, 1, 24576, 0x260eddf8 +0, 130, 130, 1, 149760, 0xb18ebdb9 +1, 131, 131, 1, 24576, 0x47291ff7 +0, 132, 132, 1, 149760, 0x57c7e50f +1, 133, 133, 1, 24576, 0x6ed4630e +0, 134, 134, 1, 149760, 0xc0d53c18 +1, 135, 135, 1, 24576, 0x56f98141 +0, 136, 136, 1, 149760, 0x94fb35f1 +1, 137, 137, 1, 24576, 0x62c48555 +0, 138, 138, 1, 149760, 0x0cc9b521 +1, 139, 139, 1, 24576, 0x059a7505 +0, 140, 140, 1, 149760, 0xd618f78f +1, 141, 141, 1, 24576, 0x99c752c9 +0, 142, 142, 1, 149760, 0x12d119cb +1, 143, 143, 1, 24576, 0x84c94c61 +0, 144, 144, 1, 149760, 0x479a07b2 +1, 145, 145, 1, 24576, 0xdac16dba +0, 146, 146, 1, 149760, 0x5009d4fe +1, 147, 147, 1, 24576, 0xc3c98ceb +0, 148, 148, 1, 149760, 0x31ce0337 +1, 149, 149, 1, 24576, 0x44afbc11 +0, 150, 150, 1, 149760, 0x72e850bb +1, 151, 151, 1, 24576, 0x1ed6f485 +0, 152, 152, 1, 149760, 0x25cd1c68 +1, 153, 153, 1, 24576, 0x14a91968 +0, 154, 154, 1, 149760, 0x6f0e7fa8 +1, 155, 155, 1, 24576, 0x398a29a7 +0, 156, 156, 1, 149760, 0x12b61c36 +1, 157, 157, 1, 24576, 0xe7c43a2d +0, 158, 158, 1, 149760, 0xcfd5918d +1, 159, 159, 1, 24576, 0x417c42a9 +0, 160, 160, 1, 149760, 0x08b1c6f2 +1, 161, 161, 1, 24576, 0x1a273fff From 00ce36d037b28ead77271c4d0fd8a6247d9c0b47 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 27 Aug 2024 09:52:36 -0300 Subject: [PATCH 002/290] avcodec/cbs_h265: fix valid range for {left,right}_view_id view_id_len in VPS is 4 bits, so view_id values can be up to 15 bits long. Signed-off-by: James Almer --- libavcodec/cbs_h265.h | 4 ++-- libavcodec/cbs_h265_syntax_template.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/cbs_h265.h b/libavcodec/cbs_h265.h index 26a5a34fe9..580c6cd4f4 100644 --- a/libavcodec/cbs_h265.h +++ b/libavcodec/cbs_h265.h @@ -725,8 +725,8 @@ typedef struct H265RawSEI3DReferenceDisplaysInfo { uint8_t ref_viewing_distance_flag; uint8_t prec_ref_viewing_dist; uint8_t num_ref_displays_minus1; - uint8_t left_view_id[31]; - uint8_t right_view_id[31]; + uint16_t left_view_id[31]; + uint16_t right_view_id[31]; uint8_t exponent_ref_display_width[31]; uint8_t mantissa_ref_display_width[31]; uint8_t exponent_ref_viewing_distance[31]; diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index 1c11514435..e976c38b8d 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -2299,8 +2299,8 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext ue(prec_ref_viewing_dist, 0, 31); ue(num_ref_displays_minus1, 0, 31); for (i = 0; i <= current->num_ref_displays_minus1; i++) { - ues(left_view_id[i], 0, UINT8_MAX, 1, i); - ues(right_view_id[i], 0, UINT8_MAX, 1, i); + ues(left_view_id[i], 0, MAX_UINT_BITS(15), 1, i); + ues(right_view_id[i], 0, MAX_UINT_BITS(15), 1, i); us(6, exponent_ref_display_width[i], 0, 62, 1, i); if (!current->exponent_ref_display_width[i]) length = FFMAX(0, (int)current->prec_ref_display_width - 30); From a6a346e154442254ee02dde44c7b25da8010668b Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 24 Sep 2024 15:04:01 -0300 Subject: [PATCH 003/290] avcodec/cbs_h265: num_ref_displays can be up to 32 Signed-off-by: James Almer --- libavcodec/cbs_h265.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavcodec/cbs_h265.h b/libavcodec/cbs_h265.h index 580c6cd4f4..bb7a29c2e5 100644 --- a/libavcodec/cbs_h265.h +++ b/libavcodec/cbs_h265.h @@ -725,14 +725,14 @@ typedef struct H265RawSEI3DReferenceDisplaysInfo { uint8_t ref_viewing_distance_flag; uint8_t prec_ref_viewing_dist; uint8_t num_ref_displays_minus1; - uint16_t left_view_id[31]; - uint16_t right_view_id[31]; - uint8_t exponent_ref_display_width[31]; - uint8_t mantissa_ref_display_width[31]; - uint8_t exponent_ref_viewing_distance[31]; - uint8_t mantissa_ref_viewing_distance[31]; - uint8_t additional_shift_present_flag[31]; - uint16_t num_sample_shift_plus512[31]; + uint16_t left_view_id[32]; + uint16_t right_view_id[32]; + uint8_t exponent_ref_display_width[32]; + uint8_t mantissa_ref_display_width[32]; + uint8_t exponent_ref_viewing_distance[32]; + uint8_t mantissa_ref_viewing_distance[32]; + uint8_t additional_shift_present_flag[32]; + uint16_t num_sample_shift_plus512[32]; uint8_t three_dimensional_reference_displays_extension_flag; } H265RawSEI3DReferenceDisplaysInfo; From 2db706374e54d77f93492e5b58074341c815f47a Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 24 Sep 2024 15:04:12 -0300 Subject: [PATCH 004/290] avcodec/hevc/sei: num_ref_displays can be up to 32 Signed-off-by: James Almer --- libavcodec/hevc/sei.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavcodec/hevc/sei.h b/libavcodec/hevc/sei.h index a9d6a52080..806540fac6 100644 --- a/libavcodec/hevc/sei.h +++ b/libavcodec/hevc/sei.h @@ -84,14 +84,14 @@ typedef struct HEVCSEITDRDI { uint8_t ref_viewing_distance_flag; uint8_t prec_ref_viewing_dist; uint8_t num_ref_displays; - uint16_t left_view_id[31]; - uint16_t right_view_id[31]; - uint8_t exponent_ref_display_width[31]; - uint8_t mantissa_ref_display_width[31]; - uint8_t exponent_ref_viewing_distance[31]; - uint8_t mantissa_ref_viewing_distance[31]; - uint8_t additional_shift_present_flag[31]; - int16_t num_sample_shift[31]; + uint16_t left_view_id[32]; + uint16_t right_view_id[32]; + uint8_t exponent_ref_display_width[32]; + uint8_t mantissa_ref_display_width[32]; + uint8_t exponent_ref_viewing_distance[32]; + uint8_t mantissa_ref_viewing_distance[32]; + uint8_t additional_shift_present_flag[32]; + int16_t num_sample_shift[32]; uint8_t three_dimensional_reference_displays_extension_flag; } HEVCSEITDRDI; From f7643454aad674fd4f53cb605555eadd56b0fd96 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 24 Sep 2024 16:08:29 -0300 Subject: [PATCH 005/290] avfilter/vf_showinfo: add missing break to ViewID case Missed in 6940a6de2f047ceae414ddebaab30cd9fe35b020. Signed-off-by: James Almer (cherry picked from commit fd6cc18d60cd1b61380324c13050b04285eb1fb4) --- libavfilter/vf_showinfo.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavfilter/vf_showinfo.c b/libavfilter/vf_showinfo.c index 77082505f5..1c9cf6c6a1 100644 --- a/libavfilter/vf_showinfo.c +++ b/libavfilter/vf_showinfo.c @@ -859,6 +859,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame) break; case AV_FRAME_DATA_VIEW_ID: av_log(ctx, AV_LOG_INFO, "view id: %d\n", *(int*)sd->data); + break; default: if (name) av_log(ctx, AV_LOG_INFO, From cb2327562326773bb4d497df8514ff25eba0f37c Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 24 Sep 2024 21:08:23 -0300 Subject: [PATCH 006/290] tests/fate/mov: fix rules for some tests This was broken in 2fb2cd5c79fc0a01539e826530a195c3d6b78a17 and 74553f0026941de88286e821c9e0973206bdb1b5, making a simple make fate-mov fail and most of the test not run with a simple make fate. Signed-off-by: James Almer (cherry picked from commit 8b4e32f30bd28222c45128a9935ed483ac90f414) --- tests/fate/mov.mak | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/fate/mov.mak b/tests/fate/mov.mak index 682997f7fe..1200c77560 100644 --- a/tests/fate/mov.mak +++ b/tests/fate/mov.mak @@ -33,8 +33,8 @@ FATE_MOV_FFPROBE-$(call FRAMEMD5, MOV) = fate-mov-neg-firstpts-discard \ FATE_MOV_FASTSTART = fate-mov-faststart-4gb-overflow \ -FATE_SAMPLES_AVCONV += $(FATE_MOV) -FATE_SAMPLES_FFPROBE += $(FATE_MOV_FFPROBE) +FATE_SAMPLES_FFMPEG += $(FATE_MOV-yes) +FATE_SAMPLES_FFPROBE += $(FATE_MOV_FFPROBE-yes) FATE_SAMPLES_FASTSTART += $(FATE_MOV_FASTSTART) # Make sure we handle edit lists correctly in normal cases. @@ -281,4 +281,4 @@ fate-mov-mp4-iamf-ambisonic_1: CMD = transcode wav $(SRC) mp4 "-auto_conversion_ FATE_FFMPEG += $(FATE_MOV_FFMPEG-yes) FATE_FFMPEG_FFPROBE += $(FATE_MOV_FFMPEG_FFPROBE-yes) -fate-mov: $(FATE_MOV-yes) $(FATE_MOV_FFMPEG-yes) $(FATE_MOV_FFMPEG_FFPROBE-yes) $(FATE_MOV_FFPROBE) $(FATE_MOV_FASTSTART) $(FATE_MOV_FFMPEG_SAMPLES-yes) $(FATE_MOV_FFMPEG_FFPROBE_SAMPLES-yes) +fate-mov: $(FATE_MOV-yes) $(FATE_MOV_FFMPEG-yes) $(FATE_MOV_FFMPEG_FFPROBE-yes) $(FATE_MOV_FFPROBE-yes) $(FATE_MOV_FASTSTART) $(FATE_MOV_FFMPEG_SAMPLES-yes) $(FATE_MOV_FFMPEG_FFPROBE_SAMPLES-yes) From c21472ec31bb999b1960cf0ce9f93932b4939018 Mon Sep 17 00:00:00 2001 From: James Almer Date: Thu, 26 Sep 2024 16:38:24 -0300 Subject: [PATCH 007/290] avutil/iamf: fix doxygen Signed-off-by: James Almer (cherry picked from commit d55ab2ba9b16cabf1a069bcd6784e8d4906fc859) --- libavutil/iamf.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavutil/iamf.h b/libavutil/iamf.h index 93785d9fec..1fa73893cd 100644 --- a/libavutil/iamf.h +++ b/libavutil/iamf.h @@ -37,20 +37,29 @@ #include "rational.h" /** + * @defgroup lavu_iamf Immersive Audio Model and Formats + * @ingroup lavu_audio + * + * Immersive Audio Model and Formats related functions and defines + * * @defgroup lavu_iamf_params Parameter Definition + * @ingroup lavu_iamf * @{ * Parameters as defined in section 3.6.1 and 3.8 of IAMF. * @} + * * @defgroup lavu_iamf_audio Audio Element + * @ingroup lavu_iamf * @{ * Audio Elements as defined in section 3.6 of IAMF. * @} + * * @defgroup lavu_iamf_mix Mix Presentation + * @ingroup lavu_iamf * @{ * Mix Presentations as defined in section 3.7 of IAMF. * @} * - * @} * @addtogroup lavu_iamf_params * @{ */ @@ -673,6 +682,7 @@ AVIAMFSubmixLayout *av_iamf_submix_add_layout(AVIAMFSubmix *submix); * upon return, *mix_presentation will be set to NULL. */ void av_iamf_mix_presentation_free(AVIAMFMixPresentation **mix_presentation); + /** * @} */ From 0482410818e0fcff0e77f2d2813d391809f52ce4 Mon Sep 17 00:00:00 2001 From: Lynne Date: Fri, 27 Sep 2024 09:49:35 +0200 Subject: [PATCH 008/290] vulkan_encode_h264: fix rate control VBV values The values must be in milliseconds, not bytes. (cherry picked from commit 934be0ff50fbe58aa44bc8a876f07195846d15ea) --- libavcodec/vulkan_encode_h264.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/vulkan_encode_h264.c b/libavcodec/vulkan_encode_h264.c index 9964ba5b8b..a0a00a3db2 100644 --- a/libavcodec/vulkan_encode_h264.c +++ b/libavcodec/vulkan_encode_h264.c @@ -130,12 +130,12 @@ static int init_pic_rc(AVCodecContext *avctx, FFHWBaseEncodePicture *pic, .consecutiveBFrameCount = FFMAX(ctx->base.b_per_p - 1, 0), .temporalLayerCount = 0, }; - rc_info->pNext = &hp->vkrc_info; - rc_info->virtualBufferSizeInMs = enc->unit_opts.hrd_buffer_size; - rc_info->initialVirtualBufferSizeInMs = enc->unit_opts.initial_buffer_fullness; if (rc_info->rateControlMode > VK_VIDEO_ENCODE_RATE_CONTROL_MODE_DISABLED_BIT_KHR) { + rc_info->virtualBufferSizeInMs = (enc->unit_opts.hrd_buffer_size * 1000LL) / avctx->bit_rate; + rc_info->initialVirtualBufferSizeInMs = (enc->unit_opts.initial_buffer_fullness * 1000LL) / avctx->bit_rate; + hp->vkrc_layer_info = (VkVideoEncodeH264RateControlLayerInfoKHR) { .sType = VK_STRUCTURE_TYPE_VIDEO_ENCODE_H264_RATE_CONTROL_LAYER_INFO_KHR, From 9ada04faa3780c6360ffc6f354374e06bca00a8a Mon Sep 17 00:00:00 2001 From: Lynne Date: Fri, 27 Sep 2024 09:52:14 +0200 Subject: [PATCH 009/290] vulkan_encode_h265: fix rate control VBV values The values written were placeholder values. (cherry picked from commit 81c6e6c9eeb2ced02654631dbe83d342e6b59505) --- libavcodec/vulkan_encode_h265.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/vulkan_encode_h265.c b/libavcodec/vulkan_encode_h265.c index 54bf071d78..6aadbc93fc 100644 --- a/libavcodec/vulkan_encode_h265.c +++ b/libavcodec/vulkan_encode_h265.c @@ -124,12 +124,12 @@ static int init_pic_rc(AVCodecContext *avctx, FFHWBaseEncodePicture *pic, .consecutiveBFrameCount = FFMAX(ctx->base.b_per_p - 1, 0), .subLayerCount = 0, }; - rc_info->pNext = &hp->vkrc_info; - rc_info->virtualBufferSizeInMs = 1000; - rc_info->initialVirtualBufferSizeInMs = 500; if (rc_info->rateControlMode > VK_VIDEO_ENCODE_RATE_CONTROL_MODE_DISABLED_BIT_KHR) { + rc_info->virtualBufferSizeInMs = (enc->hrd_buffer_size * 1000LL) / avctx->bit_rate; + rc_info->initialVirtualBufferSizeInMs = (enc->initial_buffer_fullness * 1000LL) / avctx->bit_rate; + hp->vkrc_layer_info = (VkVideoEncodeH265RateControlLayerInfoKHR) { .sType = VK_STRUCTURE_TYPE_VIDEO_ENCODE_H265_RATE_CONTROL_LAYER_INFO_KHR, From 55d0c353fe745c762a9ff0a69c97e11522a6d1e7 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Wed, 25 Sep 2024 20:49:47 +0200 Subject: [PATCH 010/290] lavu/opt: add missing 'else' (cherry picked from commit 9b764e9b491747aa85c47ecd210551ab001ca977) Signed-off-by: Anton Khirnov --- libavutil/opt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/opt.c b/libavutil/opt.c index 45db4f484f..02ed9d9fe9 100644 --- a/libavutil/opt.c +++ b/libavutil/opt.c @@ -2362,7 +2362,7 @@ int av_opt_set_array(void *obj, const char *name, int search_flags, ret = opt_set_elem(obj, target_obj, o, *(const char **)src, dst); if (ret < 0) goto fail; - } if (val_type == AV_OPT_TYPE_INT || + } else if (val_type == AV_OPT_TYPE_INT || val_type == AV_OPT_TYPE_INT64 || val_type == AV_OPT_TYPE_FLOAT || val_type == AV_OPT_TYPE_DOUBLE || From d5c308fcc5576861e42aa0c8897e3a0271a86ff7 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 26 Sep 2024 18:08:04 +0200 Subject: [PATCH 011/290] lavu/opt: avoid accidentally propagating spurious errors An error from read_number() is non-fatal here and should not be forwarded. (cherry picked from commit 505fea34e53e0459d1ca6604a3f4737f0b90902c) Signed-off-by: Anton Khirnov --- libavutil/opt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavutil/opt.c b/libavutil/opt.c index 02ed9d9fe9..93f2bb1320 100644 --- a/libavutil/opt.c +++ b/libavutil/opt.c @@ -2343,13 +2343,15 @@ int av_opt_set_array(void *obj, const char *name, int search_flags, int64_t intnum = 1; if (val_type == TYPE_BASE(o->type)) { + int err; + ret = opt_copy_elem(obj, val_type, dst, src); if (ret < 0) goto fail; // validate the range for numeric options - ret = read_number(o, dst, &num, &den, &intnum); - if (ret >= 0 && TYPE_BASE(o->type) != AV_OPT_TYPE_FLAGS && + err = read_number(o, dst, &num, &den, &intnum); + if (err >= 0 && TYPE_BASE(o->type) != AV_OPT_TYPE_FLAGS && (!den || o->max * den < num * intnum || o->min * den > num * intnum)) { num = den ? num * intnum / den : (num && intnum ? INFINITY : NAN); av_log(obj, AV_LOG_ERROR, "Cannot set array element %u for " From 05ff3eb9f2b9321e4314e7d84fe67557bd809307 Mon Sep 17 00:00:00 2001 From: Brad Smith Date: Sat, 21 Sep 2024 05:00:41 -0400 Subject: [PATCH 012/290] ppc: Recognize the PPC VSX and Power8 CPU flags Signed-off-by: Brad Smith (cherry picked from commit 6ec6b0790021c5871016f57ac33d54bb6cab7a7d) Signed-off-by: Brad Smith --- libavutil/cpu.c | 2 ++ libavutil/tests/cpu.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/libavutil/cpu.c b/libavutil/cpu.c index df00bd541f..44cbb9e9ff 100644 --- a/libavutil/cpu.c +++ b/libavutil/cpu.c @@ -120,6 +120,8 @@ int av_parse_cpu_caps(unsigned *flags, const char *s) { "flags" , NULL, 0, AV_OPT_TYPE_FLAGS, { .i64 = 0 }, INT64_MIN, INT64_MAX, .unit = "flags" }, #if ARCH_PPC { "altivec" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_ALTIVEC }, .unit = "flags" }, + { "vsx" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_VSX }, .unit = "flags" }, + { "power8" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_POWER8 }, .unit = "flags" }, #elif ARCH_X86 { "mmx" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_MMX }, .unit = "flags" }, { "mmx2" , NULL, 0, AV_OPT_TYPE_CONST, { .i64 = AV_CPU_FLAG_MMX2 }, .unit = "flags" }, diff --git a/libavutil/tests/cpu.c b/libavutil/tests/cpu.c index 0a459c1d9e..53e9f99950 100644 --- a/libavutil/tests/cpu.c +++ b/libavutil/tests/cpu.c @@ -51,6 +51,8 @@ static const struct { { AV_CPU_FLAG_SETEND, "setend" }, #elif ARCH_PPC { AV_CPU_FLAG_ALTIVEC, "altivec" }, + { AV_CPU_FLAG_VSX, "vsx" }, + { AV_CPU_FLAG_POWER8, "power8" }, #elif ARCH_MIPS { AV_CPU_FLAG_MMI, "mmi" }, { AV_CPU_FLAG_MSA, "msa" }, From 963145483cd0234cd0fac1b51f2410b5274b5f2d Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Thu, 12 Sep 2024 04:52:43 +0200 Subject: [PATCH 013/290] avdevice/decklink_dec: fix leak on error In the early return when both draw_bars and signal_loss_action options are used, the context allocated previously was not properly freed. Introduced in 9bcb86b0fa58f1a5a2a8613065349e26abadb329 Fixes CID1619296 Signed-off-by: Marton Balint (cherry picked from commit 7554346cb5cf6e8863da12f9d56e300b08d6cc23) --- libavdevice/decklink_dec.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/libavdevice/decklink_dec.cpp b/libavdevice/decklink_dec.cpp index 54d698bc12..9a817daf18 100644 --- a/libavdevice/decklink_dec.cpp +++ b/libavdevice/decklink_dec.cpp @@ -1098,6 +1098,7 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx) } if (!ctx->draw_bars && ctx->signal_loss_action != SIGNAL_LOSS_NONE) { av_log(avctx, AV_LOG_ERROR, "options draw_bars and signal_loss_action are mutually exclusive\n"); + av_freep(&ctx); return AVERROR(EINVAL); } ctx->audio_depth = cctx->audio_depth; From ebd0ca9fee85891262979b2c9d320ff69abdc104 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Thu, 12 Sep 2024 04:58:38 +0200 Subject: [PATCH 014/290] avdevice/decklink_dec: fix leaks on error In case of errors in this function, the allocated context was not properly freed in several cases. Signed-off-by: Marton Balint (cherry picked from commit 8e76c993013d6dd9382774d1716d8fe2421c42bd) --- libavdevice/decklink_dec.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavdevice/decklink_dec.cpp b/libavdevice/decklink_dec.cpp index 9a817daf18..418701e4e0 100644 --- a/libavdevice/decklink_dec.cpp +++ b/libavdevice/decklink_dec.cpp @@ -1114,7 +1114,8 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx) break; default: av_log(avctx, AV_LOG_ERROR, "Value of channels option must be one of 2, 8 or 16\n"); - return AVERROR(EINVAL); + ret = AVERROR(EINVAL); + goto error; } /* Check audio bit depth option for valid values: 16 or 32 */ @@ -1124,18 +1125,20 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx) break; default: av_log(avctx, AV_LOG_ERROR, "Value for audio bit depth option must be either 16 or 32\n"); - return AVERROR(EINVAL); + ret = AVERROR(EINVAL); + goto error; } /* List available devices. */ if (ctx->list_devices) { ff_decklink_list_devices_legacy(avctx, 1, 0); - return AVERROR_EXIT; + ret = AVERROR_EXIT; + goto error; } ret = ff_decklink_init_device(avctx, avctx->url); if (ret < 0) - return ret; + goto error; /* Get input device. */ if (ctx->dl->QueryInterface(IID_IDeckLinkInput, (void **) &ctx->dli) != S_OK) { @@ -1336,6 +1339,7 @@ av_cold int ff_decklink_read_header(AVFormatContext *avctx) error: ff_decklink_cleanup(avctx); + av_freep(&cctx->ctx); return ret; } From 09e9d61d0a12dee0272966c4f82d0a65ad696d42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Thu, 26 Sep 2024 13:13:46 +0300 Subject: [PATCH 015/290] checkasm/sw_rgb: Revert test additions from e18b46d95fadcbaaf450bda9f1871849f2b0c586 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unaligned width test cases fail on i386; we have an assembly function of rgb24toyv12 which is enabled only within "#if ARCH_X86_32 && HAVE_7REGS", which seems to fail these new test cases for unaligned widths. As that assembly function has existed for a long time in that form, the issue probably isn't very recent, thus skip testing these cases for now. Once the assembly function has been fixed, these test cases can be readded. Signed-off-by: Martin Storsjö (cherry picked from commit 157ce21939771a8054b5effc05381fa30b825c1f) Signed-off-by: Martin Storsjö --- tests/checkasm/sw_rgb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/checkasm/sw_rgb.c b/tests/checkasm/sw_rgb.c index 7a6d621375..af9434073a 100644 --- a/tests/checkasm/sw_rgb.c +++ b/tests/checkasm/sw_rgb.c @@ -129,7 +129,7 @@ static int cmp_off_by_n(const uint8_t *ref, const uint8_t *test, size_t n, int a static void check_rgb24toyv12(struct SwsContext *ctx) { - static const int input_sizes[] = {2, 16, 128, 540, MAX_LINE_SIZE, -MAX_LINE_SIZE}; + static const int input_sizes[] = {16, 128, 512, MAX_LINE_SIZE, -MAX_LINE_SIZE}; LOCAL_ALIGNED_32(uint8_t, src, [BUFSIZE * 3]); LOCAL_ALIGNED_32(uint8_t, buf_y_0, [BUFSIZE]); From 0bad953cc54905d1147309cc45feffb17d7b02a6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 24 Sep 2024 23:43:09 +0200 Subject: [PATCH 016/290] avcodec/ffv1enc: Fix >8bit context size Fixes: Ticket5405 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit a9c83e43f2fc9128e20851291b0270add1a6b95f) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 1c37f61ada..a6f405289e 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -724,19 +724,21 @@ static av_cold int encode_init(AVCodecContext *avctx) s->quant_tables[1][2][i]= 11*11*quant5 [i]; s->quant_tables[1][3][i]= 5*11*11*quant5 [i]; s->quant_tables[1][4][i]= 5*5*11*11*quant5 [i]; + s->context_count[0] = (11 * 11 * 11 + 1) / 2; + s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2; } else { s->quant_tables[0][0][i]= quant9_10bit[i]; - s->quant_tables[0][1][i]= 11*quant9_10bit[i]; - s->quant_tables[0][2][i]= 11*11*quant9_10bit[i]; + s->quant_tables[0][1][i]= 9*quant9_10bit[i]; + s->quant_tables[0][2][i]= 9*9*quant9_10bit[i]; s->quant_tables[1][0][i]= quant9_10bit[i]; - s->quant_tables[1][1][i]= 11*quant9_10bit[i]; - s->quant_tables[1][2][i]= 11*11*quant5_10bit[i]; - s->quant_tables[1][3][i]= 5*11*11*quant5_10bit[i]; - s->quant_tables[1][4][i]= 5*5*11*11*quant5_10bit[i]; + s->quant_tables[1][1][i]= 9*quant9_10bit[i]; + s->quant_tables[1][2][i]= 9*9*quant5_10bit[i]; + s->quant_tables[1][3][i]= 5*9*9*quant5_10bit[i]; + s->quant_tables[1][4][i]= 5*5*9*9*quant5_10bit[i]; + s->context_count[0] = (9 * 9 * 9 + 1) / 2; + s->context_count[1] = (9 * 9 * 5 * 5 * 5 + 1) / 2; } } - s->context_count[0] = (11 * 11 * 11 + 1) / 2; - s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2; if ((ret = ff_ffv1_allocate_initial_states(s)) < 0) return ret; From 69cf68f5a0999b50aa595a92ba8e212ea997c4e5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 29 Sep 2024 18:41:14 +0200 Subject: [PATCH 017/290] Update for 7.1 Signed-off-by: Michael Niedermayer --- RELEASE | 2 +- doc/Doxyfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RELEASE b/RELEASE index 72ec89de30..0f0fefae5a 100644 --- a/RELEASE +++ b/RELEASE @@ -1 +1 @@ -7.0.git +7.1 diff --git a/doc/Doxyfile b/doc/Doxyfile index 572c532da5..c6dc306197 100644 --- a/doc/Doxyfile +++ b/doc/Doxyfile @@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = +PROJECT_NUMBER = 7.1 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a From b08d7969c550a804a59511c7b83f2dd8cc0499b8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 2 Nov 2018 01:36:21 +0100 Subject: [PATCH 018/290] RELEASE_NOTES: Based on the version from 5.1 Name suggested by 3 people on ML Signed-off-by: Michael Niedermayer --- RELEASE_NOTES | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 RELEASE_NOTES diff --git a/RELEASE_NOTES b/RELEASE_NOTES new file mode 100644 index 0000000000..851701a735 --- /dev/null +++ b/RELEASE_NOTES @@ -0,0 +1,15 @@ + + ┌──────────────────────────────────────┐ + │ RELEASE NOTES for FFmpeg 7.1 "Péter" │ + └──────────────────────────────────────┘ + + The FFmpeg Project proudly presents FFmpeg 7.1 "Péter", about 6 + months after the release of FFmpeg 7.0. + + A complete Changelog is available at the root of the project, and the + complete Git history on https://git.ffmpeg.org/gitweb/ffmpeg.git + + We hope you will like this release as much as we enjoyed working on it, and + as usual, if you have any questions about it, or any FFmpeg related topic, + feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask + on the mailing-lists. From 12682eba2ef6047f58cb34c07726126025b6e752 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 30 Sep 2024 10:59:02 -0300 Subject: [PATCH 019/290] avformat/mov: don't return the latest stream when an item stream is expected Otherwise, things like ICC profiles as read from the colr box meant for an item with no stream (like a grid) may end up being added to the wrong stream. Signed-off-by: James Almer (cherry picked from commit 04182b55494b44152146e6a6bcd5eb9403f00625) --- libavformat/mov.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index a2333ac1fd..5b0b23ffc1 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -188,6 +188,10 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len, return p - dst; } +/** + * Get the current stream in the parsing process. This can either be the + * latest stream added to the context, or the stream referenced by an item. + */ static AVStream *get_curr_st(MOVContext *c) { AVStream *st = NULL; @@ -206,7 +210,7 @@ static AVStream *get_curr_st(MOVContext *c) st = item->st; break; } - if (!st) + if (!st && c->cur_item_id == -1) st = c->fc->streams[c->fc->nb_streams-1]; return st; From ff93c1898d4b1807f4ac0d59897891c5d342a865 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Mon, 23 Sep 2024 23:14:19 +0800 Subject: [PATCH 020/290] avformat/internal: Add ff_get_frame_filename MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's similar to av_get_frame_filename2 but with int64_t number support. Make av_get_frame_filename* a wrapper over ff_get_frame_filename. Co-authored-by: Filip Mašić Signed-off-by: Zhao Zhili (cherry picked from commit a2d9663241908d6f558b8e6b24bd42f2aaebc144) --- libavformat/internal.h | 16 ++++++++++++++++ libavformat/utils.c | 11 ++++++++--- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/libavformat/internal.h b/libavformat/internal.h index 8e8971bfeb..6c026f08a0 100644 --- a/libavformat/internal.h +++ b/libavformat/internal.h @@ -745,6 +745,22 @@ void ff_format_set_url(AVFormatContext *s, char *url); */ int ff_match_url_ext(const char *url, const char *extensions); +/** + * Return in 'buf' the path with '%d' replaced by a number. + * + * Also handles the '%0nd' format where 'n' is the total number + * of digits and '%%'. + * + * @param buf destination buffer + * @param buf_size destination buffer size + * @param path path with substitution template + * @param number the number to substitute + * @param flags AV_FRAME_FILENAME_FLAGS_* + * @return 0 if OK, -1 on format error + */ +int ff_get_frame_filename(char *buf, int buf_size, const char *path, + int64_t number, int flags); + struct FFOutputFormat; struct FFInputFormat; void avpriv_register_devices(const struct FFOutputFormat * const o[], diff --git a/libavformat/utils.c b/libavformat/utils.c index e9ded627ad..e892e8bde7 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -280,7 +280,7 @@ uint64_t ff_parse_ntp_time(uint64_t ntp_ts) return (sec * 1000000) + usec; } -int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number, int flags) +int ff_get_frame_filename(char *buf, int buf_size, const char *path, int64_t number, int flags) { const char *p; char *q, buf1[20], c; @@ -313,7 +313,7 @@ int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number percentd_found = 1; if (number < 0) nd += 1; - snprintf(buf1, sizeof(buf1), "%0*d", nd, number); + snprintf(buf1, sizeof(buf1), "%0*" PRId64, nd, number); len = strlen(buf1); if ((q - buf + len) > buf_size - 1) goto fail; @@ -338,9 +338,14 @@ fail: return -1; } +int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number, int flags) +{ + return ff_get_frame_filename(buf, buf_size, path, number, flags); +} + int av_get_frame_filename(char *buf, int buf_size, const char *path, int number) { - return av_get_frame_filename2(buf, buf_size, path, number, 0); + return ff_get_frame_filename(buf, buf_size, path, number, 0); } void av_url_split(char *proto, int proto_size, From 8be6e56a536e978d77640dadc7c00861b19c0ee5 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Tue, 24 Sep 2024 00:16:13 +0800 Subject: [PATCH 021/290] avformat/img2enc: Fix integer truncation when frame_pts is enabled Fix #11194 Signed-off-by: Zhao Zhili (cherry picked from commit f56a54387b9cea884ca139e9cb993ff6989b8def) --- libavformat/img2enc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/img2enc.c b/libavformat/img2enc.c index 526a11e5ee..41638d92b8 100644 --- a/libavformat/img2enc.c +++ b/libavformat/img2enc.c @@ -160,13 +160,13 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR(EINVAL); } } else if (img->frame_pts) { - if (av_get_frame_filename2(filename, sizeof(filename), s->url, pkt->pts, AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) { + if (ff_get_frame_filename(filename, sizeof(filename), s->url, pkt->pts, AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) { av_log(s, AV_LOG_ERROR, "Cannot write filename by pts of the frames."); return AVERROR(EINVAL); } - } else if (av_get_frame_filename2(filename, sizeof(filename), s->url, - img->img_number, - AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) { + } else if (ff_get_frame_filename(filename, sizeof(filename), s->url, + img->img_number, + AV_FRAME_FILENAME_FLAGS_MULTIPLE) < 0) { if (img->img_number == img->start_img_number) { av_log(s, AV_LOG_WARNING, "The specified filename '%s' does not contain an image sequence pattern or a pattern is invalid.\n", s->url); av_log(s, AV_LOG_WARNING, From 4c0ef3bfae1473902f8ec8ee0a1a95607827b390 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Fri, 4 Oct 2024 01:30:57 +0800 Subject: [PATCH 022/290] avcodec/mediacodecenc: Fix access of uninitialized value When crop is skipped, av_strlcatf will access `str` which isn't initialized properly. Signed-off-by: Zhao Zhili (cherry picked from commit eff9ed7bff45998ea370e3d6f627529ad47e2e74) --- libavcodec/mediacodecenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/mediacodecenc.c b/libavcodec/mediacodecenc.c index 6ca3968a24..e76ea81236 100644 --- a/libavcodec/mediacodecenc.c +++ b/libavcodec/mediacodecenc.c @@ -134,7 +134,7 @@ static int extract_extradata_support(AVCodecContext *avctx) static int mediacodec_init_bsf(AVCodecContext *avctx) { MediaCodecEncContext *s = avctx->priv_data; - char str[128]; + char str[128] = {0}; int ret; int crop_right = s->width - avctx->width; int crop_bottom = s->height - avctx->height; From e14a3a4b116122899dc8d251d6b890ae378f9802 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Tue, 1 Oct 2024 02:57:11 +0200 Subject: [PATCH 023/290] fftools: do not access out of bounds filtergraph The log message was logged for `filtergraphs[j]` which would cause a heap buffer overflow in certain circumstances. Correctly it should be logged for the current filtergraph, so just use `fg` here. (cherry picked from commit 5beeb3a1f97d8f6d4076fe83aaf5e2e5871f945e) --- fftools/ffmpeg_filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c index 7ec328e04e..2f2b297932 100644 --- a/fftools/ffmpeg_filter.c +++ b/fftools/ffmpeg_filter.c @@ -1408,7 +1408,7 @@ int fg_finalise_bindings(void) for (int j = 0; j < fg->nb_outputs; j++) { OutputFilter *output = fg->outputs[j]; if (!output->bound) { - av_log(filtergraphs[j], AV_LOG_FATAL, + av_log(fg, AV_LOG_FATAL, "Filter %s has an unconnected output\n", output->name); return AVERROR(EINVAL); } From 9b061291ad3c38944ab628be52e9338090d2f3a7 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Tue, 1 Oct 2024 03:20:04 +0200 Subject: [PATCH 024/290] fftools: log unconnected filter output label (cherry picked from commit f25c9cc213c7e3eb585d3339eb775b16921c4d98) --- fftools/ffmpeg_filter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c index 2f2b297932..4e3a47e3b6 100644 --- a/fftools/ffmpeg_filter.c +++ b/fftools/ffmpeg_filter.c @@ -1409,7 +1409,9 @@ int fg_finalise_bindings(void) OutputFilter *output = fg->outputs[j]; if (!output->bound) { av_log(fg, AV_LOG_FATAL, - "Filter %s has an unconnected output\n", output->name); + "Filter '%s' has output %d (%s) unconnected\n", + output->name, j, + output->linklabel ? (const char *)output->linklabel : "unlabeled"); return AVERROR(EINVAL); } } From 63f5c007a7da69248f664c988398204c21eac7cf Mon Sep 17 00:00:00 2001 From: Gyan Doshi Date: Sat, 5 Oct 2024 10:08:31 +0530 Subject: [PATCH 025/290] avcodec/libx265: unbreak build for X265_BUILD >= 213 Earlier, x265 made an API change to support alpha and other multiple layer pictures. We added guards to accommodate that in 1f801dfdb5 They have now reverted that API change in https://bitbucket.org/multicoreware/x265_git/commits/78e5b703b1 Updated our wrapper guards to unbreak build again. --- libavcodec/libx265.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/libx265.c b/libavcodec/libx265.c index 513f473307..63cc497f83 100644 --- a/libavcodec/libx265.c +++ b/libavcodec/libx265.c @@ -661,7 +661,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt, { libx265Context *ctx = avctx->priv_data; x265_picture x265pic; -#if X265_BUILD >= 210 +#if (X265_BUILD >= 210) && (X265_BUILD < 213) x265_picture x265pic_layers_out[MAX_SCALABLE_LAYERS]; x265_picture* x265pic_lyrptr_out[MAX_SCALABLE_LAYERS]; #else @@ -805,7 +805,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt, #endif } -#if X265_BUILD >= 210 +#if (X265_BUILD >= 210) && (X265_BUILD < 213) for (i = 0; i < MAX_SCALABLE_LAYERS; i++) x265pic_lyrptr_out[i] = &x265pic_layers_out[i]; @@ -844,7 +844,7 @@ static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt, pkt->flags |= AV_PKT_FLAG_KEY; } -#if X265_BUILD >= 210 +#if (X265_BUILD >= 210) && (X265_BUILD < 213) x265pic_out = x265pic_lyrptr_out[0]; #else x265pic_out = &x265pic_solo_out; From 794245fa715493e0275c190d0c3917deccf2d7a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 4 Oct 2024 00:30:24 +0300 Subject: [PATCH 026/290] arm: Consistently use proper interworking function returns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use "bx lr", or "pop {lr}", which do proper mode switching between thumb and arm modes. A plain "mov pc, lr" does not switch from thumb mode to arm mode (while in arm mode, it does switch mode for a thumb caller). This is normally not an issue, as CONFIG_THUMB only is enabled if the C compiler defaults to thumb; but stick to patterns that can do mode switching if needed, for consistency. Signed-off-by: Martin Storsjö (cherry picked from commit 77e6293735262b20a86b5047b77991a86cf4e9e1) --- libswresample/arm/resample.S | 8 ++++---- libswscale/arm/hscale.S | 3 +-- libswscale/arm/output.S | 3 +-- libswscale/arm/yuv2rgb_neon.S | 3 +-- 4 files changed, 7 insertions(+), 10 deletions(-) diff --git a/libswresample/arm/resample.S b/libswresample/arm/resample.S index 3ce7623246..791f4cc016 100644 --- a/libswresample/arm/resample.S +++ b/libswresample/arm/resample.S @@ -30,7 +30,7 @@ function ff_resample_common_apply_filter_x4_float_neon, export=1 vpadd.f32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values vpadd.f32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values vst1.32 {d0[0]}, [r0] @ write accumulator - mov pc, lr + bx lr endfunc function ff_resample_common_apply_filter_x8_float_neon, export=1 @@ -46,7 +46,7 @@ function ff_resample_common_apply_filter_x8_float_neon, export=1 vpadd.f32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values vpadd.f32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values vst1.32 {d0[0]}, [r0] @ write accumulator - mov pc, lr + bx lr endfunc function ff_resample_common_apply_filter_x4_s16_neon, export=1 @@ -59,7 +59,7 @@ function ff_resample_common_apply_filter_x4_s16_neon, export=1 vpadd.s32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values vpadd.s32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values vst1.32 {d0[0]}, [r0] @ write accumulator - mov pc, lr + bx lr endfunc function ff_resample_common_apply_filter_x8_s16_neon, export=1 @@ -73,5 +73,5 @@ function ff_resample_common_apply_filter_x8_s16_neon, export=1 vpadd.s32 d0, d0, d1 @ pair adding of the 4x32-bit accumulated values vpadd.s32 d0, d0, d0 @ pair adding of the 4x32-bit accumulator values vst1.32 {d0[0]}, [r0] @ write accumulator - mov pc, lr + bx lr endfunc diff --git a/libswscale/arm/hscale.S b/libswscale/arm/hscale.S index dd4d453957..5c3551a0f1 100644 --- a/libswscale/arm/hscale.S +++ b/libswscale/arm/hscale.S @@ -65,6 +65,5 @@ function ff_hscale_8_to_15_neon, export=1 subs r2, #2 @ dstW -= 2 bgt 1b @ loop until end of line vpop {q4-q7} - pop {r4-r12, lr} - mov pc, lr + pop {r4-r12, pc} endfunc diff --git a/libswscale/arm/output.S b/libswscale/arm/output.S index 70846dee1f..5f10585f81 100644 --- a/libswscale/arm/output.S +++ b/libswscale/arm/output.S @@ -73,6 +73,5 @@ function ff_yuv2planeX_8_neon, export=1 subs r4, r4, #8 @ dstW -= 8 bgt 2b @ loop until width is consumed vpop {q4-q7} - pop {r4-r12, lr} - mov pc, lr + pop {r4-r12, pc} endfunc diff --git a/libswscale/arm/yuv2rgb_neon.S b/libswscale/arm/yuv2rgb_neon.S index 474465427d..6777d625f9 100644 --- a/libswscale/arm/yuv2rgb_neon.S +++ b/libswscale/arm/yuv2rgb_neon.S @@ -262,8 +262,7 @@ function ff_\ifmt\()_to_\ofmt\()_neon, export=1 increment_and_test_\ifmt bgt 1b vpop {q4-q7} - pop {r4-r12, lr} - mov pc, lr + pop {r4-r12, pc} endfunc .endm From c0d19c640a00ef1899f6201c659d30ae430692df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 4 Oct 2024 10:22:57 +0300 Subject: [PATCH 027/290] checkasm: lls: Use relative tolerances rather than absolute ones MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Depending on the magnitude of the output values, the potential errors can be larger. This fixes errors in the lls tests on x86_32 for some seeds, observed with GCC 11 (on Ubuntu 22.04, with the distro compiler, with -m32). Signed-off-by: Martin Storsjö (cherry picked from commit 6668268e16b6d1a6992840dccb12effece2e7202) --- tests/checkasm/lls.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/checkasm/lls.c b/tests/checkasm/lls.c index 1e0b56974c..4251032e02 100644 --- a/tests/checkasm/lls.c +++ b/tests/checkasm/lls.c @@ -46,28 +46,32 @@ static void test_update(LLSModel *lls, const double *var) call_new(lls, var); for (size_t i = 0; i < lls->indep_count; i++) - for (size_t j = i; j < lls->indep_count; j++) + for (size_t j = i; j < lls->indep_count; j++) { + double eps = FFMAX(2 * DBL_EPSILON * fabs(refcovar[i][j]), + 8 * DBL_EPSILON); if (!double_near_abs_eps(refcovar[i][j], lls->covariance[i][j], - 8 * DBL_EPSILON)) { + eps)) { fprintf(stderr, "%zu, %zu: %- .12f - %- .12f = % .12g\n", i, j, refcovar[i][j], lls->covariance[i][j], refcovar[i][j] - lls->covariance[i][j]); fail(); } + } bench_new(lls, var); } -#define EPS 0.2 static void test_evaluate(LLSModel *lls, const double *param, int order) { - double refprod, newprod; + double refprod, newprod, eps; declare_func_float(double, LLSModel *, const double *, int); refprod = call_ref(lls, param, order); newprod = call_new(lls, param, order); - if (!double_near_abs_eps(refprod, newprod, EPS)) { + eps = FFMAX(2 * DBL_EPSILON * fabs(refprod), 0.2); + + if (!double_near_abs_eps(refprod, newprod, eps)) { fprintf(stderr, "%- .12f - %- .12f = % .12g\n", refprod, newprod, refprod - newprod); fail(); From 0b5559378b1e9c309ef876ae309a61b23398355b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Tue, 1 Oct 2024 23:59:41 +0300 Subject: [PATCH 028/290] libavcodec: x86: Remove an explicit include of config.asm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This file is never included explicitly anywhere else, it's only included implicitly by passing -Pconfig.asm on the command line. Signed-off-by: Martin Storsjö (cherry picked from commit 5c4ede6b4ff6fa8818f0ca3f686aa54c1c2092b8) --- libavcodec/x86/celt_pvq_search.asm | 1 - 1 file changed, 1 deletion(-) diff --git a/libavcodec/x86/celt_pvq_search.asm b/libavcodec/x86/celt_pvq_search.asm index e9bff02650..3c6974d370 100644 --- a/libavcodec/x86/celt_pvq_search.asm +++ b/libavcodec/x86/celt_pvq_search.asm @@ -20,7 +20,6 @@ ;* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ;****************************************************************************** -%include "config.asm" %include "libavutil/x86/x86util.asm" %ifdef __NASM_VER__ From 5c59d97e8ab90daefa198dcfb0ee4fdf9c57e37f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ingo=20Br=C3=BCckl?= Date: Wed, 9 Oct 2024 04:43:01 +0200 Subject: [PATCH 029/290] avcodec/vaapi_encode: fix compilation without CONFIG_VAAPI_1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This adds VAAPIEncodeContext *ctx that has been removed in aa82340b0ccdde4955fba41b8de5e45348ecd11d. Signed-off-by: Ingo Brückl (cherry picked from commit 5557c673ea783a48e8b97c2b740b22eeeca6399b) --- libavcodec/vaapi_encode_h264.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/vaapi_encode_h264.c b/libavcodec/vaapi_encode_h264.c index fb87b68bec..ed20b9cd24 100644 --- a/libavcodec/vaapi_encode_h264.c +++ b/libavcodec/vaapi_encode_h264.c @@ -406,6 +406,9 @@ static int vaapi_encode_h264_init_picture_params(AVCodecContext *avctx, FFHWBaseEncodePicture *pic) { FFHWBaseEncodeContext *base_ctx = avctx->priv_data; +#if !CONFIG_VAAPI_1 + VAAPIEncodeContext *ctx = avctx->priv_data; +#endif VAAPIEncodeH264Context *priv = avctx->priv_data; VAAPIEncodePicture *vaapi_pic = pic->priv; VAAPIEncodeH264Picture *hpic = pic->codec_priv; From 32d3e677171e46828c2bf585fa25ae733ace6d0e Mon Sep 17 00:00:00 2001 From: Nicolas Gaullier Date: Fri, 4 Oct 2024 11:02:49 +0200 Subject: [PATCH 030/290] avfilter/framesync: fix forward EOF pts Note1: when the EOF pts is not accurate enough, the last frame can be dropped by vf_fps with default rounding. Note2: vf_scale use framesync since e82a3997cdd6c0894869b33ba42430ac3, so this is a very commonplace scenario. For example: ./ffprobe -f lavfi testsrc=d=1,scale,fps -of flat \ -count_frames -show_entries stream=nb_read_frames Before: streams.stream.0.nb_read_frames="24" After: streams.stream.0.nb_read_frames="25" Signed-off-by: Anton Khirnov (cherry picked from commit de976eaf30df33e86c58c8c9af9905c1d8441934) Signed-off-by: Anton Khirnov --- libavfilter/framesync.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/libavfilter/framesync.c b/libavfilter/framesync.c index 8e06e0e700..0d5779f830 100644 --- a/libavfilter/framesync.c +++ b/libavfilter/framesync.c @@ -103,14 +103,14 @@ int ff_framesync_init(FFFrameSync *fs, AVFilterContext *parent, unsigned nb_in) return 0; } -static void framesync_eof(FFFrameSync *fs) +static void framesync_eof(FFFrameSync *fs, int64_t pts) { fs->eof = 1; fs->frame_ready = 0; - ff_outlink_set_status(fs->parent->outputs[0], AVERROR_EOF, AV_NOPTS_VALUE); + ff_outlink_set_status(fs->parent->outputs[0], AVERROR_EOF, pts); } -static void framesync_sync_level_update(FFFrameSync *fs) +static void framesync_sync_level_update(FFFrameSync *fs, int64_t eof_pts) { unsigned i, level = 0; @@ -131,7 +131,7 @@ static void framesync_sync_level_update(FFFrameSync *fs) if (level) fs->sync_level = level; else - framesync_eof(fs); + framesync_eof(fs, eof_pts); } int ff_framesync_configure(FFFrameSync *fs) @@ -179,7 +179,7 @@ int ff_framesync_configure(FFFrameSync *fs) for (i = 0; i < fs->nb_in; i++) fs->in[i].pts = fs->in[i].pts_next = AV_NOPTS_VALUE; fs->sync_level = UINT_MAX; - framesync_sync_level_update(fs); + framesync_sync_level_update(fs, AV_NOPTS_VALUE); return 0; } @@ -200,7 +200,7 @@ static int framesync_advance(FFFrameSync *fs) if (fs->in[i].have_next && fs->in[i].pts_next < pts) pts = fs->in[i].pts_next; if (pts == INT64_MAX) { - framesync_eof(fs); + framesync_eof(fs, AV_NOPTS_VALUE); break; } for (i = 0; i < fs->nb_in; i++) { @@ -222,7 +222,7 @@ static int framesync_advance(FFFrameSync *fs) fs->frame_ready = 1; if (fs->in[i].state == STATE_EOF && fs->in[i].after == EXT_STOP) - framesync_eof(fs); + framesync_eof(fs, AV_NOPTS_VALUE); } } if (fs->frame_ready) @@ -255,15 +255,14 @@ static void framesync_inject_frame(FFFrameSync *fs, unsigned in, AVFrame *frame) fs->in[in].have_next = 1; } -static void framesync_inject_status(FFFrameSync *fs, unsigned in, int status, int64_t pts) +static void framesync_inject_status(FFFrameSync *fs, unsigned in, int status, int64_t eof_pts) { av_assert0(!fs->in[in].have_next); - pts = fs->in[in].state != STATE_RUN || fs->in[in].after == EXT_INFINITY - ? INT64_MAX : framesync_pts_extrapolate(fs, in, fs->in[in].pts); fs->in[in].sync = 0; - framesync_sync_level_update(fs); + framesync_sync_level_update(fs, status == AVERROR_EOF ? eof_pts : AV_NOPTS_VALUE); fs->in[in].frame_next = NULL; - fs->in[in].pts_next = pts; + fs->in[in].pts_next = fs->in[in].state != STATE_RUN || fs->in[in].after == EXT_INFINITY + ? INT64_MAX : framesync_pts_extrapolate(fs, in, fs->in[in].pts); fs->in[in].have_next = 1; } From 020d9f2b4886aa620252da4db7a4936378d6eb3a Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Sun, 13 Oct 2024 14:11:39 +0200 Subject: [PATCH 031/290] lavc/avcodec: fix global/private option precendence Broken after 7753a9d62725d5bd8313e2d249acbe1c8af79ab1. Apply only the whitelist early, and the rest with a single call to av_opt_set_dict2() with AV_OPT_SEARCH_CHILDREN, which should be equivalent to the original behaviour. Reported-by: Cameron Gutman (cherry picked from commit 9ce63e65d65b303813d4ae677228226d7cd232b9) Signed-off-by: Anton Khirnov --- libavcodec/avcodec.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/libavcodec/avcodec.c b/libavcodec/avcodec.c index d1daf47611..1fa8704c9d 100644 --- a/libavcodec/avcodec.c +++ b/libavcodec/avcodec.c @@ -145,6 +145,7 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code int ret = 0; AVCodecInternal *avci; const FFCodec *codec2; + const AVDictionaryEntry *e; if (avcodec_is_open(avctx)) return 0; @@ -175,8 +176,14 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code if (avctx->extradata_size < 0 || avctx->extradata_size >= FF_MAX_EXTRADATA_SIZE) return AVERROR(EINVAL); - if ((ret = av_opt_set_dict(avctx, options)) < 0) - return ret; + // set the whitelist from provided options dict, + // so we can check it immediately + e = options ? av_dict_get(*options, "codec_whitelist", NULL, 0) : NULL; + if (e) { + ret = av_opt_set(avctx, e->key, e->value, 0); + if (ret < 0) + return ret; + } if (avctx->codec_whitelist && av_match_list(codec->name, avctx->codec_whitelist, ',') <= 0) { av_log(avctx, AV_LOG_ERROR, "Codec (%s) not on whitelist \'%s\'\n", codec->name, avctx->codec_whitelist); @@ -211,12 +218,14 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code av_opt_set_defaults(avctx->priv_data); } } - if (codec->priv_class && (ret = av_opt_set_dict(avctx->priv_data, options)) < 0) - goto free_and_end; } else { avctx->priv_data = NULL; } + ret = av_opt_set_dict2(avctx, options, AV_OPT_SEARCH_CHILDREN); + if (ret < 0) + goto free_and_end; + // only call ff_set_dimensions() for non H.264/VP6F/DXV codecs so as not to overwrite previously setup dimensions if (!(avctx->coded_width && avctx->coded_height && avctx->width && avctx->height && (avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id == AV_CODEC_ID_VP6F || avctx->codec_id == AV_CODEC_ID_DXV))) { From 87ccf995cb855f0baced9916928b7b48d8b6ed9d Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Sat, 12 Oct 2024 19:08:55 +0200 Subject: [PATCH 032/290] fftools/ffmpeg_filter: treat apad filter as a source Ideally lavfi should have a dedicated API for detecting this. Fixes #11168 and #11061 (cherry picked from commit 9e2a231236428c4682c77858c6aabfd74f459b17) Signed-off-by: Anton Khirnov --- fftools/ffmpeg_filter.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c index 4e3a47e3b6..38c7676a7e 100644 --- a/fftools/ffmpeg_filter.c +++ b/fftools/ffmpeg_filter.c @@ -1101,8 +1101,9 @@ int fg_create(FilterGraph **pfg, char *graph_desc, Scheduler *sch) for (unsigned i = 0; i < graph->nb_filters; i++) { const AVFilter *f = graph->filters[i]->filter; - if (!avfilter_filter_pad_count(f, 0) && - !(f->flags & AVFILTER_FLAG_DYNAMIC_INPUTS)) { + if ((!avfilter_filter_pad_count(f, 0) && + !(f->flags & AVFILTER_FLAG_DYNAMIC_INPUTS)) || + !strcmp(f->name, "apad")) { fgp->have_sources = 1; break; } @@ -1497,7 +1498,7 @@ static int insert_filter(AVFilterContext **last_filter, int *pad_idx, return 0; } -static int configure_output_video_filter(FilterGraph *fg, AVFilterGraph *graph, +static int configure_output_video_filter(FilterGraphPriv *fgp, AVFilterGraph *graph, OutputFilter *ofilter, AVFilterInOut *out) { OutputFilterPriv *ofp = ofp_from_ofilter(ofilter); @@ -1576,7 +1577,7 @@ static int configure_output_video_filter(FilterGraph *fg, AVFilterGraph *graph, return 0; } -static int configure_output_audio_filter(FilterGraph *fg, AVFilterGraph *graph, +static int configure_output_audio_filter(FilterGraphPriv *fgp, AVFilterGraph *graph, OutputFilter *ofilter, AVFilterInOut *out) { OutputFilterPriv *ofp = ofp_from_ofilter(ofilter); @@ -1641,8 +1642,10 @@ static int configure_output_audio_filter(FilterGraph *fg, AVFilterGraph *graph, pad_idx = 0; } - if (ofilter->apad) + if (ofilter->apad) { AUTO_INSERT_FILTER("-apad", "apad", ofilter->apad); + fgp->have_sources = 1; + } snprintf(name, sizeof(name), "trim for output %s", ofp->name); ret = insert_trim(ofp->trim_start_us, ofp->trim_duration_us, @@ -1658,12 +1661,12 @@ fail: return ret; } -static int configure_output_filter(FilterGraph *fg, AVFilterGraph *graph, +static int configure_output_filter(FilterGraphPriv *fgp, AVFilterGraph *graph, OutputFilter *ofilter, AVFilterInOut *out) { switch (ofilter->type) { - case AVMEDIA_TYPE_VIDEO: return configure_output_video_filter(fg, graph, ofilter, out); - case AVMEDIA_TYPE_AUDIO: return configure_output_audio_filter(fg, graph, ofilter, out); + case AVMEDIA_TYPE_VIDEO: return configure_output_video_filter(fgp, graph, ofilter, out); + case AVMEDIA_TYPE_AUDIO: return configure_output_audio_filter(fgp, graph, ofilter, out); default: av_assert0(0); return 0; } } @@ -1940,7 +1943,7 @@ static int configure_filtergraph(FilterGraph *fg, FilterGraphThread *fgt) avfilter_inout_free(&inputs); for (cur = outputs, i = 0; cur; cur = cur->next, i++) { - ret = configure_output_filter(fg, fgt->graph, fg->outputs[i], cur); + ret = configure_output_filter(fgp, fgt->graph, fg->outputs[i], cur); if (ret < 0) { avfilter_inout_free(&outputs); goto fail; From 9fbbd924f2863312b41303a48705b252b7ee1193 Mon Sep 17 00:00:00 2001 From: Emily Date: Mon, 7 Oct 2024 00:04:56 +0100 Subject: [PATCH 033/290] fate/ffmpeg: add samples dependency to fate-ffmpeg-spec-disposition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This test utilizes an MPEG-TS sample from FATE suite, yet was marked as not requiring samples. Reviewed-by: Jan Ekström (cherry picked from commit 3565903c638fb77d600d2983701b12300e695a5d) --- tests/fate/ffmpeg.mak | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/fate/ffmpeg.mak b/tests/fate/ffmpeg.mak index 869376dd18..d9348ee837 100644 --- a/tests/fate/ffmpeg.mak +++ b/tests/fate/ffmpeg.mak @@ -266,4 +266,4 @@ FATE_FFMPEG-$(call ENCDEC2, MPEG2VIDEO, FFV1, NUT, HSTACK_FILTER PIPE_PROTOCOL F # test matching by stream disposition fate-ffmpeg-spec-disposition: CMD = framecrc -i $(TARGET_SAMPLES)/mpegts/pmtchange.ts -map '0:disp:visual_impaired+descriptions:1' -c copy -FATE_FFMPEG-$(call FRAMECRC, MPEGTS,,) += fate-ffmpeg-spec-disposition +FATE_SAMPLES_FFMPEG-$(call FRAMECRC, MPEGTS,,) += fate-ffmpeg-spec-disposition From 15035aaec0b5d86ea063b8b3d46d13ed1ee9bed2 Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Tue, 22 Oct 2024 19:49:16 +0200 Subject: [PATCH 034/290] avutil/wchar_filename: re-introduce explicit cast of void* to char* Fixes compile error on windows with decklink: In file included from ./libavformat/os_support.h:175, from ./libavformat/internal.h:30, from libavdevice/decklink_common.cpp:25: ./libavutil/wchar_filename.h: In function 'int wchartocp(unsigned int, const wchar_t*, char**)': ./libavutil/wchar_filename.h:59:32: error: invalid conversion from 'void*' to 'char*' [-fpermissive] 59 | *filename = av_malloc_array(num_chars, sizeof **filename); | ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | void* Regression since e9e8bea2e79bc3c481a6f81f75f6c871e3e0f367. Fixes ticket #11103. Signed-off-by: Marton Balint (cherry picked from commit 9b0128aa766221f8a32e13cf3c1d3e6d75a2d829) --- libavutil/wchar_filename.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/wchar_filename.h b/libavutil/wchar_filename.h index 23cc92aa2d..1370a084c9 100644 --- a/libavutil/wchar_filename.h +++ b/libavutil/wchar_filename.h @@ -57,7 +57,7 @@ static inline int wchartocp(unsigned int code_page, const wchar_t *filename_w, errno = EINVAL; return -1; } - *filename = av_malloc_array(num_chars, sizeof **filename); + *filename = (char *)av_malloc_array(num_chars, sizeof **filename); if (!*filename) { errno = ENOMEM; return -1; From 367b7b546f0e012eadcbcf88fe28c6ebf8d16d8e Mon Sep 17 00:00:00 2001 From: Leandro Santiago Date: Thu, 31 Oct 2024 21:50:45 +0100 Subject: [PATCH 035/290] fftools/ffplay: fix crash when vk renderer is null When vulkan rendering is requested by the user and fails, ffplay should exit graciously instead of crash due to a null pointer deref. Signed-off-by: Leandro Santiago Signed-off-by: Zhao Zhili (cherry picked from commit fd0cacc4720c68c58f86e41153444252dbd4e5b6) --- fftools/ffplay.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fftools/ffplay.c b/fftools/ffplay.c index 60d8874eab..96b0b614b9 100644 --- a/fftools/ffplay.c +++ b/fftools/ffplay.c @@ -2607,6 +2607,11 @@ static int create_hwaccel(AVBufferRef **device_ctx) if (type == AV_HWDEVICE_TYPE_NONE) return AVERROR(ENOTSUP); + if (!vk_renderer) { + av_log(NULL, AV_LOG_ERROR, "Vulkan renderer is not available\n"); + return AVERROR(ENOTSUP); + } + ret = vk_renderer_get_hw_dev(vk_renderer, &vk_dev); if (ret < 0) return ret; From 5120d30890838f71de723f2318de23b363989834 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Sat, 26 Oct 2024 11:48:48 +0200 Subject: [PATCH 036/290] Document stream specifier syntax change from 46cbe4ab5c Fixes #11248. (cherry picked from commit 9e68b26765ca8396050f4b58d4b4fdc53943d35f) Signed-off-by: Anton Khirnov --- Changelog | 9 +++++++++ doc/ffmpeg.texi | 2 +- doc/fftools-common-opts.texi | 3 ++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/Changelog b/Changelog index 0c05ad2946..17bec3ceee 100644 --- a/Changelog +++ b/Changelog @@ -27,6 +27,15 @@ version 7.1: - LCEVC enhancement data exporting in H.26x and MP4/ISOBMFF - LCEVC filter - MV-HEVC decoding +- minor stream specifier syntax changes: + - when matching by metadata (:m::), the colon character + in keys or values now has to be backslash-escaped + - in optional maps (-map ....?) with a metadata-matching stream specifier, + the value has to be separated from the question mark by a colon, i.e. + -map ....:m:::? (otherwise it would be ambiguous whether the + question mark is a part of or not) + - multiple stream types in a single specifier (e.g. :s:s:0) now cause an + error, as such a specifier makes no sense version 7.0: diff --git a/doc/ffmpeg.texi b/doc/ffmpeg.texi index 34007f7ea2..013f5f4dab 100644 --- a/doc/ffmpeg.texi +++ b/doc/ffmpeg.texi @@ -1799,7 +1799,7 @@ Set the size of the canvas used to render subtitles. @section Advanced options @table @option -@item -map [-]@var{input_file_id}[:@var{stream_specifier}][:@var{view_specifier}][?] | @var{[linklabel]} (@emph{output}) +@item -map [-]@var{input_file_id}[:@var{stream_specifier}][:@var{view_specifier}][:?] | @var{[linklabel]} (@emph{output}) Create one or more streams in the output file. This option has two forms for specifying the data source(s): the first selects one or more streams from some diff --git a/doc/fftools-common-opts.texi b/doc/fftools-common-opts.texi index 4e48789def..8b0931a86d 100644 --- a/doc/fftools-common-opts.texi +++ b/doc/fftools-common-opts.texi @@ -78,7 +78,8 @@ Match the stream by stream id (e.g. PID in MPEG-TS container). @item m:@var{key}[:@var{value}] Matches streams with the metadata tag @var{key} having the specified value. If @var{value} is not given, matches streams that contain the given tag with any -value. +value. The colon character ':' in @var{key} or @var{value} needs to be +backslash-escaped. @item disp:@var{dispositions}[:@var{additional_stream_specifier}] Matches streams with the given disposition(s). @var{dispositions} is a list of one or more dispositions (as printed by the @option{-dispositions} option) From baef55364f3aec557c460621ca3e98b74646ebd4 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 10 Nov 2024 16:46:31 -0300 Subject: [PATCH 037/290] avcodec/x86/vvc: add prototypes for OF functions And wrap the implemtation in preprocessor checks. Should fix ticket #11282. Signed-off-by: James Almer (cherry picked from commit 9ec042c1aaa64b5f6dff8be263feff4288c1844e) --- libavcodec/x86/vvc/vvcdsp_init.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/libavcodec/x86/vvc/vvcdsp_init.c b/libavcodec/x86/vvc/vvcdsp_init.c index f3e2e3a27b..3a128b21ed 100644 --- a/libavcodec/x86/vvc/vvcdsp_init.c +++ b/libavcodec/x86/vvc/vvcdsp_init.c @@ -102,19 +102,29 @@ DMVR_PROTOTYPES( 8, avx2) DMVR_PROTOTYPES(10, avx2) DMVR_PROTOTYPES(12, avx2) +#define OF_PROTOTYPES(bd, opt) \ +void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \ + const int16_t *src0, const int16_t *src1, int w, int h); \ + +OF_PROTOTYPES( 8, avx2) +OF_PROTOTYPES(10, avx2) +OF_PROTOTYPES(12, avx2) + +#if ARCH_X86_64 && HAVE_AVX2_EXTERNAL void ff_vvc_apply_bdof_avx2(uint8_t *dst, ptrdiff_t dst_stride, \ const int16_t *src0, const int16_t *src1, int w, int h, int pixel_max); \ -#define OF_PROTOTYPES(bd, opt) \ -static void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \ +#define OF_FUNC(bd, opt) \ +void ff_vvc_apply_bdof_##bd##_##opt(uint8_t *dst, ptrdiff_t dst_stride, \ const int16_t *src0, const int16_t *src1, int w, int h) \ { \ ff_vvc_apply_bdof##_##opt(dst, dst_stride, src0, src1, w, h, (1 << bd) - 1); \ } \ -OF_PROTOTYPES( 8, avx2) -OF_PROTOTYPES(10, avx2) -OF_PROTOTYPES(12, avx2) +OF_FUNC( 8, avx2) +OF_FUNC(10, avx2) +OF_FUNC(12, avx2) +#endif #define ALF_BPC_PROTOTYPES(bpc, opt) \ void BF(ff_vvc_alf_filter_luma, bpc, opt)(uint8_t *dst, ptrdiff_t dst_stride, \ From 1b1ba7d4f20c14d084b5304b39d45c8a6c80013b Mon Sep 17 00:00:00 2001 From: Nuo Mi Date: Sun, 10 Nov 2024 14:20:24 +0800 Subject: [PATCH 038/290] avcodec/cbs_h266: Fix regression in DVB clip introduced by 93281630a71c06642adfebebb0d4b105a4e02e91 This commit introduced a regression to VVC_HDR_UHDTV1_OpenGOP_3840x2160_50fps_HLG10_mosaic.ts. Root Cause: The AV_CEIL_RSHIFT(a, b) macro uses bit tricks that work only when -a is a negative value. However, due to integer promotion rules, this behavior does not extend to the unsigned int type. See "6.3.1.1 Boolean, characters, and integers" in the "ISO/IEC 9899" for details. Reported-by: Frank Plowman (cherry picked from commit c49001e338feb9d8537bb00de33b2a5725ea6028) --- libavcodec/cbs_h266_syntax_template.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index b4165b43b3..d33629b06c 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1162,7 +1162,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, for (i = 1; i <= current->sps_num_subpics_minus1; i++) { if (!current->sps_subpic_same_size_flag) { if (current->sps_pic_width_max_in_luma_samples > ctb_size_y) { - const unsigned int win_right_edge = + const int win_right_edge = current->sps_pic_width_max_in_luma_samples - current->sps_conf_win_right_offset * sub_width_c; us(wlen, sps_subpic_ctu_top_left_x[i], 0, @@ -1172,7 +1172,7 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, infer(sps_subpic_ctu_top_left_x[i], 0); if (current->sps_pic_height_max_in_luma_samples > ctb_size_y) { - const unsigned int win_bottom_edge = + const int win_bottom_edge = current->sps_pic_height_max_in_luma_samples - current->sps_conf_win_bottom_offset * sub_height_c; us(hlen, sps_subpic_ctu_top_left_y[i], 0, @@ -1183,9 +1183,9 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, if (i < current->sps_num_subpics_minus1 && current->sps_pic_width_max_in_luma_samples > ctb_size_y) { - const unsigned int win_left_edge = + const int win_left_edge = current->sps_conf_win_left_offset * sub_width_c; - const unsigned int win_left_edge_ctus = + const int win_left_edge_ctus = AV_CEIL_RSHIFT(win_left_edge, ctb_log2_size_y); us(wlen, sps_subpic_width_minus1[i], win_left_edge_ctus > current->sps_subpic_ctu_top_left_x[i] @@ -1200,9 +1200,9 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw, if (i < current->sps_num_subpics_minus1 && current->sps_pic_height_max_in_luma_samples > ctb_size_y) { - const unsigned int win_top_edge = + const int win_top_edge = current->sps_conf_win_top_offset * sub_height_c; - const unsigned int win_top_edge_ctus = + const int win_top_edge_ctus = AV_CEIL_RSHIFT(win_top_edge, ctb_log2_size_y); us(hlen, sps_subpic_height_minus1[i], win_top_edge_ctus > current->sps_subpic_ctu_top_left_y[i] From 03ffd4b3b36535833ba179823dc26e811650581d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= Date: Fri, 1 Nov 2024 13:50:38 +0100 Subject: [PATCH 039/290] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow --- libavcodec/jpegxl_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 8c45e1a1b7..746c429b9c 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; - uint32_t end, lehmer = 0; + int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); - if (end > toc_count) { + if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); - if (get_bits_left(gb) < 0) { + if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } From 11e8319b8ef0015e248ff3a400457ebdc0eb77b2 Mon Sep 17 00:00:00 2001 From: Leo Izen Date: Thu, 7 Nov 2024 11:31:49 -0500 Subject: [PATCH 040/290] avcodec/jpegxl_parser: fix reading lz77-pair as initial entropy symbol MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The JPEG XL parser has an entropy decoder inside, which supports LZ77 length-distance pairs. If the first symbol from the entropy stream is an LZ77 pair, the bitstream is invalid, so we should abort immediately rather than attempt to read it anyway (which would read from the uninitialized starting window). Reported-by: Kacper Michajłow Found-by: ossfuzz Fixes: 368725676/clusterfuzz-testcase-minimized-fuzzer_protocol_file-6022251122589696-cut Fixes: 42537758/clusterfuzz-testcase-minimized-fuzzer_protocol_file-5818969469026304-cut Signed-off-by: Leo Izen --- libavcodec/jpegxl_parser.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 746c429b9c..76122af54a 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -352,6 +352,8 @@ static int decode_hybrid_varlen_uint(GetBitContext *gb, JXLEntropyDecoder *dec, if (bundle->lz77_enabled && token >= bundle->lz77_min_symbol) { const JXLSymbolDistribution *lz77dist = &bundle->dists[bundle->cluster_map[bundle->num_dist - 1]]; + if (!dec->num_decoded) + return AVERROR_INVALIDDATA; ret = read_hybrid_uint(gb, &bundle->lz_len_conf, token - bundle->lz77_min_symbol, &dec->num_to_copy); if (ret < 0) return ret; @@ -531,6 +533,7 @@ static int read_dist_clustering(GetBitContext *gb, JXLEntropyDecoder *dec, JXLDi dec->state = -1; /* it's not going to necessarily be zero after reading */ dec->num_to_copy = 0; + dec->num_decoded = 0; dist_bundle_close(&nested); if (use_mtf) { uint8_t mtf[256]; From 4ea558152f05e41f15a548e2aab8e5d40546af5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= Date: Sat, 16 Nov 2024 08:57:54 +0200 Subject: [PATCH 041/290] lavc/h264dsp: move RISC-V fn pointers to .data.rel.ro This should fix PIC builds. --- libavcodec/riscv/h264dsp_rvv.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/riscv/h264dsp_rvv.S b/libavcodec/riscv/h264dsp_rvv.S index 422ac02222..97c6708309 100644 --- a/libavcodec/riscv/h264dsp_rvv.S +++ b/libavcodec/riscv/h264dsp_rvv.S @@ -176,7 +176,7 @@ endfunc .global ff_h264_weight_funcs_8_rvv .hidden ff_h264_weight_funcs_8_rvv -const ff_h264_weight_funcs_8_rvv +const ff_h264_weight_funcs_8_rvv, relocate=1 .irp w, 16, 8, 4, 2 #if __riscv_xlen == 32 .word ff_h264_weight_pixels\w\()_8_rvv From f686cf77db3d3d556072c8b557deca366ccfe7dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= Date: Sat, 16 Nov 2024 16:22:49 +0200 Subject: [PATCH 042/290] lavc/h264idct: fix RISC-V group multiplier After the branch, the expected SEW/LMUL ratio is 1 byte/vector. So we have to set the same ratio before branching (QEMU does not care, but real hardware does). (cherry picked from commit bbb0fdedb78c289f1d3ce3fccb000f031ccfa748) --- libavcodec/riscv/h264idct_rvv.S | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/riscv/h264idct_rvv.S b/libavcodec/riscv/h264idct_rvv.S index d2f77a5b47..b1e06d93f7 100644 --- a/libavcodec/riscv/h264idct_rvv.S +++ b/libavcodec/riscv/h264idct_rvv.S @@ -644,7 +644,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x sd a4, 24(sp) ld a0, 0(a0) # dest[0] addi a1, a1, 16 * 4 # &block_offset[16] - vsetivli zero, 4, e8, mf4, ta, ma + vsetivli zero, 4, e8, m1, ta, ma jal .Lidct4_add4_\depth\()_rvv ld a4, 24(sp) # nnzc @@ -655,7 +655,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x ld a0, 8(a0) # dest[1] lla t0, ff_h264_scan8 + 32 .ifc \type, 8_422 - vsetivli zero, 4, e8, mf4, ta, ma + vsetivli zero, 4, e8, m1, ta, ma jal .Lidct4_add4_\depth\()_rvv ld a4, 24(sp) # nnzc @@ -665,7 +665,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x addi a1, t5, (-8 - 4) * 4 # &block_offset[24] ld a0, 0(a0) # dest[0] lla t0, ff_h264_scan8 + 24 - vsetivli zero, 4, e8, mf4, ta, ma + vsetivli zero, 4, e8, m1, ta, ma jal .Lidct4_add4_\depth\()_rvv ld a4, 24(sp) # nnzc @@ -679,7 +679,7 @@ func ff_h264_idct4_add\type\()_\depth\()_rvv, zve32x ld ra, 8(sp) ld s0, 0(sp) addi sp, sp, 32 - vsetivli zero, 4, e8, mf4, ta, ma + vsetivli zero, 4, e8, m1, ta, ma j .Lidct4_add4_\depth\()_rvv endfunc .endm From 779b0fe015b166f83a607e4126d1c55810c46855 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 30 Sep 2024 13:43:23 -0300 Subject: [PATCH 043/290] avformat/mov: factorize getting the current item Signed-off-by: James Almer (cherry picked from commit 58c265d956f4ce2efb0004c398e2c1f030f9398a) --- libavformat/mov.c | 45 ++++++++++++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 17 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 5b0b23ffc1..75951d6b4c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -188,6 +188,24 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len, return p - dst; } +/** + * Get the current item in the parsing process. + */ +static HEIFItem *heif_cur_item(MOVContext *c) +{ + HEIFItem *item = NULL; + + for (int i = 0; i < c->nb_heif_item; i++) { + if (c->heif_item[i].item_id != c->cur_item_id) + continue; + + item = &c->heif_item[i]; + break; + } + + return item; +} + /** * Get the current stream in the parsing process. This can either be the * latest stream added to the context, or the stream referenced by an item. @@ -195,23 +213,17 @@ static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len, static AVStream *get_curr_st(MOVContext *c) { AVStream *st = NULL; + HEIFItem *item; if (c->fc->nb_streams < 1) return NULL; - for (int i = 0; i < c->nb_heif_item; i++) { - HEIFItem *item = &c->heif_item[i]; - - if (!item->st) - continue; - if (item->st->id != c->cur_item_id) - continue; + if (c->cur_item_id == -1) + return c->fc->streams[c->fc->nb_streams-1]; + item = heif_cur_item(c); + if (item) st = item->st; - break; - } - if (!st && c->cur_item_id == -1) - st = c->fc->streams[c->fc->nb_streams-1]; return st; } @@ -8912,6 +8924,7 @@ static int mov_read_iref(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom) { + HEIFItem *item; uint32_t width, height; avio_r8(pb); /* version */ @@ -8922,12 +8935,10 @@ static int mov_read_ispe(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_log(c->fc, AV_LOG_TRACE, "ispe: item_id %d, width %u, height %u\n", c->cur_item_id, width, height); - for (int i = 0; i < c->nb_heif_item; i++) { - if (c->heif_item[i].item_id == c->cur_item_id) { - c->heif_item[i].width = width; - c->heif_item[i].height = height; - break; - } + item = heif_cur_item(c); + if (item) { + item->width = width; + item->height = height; } return 0; From 23697c3f02c43ef8135357eda5b58e884e7ccf45 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 5 Oct 2024 10:32:14 -0300 Subject: [PATCH 044/290] avformat/mov: split off heif item initialization to its own function Signed-off-by: James Almer (cherry picked from commit d5eb0e7fb334b83849a8515d83f8a3acb5a762c6) --- libavformat/mov.c | 98 ++++++++++++++++++++++++++--------------------- 1 file changed, 55 insertions(+), 43 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 75951d6b4c..11ee8b8d7f 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10072,6 +10072,58 @@ static int mov_parse_tiles(AVFormatContext *s) return 0; } +static int mov_parse_heif_items(AVFormatContext *s) +{ + MOVContext *mov = s->priv_data; + int err; + + for (int i = 0; i < mov->nb_heif_item; i++) { + HEIFItem *item = &mov->heif_item[i]; + MOVStreamContext *sc; + AVStream *st; + int64_t offset = 0; + + if (!item->st) { + if (item->item_id == mov->thmb_item_id) { + av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n"); + return AVERROR_INVALIDDATA; + } + continue; + } + if (item->is_idat_relative) { + if (!mov->idat_offset) { + av_log(s, AV_LOG_ERROR, "Missing idat box for item %d\n", item->item_id); + return AVERROR_INVALIDDATA; + } + offset = mov->idat_offset; + } + + st = item->st; + sc = st->priv_data; + st->codecpar->width = item->width; + st->codecpar->height = item->height; + + if (sc->sample_count != 1 || sc->chunk_count != 1) + return AVERROR_INVALIDDATA; + + sc->sample_sizes[0] = item->extent_length; + sc->chunk_offsets[0] = item->extent_offset + offset; + + if (item->item_id == mov->primary_item_id) + st->disposition |= AV_DISPOSITION_DEFAULT; + + mov_build_index(mov, st); + } + + if (mov->nb_heif_grid) { + err = mov_parse_tiles(s); + if (err < 0) + return err; + } + + return 0; +} + static AVStream *mov_find_reference_track(AVFormatContext *s, AVStream *st, int first_index) { @@ -10129,49 +10181,9 @@ static int mov_read_header(AVFormatContext *s) av_log(mov->fc, AV_LOG_TRACE, "on_parse_exit_offset=%"PRId64"\n", avio_tell(pb)); if (mov->found_iloc && mov->found_iinf) { - for (i = 0; i < mov->nb_heif_item; i++) { - HEIFItem *item = &mov->heif_item[i]; - MOVStreamContext *sc; - AVStream *st; - int64_t offset = 0; - - if (!item->st) { - if (item->item_id == mov->thmb_item_id) { - av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n"); - return AVERROR_INVALIDDATA; - } - continue; - } - if (item->is_idat_relative) { - if (!mov->idat_offset) { - av_log(s, AV_LOG_ERROR, "Missing idat box for item %d\n", item->item_id); - return AVERROR_INVALIDDATA; - } - offset = mov->idat_offset; - } - - st = item->st; - sc = st->priv_data; - st->codecpar->width = item->width; - st->codecpar->height = item->height; - - if (sc->sample_count != 1 || sc->chunk_count != 1) - return AVERROR_INVALIDDATA; - - sc->sample_sizes[0] = item->extent_length; - sc->chunk_offsets[0] = item->extent_offset + offset; - - if (item->item_id == mov->primary_item_id) - st->disposition |= AV_DISPOSITION_DEFAULT; - - mov_build_index(mov, st); - } - - if (mov->nb_heif_grid) { - err = mov_parse_tiles(s); - if (err < 0) - return err; - } + err = mov_parse_heif_items(s); + if (err < 0) + return err; } // prevent iloc and iinf boxes from being parsed while reading packets. // this is needed because an iinf box may have been parsed but ignored From f8fcebae95f711ce980c954eb41d2e2e703d5e14 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 8 Nov 2024 20:43:39 -0300 Subject: [PATCH 045/290] avformat/mov: use an array of pointers for heif_item Pointers to specific entries in the array are stored in other structs, so in the scenario where heif_item was reallocated when parsing an iloc box after and iinf one, the pointers may end up referencing freed memory. Fixes use-after-free with such samples. Signed-off-by: James Almer --- libavformat/isom.h | 2 +- libavformat/mov.c | 93 +++++++++++++++++++++++++++++----------------- 2 files changed, 60 insertions(+), 35 deletions(-) diff --git a/libavformat/isom.h b/libavformat/isom.h index 4723397048..ffabc01a2d 100644 --- a/libavformat/isom.h +++ b/libavformat/isom.h @@ -355,7 +355,7 @@ typedef struct MOVContext { uint32_t max_stts_delta; int primary_item_id; int cur_item_id; - HEIFItem *heif_item; + HEIFItem **heif_item; int nb_heif_item; HEIFGrid *heif_grid; int nb_heif_grid; diff --git a/libavformat/mov.c b/libavformat/mov.c index 11ee8b8d7f..54f8594f67 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -196,10 +196,10 @@ static HEIFItem *heif_cur_item(MOVContext *c) HEIFItem *item = NULL; for (int i = 0; i < c->nb_heif_item; i++) { - if (c->heif_item[i].item_id != c->cur_item_id) + if (!c->heif_item[i] || c->heif_item[i]->item_id != c->cur_item_id) continue; - item = &c->heif_item[i]; + item = c->heif_item[i]; break; } @@ -8612,7 +8612,7 @@ static int mov_read_idat(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) { - HEIFItem *heif_item; + HEIFItem **heif_item; int version, offset_size, length_size, base_offset_size, index_size; int item_count, extent_count; int64_t base_offset, extent_offset, extent_length; @@ -8643,12 +8643,13 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); c->heif_item = heif_item; if (item_count > c->nb_heif_item) - memset(c->heif_item + c->nb_heif_item, 0, + memset(&c->heif_item[c->nb_heif_item], 0, sizeof(*c->heif_item) * (item_count - c->nb_heif_item)); c->nb_heif_item = FFMAX(c->nb_heif_item, item_count); av_log(c->fc, AV_LOG_TRACE, "iloc: item_count %d\n", item_count); for (int i = 0; i < item_count; i++) { + HEIFItem *item = c->heif_item[i]; int item_id = (version < 2) ? avio_rb16(pb) : avio_rb32(pb); int offset_type = (version > 0) ? avio_rb16(pb) & 0xf : 0; @@ -8658,7 +8659,6 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) avpriv_report_missing_feature(c->fc, "iloc offset type %d", offset_type); return AVERROR_PATCHWELCOME; } - c->heif_item[i].item_id = item_id; avio_rb16(pb); // data_reference_index. if (rb_size(pb, &base_offset, base_offset_size) < 0) @@ -8669,19 +8669,26 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) avpriv_report_missing_feature(c->fc, "iloc: extent_count > 1"); return AVERROR_PATCHWELCOME; } - for (int j = 0; j < extent_count; j++) { - if (rb_size(pb, &extent_offset, offset_size) < 0 || - rb_size(pb, &extent_length, length_size) < 0 || - base_offset > INT64_MAX - extent_offset) - return AVERROR_INVALIDDATA; - if (offset_type == 1) - c->heif_item[i].is_idat_relative = 1; - c->heif_item[i].extent_length = extent_length; - c->heif_item[i].extent_offset = base_offset + extent_offset; - av_log(c->fc, AV_LOG_TRACE, "iloc: item_idx %d, offset_type %d, " - "extent_offset %"PRId64", extent_length %"PRId64"\n", - i, offset_type, c->heif_item[i].extent_offset, c->heif_item[i].extent_length); - } + + if (rb_size(pb, &extent_offset, offset_size) < 0 || + rb_size(pb, &extent_length, length_size) < 0 || + base_offset > INT64_MAX - extent_offset) + return AVERROR_INVALIDDATA; + + if (!item) + item = c->heif_item[i] = av_mallocz(sizeof(*item)); + if (!item) + return AVERROR(ENOMEM); + + item->item_id = item_id; + + if (offset_type == 1) + item->is_idat_relative = 1; + item->extent_length = extent_length; + item->extent_offset = base_offset + extent_offset; + av_log(c->fc, AV_LOG_TRACE, "iloc: item_idx %d, offset_type %d, " + "extent_offset %"PRId64", extent_length %"PRId64"\n", + i, offset_type, item->extent_offset, item->extent_length); } c->found_iloc = 1; @@ -8690,6 +8697,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) { + HEIFItem *item; AVBPrint item_name; int64_t size = atom.size; uint32_t item_type; @@ -8729,15 +8737,21 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) if (size > 0) avio_skip(pb, size); + item = c->heif_item[idx]; + if (!item) + item = c->heif_item[idx] = av_mallocz(sizeof(*item)); + if (!item) + return AVERROR(ENOMEM); + if (ret) - av_bprint_finalize(&item_name, &c->heif_item[idx].name); - c->heif_item[idx].item_id = item_id; - c->heif_item[idx].type = item_type; + av_bprint_finalize(&item_name, &c->heif_item[idx]->name); + c->heif_item[idx]->item_id = item_id; + c->heif_item[idx]->type = item_type; switch (item_type) { case MKTAG('a','v','0','1'): case MKTAG('h','v','c','1'): - ret = heif_add_stream(c, &c->heif_item[idx]); + ret = heif_add_stream(c, c->heif_item[idx]); if (ret < 0) return ret; break; @@ -8748,7 +8762,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx) static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom) { - HEIFItem *heif_item; + HEIFItem **heif_item; int entry_count; int version, got_stream = 0, ret, i; @@ -8766,15 +8780,17 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); c->heif_item = heif_item; if (entry_count > c->nb_heif_item) - memset(c->heif_item + c->nb_heif_item, 0, + memset(&c->heif_item[c->nb_heif_item], 0, sizeof(*c->heif_item) * (entry_count - c->nb_heif_item)); c->nb_heif_item = FFMAX(c->nb_heif_item, entry_count); for (i = 0; i < entry_count; i++) { MOVAtom infe; - if (avio_feof(pb)) - return AVERROR_INVALIDDATA; + if (avio_feof(pb)) { + ret = AVERROR_INVALIDDATA; + goto fail; + } infe.size = avio_rb32(pb) - 8; infe.type = avio_rl32(pb); ret = mov_read_infe(c, pb, infe, i); @@ -8788,7 +8804,10 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; fail: for (; i >= 0; i--) { - HEIFItem *item = &c->heif_item[i]; + HEIFItem *item = c->heif_item[i]; + + if (!item) + continue; av_freep(&item->name); if (!item->st) @@ -8816,9 +8835,9 @@ static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) } } for (int i = 0; i < c->nb_heif_item; i++) { - if (c->heif_item[i].item_id != from_item_id) + if (!c->heif_item[i] || c->heif_item[i]->item_id != from_item_id) continue; - item = &c->heif_item[i]; + item = c->heif_item[i]; switch (item->type) { case MKTAG('g','r','i','d'): @@ -9692,8 +9711,12 @@ static int mov_read_close(AVFormatContext *s) av_freep(&mov->aes_decrypt); av_freep(&mov->chapter_tracks); - for (i = 0; i < mov->nb_heif_item; i++) - av_freep(&mov->heif_item[i].name); + for (i = 0; i < mov->nb_heif_item; i++) { + if (!mov->heif_item[i]) + continue; + av_freep(&mov->heif_item[i]->name); + av_freep(&mov->heif_item[i]); + } av_freep(&mov->heif_item); for (i = 0; i < mov->nb_heif_grid; i++) { av_freep(&mov->heif_grid[i].tile_id_list); @@ -10009,10 +10032,10 @@ static int mov_parse_tiles(AVFormatContext *s) int k; for (k = 0; k < mov->nb_heif_item; k++) { - HEIFItem *item = &mov->heif_item[k]; + HEIFItem *item = mov->heif_item[k]; AVStream *st = item->st; - if (item->item_id != tile_id) + if (!item || item->item_id != tile_id) continue; if (!st) { av_log(s, AV_LOG_WARNING, "HEIF item id %d from grid id %d doesn't " @@ -10078,11 +10101,13 @@ static int mov_parse_heif_items(AVFormatContext *s) int err; for (int i = 0; i < mov->nb_heif_item; i++) { - HEIFItem *item = &mov->heif_item[i]; + HEIFItem *item = mov->heif_item[i]; MOVStreamContext *sc; AVStream *st; int64_t offset = 0; + if (!item) + continue; if (!item->st) { if (item->item_id == mov->thmb_item_id) { av_log(s, AV_LOG_ERROR, "HEIF thumbnail doesn't reference a stream\n"); From 5f8b02a9ffc233f962dd6b267f5ae377eca22571 Mon Sep 17 00:00:00 2001 From: James Almer Date: Thu, 24 Oct 2024 23:09:23 -0300 Subject: [PATCH 046/290] avcodec/aom_film_grain: allocate film grain metadata dynamically This removes the ABI breaking use of sizeof(AVFilmGrainParams), and achieves the same size reduction to decoder structs as 08b1bffa49715a9615acc025dfbea252d8409e1f. Signed-off-by: James Almer (cherry picked from commit fd4a2c9b026d8e23301854a500fdfc7bd4a4cbc6) --- libavcodec/aom_film_grain.c | 49 +++++++++++++++++++++++++++++-------- libavcodec/aom_film_grain.h | 6 ++++- libavcodec/h2645_sei.c | 12 ++++++++- libavcodec/hevc/hevcdec.c | 1 - 4 files changed, 55 insertions(+), 13 deletions(-) diff --git a/libavcodec/aom_film_grain.c b/libavcodec/aom_film_grain.c index e302567ba5..1b1693dcd9 100644 --- a/libavcodec/aom_film_grain.c +++ b/libavcodec/aom_film_grain.c @@ -26,7 +26,9 @@ */ #include "libavutil/avassert.h" +#include "libavutil/buffer.h" #include "libavutil/imgutils.h" +#include "libavutil/mem.h" #include "aom_film_grain.h" #include "get_bits.h" @@ -124,7 +126,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, { GetBitContext gbc, *gb = &gbc; AVFilmGrainAOMParams *aom; - AVFilmGrainParams *fgp, *ref = NULL; + AVFilmGrainParams *fgp = NULL, *ref = NULL; int ret, num_sets, n, i, uv, num_y_coeffs, update_grain, luma_only; ret = init_get_bits8(gb, payload, payload_size); @@ -135,28 +137,38 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, if (!s->enable) return 0; + for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++) + av_buffer_unref(&s->sets[i]); + skip_bits(gb, 4); // reserved num_sets = get_bits(gb, 3) + 1; for (n = 0; n < num_sets; n++) { int payload_4byte, payload_size, set_idx, apply_units_log2, vsc_flag; int predict_scaling, predict_y_scaling, predict_uv_scaling[2]; int payload_bits, start_position; + size_t fgp_size; start_position = get_bits_count(gb); payload_4byte = get_bits1(gb); payload_size = get_bits(gb, payload_4byte ? 2 : 8); set_idx = get_bits(gb, 3); - fgp = &s->sets[set_idx]; + fgp = av_film_grain_params_alloc(&fgp_size); + if (!fgp) + goto error; aom = &fgp->codec.aom; fgp->type = get_bits1(gb) ? AV_FILM_GRAIN_PARAMS_AV1 : AV_FILM_GRAIN_PARAMS_NONE; - if (!fgp->type) + if (!fgp->type) { + av_freep(&fgp); continue; + } fgp->seed = get_bits(gb, 16); update_grain = get_bits1(gb); - if (!update_grain) + if (!update_grain) { + av_freep(&fgp); continue; + } apply_units_log2 = get_bits(gb, 4); fgp->width = get_bits(gb, 12) << apply_units_log2; @@ -330,32 +342,49 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, if (payload_bits > payload_size * 8) goto error; skip_bits(gb, payload_size * 8 - payload_bits); + + av_buffer_unref(&s->sets[set_idx]); + s->sets[set_idx] = av_buffer_create((uint8_t *)fgp, fgp_size, NULL, NULL, 0); + if (!s->sets[set_idx]) + goto error; } return 0; error: - memset(s, 0, sizeof(*s)); + av_free(fgp); + ff_aom_uninit_film_grain_params(s); return AVERROR_INVALIDDATA; } int ff_aom_attach_film_grain_sets(const AVFilmGrainAFGS1Params *s, AVFrame *frame) { - AVFilmGrainParams *fgp; if (!s->enable) return 0; for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++) { - if (s->sets[i].type != AV_FILM_GRAIN_PARAMS_AV1) + AVBufferRef *buf; + + if (!s->sets[i]) continue; - fgp = av_film_grain_params_create_side_data(frame); - if (!fgp) + + buf = av_buffer_ref(s->sets[i]); + if (!buf || !av_frame_new_side_data_from_buf(frame, + AV_FRAME_DATA_FILM_GRAIN_PARAMS, buf)) { + av_buffer_unref(&buf); return AVERROR(ENOMEM); - memcpy(fgp, &s->sets[i], sizeof(*fgp)); + } } return 0; } +void ff_aom_uninit_film_grain_params(AVFilmGrainAFGS1Params *s) +{ + for (int i = 0; i < FF_ARRAY_ELEMS(s->sets); i++) + av_buffer_unref(&s->sets[i]); + s->enable = 0; +} + // Taken from the AV1 spec. Range is [-2048, 2047], mean is 0 and stddev is 512 static const int16_t gaussian_sequence[2048] = { 56, 568, -180, 172, 124, -84, 172, -64, -900, 24, 820, diff --git a/libavcodec/aom_film_grain.h b/libavcodec/aom_film_grain.h index 1f8c78f657..97c33deb47 100644 --- a/libavcodec/aom_film_grain.h +++ b/libavcodec/aom_film_grain.h @@ -28,11 +28,12 @@ #ifndef AVCODEC_AOM_FILM_GRAIN_H #define AVCODEC_AOM_FILM_GRAIN_H +#include "libavutil/buffer.h" #include "libavutil/film_grain_params.h" typedef struct AVFilmGrainAFGS1Params { int enable; - AVFilmGrainParams sets[8]; + AVBufferRef *sets[8]; } AVFilmGrainAFGS1Params; // Synthesizes film grain on top of `in` and stores the result to `out`. `out` @@ -48,4 +49,7 @@ int ff_aom_parse_film_grain_sets(AVFilmGrainAFGS1Params *s, // Attach all valid film grain param sets to `frame`. int ff_aom_attach_film_grain_sets(const AVFilmGrainAFGS1Params *s, AVFrame *frame); +// Free all allocations in `s` and zero the entire struct. +void ff_aom_uninit_film_grain_params(AVFilmGrainAFGS1Params *s); + #endif /* AVCODEC_AOM_FILM_GRAIN_H */ diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c index c46a563308..15e867b5ed 100644 --- a/libavcodec/h2645_sei.c +++ b/libavcodec/h2645_sei.c @@ -26,6 +26,7 @@ #include "config_components.h" #include "libavutil/ambient_viewing_environment.h" +#include "libavutil/buffer.h" #include "libavutil/display.h" #include "libavutil/hdr_dynamic_metadata.h" #include "libavutil/film_grain_params.h" @@ -542,6 +543,14 @@ int ff_h2645_sei_ctx_replace(H2645SEI *dst, const H2645SEI *src) } } + for (unsigned i = 0; i < FF_ARRAY_ELEMS(dst->aom_film_grain.sets); i++) { + ret = av_buffer_replace(&dst->aom_film_grain.sets[i], + src->aom_film_grain.sets[i]); + if (ret < 0) + return ret; + } + dst->aom_film_grain.enable = src->aom_film_grain.enable; + return 0; } @@ -913,5 +922,6 @@ void ff_h2645_sei_reset(H2645SEI *s) s->ambient_viewing_environment.present = 0; s->mastering_display.present = 0; s->content_light.present = 0; - s->aom_film_grain.enable = 0; + + ff_aom_uninit_film_grain_params(&s->aom_film_grain); } diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 0dc24f82f8..7f1079c669 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -3969,7 +3969,6 @@ static int hevc_update_thread_context(AVCodecContext *dst, s->sei.common.alternative_transfer = s0->sei.common.alternative_transfer; s->sei.common.mastering_display = s0->sei.common.mastering_display; s->sei.common.content_light = s0->sei.common.content_light; - s->sei.common.aom_film_grain = s0->sei.common.aom_film_grain; s->sei.tdrdi = s0->sei.tdrdi; return 0; From b9abdd9eaa4ae7fe7c2d3512444bf9bd7a56e138 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 25 Oct 2024 12:49:11 -0300 Subject: [PATCH 047/290] avcodec/h2645_sei: use the RefStruct API for film_grain_characteristics And ensure the buffer is synced between threads. Based on a patch by Dale Curtis Signed-off-by: James Almer (cherry picked from commit e33b162c7d8bbbb4838a2af3685fad2bb1ac774a) --- libavcodec/h2645_sei.c | 15 ++++++++++++--- libavcodec/h2645_sei.h | 4 +++- libavcodec/h264_sei.c | 1 - libavcodec/h264_slice.c | 5 ++++- libavcodec/hevc/hevcdec.c | 9 +++++---- 5 files changed, 24 insertions(+), 10 deletions(-) diff --git a/libavcodec/h2645_sei.c b/libavcodec/h2645_sei.c index 15e867b5ed..62369dd37f 100644 --- a/libavcodec/h2645_sei.c +++ b/libavcodec/h2645_sei.c @@ -42,6 +42,7 @@ #include "golomb.h" #include "h2645_sei.h" #include "itut35.h" +#include "refstruct.h" #define IS_H264(codec_id) (CONFIG_H264_SEI && CONFIG_HEVC_SEI ? codec_id == AV_CODEC_ID_H264 : CONFIG_H264_SEI) #define IS_HEVC(codec_id) (CONFIG_H264_SEI && CONFIG_HEVC_SEI ? codec_id == AV_CODEC_ID_HEVC : CONFIG_HEVC_SEI) @@ -495,7 +496,11 @@ int ff_h2645_sei_message_decode(H2645SEI *h, enum SEIType type, case SEI_TYPE_DISPLAY_ORIENTATION: return decode_display_orientation(&h->display_orientation, gb); case SEI_TYPE_FILM_GRAIN_CHARACTERISTICS: - return decode_film_grain_characteristics(&h->film_grain_characteristics, codec_id, gb); + ff_refstruct_unref(&h->film_grain_characteristics); + h->film_grain_characteristics = ff_refstruct_allocz(sizeof(*h->film_grain_characteristics)); + if (!h->film_grain_characteristics) + return AVERROR(ENOMEM); + return decode_film_grain_characteristics(h->film_grain_characteristics, codec_id, gb); case SEI_TYPE_FRAME_PACKING_ARRANGEMENT: return decode_frame_packing_arrangement(&h->frame_packing, gb, codec_id); case SEI_TYPE_ALTERNATIVE_TRANSFER_CHARACTERISTICS: @@ -551,6 +556,9 @@ int ff_h2645_sei_ctx_replace(H2645SEI *dst, const H2645SEI *src) } dst->aom_film_grain.enable = src->aom_film_grain.enable; + ff_refstruct_replace(&dst->film_grain_characteristics, + src->film_grain_characteristics); + return 0; } @@ -820,8 +828,8 @@ int ff_h2645_sei_to_frame(AVFrame *frame, H2645SEI *sei, return ret; } - if (sei->film_grain_characteristics.present) { - H2645SEIFilmGrainCharacteristics *fgc = &sei->film_grain_characteristics; + if (sei->film_grain_characteristics && sei->film_grain_characteristics->present) { + H2645SEIFilmGrainCharacteristics *fgc = sei->film_grain_characteristics; AVFilmGrainParams *fgp = av_film_grain_params_create_side_data(frame); AVFilmGrainH274Params *h274; @@ -923,5 +931,6 @@ void ff_h2645_sei_reset(H2645SEI *s) s->mastering_display.present = 0; s->content_light.present = 0; + ff_refstruct_unref(&s->film_grain_characteristics); ff_aom_uninit_film_grain_params(&s->aom_film_grain); } diff --git a/libavcodec/h2645_sei.h b/libavcodec/h2645_sei.h index 598f78b585..abc49760d9 100644 --- a/libavcodec/h2645_sei.h +++ b/libavcodec/h2645_sei.h @@ -135,11 +135,13 @@ typedef struct H2645SEI { H2645SEIFramePacking frame_packing; H2645SEIDisplayOrientation display_orientation; H2645SEIAlternativeTransfer alternative_transfer; - H2645SEIFilmGrainCharacteristics film_grain_characteristics; H2645SEIAmbientViewingEnvironment ambient_viewing_environment; H2645SEIMasteringDisplay mastering_display; H2645SEIContentLight content_light; AVFilmGrainAFGS1Params aom_film_grain; + + // Dynamic allocations due to large size. + H2645SEIFilmGrainCharacteristics *film_grain_characteristics; } H2645SEI; enum { diff --git a/libavcodec/h264_sei.c b/libavcodec/h264_sei.c index 8d6dc77943..15a5232209 100644 --- a/libavcodec/h264_sei.c +++ b/libavcodec/h264_sei.c @@ -55,7 +55,6 @@ void ff_h264_sei_uninit(H264SEIContext *h) h->picture_timing.present = 0; h->buffering_period.present = 0; h->common.frame_packing.present = 0; - h->common.film_grain_characteristics.present = 0; h->common.display_orientation.present = 0; h->common.afd.present = 0; diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index a66b75ca80..84595b1a8b 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -516,7 +516,10 @@ static int h264_frame_start(H264Context *h) pic->f->crop_top = h->crop_top; pic->f->crop_bottom = h->crop_bottom; - pic->needs_fg = h->sei.common.film_grain_characteristics.present && !h->avctx->hwaccel && + pic->needs_fg = + h->sei.common.film_grain_characteristics && + h->sei.common.film_grain_characteristics->present && + !h->avctx->hwaccel && !(h->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN); if ((ret = alloc_picture(h, pic)) < 0) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 7f1079c669..5dc605f91f 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -411,7 +411,7 @@ static int export_stream_params_from_sei(HEVCContext *s) avctx->color_trc = s->sei.common.alternative_transfer.preferred_transfer_characteristics; } - if (s->sei.common.film_grain_characteristics.present || + if ((s->sei.common.film_grain_characteristics && s->sei.common.film_grain_characteristics->present) || s->sei.common.aom_film_grain.enable) avctx->properties |= FF_CODEC_PROPERTY_FILM_GRAIN; @@ -3236,7 +3236,8 @@ static int hevc_frame_start(HEVCContext *s, HEVCLayerContext *l, else s->cur_frame->f->flags &= ~AV_FRAME_FLAG_KEY; - s->cur_frame->needs_fg = (s->sei.common.film_grain_characteristics.present || + s->cur_frame->needs_fg = ((s->sei.common.film_grain_characteristics && + s->sei.common.film_grain_characteristics->present) || s->sei.common.aom_film_grain.enable) && !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) && !s->avctx->hwaccel; @@ -3246,8 +3247,8 @@ static int hevc_frame_start(HEVCContext *s, HEVCLayerContext *l, goto fail; if (s->cur_frame->needs_fg && - (s->sei.common.film_grain_characteristics.present && - !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id, + (s->sei.common.film_grain_characteristics && s->sei.common.film_grain_characteristics->present && + !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics->model_id, s->cur_frame->f->format) || !av_film_grain_params_select(s->cur_frame->f))) { av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown, From fa15e3839dae0139ffc13fa02a41ff87065096e5 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 9 Nov 2024 11:20:59 -0300 Subject: [PATCH 048/290] avfilter/framepool: align the frame buffers And not just the linesizes. Use the extra align bytes allocated for this purpose. Signed-off-by: James Almer (cherry picked from commit f15fc27db5b30365f2aec474bae9b8095d6d2197) --- libavfilter/framepool.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavfilter/framepool.c b/libavfilter/framepool.c index e8621e07ac..1a1fc0de1e 100644 --- a/libavfilter/framepool.c +++ b/libavfilter/framepool.c @@ -139,7 +139,9 @@ FFFramePool *ff_frame_pool_audio_init(AVBufferRef* (*alloc)(size_t size), if (ret < 0) goto fail; - pool->pools[0] = av_buffer_pool_init(pool->linesize[0], NULL); + if (pool->linesize[0] > SIZE_MAX - align) + goto fail; + pool->pools[0] = av_buffer_pool_init(pool->linesize[0] + align, NULL); if (!pool->pools[0]) goto fail; @@ -219,7 +221,7 @@ AVFrame *ff_frame_pool_get(FFFramePool *pool) if (!frame->buf[i]) goto fail; - frame->data[i] = frame->buf[i]->data; + frame->data[i] = (uint8_t *)FFALIGN((uintptr_t)frame->buf[i]->data, pool->align); } if (desc->flags & AV_PIX_FMT_FLAG_PAL) { @@ -256,13 +258,15 @@ AVFrame *ff_frame_pool_get(FFFramePool *pool) frame->buf[i] = av_buffer_pool_get(pool->pools[0]); if (!frame->buf[i]) goto fail; - frame->extended_data[i] = frame->data[i] = frame->buf[i]->data; + frame->extended_data[i] = frame->data[i] = + (uint8_t *)FFALIGN((uintptr_t)frame->buf[i]->data, pool->align); } for (i = 0; i < frame->nb_extended_buf; i++) { frame->extended_buf[i] = av_buffer_pool_get(pool->pools[0]); if (!frame->extended_buf[i]) goto fail; - frame->extended_data[i + AV_NUM_DATA_POINTERS] = frame->extended_buf[i]->data; + frame->extended_data[i + AV_NUM_DATA_POINTERS] = + (uint8_t *)FFALIGN((uintptr_t)frame->extended_buf[i]->data, pool->align); } break; From 85f389520dbda5054d1379e7270f302ff1eb3b5e Mon Sep 17 00:00:00 2001 From: Pavel Koshevoy Date: Sat, 9 Nov 2024 10:05:16 -0700 Subject: [PATCH 049/290] lavfi/vf_zscale: fix tmp buffer ptr alignment for zimg_filter_graph_process Signed-off-by: James Almer (cherry picked from commit 7b302f4db7d335f4dd42cffb461b2b0db6c00749) --- libavfilter/vf_zscale.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c index b0316f5bb8..d561466c56 100644 --- a/libavfilter/vf_zscale.c +++ b/libavfilter/vf_zscale.c @@ -626,9 +626,12 @@ static int graphs_build(AVFrame *in, AVFrame *out, const AVPixFmtDescriptor *des if (ret) return print_zimg_error(ctx); + if (size > (SIZE_MAX - ZIMG_ALIGNMENT)) + return AVERROR(ENOMEM); + if (s->tmp[job_nr]) av_freep(&s->tmp[job_nr]); - s->tmp[job_nr] = av_calloc(size, 1); + s->tmp[job_nr] = av_mallocz(size + ZIMG_ALIGNMENT); if (!s->tmp[job_nr]) return AVERROR(ENOMEM); @@ -748,7 +751,9 @@ static int filter_slice(AVFilterContext *ctx, void *data, int job_nr, int n_jobs } if (!s->graph[job_nr]) return AVERROR(EINVAL); - ret = zimg_filter_graph_process(s->graph[job_nr], &src_buf, &dst_buf, s->tmp[job_nr], 0, 0, 0, 0); + ret = zimg_filter_graph_process(s->graph[job_nr], &src_buf, &dst_buf, + (uint8_t *)FFALIGN((uintptr_t)s->tmp[job_nr], ZIMG_ALIGNMENT), + 0, 0, 0, 0); if (ret) return print_zimg_error(ctx); @@ -763,7 +768,9 @@ static int filter_slice(AVFilterContext *ctx, void *data, int job_nr, int n_jobs if (!s->alpha_graph[job_nr]) return AVERROR(EINVAL); - ret = zimg_filter_graph_process(s->alpha_graph[job_nr], &src_buf, &dst_buf, s->tmp[job_nr], 0, 0, 0, 0); + ret = zimg_filter_graph_process(s->alpha_graph[job_nr], &src_buf, &dst_buf, + (uint8_t *)FFALIGN((uintptr_t)s->tmp[job_nr], ZIMG_ALIGNMENT), + 0, 0, 0, 0); if (ret) return print_zimg_error(ctx); } From 5b461ffb041e0e24fdf14e36dfc857ae44bed249 Mon Sep 17 00:00:00 2001 From: Pavel Koshevoy Date: Sat, 9 Nov 2024 09:08:26 -0700 Subject: [PATCH 050/290] lavfi/vf_zscale: fix call to av_pix_fmt_count_planes realign_frame called av_pix_fmt_count_planes with incorrect parameter. Signed-off-by: James Almer (cherry picked from commit 00cf3df03f66dca44568b5b5d3e9da35d3597470) --- libavfilter/vf_zscale.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c index d561466c56..a35cd1cdf7 100644 --- a/libavfilter/vf_zscale.c +++ b/libavfilter/vf_zscale.c @@ -664,7 +664,7 @@ static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int ne int ret = 0, plane, planes; /* Realign any unaligned input frame. */ - planes = av_pix_fmt_count_planes(desc->nb_components); + planes = av_pix_fmt_count_planes((*frame)->format); for (plane = 0; plane < planes; plane++) { int p = desc->comp[plane].plane; if ((uintptr_t)(*frame)->data[p] % ZIMG_ALIGNMENT || (*frame)->linesize[p] % ZIMG_ALIGNMENT) { From 99f6adce60727d8e4244d4871baf3907ac545111 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 9 Nov 2024 16:55:38 -0300 Subject: [PATCH 051/290] avfilter/vf_zscale: align the frame buffers Signed-off-by: James Almer (cherry picked from commit c8e5c684b3db1a3131af5d05a3073114bd87477a) --- libavfilter/vf_zscale.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c index a35cd1cdf7..afd22ce6c6 100644 --- a/libavfilter/vf_zscale.c +++ b/libavfilter/vf_zscale.c @@ -658,7 +658,7 @@ static int graphs_build(AVFrame *in, AVFrame *out, const AVPixFmtDescriptor *des return 0; } -static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int needs_copy) +static int realign_frame(AVFilterLink *link, const AVPixFmtDescriptor *desc, AVFrame **frame, int needs_copy) { AVFrame *aligned = NULL; int ret = 0, plane, planes; @@ -668,17 +668,9 @@ static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame, int ne for (plane = 0; plane < planes; plane++) { int p = desc->comp[plane].plane; if ((uintptr_t)(*frame)->data[p] % ZIMG_ALIGNMENT || (*frame)->linesize[p] % ZIMG_ALIGNMENT) { - if (!(aligned = av_frame_alloc())) { - ret = AVERROR(ENOMEM); - goto fail; - } - - aligned->format = (*frame)->format; - aligned->width = (*frame)->width; - aligned->height = (*frame)->height; - - if ((ret = av_frame_get_buffer(aligned, ZIMG_ALIGNMENT)) < 0) - goto fail; + aligned = ff_default_get_video_buffer2(link, (*frame)->width, (*frame)->height, ZIMG_ALIGNMENT); + if (!aligned) + return AVERROR(ENOMEM); if (needs_copy && (ret = av_frame_copy(aligned, *frame)) < 0) goto fail; @@ -807,20 +799,17 @@ static int filter_frame(AVFilterLink *link, AVFrame *in) (s->src_format.pixel_type !=s->dst_format.pixel_type) || (s->src_format.transfer_characteristics !=s->dst_format.transfer_characteristics) ){ - out = ff_get_video_buffer(outlink, outlink->w, outlink->h); + out = ff_default_get_video_buffer2(outlink, outlink->w, outlink->h, ZIMG_ALIGNMENT); if (!out) { ret = AVERROR(ENOMEM); goto fail; } - if ((ret = realign_frame(odesc, &out, 0)) < 0) - goto fail; - av_frame_copy_props(out, in); out->colorspace = outlink->colorspace; out->color_range = outlink->color_range; - if ((ret = realign_frame(desc, &in, 1)) < 0) + if ((ret = realign_frame(link, desc, &in, 1)) < 0) goto fail; snprintf(buf, sizeof(buf)-1, "%d", outlink->w); From 0a58588ffb875066fc8d75ad9b5c93f3dd9e8c28 Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Sun, 3 Nov 2024 22:32:51 +0100 Subject: [PATCH 052/290] avfilter/f_loop: fix length of aloop leftover buffer If the audio loop stops inside an audio frame, the leftover buffer contains the end of the frame, which is not looped. The length supposed to be the part which was not written to the loop buffer, so we need to drain exactly that number of bytes from the leftover buffer. Signed-off-by: Marton Balint (cherry picked from commit b33a59416072ad31a5840f33f9975d88acf45add) --- libavfilter/f_loop.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavfilter/f_loop.c b/libavfilter/f_loop.c index 9b01a85405..3372c77fee 100644 --- a/libavfilter/f_loop.c +++ b/libavfilter/f_loop.c @@ -170,14 +170,13 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame) s->pts += av_rescale_q(s->start - s->ignored_samples, (AVRational){1, outlink->sample_rate}, outlink->time_base); } s->nb_samples += ret - drain; - drain = frame->nb_samples - written; - if (s->nb_samples == s->size && drain > 0) { + if (s->nb_samples == s->size && frame->nb_samples > written) { int ret2; ret2 = av_audio_fifo_write(s->left, (void **)frame->extended_data, frame->nb_samples); if (ret2 < 0) return ret2; - av_audio_fifo_drain(s->left, drain); + av_audio_fifo_drain(s->left, written); } frame->nb_samples = ret; s->pts += av_rescale_q(ret, (AVRational){1, outlink->sample_rate}, outlink->time_base); From b016aae6627128b1657762c8aa4377e4144046fc Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Mon, 4 Nov 2024 00:43:06 +0100 Subject: [PATCH 053/290] avfilter/f_loop: fix aloop activate logic The logic did not follow the documented behaviour and that caused skipping of some audio in the loop and in the leftover buffer. Example command line which should produce a smooth sine wave for the whole duration of the output: ffmpeg -f lavfi -i "sine=r=48000:f=480:d=4" -af "aloop=loop=4:start=48000:size=48000" out.wav Fixes ticket #11283. Signed-off-by: Marton Balint (cherry picked from commit fe18ed3f2a9221af0beaec7b04b7804849db1f2f) --- libavfilter/f_loop.c | 70 ++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 42 deletions(-) diff --git a/libavfilter/f_loop.c b/libavfilter/f_loop.c index 3372c77fee..4e5e8d0e79 100644 --- a/libavfilter/f_loop.c +++ b/libavfilter/f_loop.c @@ -21,6 +21,7 @@ #include "config_components.h" #include "libavutil/audio_fifo.h" +#include "libavutil/avassert.h" #include "libavutil/internal.h" #include "libavutil/mem.h" #include "libavutil/opt.h" @@ -104,7 +105,7 @@ static av_cold void auninit(AVFilterContext *ctx) av_audio_fifo_free(s->left); } -static int push_samples(AVFilterContext *ctx, int nb_samples) +static int push_samples(AVFilterContext *ctx, int nb_samples, AVFrame **frame) { AVFilterLink *outlink = ctx->outputs[0]; LoopContext *s = ctx->priv; @@ -126,9 +127,7 @@ static int push_samples(AVFilterContext *ctx, int nb_samples) i += out->nb_samples; s->current_sample += out->nb_samples; - ret = ff_filter_frame(outlink, out); - if (ret < 0) - return ret; + *frame = out; if (s->current_sample >= s->nb_samples) { s->current_sample = 0; @@ -136,6 +135,8 @@ static int push_samples(AVFilterContext *ctx, int nb_samples) if (s->loop > 0) s->loop--; } + + return 0; } return ret; @@ -182,10 +183,7 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame) s->pts += av_rescale_q(ret, (AVRational){1, outlink->sample_rate}, outlink->time_base); ret = ff_filter_frame(outlink, frame); } else { - int nb_samples = frame->nb_samples; - - av_frame_free(&frame); - ret = push_samples(ctx, nb_samples); + av_assert0(0); } } else { s->ignored_samples += frame->nb_samples; @@ -197,7 +195,7 @@ static int afilter_frame(AVFilterLink *inlink, AVFrame *frame) return ret; } -static int arequest_frame(AVFilterLink *outlink) +static int arequest_frame(AVFilterLink *outlink, AVFrame **frame) { AVFilterContext *ctx = outlink->src; LoopContext *s = ctx->priv; @@ -217,17 +215,11 @@ static int arequest_frame(AVFilterLink *outlink) av_audio_fifo_read(s->left, (void **)out->extended_data, nb_samples); out->pts = s->pts; s->pts += av_rescale_q(nb_samples, (AVRational){1, outlink->sample_rate}, outlink->time_base); - ret = ff_filter_frame(outlink, out); - if (ret < 0) - return ret; + *frame = out; } - ret = ff_request_frame(ctx->inputs[0]); + return 0; } else { - ret = push_samples(ctx, 1024); - } - - if (s->eof && s->nb_samples > 0 && s->loop != 0) { - ret = push_samples(ctx, 1024); + ret = push_samples(ctx, 1024, frame); } return ret; @@ -245,37 +237,31 @@ static int aactivate(AVFilterContext *ctx) update_time(ctx, inlink->time_base); - if (!s->eof && (s->nb_samples < s->size || !s->loop || !s->size)) { - const int in_nb_samples = FFMIN(1024, s->size - s->nb_samples); - if (in_nb_samples == 0) - ret = ff_inlink_consume_frame(inlink, &frame); - else - ret = ff_inlink_consume_samples(inlink, in_nb_samples, in_nb_samples, &frame); - if (ret < 0) - return ret; - if (ret > 0) - return afilter_frame(inlink, frame); - } +retry: + ret = arequest_frame(outlink, &frame); + if (ret < 0) + return ret; + if (frame) + return ff_filter_frame(outlink, frame); - if (!s->eof && ff_inlink_acknowledge_status(inlink, &status, &s->eof_pts)) { - if (status == AVERROR_EOF) { + ret = ff_inlink_consume_frame(inlink, &frame); + if (ret < 0) + return ret; + if (ret > 0) + return afilter_frame(inlink, frame); + + ret = ff_inlink_acknowledge_status(inlink, &status, &s->eof_pts); + if (ret) { + if (status == AVERROR_EOF && !s->eof) { s->size = s->nb_samples; s->eof = 1; + goto retry; } - } - - if (s->eof && (!s->loop || !s->size)) { - ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts + s->pts_offset); + ff_outlink_set_status(outlink, status, s->eof_pts); return 0; } - if (!s->eof && (!s->size || - (s->nb_samples < s->size) || - (s->nb_samples >= s->size && s->loop == 0))) { - FF_FILTER_FORWARD_WANTED(outlink, inlink); - } else if (s->loop && s->nb_samples == s->size) { - return arequest_frame(outlink); - } + FF_FILTER_FORWARD_WANTED(outlink, inlink); return FFERROR_NOT_READY; } From 20c8a3f5ff83e06fa6fc66dc18cedbc8f43d938b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= Date: Sun, 17 Nov 2024 11:15:01 +0200 Subject: [PATCH 054/290] lavu/riscv: fix compilation without Vector support The half-baked assembler in Clang 16 and earlier can't process our RISC-V assembler. This adds yet another work around that. If you must use Clang, please use version 17 or later. (cherry picked from commit e29432e6bbb6184d3ff2c7d1e070e9424cb25fe6) --- libavutil/riscv/cpu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/riscv/cpu.h b/libavutil/riscv/cpu.h index 191e4478c5..f2e6b7b430 100644 --- a/libavutil/riscv/cpu.h +++ b/libavutil/riscv/cpu.h @@ -56,7 +56,6 @@ static inline size_t ff_get_rv_vlenb(void) ".option pop\n" : "=r" (vlenb)); return vlenb; } -#endif /** * Checks that the vector bit-size is at least the given value. @@ -78,3 +77,4 @@ static inline bool ff_rv_vlen_least(unsigned int bits) return bits <= (8 * ff_get_rv_vlenb()); } #endif +#endif /* HAVE_RVV */ From ac4c725944d9923c3b696e6809c9da1d9d5df9fe Mon Sep 17 00:00:00 2001 From: Brad Smith Date: Mon, 21 Oct 2024 11:57:44 -0400 Subject: [PATCH 055/290] libavutil/ppc: Include the hardware feature flags like the other archs Also include the hardware feature flags like the other archs do and clean up the code a bit. Tested on Linux POWER9. Signed-off-by: Brad Smith (cherry picked from commit d6b2d08fc7283da7a5db7a64d9a3047ed1ba0de1) Signed-off-by: Brad Smith --- libavutil/ppc/cpu.c | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/libavutil/ppc/cpu.c b/libavutil/ppc/cpu.c index 9381272175..62d495ec1d 100644 --- a/libavutil/ppc/cpu.c +++ b/libavutil/ppc/cpu.c @@ -46,6 +46,17 @@ #include "libavutil/cpu.h" #include "libavutil/cpu_internal.h" +#ifndef AT_HWCAP +#define AT_HWCAP 16 +#endif +#ifndef AT_HWCAP2 +#define AT_HWCAP2 26 +#endif + +#define HWCAP_PPC_VSX (1 << 7) +#define HWCAP_PPC_ALTIVEC (1 << 28) +#define HWCAP2_PPC_ARCH_2_07 (1 << 31) + /** * This function MAY rely on signal() or fork() in order to make sure AltiVec * is present. @@ -65,20 +76,14 @@ int ff_get_cpu_flags_ppc(void) int flags = 0; unsigned long hwcap = ff_getauxval(AT_HWCAP); -#ifdef PPC_FEATURE2_ARCH_2_07 unsigned long hwcap2 = ff_getauxval(AT_HWCAP2); -#endif - if (hwcap & PPC_FEATURE_HAS_ALTIVEC) + if (hwcap & HWCAP_PPC_ALTIVEC) flags |= AV_CPU_FLAG_ALTIVEC; -#ifdef PPC_FEATURE_HAS_VSX - if (hwcap & PPC_FEATURE_HAS_VSX) + if (hwcap & HWCAP_PPC_VSX) flags |= AV_CPU_FLAG_VSX; -#endif -#ifdef PPC_FEATURE2_ARCH_2_07 - if (hwcap2 & PPC_FEATURE2_ARCH_2_07) + if (hwcap2 & HWCAP2_PPC_ARCH_2_07) flags |= AV_CPU_FLAG_POWER8; -#endif return flags; #elif defined(__APPLE__) || defined(__NetBSD__) || defined(__OpenBSD__) @@ -112,23 +117,17 @@ int ff_get_cpu_flags_ppc(void) if (buf[i] == AT_NULL) goto out; if (buf[i] == AT_HWCAP) { - if (buf[i + 1] & PPC_FEATURE_HAS_ALTIVEC) + if (buf[i + 1] & HWCAP_PPC_ALTIVEC) ret = AV_CPU_FLAG_ALTIVEC; -#ifdef PPC_FEATURE_HAS_VSX - if (buf[i + 1] & PPC_FEATURE_HAS_VSX) + if (buf[i + 1] & HWCAP_PPC_VSX) ret |= AV_CPU_FLAG_VSX; -#endif if (ret & AV_CPU_FLAG_VSX) av_assert0(ret & AV_CPU_FLAG_ALTIVEC); } -#ifdef AT_HWCAP2 /* not introduced until glibc 2.18 */ else if (buf[i] == AT_HWCAP2) { -#ifdef PPC_FEATURE2_ARCH_2_07 - if (buf[i + 1] & PPC_FEATURE2_ARCH_2_07) + if (buf[i + 1] & HWCAP2_PPC_ARCH_2_07) ret |= AV_CPU_FLAG_POWER8; -#endif } -#endif /* AT_HWCAP2 */ } } From 0c641ee6610ed3bc8a06040c32ea280649d427b0 Mon Sep 17 00:00:00 2001 From: Sean McGovern Date: Sun, 3 Nov 2024 21:58:43 -0500 Subject: [PATCH 056/290] libavutil/ppc: defines involving bit shifts should be unsigned Otherwise, these can overflow at the boundaries of the integer type. Signed-off-by: Brad Smith (cherry picked from commit c325f9c619b38614ab6e339cefacd596266db471) Signed-off-by: Brad Smith --- libavutil/ppc/cpu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavutil/ppc/cpu.c b/libavutil/ppc/cpu.c index 62d495ec1d..9f9c073434 100644 --- a/libavutil/ppc/cpu.c +++ b/libavutil/ppc/cpu.c @@ -53,9 +53,9 @@ #define AT_HWCAP2 26 #endif -#define HWCAP_PPC_VSX (1 << 7) -#define HWCAP_PPC_ALTIVEC (1 << 28) -#define HWCAP2_PPC_ARCH_2_07 (1 << 31) +#define HWCAP_PPC_VSX (1U << 7) +#define HWCAP_PPC_ALTIVEC (1U << 28) +#define HWCAP2_PPC_ARCH_2_07 (1U << 31) /** * This function MAY rely on signal() or fork() in order to make sure AltiVec From 64e2864cb983d30162dc9003b5aae81e89c929cd Mon Sep 17 00:00:00 2001 From: Brad Smith Date: Sun, 17 Nov 2024 21:02:39 -0500 Subject: [PATCH 057/290] libavutil/riscv: Make use of elf_aux_info() on FreeBSD / OpenBSD riscv MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit libavutil/riscv: Make use of elf_aux_info() on FreeBSD / OpenBSD riscv FreeBSD/OpenBSD riscv have elf_aux_info(). Signed-off-by: Brad Smith Signed-off-by: Rémi Denis-Courmont (cherry picked from commit f3eca3f387092c596f035a126fba15a30c3a9499) Signed-off-by: Brad Smith --- libavutil/riscv/cpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavutil/riscv/cpu.c b/libavutil/riscv/cpu.c index 4ec6d6c826..163e4fc14a 100644 --- a/libavutil/riscv/cpu.c +++ b/libavutil/riscv/cpu.c @@ -25,7 +25,7 @@ #include "libavutil/log.h" #include "config.h" -#if HAVE_GETAUXVAL +#if HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO #include #define HWCAP_RV(letter) (1ul << ((letter) - 'A')) #endif @@ -84,7 +84,7 @@ int ff_get_cpu_flags_riscv(void) default: } } -#elif HAVE_GETAUXVAL +#elif HAVE_GETAUXVAL || HAVE_ELF_AUX_INFO { const unsigned long hwcap = ff_getauxval(AT_HWCAP); From 3513ccccb650a920ea7da964f0415476c6525fb0 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 17 Nov 2024 23:01:37 -0300 Subject: [PATCH 058/290] avformat/movenc: don't write a calculated avgBitrate when the provided one is unset avgBitrate == 0 is used to signal a VBR track, so if that value is propagated by an encoder, don't overwrite it with a calculated value based on track size. Part of a fix for ticket #11303. Signed-off-by: James Almer (cherry picked from commit 944212acad7c2254d9dc14764b29e0023aaa645a) --- libavformat/movenc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index d20e45cf81..a365ebe921 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -737,6 +737,9 @@ static struct mpeg4_bit_rate_values calculate_mpeg4_bit_rates(MOVTrack *track) // utilize values from properties if we have them available if (props) { + // no avg_bitrate signals that the track is VBR + if (!props->avg_bitrate) + bit_rates.avg_bit_rate = props->avg_bitrate; bit_rates.max_bit_rate = FFMAX(bit_rates.max_bit_rate, props->max_bitrate); bit_rates.buffer_size = props->buffer_size / 8; From cb997ccd09737b31220c7c2bc04934ceda9702e7 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 17 Nov 2024 23:01:38 -0300 Subject: [PATCH 059/290] avcodec/libfdk-aacenc: export CPB properties Needed to signal the muxer that the stream is VBR. Finishes fixing ticket #11303. Signed-off-by: James Almer (cherry picked from commit 46c6ca3ed1651c67faf899776f1922c108093a44) --- libavcodec/libfdk-aacenc.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavcodec/libfdk-aacenc.c b/libavcodec/libfdk-aacenc.c index 0f33cdb8c9..cc0ae0d8da 100644 --- a/libavcodec/libfdk-aacenc.c +++ b/libavcodec/libfdk-aacenc.c @@ -178,6 +178,7 @@ static av_cold int aac_encode_init(AVCodecContext *avctx) AACContext *s = avctx->priv_data; int ret = AVERROR(EINVAL); AACENC_InfoStruct info = { 0 }; + AVCPBProperties *cpb_props; CHANNEL_MODE mode; AACENC_ERROR err; int aot = AV_PROFILE_AAC_LOW + 1; @@ -438,6 +439,14 @@ static av_cold int aac_encode_init(AVCodecContext *avctx) memcpy(avctx->extradata, info.confBuf, info.confSize); } + + cpb_props = ff_encode_add_cpb_side_data(avctx); + if (!cpb_props) + return AVERROR(ENOMEM); + cpb_props->max_bitrate = + cpb_props->min_bitrate = + cpb_props->avg_bitrate = avctx->bit_rate; + return 0; error: aac_encode_close(avctx); From 8fa5fa1463025ca38fab3099fe5adb337727bdaa Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 15 Nov 2024 20:14:37 -0300 Subject: [PATCH 060/290] avformat/movenc: don't disable edit lists when writing CMAF output They are needed for audio tracks with priming samples, where negative CTS offsets can't be used. Fixes ticket #11031. Signed-off-by: James Almer (cherry picked from commit ecc7d5db9c8a1aaccc876dc4b549558eadfe140a) --- libavformat/movenc.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index a365ebe921..da58a7ab15 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -7666,19 +7666,11 @@ static int mov_init(AVFormatContext *s) s->avoid_negative_ts == AVFMT_AVOID_NEG_TS_MAKE_ZERO) mov->use_editlist = 0; } - if (mov->flags & FF_MOV_FLAG_CMAF) { - // CMAF Track requires negative cts offsets without edit lists - mov->use_editlist = 0; - } } if (mov->flags & FF_MOV_FLAG_EMPTY_MOOV && !(mov->flags & FF_MOV_FLAG_DELAY_MOOV) && mov->use_editlist) av_log(s, AV_LOG_WARNING, "No meaningful edit list will be written when using empty_moov without delay_moov\n"); - if (mov->flags & FF_MOV_FLAG_CMAF && mov->use_editlist) { - av_log(s, AV_LOG_WARNING, "Edit list enabled; Assuming writing CMAF Track File\n"); - mov->flags &= ~FF_MOV_FLAG_NEGATIVE_CTS_OFFSETS; - } if (!mov->use_editlist && s->avoid_negative_ts == AVFMT_AVOID_NEG_TS_AUTO && !(mov->flags & FF_MOV_FLAG_NEGATIVE_CTS_OFFSETS)) s->avoid_negative_ts = AVFMT_AVOID_NEG_TS_MAKE_ZERO; From e07d7c75dbfd1ef5c9233fea63bb29ddf567283f Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:44:46 -0300 Subject: [PATCH 061/290] avformat/spdifdec: parse headers for audio codecs Signed-off-by: James Almer (cherry picked from commit 4e6d31755bf8d0355418d19725ee947e6c0536c0) --- libavformat/spdifdec.c | 2 + tests/ref/fate/spdif-dca-core-remux | 14 +- tests/ref/fate/spdif-dca-master-core-remux | 2344 ++++++++++---------- 3 files changed, 1181 insertions(+), 1179 deletions(-) diff --git a/libavformat/spdifdec.c b/libavformat/spdifdec.c index 6a01f2ba29..dcfe471f45 100644 --- a/libavformat/spdifdec.c +++ b/libavformat/spdifdec.c @@ -236,6 +236,8 @@ int ff_spdif_read_packet(AVFormatContext *s, AVPacket *pkt) st->codecpar->codec_id = codec_id; if (codec_id == AV_CODEC_ID_EAC3) ffstream(st)->need_parsing = AVSTREAM_PARSE_FULL; + else + ffstream(st)->need_parsing = AVSTREAM_PARSE_HEADERS; } else if (codec_id != s->streams[0]->codecpar->codec_id) { avpriv_report_missing_feature(s, "Codec change in IEC 61937"); return AVERROR_PATCHWELCOME; diff --git a/tests/ref/fate/spdif-dca-core-remux b/tests/ref/fate/spdif-dca-core-remux index a74b8a41a9..4fcbf8c5d1 100644 --- a/tests/ref/fate/spdif-dca-core-remux +++ b/tests/ref/fate/spdif-dca-core-remux @@ -5,10 +5,10 @@ a4e739ebe07c75dd569156d5038696a9 *tests/data/fate/spdif-dca-core-remux.spdif #codec_id 0: dts #sample_rate 0: 48000 #channel_layout_name 0: 5.1(side) -0, 0, 0, 0, 1024, 0x07b79d2a -0, 0, 0, 0, 1024, 0x7eaaba77 -0, 0, 0, 0, 1024, 0xbed65c1d -0, 0, 0, 0, 1024, 0x10bc6792 -0, 0, 0, 0, 1024, 0xf8436f6e -0, 0, 0, 0, 1024, 0x4454a681 -0, 0, 0, 0, 1024, 0xda3ba189 +0, 0, 0, 960, 1024, 0x07b79d2a +0, 960, 960, 960, 1024, 0x7eaaba77 +0, 1920, 1920, 960, 1024, 0xbed65c1d +0, 2880, 2880, 960, 1024, 0x10bc6792 +0, 3840, 3840, 960, 1024, 0xf8436f6e +0, 4800, 4800, 960, 1024, 0x4454a681 +0, 5760, 5760, 960, 1024, 0xda3ba189 diff --git a/tests/ref/fate/spdif-dca-master-core-remux b/tests/ref/fate/spdif-dca-master-core-remux index de6f128186..d6cfeefb5a 100644 --- a/tests/ref/fate/spdif-dca-master-core-remux +++ b/tests/ref/fate/spdif-dca-master-core-remux @@ -5,1175 +5,1175 @@ c4f3f3c6ca73fcb7beac137105dadab4 *tests/data/fate/spdif-dca-master-core-remux.sp #codec_id 0: dts #sample_rate 0: 48000 #channel_layout_name 0: 5.1(side) -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xbe7b9e5e -0, 0, 0, 0, 2012, 0x671dc73a -0, 0, 0, 0, 2012, 0x7fd5b1d2 -0, 0, 0, 0, 2012, 0xa9259df1 -0, 0, 0, 0, 2012, 0x3e8c2b92 -0, 0, 0, 0, 2012, 0x4876a9ff -0, 0, 0, 0, 2012, 0x7e469182 -0, 0, 0, 0, 2012, 0x10eba401 -0, 0, 0, 0, 2012, 0x51c68ed3 -0, 0, 0, 0, 2012, 0x3f52901b -0, 0, 0, 0, 2012, 0x7bebacce -0, 0, 0, 0, 2012, 0xcb94898d -0, 0, 0, 0, 2012, 0x14e3ae70 -0, 0, 0, 0, 2012, 0x016893cb -0, 0, 0, 0, 2012, 0x00739f0a -0, 0, 0, 0, 2012, 0x834aba41 -0, 0, 0, 0, 2012, 0x6a92ac08 -0, 0, 0, 0, 2012, 0x09eda257 -0, 0, 0, 0, 2012, 0x81449e3f -0, 0, 0, 0, 2012, 0xe6eb91d4 -0, 0, 0, 0, 2012, 0x51158c0e -0, 0, 0, 0, 2012, 0x84e4a013 -0, 0, 0, 0, 2012, 0x4c48a0e6 -0, 0, 0, 0, 2012, 0xf54c9811 -0, 0, 0, 0, 2012, 0x62778edb -0, 0, 0, 0, 2012, 0x7226a51b -0, 0, 0, 0, 2012, 0x44b9aad8 -0, 0, 0, 0, 2012, 0x8aa6b380 -0, 0, 0, 0, 2012, 0xc88c99e6 -0, 0, 0, 0, 2012, 0xed5e93e2 -0, 0, 0, 0, 2012, 0xeb0b9755 -0, 0, 0, 0, 2012, 0xe5ba8ca9 -0, 0, 0, 0, 2012, 0x2fef9bcf -0, 0, 0, 0, 2012, 0xf19c8749 -0, 0, 0, 0, 2012, 0x0feb94d0 -0, 0, 0, 0, 2012, 0x1f9194d1 -0, 0, 0, 0, 2012, 0x0cad9822 -0, 0, 0, 0, 2012, 0xe6f79152 -0, 0, 0, 0, 2012, 0x69e78955 -0, 0, 0, 0, 2012, 0x91dd8a1b -0, 0, 0, 0, 2012, 0x63fe8eea -0, 0, 0, 0, 2012, 0x8f6d90a2 -0, 0, 0, 0, 2012, 0xe3bf8626 -0, 0, 0, 0, 2012, 0xd08599db -0, 0, 0, 0, 2012, 0xf556a282 -0, 0, 0, 0, 2012, 0x7f8c8f90 -0, 0, 0, 0, 2012, 0xa04493b9 -0, 0, 0, 0, 2012, 0x21a19b3a -0, 0, 0, 0, 2012, 0x6ead9244 -0, 0, 0, 0, 2012, 0xe65290d7 -0, 0, 0, 0, 2012, 0x8ff58a8e -0, 0, 0, 0, 2012, 0x24ada603 -0, 0, 0, 0, 2012, 0x79cb85c7 -0, 0, 0, 0, 2012, 0x63c0ac54 -0, 0, 0, 0, 2012, 0x7f719f83 -0, 0, 0, 0, 2012, 0x2eb69654 -0, 0, 0, 0, 2012, 0xf5149bc0 -0, 0, 0, 0, 2012, 0xd0d6a414 -0, 0, 0, 0, 2012, 0x4f4a8ed3 -0, 0, 0, 0, 2012, 0x20888cb5 -0, 0, 0, 0, 2012, 0x13439c86 -0, 0, 0, 0, 2012, 0xc8fc98e1 -0, 0, 0, 0, 2012, 0x14689766 -0, 0, 0, 0, 2012, 0x830293e4 -0, 0, 0, 0, 2012, 0xdd5bb8ce -0, 0, 0, 0, 2012, 0x005ea280 -0, 0, 0, 0, 2012, 0x9b0581e2 -0, 0, 0, 0, 2012, 0x210f89b8 -0, 0, 0, 0, 2012, 0xb7c180bd -0, 0, 0, 0, 2012, 0xe53c85e4 -0, 0, 0, 0, 2012, 0x1f689207 -0, 0, 0, 0, 2012, 0x5653813b -0, 0, 0, 0, 2012, 0x1d278d66 -0, 0, 0, 0, 2012, 0xd94c9a83 -0, 0, 0, 0, 2012, 0x7af48548 -0, 0, 0, 0, 2012, 0x86209c99 -0, 0, 0, 0, 2012, 0x6e3b7fc9 -0, 0, 0, 0, 2012, 0x41c289e7 -0, 0, 0, 0, 2012, 0x8bea85db -0, 0, 0, 0, 2012, 0x45c98c39 -0, 0, 0, 0, 2012, 0xee098755 -0, 0, 0, 0, 2012, 0x485d9ec1 -0, 0, 0, 0, 2012, 0x78819023 -0, 0, 0, 0, 2012, 0xf43377bd -0, 0, 0, 0, 2012, 0x43fc9439 -0, 0, 0, 0, 2012, 0x045e9bf3 -0, 0, 0, 0, 2012, 0x0fc09f0c -0, 0, 0, 0, 2012, 0x7ba69bf5 -0, 0, 0, 0, 2012, 0x4aa7aaf0 -0, 0, 0, 0, 2012, 0x620c85bf -0, 0, 0, 0, 2012, 0xa6bb8a30 -0, 0, 0, 0, 2012, 0xfd10883c -0, 0, 0, 0, 2012, 0x32037e17 -0, 0, 0, 0, 2012, 0xb18c9e01 -0, 0, 0, 0, 2012, 0xd8206ee5 -0, 0, 0, 0, 2012, 0xdbc49136 -0, 0, 0, 0, 2012, 0x650a785d -0, 0, 0, 0, 2012, 0x9e107d61 -0, 0, 0, 0, 2012, 0xbf4eac50 -0, 0, 0, 0, 2012, 0x9d8f79b2 -0, 0, 0, 0, 2012, 0x252d8e8a -0, 0, 0, 0, 2012, 0x00af8fd6 -0, 0, 0, 0, 2012, 0x9e388d3b -0, 0, 0, 0, 2012, 0x75de7f56 -0, 0, 0, 0, 2012, 0xd502839c -0, 0, 0, 0, 2012, 0x66709e03 -0, 0, 0, 0, 2012, 0x3e0a96ba -0, 0, 0, 0, 2012, 0x0813ad4e -0, 0, 0, 0, 2012, 0x799c90c5 -0, 0, 0, 0, 2012, 0x98a18bed -0, 0, 0, 0, 2012, 0x8cd197d7 -0, 0, 0, 0, 2012, 0xf9ea8b22 -0, 0, 0, 0, 2012, 0x674f7cd2 -0, 0, 0, 0, 2012, 0xa5c39136 -0, 0, 0, 0, 2012, 0xe064ac30 -0, 0, 0, 0, 2012, 0x2af78c75 -0, 0, 0, 0, 2012, 0x43df9b19 -0, 0, 0, 0, 2012, 0x8d1a87d5 -0, 0, 0, 0, 2012, 0xd5be8d29 -0, 0, 0, 0, 2012, 0x43448bd4 -0, 0, 0, 0, 2012, 0xa128a30b -0, 0, 0, 0, 2012, 0x6fc29902 -0, 0, 0, 0, 2012, 0x5854a24b -0, 0, 0, 0, 2012, 0xb222958a -0, 0, 0, 0, 2012, 0xfca39cce -0, 0, 0, 0, 2012, 0xee0087f0 -0, 0, 0, 0, 2012, 0xd2d69b8c -0, 0, 0, 0, 2012, 0xe2308f8d -0, 0, 0, 0, 2012, 0x8dc4b09a -0, 0, 0, 0, 2012, 0x14489aef -0, 0, 0, 0, 2012, 0x900f9835 -0, 0, 0, 0, 2012, 0x0092a95f -0, 0, 0, 0, 2012, 0xfd90b1bf -0, 0, 0, 0, 2012, 0xb11ab5d5 -0, 0, 0, 0, 2012, 0xc802b908 -0, 0, 0, 0, 2012, 0xb12aa91e -0, 0, 0, 0, 2012, 0xd173c2a9 -0, 0, 0, 0, 2012, 0xaeafb887 -0, 0, 0, 0, 2012, 0xeb7eb0d7 -0, 0, 0, 0, 2012, 0x9afbc56a -0, 0, 0, 0, 2012, 0x2d78bc34 -0, 0, 0, 0, 2012, 0x6550aed1 -0, 0, 0, 0, 2012, 0xd514a55d -0, 0, 0, 0, 2012, 0x9058c263 -0, 0, 0, 0, 2012, 0xf819b66a -0, 0, 0, 0, 2012, 0x16a5c902 -0, 0, 0, 0, 2012, 0x602fc11b -0, 0, 0, 0, 2012, 0xe3c6b177 -0, 0, 0, 0, 2012, 0xacc4cd06 -0, 0, 0, 0, 2012, 0xeb96addb -0, 0, 0, 0, 2012, 0x1195cad3 -0, 0, 0, 0, 2012, 0x8e96ad7f -0, 0, 0, 0, 2012, 0x31e592b7 -0, 0, 0, 0, 2012, 0xa0c5ccf0 -0, 0, 0, 0, 2012, 0x6e77c92b -0, 0, 0, 0, 2012, 0xe87fa928 -0, 0, 0, 0, 2012, 0x4923bcdb -0, 0, 0, 0, 2012, 0x3260b452 -0, 0, 0, 0, 2012, 0x62beafa0 -0, 0, 0, 0, 2012, 0x5a6fc18a -0, 0, 0, 0, 2012, 0x9d05ae87 -0, 0, 0, 0, 2012, 0xb577a54e -0, 0, 0, 0, 2012, 0xd66bc5ef -0, 0, 0, 0, 2012, 0x40bec7bb -0, 0, 0, 0, 2012, 0xedd3a1b9 -0, 0, 0, 0, 2012, 0xf6f49f83 -0, 0, 0, 0, 2012, 0x316fb06d -0, 0, 0, 0, 2012, 0xc3f3a874 -0, 0, 0, 0, 2012, 0x3a96b3bd -0, 0, 0, 0, 2012, 0x825aba30 -0, 0, 0, 0, 2012, 0x5b58ce66 -0, 0, 0, 0, 2012, 0x412dc092 -0, 0, 0, 0, 2012, 0xcb47bfa3 -0, 0, 0, 0, 2012, 0xe025bb79 -0, 0, 0, 0, 2012, 0x0042ba53 -0, 0, 0, 0, 2012, 0x7e9bba1d -0, 0, 0, 0, 2012, 0x0058c99d -0, 0, 0, 0, 2012, 0x47d2b590 -0, 0, 0, 0, 2012, 0xdf4ba9c6 -0, 0, 0, 0, 2012, 0xe671987c -0, 0, 0, 0, 2012, 0x90dccc89 -0, 0, 0, 0, 2012, 0x012ccae9 -0, 0, 0, 0, 2012, 0x2eb5b83e -0, 0, 0, 0, 2012, 0x3fecb7f4 -0, 0, 0, 0, 2012, 0x7955a464 -0, 0, 0, 0, 2012, 0xfe9eb3c3 -0, 0, 0, 0, 2012, 0x7457c904 -0, 0, 0, 0, 2012, 0xd23ea69d -0, 0, 0, 0, 2012, 0xc497bf82 -0, 0, 0, 0, 2012, 0x15e5c241 -0, 0, 0, 0, 2012, 0x3dfea71f -0, 0, 0, 0, 2012, 0x1e59c9c0 -0, 0, 0, 0, 2012, 0x1a34b927 -0, 0, 0, 0, 2012, 0xbf42b430 -0, 0, 0, 0, 2012, 0xf084c29f -0, 0, 0, 0, 2012, 0x6443c44a -0, 0, 0, 0, 2012, 0x7985a4a5 -0, 0, 0, 0, 2012, 0x27add059 -0, 0, 0, 0, 2012, 0x7f1faea4 -0, 0, 0, 0, 2012, 0x8d9dc732 -0, 0, 0, 0, 2012, 0xf272c32e -0, 0, 0, 0, 2012, 0x4fa3ab11 -0, 0, 0, 0, 2012, 0x512e9887 -0, 0, 0, 0, 2012, 0xd478d55b -0, 0, 0, 0, 2012, 0xa94a9d93 -0, 0, 0, 0, 2012, 0xff73d812 -0, 0, 0, 0, 2012, 0xd3a6b9ef -0, 0, 0, 0, 2012, 0x7b4ebc1e -0, 0, 0, 0, 2012, 0xcc7bba1a -0, 0, 0, 0, 2012, 0x1aa7cd1a -0, 0, 0, 0, 2012, 0xd707c202 -0, 0, 0, 0, 2012, 0xcb6ac18b -0, 0, 0, 0, 2012, 0x1ccdcbd6 -0, 0, 0, 0, 2012, 0x700cb51e -0, 0, 0, 0, 2012, 0x27b6a3e7 -0, 0, 0, 0, 2012, 0x8570b8cd -0, 0, 0, 0, 2012, 0x22f2b2ed -0, 0, 0, 0, 2012, 0x75edb63e -0, 0, 0, 0, 2012, 0x8145b53f -0, 0, 0, 0, 2012, 0x15efb8bc -0, 0, 0, 0, 2012, 0x200bb5e6 -0, 0, 0, 0, 2012, 0xfa79b178 -0, 0, 0, 0, 2012, 0xbd39cdf4 -0, 0, 0, 0, 2012, 0x0970b0b2 -0, 0, 0, 0, 2012, 0x1acebe72 -0, 0, 0, 0, 2012, 0x1a26aa71 -0, 0, 0, 0, 2012, 0x8f71aa54 -0, 0, 0, 0, 2012, 0x0265c523 -0, 0, 0, 0, 2012, 0x2df0a53b -0, 0, 0, 0, 2012, 0x59a7a37a -0, 0, 0, 0, 2012, 0x9ad9acda -0, 0, 0, 0, 2012, 0x738cbc6f -0, 0, 0, 0, 2012, 0xc646a7ad -0, 0, 0, 0, 2012, 0x7f25c19b -0, 0, 0, 0, 2012, 0x1439bdb0 -0, 0, 0, 0, 2012, 0xa40cbef0 -0, 0, 0, 0, 2012, 0x9b09b99a -0, 0, 0, 0, 2012, 0x5ff0bbde -0, 0, 0, 0, 2012, 0x3981c2d6 -0, 0, 0, 0, 2012, 0xfa89b40d -0, 0, 0, 0, 2012, 0x12e9a7b9 -0, 0, 0, 0, 2012, 0xc5faaac3 -0, 0, 0, 0, 2012, 0xe12bc3a9 -0, 0, 0, 0, 2012, 0x9c57b8f3 -0, 0, 0, 0, 2012, 0x4fd4b6c0 -0, 0, 0, 0, 2012, 0xb72cca50 -0, 0, 0, 0, 2012, 0xb4d4cbbb -0, 0, 0, 0, 2012, 0x9399bfa1 -0, 0, 0, 0, 2012, 0x0abfb708 -0, 0, 0, 0, 2012, 0xd1d9acc0 -0, 0, 0, 0, 2012, 0x079ab5b2 -0, 0, 0, 0, 2012, 0x05a0be32 -0, 0, 0, 0, 2012, 0x445cc8db -0, 0, 0, 0, 2012, 0xf9a3aa71 -0, 0, 0, 0, 2012, 0xd2e29eac -0, 0, 0, 0, 2012, 0x391a9f20 -0, 0, 0, 0, 2012, 0x571eab4e -0, 0, 0, 0, 2012, 0x6962bc96 -0, 0, 0, 0, 2012, 0x2f04b495 -0, 0, 0, 0, 2012, 0x7b66bab7 -0, 0, 0, 0, 2012, 0xa718b8c9 -0, 0, 0, 0, 2012, 0xb069a54e -0, 0, 0, 0, 2012, 0xc052a1d2 -0, 0, 0, 0, 2012, 0x661ac62e -0, 0, 0, 0, 2012, 0xc4ebb529 -0, 0, 0, 0, 2012, 0xf998b251 -0, 0, 0, 0, 2012, 0x0ee8bffa -0, 0, 0, 0, 2012, 0x6e3fd984 -0, 0, 0, 0, 2012, 0x5825b63f -0, 0, 0, 0, 2012, 0x9c79c561 -0, 0, 0, 0, 2012, 0x3470beb7 -0, 0, 0, 0, 2012, 0x9135bd9d -0, 0, 0, 0, 2012, 0xd8e8bb7f -0, 0, 0, 0, 2012, 0x322ea448 -0, 0, 0, 0, 2012, 0xe974b3ab -0, 0, 0, 0, 2012, 0x4151c32d -0, 0, 0, 0, 2012, 0x2b05bf7d -0, 0, 0, 0, 2012, 0x4111c0d8 -0, 0, 0, 0, 2012, 0xff9ad574 -0, 0, 0, 0, 2012, 0xa55dced2 -0, 0, 0, 0, 2012, 0x11e6c0cb -0, 0, 0, 0, 2012, 0x2478b998 -0, 0, 0, 0, 2012, 0xdc8abb54 -0, 0, 0, 0, 2012, 0xe16da510 -0, 0, 0, 0, 2012, 0xfc18b3db -0, 0, 0, 0, 2012, 0x1426cd42 -0, 0, 0, 0, 2012, 0xb560a661 -0, 0, 0, 0, 2012, 0xc200aa4b -0, 0, 0, 0, 2012, 0xea00af2a -0, 0, 0, 0, 2012, 0x32bcbf84 -0, 0, 0, 0, 2012, 0x4c29cb2a -0, 0, 0, 0, 2012, 0xe8a2aabc -0, 0, 0, 0, 2012, 0x64bdb6cd -0, 0, 0, 0, 2012, 0x3a80adbc -0, 0, 0, 0, 2012, 0xa012b2c4 -0, 0, 0, 0, 2012, 0xac3ebce7 -0, 0, 0, 0, 2012, 0xfae1b2a7 -0, 0, 0, 0, 2012, 0x37b4ddae -0, 0, 0, 0, 2012, 0x8ff9bd55 -0, 0, 0, 0, 2012, 0x16f6abeb -0, 0, 0, 0, 2012, 0x5820badf -0, 0, 0, 0, 2012, 0x7183b45e -0, 0, 0, 0, 2012, 0xc0a6c826 -0, 0, 0, 0, 2012, 0x4c36bb02 -0, 0, 0, 0, 2012, 0xda46b854 -0, 0, 0, 0, 2012, 0xcc8accb6 -0, 0, 0, 0, 2012, 0xa6b2c3a2 -0, 0, 0, 0, 2012, 0x1c91cc00 -0, 0, 0, 0, 2012, 0xf33cd721 -0, 0, 0, 0, 2012, 0x7f86d2ed -0, 0, 0, 0, 2012, 0x9fdabb1d -0, 0, 0, 0, 2012, 0x33ebbbc4 -0, 0, 0, 0, 2012, 0x2741ba4f -0, 0, 0, 0, 2012, 0x0d0dd107 -0, 0, 0, 0, 2012, 0xf1d5b551 -0, 0, 0, 0, 2012, 0xf47dbebc -0, 0, 0, 0, 2012, 0xa955cea3 -0, 0, 0, 0, 2012, 0x51d6b407 -0, 0, 0, 0, 2012, 0xb7d3c2c0 -0, 0, 0, 0, 2012, 0xce3cc6ae -0, 0, 0, 0, 2012, 0x782cc184 -0, 0, 0, 0, 2012, 0xf4cec2af -0, 0, 0, 0, 2012, 0xa43eb295 -0, 0, 0, 0, 2012, 0xc74aa62d -0, 0, 0, 0, 2012, 0xf9dfc11f -0, 0, 0, 0, 2012, 0x3da1a319 -0, 0, 0, 0, 2012, 0xf613bd75 -0, 0, 0, 0, 2012, 0x10d9cda4 -0, 0, 0, 0, 2012, 0x08c9bcb3 -0, 0, 0, 0, 2012, 0x43b9d170 -0, 0, 0, 0, 2012, 0x1f0db940 -0, 0, 0, 0, 2012, 0x3c4ec614 -0, 0, 0, 0, 2012, 0xa94abaaa -0, 0, 0, 0, 2012, 0x2557a922 -0, 0, 0, 0, 2012, 0x4245c4b4 -0, 0, 0, 0, 2012, 0x0cb1b06f -0, 0, 0, 0, 2012, 0x778bbeab -0, 0, 0, 0, 2012, 0x5ce4ca3b -0, 0, 0, 0, 2012, 0xe70e9fd3 -0, 0, 0, 0, 2012, 0x28afbcbf -0, 0, 0, 0, 2012, 0xc41fb9b2 -0, 0, 0, 0, 2012, 0xd60cbfae -0, 0, 0, 0, 2012, 0x1087cb26 -0, 0, 0, 0, 2012, 0xc9face3b -0, 0, 0, 0, 2012, 0x7403b314 -0, 0, 0, 0, 2012, 0xe034ba97 -0, 0, 0, 0, 2012, 0x15dcbc67 -0, 0, 0, 0, 2012, 0x20d3bcff -0, 0, 0, 0, 2012, 0xc136a2ce -0, 0, 0, 0, 2012, 0x038bb025 -0, 0, 0, 0, 2012, 0xd655cf84 -0, 0, 0, 0, 2012, 0xcf54c656 -0, 0, 0, 0, 2012, 0x3c77bb0d -0, 0, 0, 0, 2012, 0xd765d7a7 -0, 0, 0, 0, 2012, 0x1a60b020 -0, 0, 0, 0, 2012, 0x83c8c2e9 -0, 0, 0, 0, 2012, 0x9b97c6e7 -0, 0, 0, 0, 2012, 0x3870ad63 -0, 0, 0, 0, 2012, 0x0e3ac67d -0, 0, 0, 0, 2012, 0xeb53c935 -0, 0, 0, 0, 2012, 0xeeb0c3e1 -0, 0, 0, 0, 2012, 0x9cb5bdb9 -0, 0, 0, 0, 2012, 0x64b1afec -0, 0, 0, 0, 2012, 0x57dcadbc -0, 0, 0, 0, 2012, 0xed76c5fd -0, 0, 0, 0, 2012, 0x0cb4cac5 -0, 0, 0, 0, 2012, 0xd30bbd06 -0, 0, 0, 0, 2012, 0xaee9c6c3 -0, 0, 0, 0, 2012, 0xe845c9b3 -0, 0, 0, 0, 2012, 0xc09cc7fc -0, 0, 0, 0, 2012, 0xfdebaacb -0, 0, 0, 0, 2012, 0x6f2db89f -0, 0, 0, 0, 2012, 0x7d89bee7 -0, 0, 0, 0, 2012, 0x8699b8be -0, 0, 0, 0, 2012, 0x57d6cc8a -0, 0, 0, 0, 2012, 0xcdbcd246 -0, 0, 0, 0, 2012, 0x9057b285 -0, 0, 0, 0, 2012, 0x2ac9cc87 -0, 0, 0, 0, 2012, 0xeb20c421 -0, 0, 0, 0, 2012, 0x4789d11f -0, 0, 0, 0, 2012, 0x55e7c9fe -0, 0, 0, 0, 2012, 0xd81cb4c6 -0, 0, 0, 0, 2012, 0x2af0a88e -0, 0, 0, 0, 2012, 0x7d96a4ee -0, 0, 0, 0, 2012, 0xff7cc3ea -0, 0, 0, 0, 2012, 0x2514d2a8 -0, 0, 0, 0, 2012, 0x7d2cccc3 -0, 0, 0, 0, 2012, 0x98dccbbf -0, 0, 0, 0, 2012, 0x55f2bd3e -0, 0, 0, 0, 2012, 0x0e58bbd7 -0, 0, 0, 0, 2012, 0x1520c45d -0, 0, 0, 0, 2012, 0x3c60cede -0, 0, 0, 0, 2012, 0xbfb2be6b -0, 0, 0, 0, 2012, 0xa839c2d5 -0, 0, 0, 0, 2012, 0x7713bdba -0, 0, 0, 0, 2012, 0xf16c9e95 -0, 0, 0, 0, 2012, 0x8e94caf1 -0, 0, 0, 0, 2012, 0x3915c673 -0, 0, 0, 0, 2012, 0x69afc76f -0, 0, 0, 0, 2012, 0x3ebec514 -0, 0, 0, 0, 2012, 0x70c5dd9b -0, 0, 0, 0, 2012, 0x6868b7d9 -0, 0, 0, 0, 2012, 0x9a31c801 -0, 0, 0, 0, 2012, 0x93c4b6ac -0, 0, 0, 0, 2012, 0xb1aaca39 -0, 0, 0, 0, 2012, 0x8f67b9ed -0, 0, 0, 0, 2012, 0x09adcf1f -0, 0, 0, 0, 2012, 0xe172cb3c -0, 0, 0, 0, 2012, 0x044bbdc5 -0, 0, 0, 0, 2012, 0x391cb3d9 -0, 0, 0, 0, 2012, 0x3bd1bc29 -0, 0, 0, 0, 2012, 0x8a78c5d2 -0, 0, 0, 0, 2012, 0xa46fce11 -0, 0, 0, 0, 2012, 0x4c13d9bc -0, 0, 0, 0, 2012, 0x7f47ce4f -0, 0, 0, 0, 2012, 0xa03ebcae -0, 0, 0, 0, 2012, 0xf6f2b2c8 -0, 0, 0, 0, 2012, 0x7995be2a -0, 0, 0, 0, 2012, 0x22d7b94a -0, 0, 0, 0, 2012, 0x07bcc06a -0, 0, 0, 0, 2012, 0x04adcb6d -0, 0, 0, 0, 2012, 0x4aecc135 -0, 0, 0, 0, 2012, 0x8442dc6a -0, 0, 0, 0, 2012, 0x9e67b826 -0, 0, 0, 0, 2012, 0xb1c4b235 -0, 0, 0, 0, 2012, 0x565ecaae -0, 0, 0, 0, 2012, 0x34a2c877 -0, 0, 0, 0, 2012, 0x815eb148 -0, 0, 0, 0, 2012, 0x354eb4ce -0, 0, 0, 0, 2012, 0xf74db8b1 -0, 0, 0, 0, 2012, 0x56f3b430 -0, 0, 0, 0, 2012, 0x39f9c72f -0, 0, 0, 0, 2012, 0x83d1bfde -0, 0, 0, 0, 2012, 0x2da1bf57 -0, 0, 0, 0, 2012, 0xd97fc933 -0, 0, 0, 0, 2012, 0x4b3edbfe -0, 0, 0, 0, 2012, 0xb975d346 -0, 0, 0, 0, 2012, 0x856ac304 -0, 0, 0, 0, 2012, 0xb38dba2e -0, 0, 0, 0, 2012, 0xbe14c822 -0, 0, 0, 0, 2012, 0xb848c927 -0, 0, 0, 0, 2012, 0x0a89c0e6 -0, 0, 0, 0, 2012, 0x44a3c3d5 -0, 0, 0, 0, 2012, 0x7af1c30c -0, 0, 0, 0, 2012, 0xe928b619 -0, 0, 0, 0, 2012, 0xc9aeb012 -0, 0, 0, 0, 2012, 0xae02cfde -0, 0, 0, 0, 2012, 0x0b42c3d9 -0, 0, 0, 0, 2012, 0xa5b7c1ed -0, 0, 0, 0, 2012, 0xd2dcbcdc -0, 0, 0, 0, 2012, 0x18cfbf55 -0, 0, 0, 0, 2012, 0x34f0c800 -0, 0, 0, 0, 2012, 0x2a80bdba -0, 0, 0, 0, 2012, 0x5ef2b3a7 -0, 0, 0, 0, 2012, 0x35a6ba33 -0, 0, 0, 0, 2012, 0x1088bbf5 -0, 0, 0, 0, 2012, 0xaec0bedf -0, 0, 0, 0, 2012, 0x769fb535 -0, 0, 0, 0, 2012, 0xfe11b979 -0, 0, 0, 0, 2012, 0xe856b37e -0, 0, 0, 0, 2012, 0x36c3cffd -0, 0, 0, 0, 2012, 0x4771db58 -0, 0, 0, 0, 2012, 0x5467d13e -0, 0, 0, 0, 2012, 0xb405c1b5 -0, 0, 0, 0, 2012, 0x3cbdc145 -0, 0, 0, 0, 2012, 0xbb9ccdd7 -0, 0, 0, 0, 2012, 0xac25ce9e -0, 0, 0, 0, 2012, 0x6d2ac82a -0, 0, 0, 0, 2012, 0x1661ba50 -0, 0, 0, 0, 2012, 0xbc7ac82a -0, 0, 0, 0, 2012, 0x020bb4de -0, 0, 0, 0, 2012, 0x4e10cb93 -0, 0, 0, 0, 2012, 0x3dabc15f -0, 0, 0, 0, 2012, 0x12acc64b -0, 0, 0, 0, 2012, 0x9cecb51a -0, 0, 0, 0, 2012, 0x959acb39 -0, 0, 0, 0, 2012, 0x3ee7c0e8 -0, 0, 0, 0, 2012, 0xde18c1df -0, 0, 0, 0, 2012, 0x3c72c3cd -0, 0, 0, 0, 2012, 0x1ac4bb5d -0, 0, 0, 0, 2012, 0xb155c741 -0, 0, 0, 0, 2012, 0x5069c8aa -0, 0, 0, 0, 2012, 0x610db0bc -0, 0, 0, 0, 2012, 0xb82bc329 -0, 0, 0, 0, 2012, 0x8bd4c522 -0, 0, 0, 0, 2012, 0xd44bb865 -0, 0, 0, 0, 2012, 0xb51ac7dc -0, 0, 0, 0, 2012, 0xfe2bc799 -0, 0, 0, 0, 2012, 0x8cd1bb53 -0, 0, 0, 0, 2012, 0xba13ca97 -0, 0, 0, 0, 2012, 0xf107bd51 -0, 0, 0, 0, 2012, 0xa04ece95 -0, 0, 0, 0, 2012, 0x4f4faa54 -0, 0, 0, 0, 2012, 0x5a74bfe1 -0, 0, 0, 0, 2012, 0xdafade5b -0, 0, 0, 0, 2012, 0x738fba51 -0, 0, 0, 0, 2012, 0xe7b2b78e -0, 0, 0, 0, 2012, 0x7685b6ce -0, 0, 0, 0, 2012, 0xae45bd8a -0, 0, 0, 0, 2012, 0xd52cc84e -0, 0, 0, 0, 2012, 0x04abd773 -0, 0, 0, 0, 2012, 0x2badb0ff -0, 0, 0, 0, 2012, 0x0eaec6b2 -0, 0, 0, 0, 2012, 0x7c1ec33f -0, 0, 0, 0, 2012, 0x8773b925 -0, 0, 0, 0, 2012, 0x40bbc36d -0, 0, 0, 0, 2012, 0x330bc288 -0, 0, 0, 0, 2012, 0x1659b6f5 -0, 0, 0, 0, 2012, 0x66eac162 -0, 0, 0, 0, 2012, 0xf3acdb3d -0, 0, 0, 0, 2012, 0x465abb87 -0, 0, 0, 0, 2012, 0xe8e9bc16 -0, 0, 0, 0, 2012, 0x71eebbd9 -0, 0, 0, 0, 2012, 0x1f59cb2a -0, 0, 0, 0, 2012, 0x53e3c9e7 -0, 0, 0, 0, 2012, 0xf410b939 -0, 0, 0, 0, 2012, 0xdb13d1b3 -0, 0, 0, 0, 2012, 0xcd26bf27 -0, 0, 0, 0, 2012, 0x707ecc9c -0, 0, 0, 0, 2012, 0x3483b6bf -0, 0, 0, 0, 2012, 0x4184d451 -0, 0, 0, 0, 2012, 0xcf6abfae -0, 0, 0, 0, 2012, 0x5c9eb4ca -0, 0, 0, 0, 2012, 0xf396be01 -0, 0, 0, 0, 2012, 0x06bfda38 -0, 0, 0, 0, 2012, 0x0e92bcf4 -0, 0, 0, 0, 2012, 0xaaa2b99d -0, 0, 0, 0, 2012, 0xf112a9a9 -0, 0, 0, 0, 2012, 0x2844bdf1 -0, 0, 0, 0, 2012, 0xb96baf39 -0, 0, 0, 0, 2012, 0xd4f2d157 -0, 0, 0, 0, 2012, 0x7c74b149 -0, 0, 0, 0, 2012, 0xbd43d5f2 -0, 0, 0, 0, 2012, 0xaa10b2ba -0, 0, 0, 0, 2012, 0x66e9b95f -0, 0, 0, 0, 2012, 0x6f01abef -0, 0, 0, 0, 2012, 0x1cb5c664 -0, 0, 0, 0, 2012, 0x5ee2afc5 -0, 0, 0, 0, 2012, 0xeb39d213 -0, 0, 0, 0, 2012, 0x1ffeaafc -0, 0, 0, 0, 2012, 0x6bb4d548 -0, 0, 0, 0, 2012, 0xa045b23a -0, 0, 0, 0, 2012, 0x17c3aa49 -0, 0, 0, 0, 2012, 0x2d47db7c -0, 0, 0, 0, 2012, 0x07ddc9ac -0, 0, 0, 0, 2012, 0xa386c99e -0, 0, 0, 0, 2012, 0x0e0bae8a -0, 0, 0, 0, 2012, 0x7d6fc419 -0, 0, 0, 0, 2012, 0x34a3c5a2 -0, 0, 0, 0, 2012, 0xda81c8e9 -0, 0, 0, 0, 2012, 0xde53bcd8 -0, 0, 0, 0, 2012, 0x372ac065 -0, 0, 0, 0, 2012, 0x6d07a95c -0, 0, 0, 0, 2012, 0x296eb47f -0, 0, 0, 0, 2012, 0x0f47be2a -0, 0, 0, 0, 2012, 0x389ebaf6 -0, 0, 0, 0, 2012, 0x9746ba3b -0, 0, 0, 0, 2012, 0x070e9aed -0, 0, 0, 0, 2012, 0xa4abc798 -0, 0, 0, 0, 2012, 0xe55cac7b -0, 0, 0, 0, 2012, 0x0c71ba45 -0, 0, 0, 0, 2012, 0x70fbb3c5 -0, 0, 0, 0, 2012, 0xa35ec30a -0, 0, 0, 0, 2012, 0xf30ab935 -0, 0, 0, 0, 2012, 0x2cbb9b99 -0, 0, 0, 0, 2012, 0x6606c1bf -0, 0, 0, 0, 2012, 0x41ccad5c -0, 0, 0, 0, 2012, 0x352fc002 -0, 0, 0, 0, 2012, 0x1763bd10 -0, 0, 0, 0, 2012, 0xb54bcae6 -0, 0, 0, 0, 2012, 0x7374ab92 -0, 0, 0, 0, 2012, 0x2895a99a -0, 0, 0, 0, 2012, 0x9f68b02f -0, 0, 0, 0, 2012, 0xdfabbb76 -0, 0, 0, 0, 2012, 0x764ea6c5 -0, 0, 0, 0, 2012, 0x4e83c5a5 -0, 0, 0, 0, 2012, 0xf0e8c76a -0, 0, 0, 0, 2012, 0xdc80b4ea -0, 0, 0, 0, 2012, 0xcc53b0a5 -0, 0, 0, 0, 2012, 0x7893bc7f -0, 0, 0, 0, 2012, 0x6965b355 -0, 0, 0, 0, 2012, 0x7f8fac00 -0, 0, 0, 0, 2012, 0x6c71c7b8 -0, 0, 0, 0, 2012, 0xa00ec367 -0, 0, 0, 0, 2012, 0x5f0fc50e -0, 0, 0, 0, 2012, 0x1bd2ad87 -0, 0, 0, 0, 2012, 0xd054ba2d -0, 0, 0, 0, 2012, 0xaf80a0d5 -0, 0, 0, 0, 2012, 0x2acac873 -0, 0, 0, 0, 2012, 0x260ca584 -0, 0, 0, 0, 2012, 0x4f98aa7c -0, 0, 0, 0, 2012, 0x0254aa36 -0, 0, 0, 0, 2012, 0xe3c7c33a -0, 0, 0, 0, 2012, 0x3b9ea70f -0, 0, 0, 0, 2012, 0xe829b7e6 -0, 0, 0, 0, 2012, 0x9317a8d1 -0, 0, 0, 0, 2012, 0x88b3a98f -0, 0, 0, 0, 2012, 0xa4a8c3bc -0, 0, 0, 0, 2012, 0x95c9a869 -0, 0, 0, 0, 2012, 0x7f889fed -0, 0, 0, 0, 2012, 0x5438c408 -0, 0, 0, 0, 2012, 0x3455a366 -0, 0, 0, 0, 2012, 0x5319b33d -0, 0, 0, 0, 2012, 0xb19dc4f0 -0, 0, 0, 0, 2012, 0xf080b109 -0, 0, 0, 0, 2012, 0xef83d8e7 -0, 0, 0, 0, 2012, 0x237ac69c -0, 0, 0, 0, 2012, 0xbb30b714 -0, 0, 0, 0, 2012, 0x8745ba54 -0, 0, 0, 0, 2012, 0x8588bd6c -0, 0, 0, 0, 2012, 0xc580bdde -0, 0, 0, 0, 2012, 0xb062baf1 -0, 0, 0, 0, 2012, 0xe014b082 -0, 0, 0, 0, 2012, 0x148bcb87 -0, 0, 0, 0, 2012, 0x554bc13d -0, 0, 0, 0, 2012, 0xc410c270 -0, 0, 0, 0, 2012, 0xb2c8b65b -0, 0, 0, 0, 2012, 0xa412b3f4 -0, 0, 0, 0, 2012, 0xbb52aa9a -0, 0, 0, 0, 2012, 0x4005b527 -0, 0, 0, 0, 2012, 0x8c5eb055 -0, 0, 0, 0, 2012, 0x8622c142 -0, 0, 0, 0, 2012, 0x05a3b861 -0, 0, 0, 0, 2012, 0x9f6dbb4d -0, 0, 0, 0, 2012, 0x033fb867 -0, 0, 0, 0, 2012, 0x243babd5 -0, 0, 0, 0, 2012, 0x8d6db83c -0, 0, 0, 0, 2012, 0x3923b829 -0, 0, 0, 0, 2012, 0x69b6b587 -0, 0, 0, 0, 2012, 0xdda8d018 -0, 0, 0, 0, 2012, 0x54b1b2a4 -0, 0, 0, 0, 2012, 0x380eb1af -0, 0, 0, 0, 2012, 0xec3cbdb4 -0, 0, 0, 0, 2012, 0x7ce9b4cf -0, 0, 0, 0, 2012, 0xcf6cb99b -0, 0, 0, 0, 2012, 0x7383ab97 -0, 0, 0, 0, 2012, 0xaa4cc068 -0, 0, 0, 0, 2012, 0x96d4c3db -0, 0, 0, 0, 2012, 0xab8cb84f -0, 0, 0, 0, 2012, 0x73dcacf9 -0, 0, 0, 0, 2012, 0xf61ca122 -0, 0, 0, 0, 2012, 0x9f1cbd5b -0, 0, 0, 0, 2012, 0x1f84aa3f -0, 0, 0, 0, 2012, 0xa003ad43 -0, 0, 0, 0, 2012, 0x6cffa4ef -0, 0, 0, 0, 2012, 0x29559e1e -0, 0, 0, 0, 2012, 0x7a79b059 -0, 0, 0, 0, 2012, 0xa1929c42 -0, 0, 0, 0, 2012, 0x52dead1c -0, 0, 0, 0, 2012, 0x8f31b9f5 -0, 0, 0, 0, 2012, 0xb8a899ec -0, 0, 0, 0, 2012, 0x7ca4b02d -0, 0, 0, 0, 2012, 0x2c92ae1b -0, 0, 0, 0, 2012, 0xe683a92f -0, 0, 0, 0, 2012, 0xe9d5abcf -0, 0, 0, 0, 2012, 0x757db377 -0, 0, 0, 0, 2012, 0xd4a8bbae -0, 0, 0, 0, 2012, 0xeea5c4ee -0, 0, 0, 0, 2012, 0xc37ca9a9 -0, 0, 0, 0, 2012, 0x8871bb51 -0, 0, 0, 0, 2012, 0x5dd8b3a2 -0, 0, 0, 0, 2012, 0xef0fae7f -0, 0, 0, 0, 2012, 0xe7ecb23e -0, 0, 0, 0, 2012, 0xc4f6d437 -0, 0, 0, 0, 2012, 0x0c74b81d -0, 0, 0, 0, 2012, 0xee68b1ee -0, 0, 0, 0, 2012, 0x46b4b4a8 -0, 0, 0, 0, 2012, 0x0526abca -0, 0, 0, 0, 2012, 0x7695ba55 -0, 0, 0, 0, 2012, 0xc7f5ad90 -0, 0, 0, 0, 2012, 0x0522b9bc -0, 0, 0, 0, 2012, 0x0eefc6ad -0, 0, 0, 0, 2012, 0x340dae16 -0, 0, 0, 0, 2012, 0xea42bdc0 -0, 0, 0, 0, 2012, 0xe047abb6 -0, 0, 0, 0, 2012, 0x6da5c14f -0, 0, 0, 0, 2012, 0x46d8c11d -0, 0, 0, 0, 2012, 0x8f4d9f2f -0, 0, 0, 0, 2012, 0x6d00d26c -0, 0, 0, 0, 2012, 0x87fc9d1b -0, 0, 0, 0, 2012, 0xbba5b763 -0, 0, 0, 0, 2012, 0xab58b853 -0, 0, 0, 0, 2012, 0x8180b863 -0, 0, 0, 0, 2012, 0x3684b3ba -0, 0, 0, 0, 2012, 0xf1a4a806 -0, 0, 0, 0, 2012, 0x2826b48c -0, 0, 0, 0, 2012, 0x1883af7f -0, 0, 0, 0, 2012, 0x44c5c37a -0, 0, 0, 0, 2012, 0xec33c3f1 -0, 0, 0, 0, 2012, 0xd67fb767 -0, 0, 0, 0, 2012, 0x03c2c219 -0, 0, 0, 0, 2012, 0x75a9b389 -0, 0, 0, 0, 2012, 0xe041ad88 -0, 0, 0, 0, 2012, 0x6bccb005 -0, 0, 0, 0, 2012, 0xd881c24a -0, 0, 0, 0, 2012, 0x7dd0c302 -0, 0, 0, 0, 2012, 0x2ba8a649 -0, 0, 0, 0, 2012, 0x63e19eab -0, 0, 0, 0, 2012, 0x1c0dafce -0, 0, 0, 0, 2012, 0xf266bf47 -0, 0, 0, 0, 2012, 0x11beb4b1 -0, 0, 0, 0, 2012, 0xc6f6b2b5 -0, 0, 0, 0, 2012, 0x15d4b4d0 -0, 0, 0, 0, 2012, 0x08bfa1e7 -0, 0, 0, 0, 2012, 0x18dbb7b5 -0, 0, 0, 0, 2012, 0xc279cc67 -0, 0, 0, 0, 2012, 0xd236bf28 -0, 0, 0, 0, 2012, 0xc9d1b196 -0, 0, 0, 0, 2012, 0xb605983e -0, 0, 0, 0, 2012, 0x8132c566 -0, 0, 0, 0, 2012, 0x6be4cd39 -0, 0, 0, 0, 2012, 0xce53c1f9 -0, 0, 0, 0, 2012, 0xe1efac0f -0, 0, 0, 0, 2012, 0x3d60a57a -0, 0, 0, 0, 2012, 0x1beda4b7 -0, 0, 0, 0, 2012, 0x34a4ac81 -0, 0, 0, 0, 2012, 0x30b0be4b -0, 0, 0, 0, 2012, 0xc7ceaf45 -0, 0, 0, 0, 2012, 0xade0b6ec -0, 0, 0, 0, 2012, 0xe00daf06 -0, 0, 0, 0, 2012, 0x04f79fe4 -0, 0, 0, 0, 2012, 0x8c59b7d9 -0, 0, 0, 0, 2012, 0x6f66b92a -0, 0, 0, 0, 2012, 0x9b08b2c0 -0, 0, 0, 0, 2012, 0xa8c1b5c1 -0, 0, 0, 0, 2012, 0xe3aac0b0 -0, 0, 0, 0, 2012, 0x1622bdaf -0, 0, 0, 0, 2012, 0x25e1a9ff -0, 0, 0, 0, 2012, 0x5577ad82 -0, 0, 0, 0, 2012, 0xfe16a49b -0, 0, 0, 0, 2012, 0xef7fc32a -0, 0, 0, 0, 2012, 0xfe30c35d -0, 0, 0, 0, 2012, 0x3adc9610 -0, 0, 0, 0, 2012, 0x36eeabdc -0, 0, 0, 0, 2012, 0xde3fb56c -0, 0, 0, 0, 2012, 0x5629bd82 -0, 0, 0, 0, 2012, 0xb099a61d -0, 0, 0, 0, 2012, 0x3013b106 -0, 0, 0, 0, 2012, 0xc359aef3 -0, 0, 0, 0, 2012, 0xec01b3e1 -0, 0, 0, 0, 2012, 0x6e8ac0b1 -0, 0, 0, 0, 2012, 0x41e8b82d -0, 0, 0, 0, 2012, 0x3a2fb38b -0, 0, 0, 0, 2012, 0x7025aac9 -0, 0, 0, 0, 2012, 0xbb0eb094 -0, 0, 0, 0, 2012, 0xdc06c156 -0, 0, 0, 0, 2012, 0x4007cea4 -0, 0, 0, 0, 2012, 0x102ebe03 -0, 0, 0, 0, 2012, 0x6e8faae7 -0, 0, 0, 0, 2012, 0xa357aa0c -0, 0, 0, 0, 2012, 0x07d2bf4d -0, 0, 0, 0, 2012, 0xfb71b338 -0, 0, 0, 0, 2012, 0xd5f1be84 -0, 0, 0, 0, 2012, 0x2a7cb554 -0, 0, 0, 0, 2012, 0xfb03b8c3 -0, 0, 0, 0, 2012, 0x2ff1ca87 -0, 0, 0, 0, 2012, 0xeef2b7f3 -0, 0, 0, 0, 2012, 0x9377b15f -0, 0, 0, 0, 2012, 0x370cb0c2 -0, 0, 0, 0, 2012, 0x5f78b118 -0, 0, 0, 0, 2012, 0x19afa87a -0, 0, 0, 0, 2012, 0xc717ab0d -0, 0, 0, 0, 2012, 0x3ca499f4 -0, 0, 0, 0, 2012, 0x9612b8e4 -0, 0, 0, 0, 2012, 0x32c0bb29 -0, 0, 0, 0, 2012, 0x7727beba -0, 0, 0, 0, 2012, 0x8b60a4cb -0, 0, 0, 0, 2012, 0xe899a9c8 -0, 0, 0, 0, 2012, 0x60f4b7fe -0, 0, 0, 0, 2012, 0x544f9ecb -0, 0, 0, 0, 2012, 0x34afcd71 -0, 0, 0, 0, 2012, 0x470eab55 -0, 0, 0, 0, 2012, 0xe4959f93 -0, 0, 0, 0, 2012, 0x69eeaf97 -0, 0, 0, 0, 2012, 0x0ec9aca3 -0, 0, 0, 0, 2012, 0x51e4b7f6 -0, 0, 0, 0, 2012, 0xf6c0a837 -0, 0, 0, 0, 2012, 0x3bdca59b -0, 0, 0, 0, 2012, 0x14c59dfc -0, 0, 0, 0, 2012, 0xa50ab23a -0, 0, 0, 0, 2012, 0x8832b6e2 -0, 0, 0, 0, 2012, 0x3d699d1b -0, 0, 0, 0, 2012, 0x751aa4b8 -0, 0, 0, 0, 2012, 0x59a9b98c -0, 0, 0, 0, 2012, 0xb67c98cb -0, 0, 0, 0, 2012, 0x0fd39ccd -0, 0, 0, 0, 2012, 0x9980d1e1 -0, 0, 0, 0, 2012, 0xffd9a716 -0, 0, 0, 0, 2012, 0x7d2fbed1 -0, 0, 0, 0, 2012, 0x76e6b042 -0, 0, 0, 0, 2012, 0xe027a232 -0, 0, 0, 0, 2012, 0x7c6ca5ce -0, 0, 0, 0, 2012, 0x5cf6bda4 -0, 0, 0, 0, 2012, 0x6075bd0d -0, 0, 0, 0, 2012, 0xedc4abe9 -0, 0, 0, 0, 2012, 0xb8f7cc26 -0, 0, 0, 0, 2012, 0x2cbbb500 -0, 0, 0, 0, 2012, 0x1c34b04d -0, 0, 0, 0, 2012, 0x5f18bea2 -0, 0, 0, 0, 2012, 0x94d0bb2b -0, 0, 0, 0, 2012, 0x6899b78e -0, 0, 0, 0, 2012, 0xc9aaa7a2 -0, 0, 0, 0, 2012, 0x298cbafa -0, 0, 0, 0, 2012, 0x89d9ac80 -0, 0, 0, 0, 2012, 0xc6ffa7e6 -0, 0, 0, 0, 2012, 0xdcf7caf9 -0, 0, 0, 0, 2012, 0x26cfb4ee -0, 0, 0, 0, 2012, 0xec70b09d -0, 0, 0, 0, 2012, 0x65dca50f -0, 0, 0, 0, 2012, 0xcdebc0b6 -0, 0, 0, 0, 2012, 0x9393a262 -0, 0, 0, 0, 2012, 0x34aab06d -0, 0, 0, 0, 2012, 0x4800a550 -0, 0, 0, 0, 2012, 0x4d9aadec -0, 0, 0, 0, 2012, 0x2cddabb6 -0, 0, 0, 0, 2012, 0x91a0c5b2 -0, 0, 0, 0, 2012, 0xd326bee1 -0, 0, 0, 0, 2012, 0xf76ab2d5 -0, 0, 0, 0, 2012, 0xcef99ade -0, 0, 0, 0, 2012, 0x950dc76f -0, 0, 0, 0, 2012, 0xb6aca7ad -0, 0, 0, 0, 2012, 0x1aacb71c -0, 0, 0, 0, 2012, 0x32389da0 -0, 0, 0, 0, 2012, 0x030cbcce -0, 0, 0, 0, 2012, 0x0ec4b0cb -0, 0, 0, 0, 2012, 0x6c0bb62e -0, 0, 0, 0, 2012, 0xfadbb20d -0, 0, 0, 0, 2012, 0x99c9c848 -0, 0, 0, 0, 2012, 0xe3e3b21a -0, 0, 0, 0, 2012, 0x88d9a50b -0, 0, 0, 0, 2012, 0xf4bbaf17 -0, 0, 0, 0, 2012, 0x49fea706 -0, 0, 0, 0, 2012, 0xafd0babf -0, 0, 0, 0, 2012, 0x8970a8f3 -0, 0, 0, 0, 2012, 0x9223a553 -0, 0, 0, 0, 2012, 0x6ec2b2f9 -0, 0, 0, 0, 2012, 0x7960b759 -0, 0, 0, 0, 2012, 0x852891bf -0, 0, 0, 0, 2012, 0x094ebbeb -0, 0, 0, 0, 2012, 0xf9bab418 -0, 0, 0, 0, 2012, 0x010eae8c -0, 0, 0, 0, 2012, 0x10baab3d -0, 0, 0, 0, 2012, 0x2564b13f -0, 0, 0, 0, 2012, 0xaec8ac22 -0, 0, 0, 0, 2012, 0xda0cbd4f -0, 0, 0, 0, 2012, 0x97e1c075 -0, 0, 0, 0, 2012, 0x6731aca5 -0, 0, 0, 0, 2012, 0x2c1db696 -0, 0, 0, 0, 2012, 0x8ff7abbf -0, 0, 0, 0, 2012, 0xf75ab3a2 -0, 0, 0, 0, 2012, 0x8683b824 -0, 0, 0, 0, 2012, 0x9668b354 -0, 0, 0, 0, 2012, 0x6e9aae04 -0, 0, 0, 0, 2012, 0xd8e9acd7 -0, 0, 0, 0, 2012, 0xa326c298 -0, 0, 0, 0, 2012, 0x6abcb409 -0, 0, 0, 0, 2012, 0x7eb3b549 -0, 0, 0, 0, 2012, 0xfc72ba6a -0, 0, 0, 0, 2012, 0xed73b2e6 -0, 0, 0, 0, 2012, 0x07a6b0a9 -0, 0, 0, 0, 2012, 0x10a4aec4 -0, 0, 0, 0, 2012, 0xaac9a650 -0, 0, 0, 0, 2012, 0x848b9869 -0, 0, 0, 0, 2012, 0x1ddaafd6 -0, 0, 0, 0, 2012, 0xe291aaec -0, 0, 0, 0, 2012, 0x8aa1aa4d -0, 0, 0, 0, 2012, 0x9b69b94c -0, 0, 0, 0, 2012, 0xe784bec0 -0, 0, 0, 0, 2012, 0x9305ba2d -0, 0, 0, 0, 2012, 0x5616bb81 -0, 0, 0, 0, 2012, 0xea0facca -0, 0, 0, 0, 2012, 0xe1b9991e -0, 0, 0, 0, 2012, 0xded8bd59 -0, 0, 0, 0, 2012, 0xe79fb0ee -0, 0, 0, 0, 2012, 0x1b8595a6 -0, 0, 0, 0, 2012, 0xb55ba336 -0, 0, 0, 0, 2012, 0xc552bc98 -0, 0, 0, 0, 2012, 0x2fe2c5ba -0, 0, 0, 0, 2012, 0xe18aa5a6 -0, 0, 0, 0, 2012, 0xaa9bae1c -0, 0, 0, 0, 2012, 0xd1ddb68d -0, 0, 0, 0, 2012, 0x95bfb203 -0, 0, 0, 0, 2012, 0xeacab8b9 -0, 0, 0, 0, 2012, 0x5bfcb117 -0, 0, 0, 0, 2012, 0x1a9fa91c -0, 0, 0, 0, 2012, 0xa285b180 -0, 0, 0, 0, 2012, 0xfd58a6e2 -0, 0, 0, 0, 2012, 0x394fc325 -0, 0, 0, 0, 2012, 0x0415a6aa -0, 0, 0, 0, 2012, 0xf75fa5e0 -0, 0, 0, 0, 2012, 0x115cd11b -0, 0, 0, 0, 2012, 0x6587b9e3 -0, 0, 0, 0, 2012, 0xce6bb7e6 -0, 0, 0, 0, 2012, 0xbaa2b409 -0, 0, 0, 0, 2012, 0x271bbb14 -0, 0, 0, 0, 2012, 0x4516c223 -0, 0, 0, 0, 2012, 0x4f6ab266 -0, 0, 0, 0, 2012, 0x244ba6fc -0, 0, 0, 0, 2012, 0x60e0ae4e -0, 0, 0, 0, 2012, 0xfc3cac80 -0, 0, 0, 0, 2012, 0x8465b287 -0, 0, 0, 0, 2012, 0xc683b070 -0, 0, 0, 0, 2012, 0x2901c8e7 -0, 0, 0, 0, 2012, 0x0622b1a1 -0, 0, 0, 0, 2012, 0xe002b34c -0, 0, 0, 0, 2012, 0xf4969e79 -0, 0, 0, 0, 2012, 0x871cc453 -0, 0, 0, 0, 2012, 0x9a7daaf3 -0, 0, 0, 0, 2012, 0xba92a60a -0, 0, 0, 0, 2012, 0xf464a0c4 -0, 0, 0, 0, 2012, 0x53bbb6cd -0, 0, 0, 0, 2012, 0xb58a9d2a -0, 0, 0, 0, 2012, 0x1e1fb830 -0, 0, 0, 0, 2012, 0xdc7eb93e -0, 0, 0, 0, 2012, 0xe6ceaaf9 -0, 0, 0, 0, 2012, 0x8c7ea35d -0, 0, 0, 0, 2012, 0x0b87ba04 -0, 0, 0, 0, 2012, 0xf516a700 -0, 0, 0, 0, 2012, 0xfaf19e13 -0, 0, 0, 0, 2012, 0x53cf9ed0 -0, 0, 0, 0, 2012, 0x2e25c2f9 -0, 0, 0, 0, 2012, 0x959aa1b8 -0, 0, 0, 0, 2012, 0x2a49a572 -0, 0, 0, 0, 2012, 0xf7a9b809 -0, 0, 0, 0, 2012, 0x44a9b879 -0, 0, 0, 0, 2012, 0xe428c0d4 -0, 0, 0, 0, 2012, 0xc258c2c6 -0, 0, 0, 0, 2012, 0xf7f3b794 -0, 0, 0, 0, 2012, 0xa8adbad9 -0, 0, 0, 0, 2012, 0xc2508e79 -0, 0, 0, 0, 2012, 0x1418ac76 -0, 0, 0, 0, 2012, 0xb28aadef -0, 0, 0, 0, 2012, 0xda17bd03 -0, 0, 0, 0, 2012, 0xa92ab852 -0, 0, 0, 0, 2012, 0xc3cbcfa4 -0, 0, 0, 0, 2012, 0xf716bb5e -0, 0, 0, 0, 2012, 0x6009a8af -0, 0, 0, 0, 2012, 0x9e69bc81 -0, 0, 0, 0, 2012, 0x3aafc8cf -0, 0, 0, 0, 2012, 0x03bccdab -0, 0, 0, 0, 2012, 0xfdceb2d9 -0, 0, 0, 0, 2012, 0x68f7afb8 -0, 0, 0, 0, 2012, 0xb7bab330 -0, 0, 0, 0, 2012, 0x4976b125 -0, 0, 0, 0, 2012, 0x7c86ae12 -0, 0, 0, 0, 2012, 0x4ce4ca54 -0, 0, 0, 0, 2012, 0xf1f7b892 -0, 0, 0, 0, 2012, 0xf958abb1 -0, 0, 0, 0, 2012, 0x047accd0 -0, 0, 0, 0, 2012, 0x34a1c49c -0, 0, 0, 0, 2012, 0x4b24a4ed -0, 0, 0, 0, 2012, 0xea31b1bc -0, 0, 0, 0, 2012, 0x8beaa3e3 -0, 0, 0, 0, 2012, 0x064caaf9 -0, 0, 0, 0, 2012, 0x56babf15 -0, 0, 0, 0, 2012, 0xd16fc6f4 -0, 0, 0, 0, 2012, 0x4ac2b78a -0, 0, 0, 0, 2012, 0xba3aa509 -0, 0, 0, 0, 2012, 0xc103b074 -0, 0, 0, 0, 2012, 0x464aba98 -0, 0, 0, 0, 2012, 0xaacac5a3 -0, 0, 0, 0, 2012, 0x9cecbcfa -0, 0, 0, 0, 2012, 0x8da0ab79 -0, 0, 0, 0, 2012, 0x85b2b023 -0, 0, 0, 0, 2012, 0x598abc91 -0, 0, 0, 0, 2012, 0x08c0a35c -0, 0, 0, 0, 2012, 0x30e4a7cf -0, 0, 0, 0, 2012, 0xf1e4a931 -0, 0, 0, 0, 2012, 0x8a4fb6c1 -0, 0, 0, 0, 2012, 0x126aac08 -0, 0, 0, 0, 2012, 0x537fa51b -0, 0, 0, 0, 2012, 0x1e54ac5a -0, 0, 0, 0, 2012, 0x7274bbd0 -0, 0, 0, 0, 2012, 0xd16bc2c2 -0, 0, 0, 0, 2012, 0x9236c1e3 -0, 0, 0, 0, 2012, 0x348aa7af -0, 0, 0, 0, 2012, 0xa020be5e -0, 0, 0, 0, 2012, 0x3cc5a4b8 -0, 0, 0, 0, 2012, 0x8b19b649 -0, 0, 0, 0, 2012, 0x554aa5ab -0, 0, 0, 0, 2012, 0x35d6ac35 -0, 0, 0, 0, 2012, 0x64dba435 -0, 0, 0, 0, 2012, 0x6001bae2 -0, 0, 0, 0, 2012, 0x9220b599 -0, 0, 0, 0, 2012, 0xa3fdb899 -0, 0, 0, 0, 2012, 0x19a5abf4 -0, 0, 0, 0, 2012, 0xd857b8cf -0, 0, 0, 0, 2012, 0x38d1b234 -0, 0, 0, 0, 2012, 0x69f4bfb8 -0, 0, 0, 0, 2012, 0xcc87a375 -0, 0, 0, 0, 2012, 0xc1cdd0c5 -0, 0, 0, 0, 2012, 0xba0ca3ee -0, 0, 0, 0, 2012, 0x4d20c397 -0, 0, 0, 0, 2012, 0x825c9636 -0, 0, 0, 0, 2012, 0x7aa4ae53 -0, 0, 0, 0, 2012, 0xe970ae78 -0, 0, 0, 0, 2012, 0x5fb2ba59 -0, 0, 0, 0, 2012, 0xcd90a953 -0, 0, 0, 0, 2012, 0xf573ac40 -0, 0, 0, 0, 2012, 0x324cbd77 -0, 0, 0, 0, 2012, 0xece0a73d -0, 0, 0, 0, 2012, 0x0dd1aefa -0, 0, 0, 0, 2012, 0xe338c866 -0, 0, 0, 0, 2012, 0xfe71bffc -0, 0, 0, 0, 2012, 0x61a5a810 -0, 0, 0, 0, 2012, 0x7c3ba074 -0, 0, 0, 0, 2012, 0x492f9d91 -0, 0, 0, 0, 2012, 0xa126a7b9 -0, 0, 0, 0, 2012, 0x7cf19a40 -0, 0, 0, 0, 2012, 0x1c2fbae6 -0, 0, 0, 0, 2012, 0x540accdf -0, 0, 0, 0, 2012, 0x5908a938 -0, 0, 0, 0, 2012, 0xe7f8b501 -0, 0, 0, 0, 2012, 0x03a8b53e -0, 0, 0, 0, 2012, 0xb4e3bdda -0, 0, 0, 0, 2012, 0x9e86abe1 -0, 0, 0, 0, 2012, 0x3234b98d -0, 0, 0, 0, 2012, 0x5caec781 -0, 0, 0, 0, 2012, 0x5c21a32e -0, 0, 0, 0, 2012, 0x8b72c112 -0, 0, 0, 0, 2012, 0x2ec2bac3 -0, 0, 0, 0, 2012, 0xd9c4adaa -0, 0, 0, 0, 2012, 0x2da1b496 -0, 0, 0, 0, 2012, 0x0a51b21e -0, 0, 0, 0, 2012, 0x6414ab0d -0, 0, 0, 0, 2012, 0x95c4b203 -0, 0, 0, 0, 2012, 0x98e0b4a2 -0, 0, 0, 0, 2012, 0x34369f5f -0, 0, 0, 0, 2012, 0x9dffa40c -0, 0, 0, 0, 2012, 0xf345b0e5 -0, 0, 0, 0, 2012, 0x6714bdbf -0, 0, 0, 0, 2012, 0xc276c3d1 -0, 0, 0, 0, 2012, 0xf199b475 -0, 0, 0, 0, 2012, 0x3395cf3b -0, 0, 0, 0, 2012, 0x4b52afb0 -0, 0, 0, 0, 2012, 0x3f74b217 -0, 0, 0, 0, 2012, 0xa25cad38 -0, 0, 0, 0, 2012, 0x3290a5b4 -0, 0, 0, 0, 2012, 0x2917b750 -0, 0, 0, 0, 2012, 0xeb3ec739 -0, 0, 0, 0, 2012, 0xbf9ea51d -0, 0, 0, 0, 2012, 0x98e2a0c1 -0, 0, 0, 0, 2012, 0xa39ba7f2 -0, 0, 0, 0, 2012, 0x6df7a05c -0, 0, 0, 0, 2012, 0x2c1bba28 -0, 0, 0, 0, 2012, 0x6099b1cd -0, 0, 0, 0, 2012, 0x9366b9f2 -0, 0, 0, 0, 2012, 0x95899570 -0, 0, 0, 0, 2012, 0x6234a0c8 -0, 0, 0, 0, 2012, 0xec2cbcfc -0, 0, 0, 0, 2012, 0x3ff7a9db -0, 0, 0, 0, 2012, 0x4e44bad7 -0, 0, 0, 0, 2012, 0x1dbbbc39 -0, 0, 0, 0, 2012, 0xf9df99be -0, 0, 0, 0, 2012, 0xa713b313 -0, 0, 0, 0, 2012, 0x8bbdbe51 -0, 0, 0, 0, 2012, 0x0d5bc786 -0, 0, 0, 0, 2012, 0x75d293f2 -0, 0, 0, 0, 2012, 0x4832b688 -0, 0, 0, 0, 2012, 0x71aba74c -0, 0, 0, 0, 2012, 0x04d5abf2 -0, 0, 0, 0, 2012, 0xaa8fbd98 -0, 0, 0, 0, 2012, 0xd93eb6d4 -0, 0, 0, 0, 2012, 0x8fb6b5a8 -0, 0, 0, 0, 2012, 0x779a92f5 -0, 0, 0, 0, 2012, 0x35c8ab3d -0, 0, 0, 0, 2012, 0x0017aaa5 -0, 0, 0, 0, 2012, 0xd6e7bafe -0, 0, 0, 0, 2012, 0xe358b423 -0, 0, 0, 0, 2012, 0x3f74bfba -0, 0, 0, 0, 2012, 0x0a5eb707 -0, 0, 0, 0, 2012, 0xedbfb0df -0, 0, 0, 0, 2012, 0x2e71a26f -0, 0, 0, 0, 2012, 0x214db1a8 -0, 0, 0, 0, 2012, 0xb632c275 -0, 0, 0, 0, 2012, 0xb597cf92 -0, 0, 0, 0, 2012, 0x18a8b508 -0, 0, 0, 0, 2012, 0x8267b4ff -0, 0, 0, 0, 2012, 0x5a9ab8d6 -0, 0, 0, 0, 2012, 0x2037a2b6 +0, 0, 0, 960, 2012, 0x671dc73a +0, 960, 960, 960, 2012, 0x7fd5b1d2 +0, 1920, 1920, 960, 2012, 0xbe7b9e5e +0, 2880, 2880, 960, 2012, 0x671dc73a +0, 3840, 3840, 960, 2012, 0x7fd5b1d2 +0, 4800, 4800, 960, 2012, 0xbe7b9e5e +0, 5760, 5760, 960, 2012, 0x671dc73a +0, 6720, 6720, 960, 2012, 0x7fd5b1d2 +0, 7680, 7680, 960, 2012, 0xbe7b9e5e +0, 8640, 8640, 960, 2012, 0x671dc73a +0, 9600, 9600, 960, 2012, 0x7fd5b1d2 +0, 10560, 10560, 960, 2012, 0xbe7b9e5e +0, 11520, 11520, 960, 2012, 0x671dc73a +0, 12480, 12480, 960, 2012, 0x7fd5b1d2 +0, 13440, 13440, 960, 2012, 0xbe7b9e5e +0, 14400, 14400, 960, 2012, 0x671dc73a +0, 15360, 15360, 960, 2012, 0x7fd5b1d2 +0, 16320, 16320, 960, 2012, 0xbe7b9e5e +0, 17280, 17280, 960, 2012, 0x671dc73a +0, 18240, 18240, 960, 2012, 0x7fd5b1d2 +0, 19200, 19200, 960, 2012, 0xbe7b9e5e +0, 20160, 20160, 960, 2012, 0x671dc73a +0, 21120, 21120, 960, 2012, 0x7fd5b1d2 +0, 22080, 22080, 960, 2012, 0xbe7b9e5e +0, 23040, 23040, 960, 2012, 0x671dc73a +0, 24000, 24000, 960, 2012, 0x7fd5b1d2 +0, 24960, 24960, 960, 2012, 0xbe7b9e5e +0, 25920, 25920, 960, 2012, 0x671dc73a +0, 26880, 26880, 960, 2012, 0x7fd5b1d2 +0, 27840, 27840, 960, 2012, 0xbe7b9e5e +0, 28800, 28800, 960, 2012, 0x671dc73a +0, 29760, 29760, 960, 2012, 0x7fd5b1d2 +0, 30720, 30720, 960, 2012, 0xbe7b9e5e +0, 31680, 31680, 960, 2012, 0x671dc73a +0, 32640, 32640, 960, 2012, 0x7fd5b1d2 +0, 33600, 33600, 960, 2012, 0xbe7b9e5e +0, 34560, 34560, 960, 2012, 0x671dc73a +0, 35520, 35520, 960, 2012, 0x7fd5b1d2 +0, 36480, 36480, 960, 2012, 0xbe7b9e5e +0, 37440, 37440, 960, 2012, 0x671dc73a +0, 38400, 38400, 960, 2012, 0x7fd5b1d2 +0, 39360, 39360, 960, 2012, 0xbe7b9e5e +0, 40320, 40320, 960, 2012, 0x671dc73a +0, 41280, 41280, 960, 2012, 0x7fd5b1d2 +0, 42240, 42240, 960, 2012, 0xbe7b9e5e +0, 43200, 43200, 960, 2012, 0x671dc73a +0, 44160, 44160, 960, 2012, 0x7fd5b1d2 +0, 45120, 45120, 960, 2012, 0xbe7b9e5e +0, 46080, 46080, 960, 2012, 0x671dc73a +0, 47040, 47040, 960, 2012, 0x7fd5b1d2 +0, 48000, 48000, 960, 2012, 0xbe7b9e5e +0, 48960, 48960, 960, 2012, 0x671dc73a +0, 49920, 49920, 960, 2012, 0x7fd5b1d2 +0, 50880, 50880, 960, 2012, 0xbe7b9e5e +0, 51840, 51840, 960, 2012, 0x671dc73a +0, 52800, 52800, 960, 2012, 0x7fd5b1d2 +0, 53760, 53760, 960, 2012, 0xbe7b9e5e +0, 54720, 54720, 960, 2012, 0x671dc73a +0, 55680, 55680, 960, 2012, 0x7fd5b1d2 +0, 56640, 56640, 960, 2012, 0xbe7b9e5e +0, 57600, 57600, 960, 2012, 0x671dc73a +0, 58560, 58560, 960, 2012, 0x7fd5b1d2 +0, 59520, 59520, 960, 2012, 0xbe7b9e5e +0, 60480, 60480, 960, 2012, 0x671dc73a +0, 61440, 61440, 960, 2012, 0x7fd5b1d2 +0, 62400, 62400, 960, 2012, 0xbe7b9e5e +0, 63360, 63360, 960, 2012, 0x671dc73a +0, 64320, 64320, 960, 2012, 0x7fd5b1d2 +0, 65280, 65280, 960, 2012, 0xbe7b9e5e +0, 66240, 66240, 960, 2012, 0x671dc73a +0, 67200, 67200, 960, 2012, 0x7fd5b1d2 +0, 68160, 68160, 960, 2012, 0xbe7b9e5e +0, 69120, 69120, 960, 2012, 0x671dc73a +0, 70080, 70080, 960, 2012, 0x7fd5b1d2 +0, 71040, 71040, 960, 2012, 0xbe7b9e5e +0, 72000, 72000, 960, 2012, 0x671dc73a +0, 72960, 72960, 960, 2012, 0x7fd5b1d2 +0, 73920, 73920, 960, 2012, 0xbe7b9e5e +0, 74880, 74880, 960, 2012, 0x671dc73a +0, 75840, 75840, 960, 2012, 0x7fd5b1d2 +0, 76800, 76800, 960, 2012, 0xbe7b9e5e +0, 77760, 77760, 960, 2012, 0x671dc73a +0, 78720, 78720, 960, 2012, 0x7fd5b1d2 +0, 79680, 79680, 960, 2012, 0xbe7b9e5e +0, 80640, 80640, 960, 2012, 0x671dc73a +0, 81600, 81600, 960, 2012, 0x7fd5b1d2 +0, 82560, 82560, 960, 2012, 0xbe7b9e5e +0, 83520, 83520, 960, 2012, 0x671dc73a +0, 84480, 84480, 960, 2012, 0x7fd5b1d2 +0, 85440, 85440, 960, 2012, 0xbe7b9e5e +0, 86400, 86400, 960, 2012, 0x671dc73a +0, 87360, 87360, 960, 2012, 0x7fd5b1d2 +0, 88320, 88320, 960, 2012, 0xbe7b9e5e +0, 89280, 89280, 960, 2012, 0x671dc73a +0, 90240, 90240, 960, 2012, 0x7fd5b1d2 +0, 91200, 91200, 960, 2012, 0xa9259df1 +0, 92160, 92160, 960, 2012, 0x3e8c2b92 +0, 93120, 93120, 960, 2012, 0x4876a9ff +0, 94080, 94080, 960, 2012, 0x7e469182 +0, 95040, 95040, 960, 2012, 0x10eba401 +0, 96000, 96000, 960, 2012, 0x51c68ed3 +0, 96960, 96960, 960, 2012, 0x3f52901b +0, 97920, 97920, 960, 2012, 0x7bebacce +0, 98880, 98880, 960, 2012, 0xcb94898d +0, 99840, 99840, 960, 2012, 0x14e3ae70 +0, 100800, 100800, 960, 2012, 0x016893cb +0, 101760, 101760, 960, 2012, 0x00739f0a +0, 102720, 102720, 960, 2012, 0x834aba41 +0, 103680, 103680, 960, 2012, 0x6a92ac08 +0, 104640, 104640, 960, 2012, 0x09eda257 +0, 105600, 105600, 960, 2012, 0x81449e3f +0, 106560, 106560, 960, 2012, 0xe6eb91d4 +0, 107520, 107520, 960, 2012, 0x51158c0e +0, 108480, 108480, 960, 2012, 0x84e4a013 +0, 109440, 109440, 960, 2012, 0x4c48a0e6 +0, 110400, 110400, 960, 2012, 0xf54c9811 +0, 111360, 111360, 960, 2012, 0x62778edb +0, 112320, 112320, 960, 2012, 0x7226a51b +0, 113280, 113280, 960, 2012, 0x44b9aad8 +0, 114240, 114240, 960, 2012, 0x8aa6b380 +0, 115200, 115200, 960, 2012, 0xc88c99e6 +0, 116160, 116160, 960, 2012, 0xed5e93e2 +0, 117120, 117120, 960, 2012, 0xeb0b9755 +0, 118080, 118080, 960, 2012, 0xe5ba8ca9 +0, 119040, 119040, 960, 2012, 0x2fef9bcf +0, 120000, 120000, 960, 2012, 0xf19c8749 +0, 120960, 120960, 960, 2012, 0x0feb94d0 +0, 121920, 121920, 960, 2012, 0x1f9194d1 +0, 122880, 122880, 960, 2012, 0x0cad9822 +0, 123840, 123840, 960, 2012, 0xe6f79152 +0, 124800, 124800, 960, 2012, 0x69e78955 +0, 125760, 125760, 960, 2012, 0x91dd8a1b +0, 126720, 126720, 960, 2012, 0x63fe8eea +0, 127680, 127680, 960, 2012, 0x8f6d90a2 +0, 128640, 128640, 960, 2012, 0xe3bf8626 +0, 129600, 129600, 960, 2012, 0xd08599db +0, 130560, 130560, 960, 2012, 0xf556a282 +0, 131520, 131520, 960, 2012, 0x7f8c8f90 +0, 132480, 132480, 960, 2012, 0xa04493b9 +0, 133440, 133440, 960, 2012, 0x21a19b3a +0, 134400, 134400, 960, 2012, 0x6ead9244 +0, 135360, 135360, 960, 2012, 0xe65290d7 +0, 136320, 136320, 960, 2012, 0x8ff58a8e +0, 137280, 137280, 960, 2012, 0x24ada603 +0, 138240, 138240, 960, 2012, 0x79cb85c7 +0, 139200, 139200, 960, 2012, 0x63c0ac54 +0, 140160, 140160, 960, 2012, 0x7f719f83 +0, 141120, 141120, 960, 2012, 0x2eb69654 +0, 142080, 142080, 960, 2012, 0xf5149bc0 +0, 143040, 143040, 960, 2012, 0xd0d6a414 +0, 144000, 144000, 960, 2012, 0x4f4a8ed3 +0, 144960, 144960, 960, 2012, 0x20888cb5 +0, 145920, 145920, 960, 2012, 0x13439c86 +0, 146880, 146880, 960, 2012, 0xc8fc98e1 +0, 147840, 147840, 960, 2012, 0x14689766 +0, 148800, 148800, 960, 2012, 0x830293e4 +0, 149760, 149760, 960, 2012, 0xdd5bb8ce +0, 150720, 150720, 960, 2012, 0x005ea280 +0, 151680, 151680, 960, 2012, 0x9b0581e2 +0, 152640, 152640, 960, 2012, 0x210f89b8 +0, 153600, 153600, 960, 2012, 0xb7c180bd +0, 154560, 154560, 960, 2012, 0xe53c85e4 +0, 155520, 155520, 960, 2012, 0x1f689207 +0, 156480, 156480, 960, 2012, 0x5653813b +0, 157440, 157440, 960, 2012, 0x1d278d66 +0, 158400, 158400, 960, 2012, 0xd94c9a83 +0, 159360, 159360, 960, 2012, 0x7af48548 +0, 160320, 160320, 960, 2012, 0x86209c99 +0, 161280, 161280, 960, 2012, 0x6e3b7fc9 +0, 162240, 162240, 960, 2012, 0x41c289e7 +0, 163200, 163200, 960, 2012, 0x8bea85db +0, 164160, 164160, 960, 2012, 0x45c98c39 +0, 165120, 165120, 960, 2012, 0xee098755 +0, 166080, 166080, 960, 2012, 0x485d9ec1 +0, 167040, 167040, 960, 2012, 0x78819023 +0, 168000, 168000, 960, 2012, 0xf43377bd +0, 168960, 168960, 960, 2012, 0x43fc9439 +0, 169920, 169920, 960, 2012, 0x045e9bf3 +0, 170880, 170880, 960, 2012, 0x0fc09f0c +0, 171840, 171840, 960, 2012, 0x7ba69bf5 +0, 172800, 172800, 960, 2012, 0x4aa7aaf0 +0, 173760, 173760, 960, 2012, 0x620c85bf +0, 174720, 174720, 960, 2012, 0xa6bb8a30 +0, 175680, 175680, 960, 2012, 0xfd10883c +0, 176640, 176640, 960, 2012, 0x32037e17 +0, 177600, 177600, 960, 2012, 0xb18c9e01 +0, 178560, 178560, 960, 2012, 0xd8206ee5 +0, 179520, 179520, 960, 2012, 0xdbc49136 +0, 180480, 180480, 960, 2012, 0x650a785d +0, 181440, 181440, 960, 2012, 0x9e107d61 +0, 182400, 182400, 960, 2012, 0xbf4eac50 +0, 183360, 183360, 960, 2012, 0x9d8f79b2 +0, 184320, 184320, 960, 2012, 0x252d8e8a +0, 185280, 185280, 960, 2012, 0x00af8fd6 +0, 186240, 186240, 960, 2012, 0x9e388d3b +0, 187200, 187200, 960, 2012, 0x75de7f56 +0, 188160, 188160, 960, 2012, 0xd502839c +0, 189120, 189120, 960, 2012, 0x66709e03 +0, 190080, 190080, 960, 2012, 0x3e0a96ba +0, 191040, 191040, 960, 2012, 0x0813ad4e +0, 192000, 192000, 960, 2012, 0x799c90c5 +0, 192960, 192960, 960, 2012, 0x98a18bed +0, 193920, 193920, 960, 2012, 0x8cd197d7 +0, 194880, 194880, 960, 2012, 0xf9ea8b22 +0, 195840, 195840, 960, 2012, 0x674f7cd2 +0, 196800, 196800, 960, 2012, 0xa5c39136 +0, 197760, 197760, 960, 2012, 0xe064ac30 +0, 198720, 198720, 960, 2012, 0x2af78c75 +0, 199680, 199680, 960, 2012, 0x43df9b19 +0, 200640, 200640, 960, 2012, 0x8d1a87d5 +0, 201600, 201600, 960, 2012, 0xd5be8d29 +0, 202560, 202560, 960, 2012, 0x43448bd4 +0, 203520, 203520, 960, 2012, 0xa128a30b +0, 204480, 204480, 960, 2012, 0x6fc29902 +0, 205440, 205440, 960, 2012, 0x5854a24b +0, 206400, 206400, 960, 2012, 0xb222958a +0, 207360, 207360, 960, 2012, 0xfca39cce +0, 208320, 208320, 960, 2012, 0xee0087f0 +0, 209280, 209280, 960, 2012, 0xd2d69b8c +0, 210240, 210240, 960, 2012, 0xe2308f8d +0, 211200, 211200, 960, 2012, 0x8dc4b09a +0, 212160, 212160, 960, 2012, 0x14489aef +0, 213120, 213120, 960, 2012, 0x900f9835 +0, 214080, 214080, 960, 2012, 0x0092a95f +0, 215040, 215040, 960, 2012, 0xfd90b1bf +0, 216000, 216000, 960, 2012, 0xb11ab5d5 +0, 216960, 216960, 960, 2012, 0xc802b908 +0, 217920, 217920, 960, 2012, 0xb12aa91e +0, 218880, 218880, 960, 2012, 0xd173c2a9 +0, 219840, 219840, 960, 2012, 0xaeafb887 +0, 220800, 220800, 960, 2012, 0xeb7eb0d7 +0, 221760, 221760, 960, 2012, 0x9afbc56a +0, 222720, 222720, 960, 2012, 0x2d78bc34 +0, 223680, 223680, 960, 2012, 0x6550aed1 +0, 224640, 224640, 960, 2012, 0xd514a55d +0, 225600, 225600, 960, 2012, 0x9058c263 +0, 226560, 226560, 960, 2012, 0xf819b66a +0, 227520, 227520, 960, 2012, 0x16a5c902 +0, 228480, 228480, 960, 2012, 0x602fc11b +0, 229440, 229440, 960, 2012, 0xe3c6b177 +0, 230400, 230400, 960, 2012, 0xacc4cd06 +0, 231360, 231360, 960, 2012, 0xeb96addb +0, 232320, 232320, 960, 2012, 0x1195cad3 +0, 233280, 233280, 960, 2012, 0x8e96ad7f +0, 234240, 234240, 960, 2012, 0x31e592b7 +0, 235200, 235200, 960, 2012, 0xa0c5ccf0 +0, 236160, 236160, 960, 2012, 0x6e77c92b +0, 237120, 237120, 960, 2012, 0xe87fa928 +0, 238080, 238080, 960, 2012, 0x4923bcdb +0, 239040, 239040, 960, 2012, 0x3260b452 +0, 240000, 240000, 960, 2012, 0x62beafa0 +0, 240960, 240960, 960, 2012, 0x5a6fc18a +0, 241920, 241920, 960, 2012, 0x9d05ae87 +0, 242880, 242880, 960, 2012, 0xb577a54e +0, 243840, 243840, 960, 2012, 0xd66bc5ef +0, 244800, 244800, 960, 2012, 0x40bec7bb +0, 245760, 245760, 960, 2012, 0xedd3a1b9 +0, 246720, 246720, 960, 2012, 0xf6f49f83 +0, 247680, 247680, 960, 2012, 0x316fb06d +0, 248640, 248640, 960, 2012, 0xc3f3a874 +0, 249600, 249600, 960, 2012, 0x3a96b3bd +0, 250560, 250560, 960, 2012, 0x825aba30 +0, 251520, 251520, 960, 2012, 0x5b58ce66 +0, 252480, 252480, 960, 2012, 0x412dc092 +0, 253440, 253440, 960, 2012, 0xcb47bfa3 +0, 254400, 254400, 960, 2012, 0xe025bb79 +0, 255360, 255360, 960, 2012, 0x0042ba53 +0, 256320, 256320, 960, 2012, 0x7e9bba1d +0, 257280, 257280, 960, 2012, 0x0058c99d +0, 258240, 258240, 960, 2012, 0x47d2b590 +0, 259200, 259200, 960, 2012, 0xdf4ba9c6 +0, 260160, 260160, 960, 2012, 0xe671987c +0, 261120, 261120, 960, 2012, 0x90dccc89 +0, 262080, 262080, 960, 2012, 0x012ccae9 +0, 263040, 263040, 960, 2012, 0x2eb5b83e +0, 264000, 264000, 960, 2012, 0x3fecb7f4 +0, 264960, 264960, 960, 2012, 0x7955a464 +0, 265920, 265920, 960, 2012, 0xfe9eb3c3 +0, 266880, 266880, 960, 2012, 0x7457c904 +0, 267840, 267840, 960, 2012, 0xd23ea69d +0, 268800, 268800, 960, 2012, 0xc497bf82 +0, 269760, 269760, 960, 2012, 0x15e5c241 +0, 270720, 270720, 960, 2012, 0x3dfea71f +0, 271680, 271680, 960, 2012, 0x1e59c9c0 +0, 272640, 272640, 960, 2012, 0x1a34b927 +0, 273600, 273600, 960, 2012, 0xbf42b430 +0, 274560, 274560, 960, 2012, 0xf084c29f +0, 275520, 275520, 960, 2012, 0x6443c44a +0, 276480, 276480, 960, 2012, 0x7985a4a5 +0, 277440, 277440, 960, 2012, 0x27add059 +0, 278400, 278400, 960, 2012, 0x7f1faea4 +0, 279360, 279360, 960, 2012, 0x8d9dc732 +0, 280320, 280320, 960, 2012, 0xf272c32e +0, 281280, 281280, 960, 2012, 0x4fa3ab11 +0, 282240, 282240, 960, 2012, 0x512e9887 +0, 283200, 283200, 960, 2012, 0xd478d55b +0, 284160, 284160, 960, 2012, 0xa94a9d93 +0, 285120, 285120, 960, 2012, 0xff73d812 +0, 286080, 286080, 960, 2012, 0xd3a6b9ef +0, 287040, 287040, 960, 2012, 0x7b4ebc1e +0, 288000, 288000, 960, 2012, 0xcc7bba1a +0, 288960, 288960, 960, 2012, 0x1aa7cd1a +0, 289920, 289920, 960, 2012, 0xd707c202 +0, 290880, 290880, 960, 2012, 0xcb6ac18b +0, 291840, 291840, 960, 2012, 0x1ccdcbd6 +0, 292800, 292800, 960, 2012, 0x700cb51e +0, 293760, 293760, 960, 2012, 0x27b6a3e7 +0, 294720, 294720, 960, 2012, 0x8570b8cd +0, 295680, 295680, 960, 2012, 0x22f2b2ed +0, 296640, 296640, 960, 2012, 0x75edb63e +0, 297600, 297600, 960, 2012, 0x8145b53f +0, 298560, 298560, 960, 2012, 0x15efb8bc +0, 299520, 299520, 960, 2012, 0x200bb5e6 +0, 300480, 300480, 960, 2012, 0xfa79b178 +0, 301440, 301440, 960, 2012, 0xbd39cdf4 +0, 302400, 302400, 960, 2012, 0x0970b0b2 +0, 303360, 303360, 960, 2012, 0x1acebe72 +0, 304320, 304320, 960, 2012, 0x1a26aa71 +0, 305280, 305280, 960, 2012, 0x8f71aa54 +0, 306240, 306240, 960, 2012, 0x0265c523 +0, 307200, 307200, 960, 2012, 0x2df0a53b +0, 308160, 308160, 960, 2012, 0x59a7a37a +0, 309120, 309120, 960, 2012, 0x9ad9acda +0, 310080, 310080, 960, 2012, 0x738cbc6f +0, 311040, 311040, 960, 2012, 0xc646a7ad +0, 312000, 312000, 960, 2012, 0x7f25c19b +0, 312960, 312960, 960, 2012, 0x1439bdb0 +0, 313920, 313920, 960, 2012, 0xa40cbef0 +0, 314880, 314880, 960, 2012, 0x9b09b99a +0, 315840, 315840, 960, 2012, 0x5ff0bbde +0, 316800, 316800, 960, 2012, 0x3981c2d6 +0, 317760, 317760, 960, 2012, 0xfa89b40d +0, 318720, 318720, 960, 2012, 0x12e9a7b9 +0, 319680, 319680, 960, 2012, 0xc5faaac3 +0, 320640, 320640, 960, 2012, 0xe12bc3a9 +0, 321600, 321600, 960, 2012, 0x9c57b8f3 +0, 322560, 322560, 960, 2012, 0x4fd4b6c0 +0, 323520, 323520, 960, 2012, 0xb72cca50 +0, 324480, 324480, 960, 2012, 0xb4d4cbbb +0, 325440, 325440, 960, 2012, 0x9399bfa1 +0, 326400, 326400, 960, 2012, 0x0abfb708 +0, 327360, 327360, 960, 2012, 0xd1d9acc0 +0, 328320, 328320, 960, 2012, 0x079ab5b2 +0, 329280, 329280, 960, 2012, 0x05a0be32 +0, 330240, 330240, 960, 2012, 0x445cc8db +0, 331200, 331200, 960, 2012, 0xf9a3aa71 +0, 332160, 332160, 960, 2012, 0xd2e29eac +0, 333120, 333120, 960, 2012, 0x391a9f20 +0, 334080, 334080, 960, 2012, 0x571eab4e +0, 335040, 335040, 960, 2012, 0x6962bc96 +0, 336000, 336000, 960, 2012, 0x2f04b495 +0, 336960, 336960, 960, 2012, 0x7b66bab7 +0, 337920, 337920, 960, 2012, 0xa718b8c9 +0, 338880, 338880, 960, 2012, 0xb069a54e +0, 339840, 339840, 960, 2012, 0xc052a1d2 +0, 340800, 340800, 960, 2012, 0x661ac62e +0, 341760, 341760, 960, 2012, 0xc4ebb529 +0, 342720, 342720, 960, 2012, 0xf998b251 +0, 343680, 343680, 960, 2012, 0x0ee8bffa +0, 344640, 344640, 960, 2012, 0x6e3fd984 +0, 345600, 345600, 960, 2012, 0x5825b63f +0, 346560, 346560, 960, 2012, 0x9c79c561 +0, 347520, 347520, 960, 2012, 0x3470beb7 +0, 348480, 348480, 960, 2012, 0x9135bd9d +0, 349440, 349440, 960, 2012, 0xd8e8bb7f +0, 350400, 350400, 960, 2012, 0x322ea448 +0, 351360, 351360, 960, 2012, 0xe974b3ab +0, 352320, 352320, 960, 2012, 0x4151c32d +0, 353280, 353280, 960, 2012, 0x2b05bf7d +0, 354240, 354240, 960, 2012, 0x4111c0d8 +0, 355200, 355200, 960, 2012, 0xff9ad574 +0, 356160, 356160, 960, 2012, 0xa55dced2 +0, 357120, 357120, 960, 2012, 0x11e6c0cb +0, 358080, 358080, 960, 2012, 0x2478b998 +0, 359040, 359040, 960, 2012, 0xdc8abb54 +0, 360000, 360000, 960, 2012, 0xe16da510 +0, 360960, 360960, 960, 2012, 0xfc18b3db +0, 361920, 361920, 960, 2012, 0x1426cd42 +0, 362880, 362880, 960, 2012, 0xb560a661 +0, 363840, 363840, 960, 2012, 0xc200aa4b +0, 364800, 364800, 960, 2012, 0xea00af2a +0, 365760, 365760, 960, 2012, 0x32bcbf84 +0, 366720, 366720, 960, 2012, 0x4c29cb2a +0, 367680, 367680, 960, 2012, 0xe8a2aabc +0, 368640, 368640, 960, 2012, 0x64bdb6cd +0, 369600, 369600, 960, 2012, 0x3a80adbc +0, 370560, 370560, 960, 2012, 0xa012b2c4 +0, 371520, 371520, 960, 2012, 0xac3ebce7 +0, 372480, 372480, 960, 2012, 0xfae1b2a7 +0, 373440, 373440, 960, 2012, 0x37b4ddae +0, 374400, 374400, 960, 2012, 0x8ff9bd55 +0, 375360, 375360, 960, 2012, 0x16f6abeb +0, 376320, 376320, 960, 2012, 0x5820badf +0, 377280, 377280, 960, 2012, 0x7183b45e +0, 378240, 378240, 960, 2012, 0xc0a6c826 +0, 379200, 379200, 960, 2012, 0x4c36bb02 +0, 380160, 380160, 960, 2012, 0xda46b854 +0, 381120, 381120, 960, 2012, 0xcc8accb6 +0, 382080, 382080, 960, 2012, 0xa6b2c3a2 +0, 383040, 383040, 960, 2012, 0x1c91cc00 +0, 384000, 384000, 960, 2012, 0xf33cd721 +0, 384960, 384960, 960, 2012, 0x7f86d2ed +0, 385920, 385920, 960, 2012, 0x9fdabb1d +0, 386880, 386880, 960, 2012, 0x33ebbbc4 +0, 387840, 387840, 960, 2012, 0x2741ba4f +0, 388800, 388800, 960, 2012, 0x0d0dd107 +0, 389760, 389760, 960, 2012, 0xf1d5b551 +0, 390720, 390720, 960, 2012, 0xf47dbebc +0, 391680, 391680, 960, 2012, 0xa955cea3 +0, 392640, 392640, 960, 2012, 0x51d6b407 +0, 393600, 393600, 960, 2012, 0xb7d3c2c0 +0, 394560, 394560, 960, 2012, 0xce3cc6ae +0, 395520, 395520, 960, 2012, 0x782cc184 +0, 396480, 396480, 960, 2012, 0xf4cec2af +0, 397440, 397440, 960, 2012, 0xa43eb295 +0, 398400, 398400, 960, 2012, 0xc74aa62d +0, 399360, 399360, 960, 2012, 0xf9dfc11f +0, 400320, 400320, 960, 2012, 0x3da1a319 +0, 401280, 401280, 960, 2012, 0xf613bd75 +0, 402240, 402240, 960, 2012, 0x10d9cda4 +0, 403200, 403200, 960, 2012, 0x08c9bcb3 +0, 404160, 404160, 960, 2012, 0x43b9d170 +0, 405120, 405120, 960, 2012, 0x1f0db940 +0, 406080, 406080, 960, 2012, 0x3c4ec614 +0, 407040, 407040, 960, 2012, 0xa94abaaa +0, 408000, 408000, 960, 2012, 0x2557a922 +0, 408960, 408960, 960, 2012, 0x4245c4b4 +0, 409920, 409920, 960, 2012, 0x0cb1b06f +0, 410880, 410880, 960, 2012, 0x778bbeab +0, 411840, 411840, 960, 2012, 0x5ce4ca3b +0, 412800, 412800, 960, 2012, 0xe70e9fd3 +0, 413760, 413760, 960, 2012, 0x28afbcbf +0, 414720, 414720, 960, 2012, 0xc41fb9b2 +0, 415680, 415680, 960, 2012, 0xd60cbfae +0, 416640, 416640, 960, 2012, 0x1087cb26 +0, 417600, 417600, 960, 2012, 0xc9face3b +0, 418560, 418560, 960, 2012, 0x7403b314 +0, 419520, 419520, 960, 2012, 0xe034ba97 +0, 420480, 420480, 960, 2012, 0x15dcbc67 +0, 421440, 421440, 960, 2012, 0x20d3bcff +0, 422400, 422400, 960, 2012, 0xc136a2ce +0, 423360, 423360, 960, 2012, 0x038bb025 +0, 424320, 424320, 960, 2012, 0xd655cf84 +0, 425280, 425280, 960, 2012, 0xcf54c656 +0, 426240, 426240, 960, 2012, 0x3c77bb0d +0, 427200, 427200, 960, 2012, 0xd765d7a7 +0, 428160, 428160, 960, 2012, 0x1a60b020 +0, 429120, 429120, 960, 2012, 0x83c8c2e9 +0, 430080, 430080, 960, 2012, 0x9b97c6e7 +0, 431040, 431040, 960, 2012, 0x3870ad63 +0, 432000, 432000, 960, 2012, 0x0e3ac67d +0, 432960, 432960, 960, 2012, 0xeb53c935 +0, 433920, 433920, 960, 2012, 0xeeb0c3e1 +0, 434880, 434880, 960, 2012, 0x9cb5bdb9 +0, 435840, 435840, 960, 2012, 0x64b1afec +0, 436800, 436800, 960, 2012, 0x57dcadbc +0, 437760, 437760, 960, 2012, 0xed76c5fd +0, 438720, 438720, 960, 2012, 0x0cb4cac5 +0, 439680, 439680, 960, 2012, 0xd30bbd06 +0, 440640, 440640, 960, 2012, 0xaee9c6c3 +0, 441600, 441600, 960, 2012, 0xe845c9b3 +0, 442560, 442560, 960, 2012, 0xc09cc7fc +0, 443520, 443520, 960, 2012, 0xfdebaacb +0, 444480, 444480, 960, 2012, 0x6f2db89f +0, 445440, 445440, 960, 2012, 0x7d89bee7 +0, 446400, 446400, 960, 2012, 0x8699b8be +0, 447360, 447360, 960, 2012, 0x57d6cc8a +0, 448320, 448320, 960, 2012, 0xcdbcd246 +0, 449280, 449280, 960, 2012, 0x9057b285 +0, 450240, 450240, 960, 2012, 0x2ac9cc87 +0, 451200, 451200, 960, 2012, 0xeb20c421 +0, 452160, 452160, 960, 2012, 0x4789d11f +0, 453120, 453120, 960, 2012, 0x55e7c9fe +0, 454080, 454080, 960, 2012, 0xd81cb4c6 +0, 455040, 455040, 960, 2012, 0x2af0a88e +0, 456000, 456000, 960, 2012, 0x7d96a4ee +0, 456960, 456960, 960, 2012, 0xff7cc3ea +0, 457920, 457920, 960, 2012, 0x2514d2a8 +0, 458880, 458880, 960, 2012, 0x7d2cccc3 +0, 459840, 459840, 960, 2012, 0x98dccbbf +0, 460800, 460800, 960, 2012, 0x55f2bd3e +0, 461760, 461760, 960, 2012, 0x0e58bbd7 +0, 462720, 462720, 960, 2012, 0x1520c45d +0, 463680, 463680, 960, 2012, 0x3c60cede +0, 464640, 464640, 960, 2012, 0xbfb2be6b +0, 465600, 465600, 960, 2012, 0xa839c2d5 +0, 466560, 466560, 960, 2012, 0x7713bdba +0, 467520, 467520, 960, 2012, 0xf16c9e95 +0, 468480, 468480, 960, 2012, 0x8e94caf1 +0, 469440, 469440, 960, 2012, 0x3915c673 +0, 470400, 470400, 960, 2012, 0x69afc76f +0, 471360, 471360, 960, 2012, 0x3ebec514 +0, 472320, 472320, 960, 2012, 0x70c5dd9b +0, 473280, 473280, 960, 2012, 0x6868b7d9 +0, 474240, 474240, 960, 2012, 0x9a31c801 +0, 475200, 475200, 960, 2012, 0x93c4b6ac +0, 476160, 476160, 960, 2012, 0xb1aaca39 +0, 477120, 477120, 960, 2012, 0x8f67b9ed +0, 478080, 478080, 960, 2012, 0x09adcf1f +0, 479040, 479040, 960, 2012, 0xe172cb3c +0, 480000, 480000, 960, 2012, 0x044bbdc5 +0, 480960, 480960, 960, 2012, 0x391cb3d9 +0, 481920, 481920, 960, 2012, 0x3bd1bc29 +0, 482880, 482880, 960, 2012, 0x8a78c5d2 +0, 483840, 483840, 960, 2012, 0xa46fce11 +0, 484800, 484800, 960, 2012, 0x4c13d9bc +0, 485760, 485760, 960, 2012, 0x7f47ce4f +0, 486720, 486720, 960, 2012, 0xa03ebcae +0, 487680, 487680, 960, 2012, 0xf6f2b2c8 +0, 488640, 488640, 960, 2012, 0x7995be2a +0, 489600, 489600, 960, 2012, 0x22d7b94a +0, 490560, 490560, 960, 2012, 0x07bcc06a +0, 491520, 491520, 960, 2012, 0x04adcb6d +0, 492480, 492480, 960, 2012, 0x4aecc135 +0, 493440, 493440, 960, 2012, 0x8442dc6a +0, 494400, 494400, 960, 2012, 0x9e67b826 +0, 495360, 495360, 960, 2012, 0xb1c4b235 +0, 496320, 496320, 960, 2012, 0x565ecaae +0, 497280, 497280, 960, 2012, 0x34a2c877 +0, 498240, 498240, 960, 2012, 0x815eb148 +0, 499200, 499200, 960, 2012, 0x354eb4ce +0, 500160, 500160, 960, 2012, 0xf74db8b1 +0, 501120, 501120, 960, 2012, 0x56f3b430 +0, 502080, 502080, 960, 2012, 0x39f9c72f +0, 503040, 503040, 960, 2012, 0x83d1bfde +0, 504000, 504000, 960, 2012, 0x2da1bf57 +0, 504960, 504960, 960, 2012, 0xd97fc933 +0, 505920, 505920, 960, 2012, 0x4b3edbfe +0, 506880, 506880, 960, 2012, 0xb975d346 +0, 507840, 507840, 960, 2012, 0x856ac304 +0, 508800, 508800, 960, 2012, 0xb38dba2e +0, 509760, 509760, 960, 2012, 0xbe14c822 +0, 510720, 510720, 960, 2012, 0xb848c927 +0, 511680, 511680, 960, 2012, 0x0a89c0e6 +0, 512640, 512640, 960, 2012, 0x44a3c3d5 +0, 513600, 513600, 960, 2012, 0x7af1c30c +0, 514560, 514560, 960, 2012, 0xe928b619 +0, 515520, 515520, 960, 2012, 0xc9aeb012 +0, 516480, 516480, 960, 2012, 0xae02cfde +0, 517440, 517440, 960, 2012, 0x0b42c3d9 +0, 518400, 518400, 960, 2012, 0xa5b7c1ed +0, 519360, 519360, 960, 2012, 0xd2dcbcdc +0, 520320, 520320, 960, 2012, 0x18cfbf55 +0, 521280, 521280, 960, 2012, 0x34f0c800 +0, 522240, 522240, 960, 2012, 0x2a80bdba +0, 523200, 523200, 960, 2012, 0x5ef2b3a7 +0, 524160, 524160, 960, 2012, 0x35a6ba33 +0, 525120, 525120, 960, 2012, 0x1088bbf5 +0, 526080, 526080, 960, 2012, 0xaec0bedf +0, 527040, 527040, 960, 2012, 0x769fb535 +0, 528000, 528000, 960, 2012, 0xfe11b979 +0, 528960, 528960, 960, 2012, 0xe856b37e +0, 529920, 529920, 960, 2012, 0x36c3cffd +0, 530880, 530880, 960, 2012, 0x4771db58 +0, 531840, 531840, 960, 2012, 0x5467d13e +0, 532800, 532800, 960, 2012, 0xb405c1b5 +0, 533760, 533760, 960, 2012, 0x3cbdc145 +0, 534720, 534720, 960, 2012, 0xbb9ccdd7 +0, 535680, 535680, 960, 2012, 0xac25ce9e +0, 536640, 536640, 960, 2012, 0x6d2ac82a +0, 537600, 537600, 960, 2012, 0x1661ba50 +0, 538560, 538560, 960, 2012, 0xbc7ac82a +0, 539520, 539520, 960, 2012, 0x020bb4de +0, 540480, 540480, 960, 2012, 0x4e10cb93 +0, 541440, 541440, 960, 2012, 0x3dabc15f +0, 542400, 542400, 960, 2012, 0x12acc64b +0, 543360, 543360, 960, 2012, 0x9cecb51a +0, 544320, 544320, 960, 2012, 0x959acb39 +0, 545280, 545280, 960, 2012, 0x3ee7c0e8 +0, 546240, 546240, 960, 2012, 0xde18c1df +0, 547200, 547200, 960, 2012, 0x3c72c3cd +0, 548160, 548160, 960, 2012, 0x1ac4bb5d +0, 549120, 549120, 960, 2012, 0xb155c741 +0, 550080, 550080, 960, 2012, 0x5069c8aa +0, 551040, 551040, 960, 2012, 0x610db0bc +0, 552000, 552000, 960, 2012, 0xb82bc329 +0, 552960, 552960, 960, 2012, 0x8bd4c522 +0, 553920, 553920, 960, 2012, 0xd44bb865 +0, 554880, 554880, 960, 2012, 0xb51ac7dc +0, 555840, 555840, 960, 2012, 0xfe2bc799 +0, 556800, 556800, 960, 2012, 0x8cd1bb53 +0, 557760, 557760, 960, 2012, 0xba13ca97 +0, 558720, 558720, 960, 2012, 0xf107bd51 +0, 559680, 559680, 960, 2012, 0xa04ece95 +0, 560640, 560640, 960, 2012, 0x4f4faa54 +0, 561600, 561600, 960, 2012, 0x5a74bfe1 +0, 562560, 562560, 960, 2012, 0xdafade5b +0, 563520, 563520, 960, 2012, 0x738fba51 +0, 564480, 564480, 960, 2012, 0xe7b2b78e +0, 565440, 565440, 960, 2012, 0x7685b6ce +0, 566400, 566400, 960, 2012, 0xae45bd8a +0, 567360, 567360, 960, 2012, 0xd52cc84e +0, 568320, 568320, 960, 2012, 0x04abd773 +0, 569280, 569280, 960, 2012, 0x2badb0ff +0, 570240, 570240, 960, 2012, 0x0eaec6b2 +0, 571200, 571200, 960, 2012, 0x7c1ec33f +0, 572160, 572160, 960, 2012, 0x8773b925 +0, 573120, 573120, 960, 2012, 0x40bbc36d +0, 574080, 574080, 960, 2012, 0x330bc288 +0, 575040, 575040, 960, 2012, 0x1659b6f5 +0, 576000, 576000, 960, 2012, 0x66eac162 +0, 576960, 576960, 960, 2012, 0xf3acdb3d +0, 577920, 577920, 960, 2012, 0x465abb87 +0, 578880, 578880, 960, 2012, 0xe8e9bc16 +0, 579840, 579840, 960, 2012, 0x71eebbd9 +0, 580800, 580800, 960, 2012, 0x1f59cb2a +0, 581760, 581760, 960, 2012, 0x53e3c9e7 +0, 582720, 582720, 960, 2012, 0xf410b939 +0, 583680, 583680, 960, 2012, 0xdb13d1b3 +0, 584640, 584640, 960, 2012, 0xcd26bf27 +0, 585600, 585600, 960, 2012, 0x707ecc9c +0, 586560, 586560, 960, 2012, 0x3483b6bf +0, 587520, 587520, 960, 2012, 0x4184d451 +0, 588480, 588480, 960, 2012, 0xcf6abfae +0, 589440, 589440, 960, 2012, 0x5c9eb4ca +0, 590400, 590400, 960, 2012, 0xf396be01 +0, 591360, 591360, 960, 2012, 0x06bfda38 +0, 592320, 592320, 960, 2012, 0x0e92bcf4 +0, 593280, 593280, 960, 2012, 0xaaa2b99d +0, 594240, 594240, 960, 2012, 0xf112a9a9 +0, 595200, 595200, 960, 2012, 0x2844bdf1 +0, 596160, 596160, 960, 2012, 0xb96baf39 +0, 597120, 597120, 960, 2012, 0xd4f2d157 +0, 598080, 598080, 960, 2012, 0x7c74b149 +0, 599040, 599040, 960, 2012, 0xbd43d5f2 +0, 600000, 600000, 960, 2012, 0xaa10b2ba +0, 600960, 600960, 960, 2012, 0x66e9b95f +0, 601920, 601920, 960, 2012, 0x6f01abef +0, 602880, 602880, 960, 2012, 0x1cb5c664 +0, 603840, 603840, 960, 2012, 0x5ee2afc5 +0, 604800, 604800, 960, 2012, 0xeb39d213 +0, 605760, 605760, 960, 2012, 0x1ffeaafc +0, 606720, 606720, 960, 2012, 0x6bb4d548 +0, 607680, 607680, 960, 2012, 0xa045b23a +0, 608640, 608640, 960, 2012, 0x17c3aa49 +0, 609600, 609600, 960, 2012, 0x2d47db7c +0, 610560, 610560, 960, 2012, 0x07ddc9ac +0, 611520, 611520, 960, 2012, 0xa386c99e +0, 612480, 612480, 960, 2012, 0x0e0bae8a +0, 613440, 613440, 960, 2012, 0x7d6fc419 +0, 614400, 614400, 960, 2012, 0x34a3c5a2 +0, 615360, 615360, 960, 2012, 0xda81c8e9 +0, 616320, 616320, 960, 2012, 0xde53bcd8 +0, 617280, 617280, 960, 2012, 0x372ac065 +0, 618240, 618240, 960, 2012, 0x6d07a95c +0, 619200, 619200, 960, 2012, 0x296eb47f +0, 620160, 620160, 960, 2012, 0x0f47be2a +0, 621120, 621120, 960, 2012, 0x389ebaf6 +0, 622080, 622080, 960, 2012, 0x9746ba3b +0, 623040, 623040, 960, 2012, 0x070e9aed +0, 624000, 624000, 960, 2012, 0xa4abc798 +0, 624960, 624960, 960, 2012, 0xe55cac7b +0, 625920, 625920, 960, 2012, 0x0c71ba45 +0, 626880, 626880, 960, 2012, 0x70fbb3c5 +0, 627840, 627840, 960, 2012, 0xa35ec30a +0, 628800, 628800, 960, 2012, 0xf30ab935 +0, 629760, 629760, 960, 2012, 0x2cbb9b99 +0, 630720, 630720, 960, 2012, 0x6606c1bf +0, 631680, 631680, 960, 2012, 0x41ccad5c +0, 632640, 632640, 960, 2012, 0x352fc002 +0, 633600, 633600, 960, 2012, 0x1763bd10 +0, 634560, 634560, 960, 2012, 0xb54bcae6 +0, 635520, 635520, 960, 2012, 0x7374ab92 +0, 636480, 636480, 960, 2012, 0x2895a99a +0, 637440, 637440, 960, 2012, 0x9f68b02f +0, 638400, 638400, 960, 2012, 0xdfabbb76 +0, 639360, 639360, 960, 2012, 0x764ea6c5 +0, 640320, 640320, 960, 2012, 0x4e83c5a5 +0, 641280, 641280, 960, 2012, 0xf0e8c76a +0, 642240, 642240, 960, 2012, 0xdc80b4ea +0, 643200, 643200, 960, 2012, 0xcc53b0a5 +0, 644160, 644160, 960, 2012, 0x7893bc7f +0, 645120, 645120, 960, 2012, 0x6965b355 +0, 646080, 646080, 960, 2012, 0x7f8fac00 +0, 647040, 647040, 960, 2012, 0x6c71c7b8 +0, 648000, 648000, 960, 2012, 0xa00ec367 +0, 648960, 648960, 960, 2012, 0x5f0fc50e +0, 649920, 649920, 960, 2012, 0x1bd2ad87 +0, 650880, 650880, 960, 2012, 0xd054ba2d +0, 651840, 651840, 960, 2012, 0xaf80a0d5 +0, 652800, 652800, 960, 2012, 0x2acac873 +0, 653760, 653760, 960, 2012, 0x260ca584 +0, 654720, 654720, 960, 2012, 0x4f98aa7c +0, 655680, 655680, 960, 2012, 0x0254aa36 +0, 656640, 656640, 960, 2012, 0xe3c7c33a +0, 657600, 657600, 960, 2012, 0x3b9ea70f +0, 658560, 658560, 960, 2012, 0xe829b7e6 +0, 659520, 659520, 960, 2012, 0x9317a8d1 +0, 660480, 660480, 960, 2012, 0x88b3a98f +0, 661440, 661440, 960, 2012, 0xa4a8c3bc +0, 662400, 662400, 960, 2012, 0x95c9a869 +0, 663360, 663360, 960, 2012, 0x7f889fed +0, 664320, 664320, 960, 2012, 0x5438c408 +0, 665280, 665280, 960, 2012, 0x3455a366 +0, 666240, 666240, 960, 2012, 0x5319b33d +0, 667200, 667200, 960, 2012, 0xb19dc4f0 +0, 668160, 668160, 960, 2012, 0xf080b109 +0, 669120, 669120, 960, 2012, 0xef83d8e7 +0, 670080, 670080, 960, 2012, 0x237ac69c +0, 671040, 671040, 960, 2012, 0xbb30b714 +0, 672000, 672000, 960, 2012, 0x8745ba54 +0, 672960, 672960, 960, 2012, 0x8588bd6c +0, 673920, 673920, 960, 2012, 0xc580bdde +0, 674880, 674880, 960, 2012, 0xb062baf1 +0, 675840, 675840, 960, 2012, 0xe014b082 +0, 676800, 676800, 960, 2012, 0x148bcb87 +0, 677760, 677760, 960, 2012, 0x554bc13d +0, 678720, 678720, 960, 2012, 0xc410c270 +0, 679680, 679680, 960, 2012, 0xb2c8b65b +0, 680640, 680640, 960, 2012, 0xa412b3f4 +0, 681600, 681600, 960, 2012, 0xbb52aa9a +0, 682560, 682560, 960, 2012, 0x4005b527 +0, 683520, 683520, 960, 2012, 0x8c5eb055 +0, 684480, 684480, 960, 2012, 0x8622c142 +0, 685440, 685440, 960, 2012, 0x05a3b861 +0, 686400, 686400, 960, 2012, 0x9f6dbb4d +0, 687360, 687360, 960, 2012, 0x033fb867 +0, 688320, 688320, 960, 2012, 0x243babd5 +0, 689280, 689280, 960, 2012, 0x8d6db83c +0, 690240, 690240, 960, 2012, 0x3923b829 +0, 691200, 691200, 960, 2012, 0x69b6b587 +0, 692160, 692160, 960, 2012, 0xdda8d018 +0, 693120, 693120, 960, 2012, 0x54b1b2a4 +0, 694080, 694080, 960, 2012, 0x380eb1af +0, 695040, 695040, 960, 2012, 0xec3cbdb4 +0, 696000, 696000, 960, 2012, 0x7ce9b4cf +0, 696960, 696960, 960, 2012, 0xcf6cb99b +0, 697920, 697920, 960, 2012, 0x7383ab97 +0, 698880, 698880, 960, 2012, 0xaa4cc068 +0, 699840, 699840, 960, 2012, 0x96d4c3db +0, 700800, 700800, 960, 2012, 0xab8cb84f +0, 701760, 701760, 960, 2012, 0x73dcacf9 +0, 702720, 702720, 960, 2012, 0xf61ca122 +0, 703680, 703680, 960, 2012, 0x9f1cbd5b +0, 704640, 704640, 960, 2012, 0x1f84aa3f +0, 705600, 705600, 960, 2012, 0xa003ad43 +0, 706560, 706560, 960, 2012, 0x6cffa4ef +0, 707520, 707520, 960, 2012, 0x29559e1e +0, 708480, 708480, 960, 2012, 0x7a79b059 +0, 709440, 709440, 960, 2012, 0xa1929c42 +0, 710400, 710400, 960, 2012, 0x52dead1c +0, 711360, 711360, 960, 2012, 0x8f31b9f5 +0, 712320, 712320, 960, 2012, 0xb8a899ec +0, 713280, 713280, 960, 2012, 0x7ca4b02d +0, 714240, 714240, 960, 2012, 0x2c92ae1b +0, 715200, 715200, 960, 2012, 0xe683a92f +0, 716160, 716160, 960, 2012, 0xe9d5abcf +0, 717120, 717120, 960, 2012, 0x757db377 +0, 718080, 718080, 960, 2012, 0xd4a8bbae +0, 719040, 719040, 960, 2012, 0xeea5c4ee +0, 720000, 720000, 960, 2012, 0xc37ca9a9 +0, 720960, 720960, 960, 2012, 0x8871bb51 +0, 721920, 721920, 960, 2012, 0x5dd8b3a2 +0, 722880, 722880, 960, 2012, 0xef0fae7f +0, 723840, 723840, 960, 2012, 0xe7ecb23e +0, 724800, 724800, 960, 2012, 0xc4f6d437 +0, 725760, 725760, 960, 2012, 0x0c74b81d +0, 726720, 726720, 960, 2012, 0xee68b1ee +0, 727680, 727680, 960, 2012, 0x46b4b4a8 +0, 728640, 728640, 960, 2012, 0x0526abca +0, 729600, 729600, 960, 2012, 0x7695ba55 +0, 730560, 730560, 960, 2012, 0xc7f5ad90 +0, 731520, 731520, 960, 2012, 0x0522b9bc +0, 732480, 732480, 960, 2012, 0x0eefc6ad +0, 733440, 733440, 960, 2012, 0x340dae16 +0, 734400, 734400, 960, 2012, 0xea42bdc0 +0, 735360, 735360, 960, 2012, 0xe047abb6 +0, 736320, 736320, 960, 2012, 0x6da5c14f +0, 737280, 737280, 960, 2012, 0x46d8c11d +0, 738240, 738240, 960, 2012, 0x8f4d9f2f +0, 739200, 739200, 960, 2012, 0x6d00d26c +0, 740160, 740160, 960, 2012, 0x87fc9d1b +0, 741120, 741120, 960, 2012, 0xbba5b763 +0, 742080, 742080, 960, 2012, 0xab58b853 +0, 743040, 743040, 960, 2012, 0x8180b863 +0, 744000, 744000, 960, 2012, 0x3684b3ba +0, 744960, 744960, 960, 2012, 0xf1a4a806 +0, 745920, 745920, 960, 2012, 0x2826b48c +0, 746880, 746880, 960, 2012, 0x1883af7f +0, 747840, 747840, 960, 2012, 0x44c5c37a +0, 748800, 748800, 960, 2012, 0xec33c3f1 +0, 749760, 749760, 960, 2012, 0xd67fb767 +0, 750720, 750720, 960, 2012, 0x03c2c219 +0, 751680, 751680, 960, 2012, 0x75a9b389 +0, 752640, 752640, 960, 2012, 0xe041ad88 +0, 753600, 753600, 960, 2012, 0x6bccb005 +0, 754560, 754560, 960, 2012, 0xd881c24a +0, 755520, 755520, 960, 2012, 0x7dd0c302 +0, 756480, 756480, 960, 2012, 0x2ba8a649 +0, 757440, 757440, 960, 2012, 0x63e19eab +0, 758400, 758400, 960, 2012, 0x1c0dafce +0, 759360, 759360, 960, 2012, 0xf266bf47 +0, 760320, 760320, 960, 2012, 0x11beb4b1 +0, 761280, 761280, 960, 2012, 0xc6f6b2b5 +0, 762240, 762240, 960, 2012, 0x15d4b4d0 +0, 763200, 763200, 960, 2012, 0x08bfa1e7 +0, 764160, 764160, 960, 2012, 0x18dbb7b5 +0, 765120, 765120, 960, 2012, 0xc279cc67 +0, 766080, 766080, 960, 2012, 0xd236bf28 +0, 767040, 767040, 960, 2012, 0xc9d1b196 +0, 768000, 768000, 960, 2012, 0xb605983e +0, 768960, 768960, 960, 2012, 0x8132c566 +0, 769920, 769920, 960, 2012, 0x6be4cd39 +0, 770880, 770880, 960, 2012, 0xce53c1f9 +0, 771840, 771840, 960, 2012, 0xe1efac0f +0, 772800, 772800, 960, 2012, 0x3d60a57a +0, 773760, 773760, 960, 2012, 0x1beda4b7 +0, 774720, 774720, 960, 2012, 0x34a4ac81 +0, 775680, 775680, 960, 2012, 0x30b0be4b +0, 776640, 776640, 960, 2012, 0xc7ceaf45 +0, 777600, 777600, 960, 2012, 0xade0b6ec +0, 778560, 778560, 960, 2012, 0xe00daf06 +0, 779520, 779520, 960, 2012, 0x04f79fe4 +0, 780480, 780480, 960, 2012, 0x8c59b7d9 +0, 781440, 781440, 960, 2012, 0x6f66b92a +0, 782400, 782400, 960, 2012, 0x9b08b2c0 +0, 783360, 783360, 960, 2012, 0xa8c1b5c1 +0, 784320, 784320, 960, 2012, 0xe3aac0b0 +0, 785280, 785280, 960, 2012, 0x1622bdaf +0, 786240, 786240, 960, 2012, 0x25e1a9ff +0, 787200, 787200, 960, 2012, 0x5577ad82 +0, 788160, 788160, 960, 2012, 0xfe16a49b +0, 789120, 789120, 960, 2012, 0xef7fc32a +0, 790080, 790080, 960, 2012, 0xfe30c35d +0, 791040, 791040, 960, 2012, 0x3adc9610 +0, 792000, 792000, 960, 2012, 0x36eeabdc +0, 792960, 792960, 960, 2012, 0xde3fb56c +0, 793920, 793920, 960, 2012, 0x5629bd82 +0, 794880, 794880, 960, 2012, 0xb099a61d +0, 795840, 795840, 960, 2012, 0x3013b106 +0, 796800, 796800, 960, 2012, 0xc359aef3 +0, 797760, 797760, 960, 2012, 0xec01b3e1 +0, 798720, 798720, 960, 2012, 0x6e8ac0b1 +0, 799680, 799680, 960, 2012, 0x41e8b82d +0, 800640, 800640, 960, 2012, 0x3a2fb38b +0, 801600, 801600, 960, 2012, 0x7025aac9 +0, 802560, 802560, 960, 2012, 0xbb0eb094 +0, 803520, 803520, 960, 2012, 0xdc06c156 +0, 804480, 804480, 960, 2012, 0x4007cea4 +0, 805440, 805440, 960, 2012, 0x102ebe03 +0, 806400, 806400, 960, 2012, 0x6e8faae7 +0, 807360, 807360, 960, 2012, 0xa357aa0c +0, 808320, 808320, 960, 2012, 0x07d2bf4d +0, 809280, 809280, 960, 2012, 0xfb71b338 +0, 810240, 810240, 960, 2012, 0xd5f1be84 +0, 811200, 811200, 960, 2012, 0x2a7cb554 +0, 812160, 812160, 960, 2012, 0xfb03b8c3 +0, 813120, 813120, 960, 2012, 0x2ff1ca87 +0, 814080, 814080, 960, 2012, 0xeef2b7f3 +0, 815040, 815040, 960, 2012, 0x9377b15f +0, 816000, 816000, 960, 2012, 0x370cb0c2 +0, 816960, 816960, 960, 2012, 0x5f78b118 +0, 817920, 817920, 960, 2012, 0x19afa87a +0, 818880, 818880, 960, 2012, 0xc717ab0d +0, 819840, 819840, 960, 2012, 0x3ca499f4 +0, 820800, 820800, 960, 2012, 0x9612b8e4 +0, 821760, 821760, 960, 2012, 0x32c0bb29 +0, 822720, 822720, 960, 2012, 0x7727beba +0, 823680, 823680, 960, 2012, 0x8b60a4cb +0, 824640, 824640, 960, 2012, 0xe899a9c8 +0, 825600, 825600, 960, 2012, 0x60f4b7fe +0, 826560, 826560, 960, 2012, 0x544f9ecb +0, 827520, 827520, 960, 2012, 0x34afcd71 +0, 828480, 828480, 960, 2012, 0x470eab55 +0, 829440, 829440, 960, 2012, 0xe4959f93 +0, 830400, 830400, 960, 2012, 0x69eeaf97 +0, 831360, 831360, 960, 2012, 0x0ec9aca3 +0, 832320, 832320, 960, 2012, 0x51e4b7f6 +0, 833280, 833280, 960, 2012, 0xf6c0a837 +0, 834240, 834240, 960, 2012, 0x3bdca59b +0, 835200, 835200, 960, 2012, 0x14c59dfc +0, 836160, 836160, 960, 2012, 0xa50ab23a +0, 837120, 837120, 960, 2012, 0x8832b6e2 +0, 838080, 838080, 960, 2012, 0x3d699d1b +0, 839040, 839040, 960, 2012, 0x751aa4b8 +0, 840000, 840000, 960, 2012, 0x59a9b98c +0, 840960, 840960, 960, 2012, 0xb67c98cb +0, 841920, 841920, 960, 2012, 0x0fd39ccd +0, 842880, 842880, 960, 2012, 0x9980d1e1 +0, 843840, 843840, 960, 2012, 0xffd9a716 +0, 844800, 844800, 960, 2012, 0x7d2fbed1 +0, 845760, 845760, 960, 2012, 0x76e6b042 +0, 846720, 846720, 960, 2012, 0xe027a232 +0, 847680, 847680, 960, 2012, 0x7c6ca5ce +0, 848640, 848640, 960, 2012, 0x5cf6bda4 +0, 849600, 849600, 960, 2012, 0x6075bd0d +0, 850560, 850560, 960, 2012, 0xedc4abe9 +0, 851520, 851520, 960, 2012, 0xb8f7cc26 +0, 852480, 852480, 960, 2012, 0x2cbbb500 +0, 853440, 853440, 960, 2012, 0x1c34b04d +0, 854400, 854400, 960, 2012, 0x5f18bea2 +0, 855360, 855360, 960, 2012, 0x94d0bb2b +0, 856320, 856320, 960, 2012, 0x6899b78e +0, 857280, 857280, 960, 2012, 0xc9aaa7a2 +0, 858240, 858240, 960, 2012, 0x298cbafa +0, 859200, 859200, 960, 2012, 0x89d9ac80 +0, 860160, 860160, 960, 2012, 0xc6ffa7e6 +0, 861120, 861120, 960, 2012, 0xdcf7caf9 +0, 862080, 862080, 960, 2012, 0x26cfb4ee +0, 863040, 863040, 960, 2012, 0xec70b09d +0, 864000, 864000, 960, 2012, 0x65dca50f +0, 864960, 864960, 960, 2012, 0xcdebc0b6 +0, 865920, 865920, 960, 2012, 0x9393a262 +0, 866880, 866880, 960, 2012, 0x34aab06d +0, 867840, 867840, 960, 2012, 0x4800a550 +0, 868800, 868800, 960, 2012, 0x4d9aadec +0, 869760, 869760, 960, 2012, 0x2cddabb6 +0, 870720, 870720, 960, 2012, 0x91a0c5b2 +0, 871680, 871680, 960, 2012, 0xd326bee1 +0, 872640, 872640, 960, 2012, 0xf76ab2d5 +0, 873600, 873600, 960, 2012, 0xcef99ade +0, 874560, 874560, 960, 2012, 0x950dc76f +0, 875520, 875520, 960, 2012, 0xb6aca7ad +0, 876480, 876480, 960, 2012, 0x1aacb71c +0, 877440, 877440, 960, 2012, 0x32389da0 +0, 878400, 878400, 960, 2012, 0x030cbcce +0, 879360, 879360, 960, 2012, 0x0ec4b0cb +0, 880320, 880320, 960, 2012, 0x6c0bb62e +0, 881280, 881280, 960, 2012, 0xfadbb20d +0, 882240, 882240, 960, 2012, 0x99c9c848 +0, 883200, 883200, 960, 2012, 0xe3e3b21a +0, 884160, 884160, 960, 2012, 0x88d9a50b +0, 885120, 885120, 960, 2012, 0xf4bbaf17 +0, 886080, 886080, 960, 2012, 0x49fea706 +0, 887040, 887040, 960, 2012, 0xafd0babf +0, 888000, 888000, 960, 2012, 0x8970a8f3 +0, 888960, 888960, 960, 2012, 0x9223a553 +0, 889920, 889920, 960, 2012, 0x6ec2b2f9 +0, 890880, 890880, 960, 2012, 0x7960b759 +0, 891840, 891840, 960, 2012, 0x852891bf +0, 892800, 892800, 960, 2012, 0x094ebbeb +0, 893760, 893760, 960, 2012, 0xf9bab418 +0, 894720, 894720, 960, 2012, 0x010eae8c +0, 895680, 895680, 960, 2012, 0x10baab3d +0, 896640, 896640, 960, 2012, 0x2564b13f +0, 897600, 897600, 960, 2012, 0xaec8ac22 +0, 898560, 898560, 960, 2012, 0xda0cbd4f +0, 899520, 899520, 960, 2012, 0x97e1c075 +0, 900480, 900480, 960, 2012, 0x6731aca5 +0, 901440, 901440, 960, 2012, 0x2c1db696 +0, 902400, 902400, 960, 2012, 0x8ff7abbf +0, 903360, 903360, 960, 2012, 0xf75ab3a2 +0, 904320, 904320, 960, 2012, 0x8683b824 +0, 905280, 905280, 960, 2012, 0x9668b354 +0, 906240, 906240, 960, 2012, 0x6e9aae04 +0, 907200, 907200, 960, 2012, 0xd8e9acd7 +0, 908160, 908160, 960, 2012, 0xa326c298 +0, 909120, 909120, 960, 2012, 0x6abcb409 +0, 910080, 910080, 960, 2012, 0x7eb3b549 +0, 911040, 911040, 960, 2012, 0xfc72ba6a +0, 912000, 912000, 960, 2012, 0xed73b2e6 +0, 912960, 912960, 960, 2012, 0x07a6b0a9 +0, 913920, 913920, 960, 2012, 0x10a4aec4 +0, 914880, 914880, 960, 2012, 0xaac9a650 +0, 915840, 915840, 960, 2012, 0x848b9869 +0, 916800, 916800, 960, 2012, 0x1ddaafd6 +0, 917760, 917760, 960, 2012, 0xe291aaec +0, 918720, 918720, 960, 2012, 0x8aa1aa4d +0, 919680, 919680, 960, 2012, 0x9b69b94c +0, 920640, 920640, 960, 2012, 0xe784bec0 +0, 921600, 921600, 960, 2012, 0x9305ba2d +0, 922560, 922560, 960, 2012, 0x5616bb81 +0, 923520, 923520, 960, 2012, 0xea0facca +0, 924480, 924480, 960, 2012, 0xe1b9991e +0, 925440, 925440, 960, 2012, 0xded8bd59 +0, 926400, 926400, 960, 2012, 0xe79fb0ee +0, 927360, 927360, 960, 2012, 0x1b8595a6 +0, 928320, 928320, 960, 2012, 0xb55ba336 +0, 929280, 929280, 960, 2012, 0xc552bc98 +0, 930240, 930240, 960, 2012, 0x2fe2c5ba +0, 931200, 931200, 960, 2012, 0xe18aa5a6 +0, 932160, 932160, 960, 2012, 0xaa9bae1c +0, 933120, 933120, 960, 2012, 0xd1ddb68d +0, 934080, 934080, 960, 2012, 0x95bfb203 +0, 935040, 935040, 960, 2012, 0xeacab8b9 +0, 936000, 936000, 960, 2012, 0x5bfcb117 +0, 936960, 936960, 960, 2012, 0x1a9fa91c +0, 937920, 937920, 960, 2012, 0xa285b180 +0, 938880, 938880, 960, 2012, 0xfd58a6e2 +0, 939840, 939840, 960, 2012, 0x394fc325 +0, 940800, 940800, 960, 2012, 0x0415a6aa +0, 941760, 941760, 960, 2012, 0xf75fa5e0 +0, 942720, 942720, 960, 2012, 0x115cd11b +0, 943680, 943680, 960, 2012, 0x6587b9e3 +0, 944640, 944640, 960, 2012, 0xce6bb7e6 +0, 945600, 945600, 960, 2012, 0xbaa2b409 +0, 946560, 946560, 960, 2012, 0x271bbb14 +0, 947520, 947520, 960, 2012, 0x4516c223 +0, 948480, 948480, 960, 2012, 0x4f6ab266 +0, 949440, 949440, 960, 2012, 0x244ba6fc +0, 950400, 950400, 960, 2012, 0x60e0ae4e +0, 951360, 951360, 960, 2012, 0xfc3cac80 +0, 952320, 952320, 960, 2012, 0x8465b287 +0, 953280, 953280, 960, 2012, 0xc683b070 +0, 954240, 954240, 960, 2012, 0x2901c8e7 +0, 955200, 955200, 960, 2012, 0x0622b1a1 +0, 956160, 956160, 960, 2012, 0xe002b34c +0, 957120, 957120, 960, 2012, 0xf4969e79 +0, 958080, 958080, 960, 2012, 0x871cc453 +0, 959040, 959040, 960, 2012, 0x9a7daaf3 +0, 960000, 960000, 960, 2012, 0xba92a60a +0, 960960, 960960, 960, 2012, 0xf464a0c4 +0, 961920, 961920, 960, 2012, 0x53bbb6cd +0, 962880, 962880, 960, 2012, 0xb58a9d2a +0, 963840, 963840, 960, 2012, 0x1e1fb830 +0, 964800, 964800, 960, 2012, 0xdc7eb93e +0, 965760, 965760, 960, 2012, 0xe6ceaaf9 +0, 966720, 966720, 960, 2012, 0x8c7ea35d +0, 967680, 967680, 960, 2012, 0x0b87ba04 +0, 968640, 968640, 960, 2012, 0xf516a700 +0, 969600, 969600, 960, 2012, 0xfaf19e13 +0, 970560, 970560, 960, 2012, 0x53cf9ed0 +0, 971520, 971520, 960, 2012, 0x2e25c2f9 +0, 972480, 972480, 960, 2012, 0x959aa1b8 +0, 973440, 973440, 960, 2012, 0x2a49a572 +0, 974400, 974400, 960, 2012, 0xf7a9b809 +0, 975360, 975360, 960, 2012, 0x44a9b879 +0, 976320, 976320, 960, 2012, 0xe428c0d4 +0, 977280, 977280, 960, 2012, 0xc258c2c6 +0, 978240, 978240, 960, 2012, 0xf7f3b794 +0, 979200, 979200, 960, 2012, 0xa8adbad9 +0, 980160, 980160, 960, 2012, 0xc2508e79 +0, 981120, 981120, 960, 2012, 0x1418ac76 +0, 982080, 982080, 960, 2012, 0xb28aadef +0, 983040, 983040, 960, 2012, 0xda17bd03 +0, 984000, 984000, 960, 2012, 0xa92ab852 +0, 984960, 984960, 960, 2012, 0xc3cbcfa4 +0, 985920, 985920, 960, 2012, 0xf716bb5e +0, 986880, 986880, 960, 2012, 0x6009a8af +0, 987840, 987840, 960, 2012, 0x9e69bc81 +0, 988800, 988800, 960, 2012, 0x3aafc8cf +0, 989760, 989760, 960, 2012, 0x03bccdab +0, 990720, 990720, 960, 2012, 0xfdceb2d9 +0, 991680, 991680, 960, 2012, 0x68f7afb8 +0, 992640, 992640, 960, 2012, 0xb7bab330 +0, 993600, 993600, 960, 2012, 0x4976b125 +0, 994560, 994560, 960, 2012, 0x7c86ae12 +0, 995520, 995520, 960, 2012, 0x4ce4ca54 +0, 996480, 996480, 960, 2012, 0xf1f7b892 +0, 997440, 997440, 960, 2012, 0xf958abb1 +0, 998400, 998400, 960, 2012, 0x047accd0 +0, 999360, 999360, 960, 2012, 0x34a1c49c +0, 1000320, 1000320, 960, 2012, 0x4b24a4ed +0, 1001280, 1001280, 960, 2012, 0xea31b1bc +0, 1002240, 1002240, 960, 2012, 0x8beaa3e3 +0, 1003200, 1003200, 960, 2012, 0x064caaf9 +0, 1004160, 1004160, 960, 2012, 0x56babf15 +0, 1005120, 1005120, 960, 2012, 0xd16fc6f4 +0, 1006080, 1006080, 960, 2012, 0x4ac2b78a +0, 1007040, 1007040, 960, 2012, 0xba3aa509 +0, 1008000, 1008000, 960, 2012, 0xc103b074 +0, 1008960, 1008960, 960, 2012, 0x464aba98 +0, 1009920, 1009920, 960, 2012, 0xaacac5a3 +0, 1010880, 1010880, 960, 2012, 0x9cecbcfa +0, 1011840, 1011840, 960, 2012, 0x8da0ab79 +0, 1012800, 1012800, 960, 2012, 0x85b2b023 +0, 1013760, 1013760, 960, 2012, 0x598abc91 +0, 1014720, 1014720, 960, 2012, 0x08c0a35c +0, 1015680, 1015680, 960, 2012, 0x30e4a7cf +0, 1016640, 1016640, 960, 2012, 0xf1e4a931 +0, 1017600, 1017600, 960, 2012, 0x8a4fb6c1 +0, 1018560, 1018560, 960, 2012, 0x126aac08 +0, 1019520, 1019520, 960, 2012, 0x537fa51b +0, 1020480, 1020480, 960, 2012, 0x1e54ac5a +0, 1021440, 1021440, 960, 2012, 0x7274bbd0 +0, 1022400, 1022400, 960, 2012, 0xd16bc2c2 +0, 1023360, 1023360, 960, 2012, 0x9236c1e3 +0, 1024320, 1024320, 960, 2012, 0x348aa7af +0, 1025280, 1025280, 960, 2012, 0xa020be5e +0, 1026240, 1026240, 960, 2012, 0x3cc5a4b8 +0, 1027200, 1027200, 960, 2012, 0x8b19b649 +0, 1028160, 1028160, 960, 2012, 0x554aa5ab +0, 1029120, 1029120, 960, 2012, 0x35d6ac35 +0, 1030080, 1030080, 960, 2012, 0x64dba435 +0, 1031040, 1031040, 960, 2012, 0x6001bae2 +0, 1032000, 1032000, 960, 2012, 0x9220b599 +0, 1032960, 1032960, 960, 2012, 0xa3fdb899 +0, 1033920, 1033920, 960, 2012, 0x19a5abf4 +0, 1034880, 1034880, 960, 2012, 0xd857b8cf +0, 1035840, 1035840, 960, 2012, 0x38d1b234 +0, 1036800, 1036800, 960, 2012, 0x69f4bfb8 +0, 1037760, 1037760, 960, 2012, 0xcc87a375 +0, 1038720, 1038720, 960, 2012, 0xc1cdd0c5 +0, 1039680, 1039680, 960, 2012, 0xba0ca3ee +0, 1040640, 1040640, 960, 2012, 0x4d20c397 +0, 1041600, 1041600, 960, 2012, 0x825c9636 +0, 1042560, 1042560, 960, 2012, 0x7aa4ae53 +0, 1043520, 1043520, 960, 2012, 0xe970ae78 +0, 1044480, 1044480, 960, 2012, 0x5fb2ba59 +0, 1045440, 1045440, 960, 2012, 0xcd90a953 +0, 1046400, 1046400, 960, 2012, 0xf573ac40 +0, 1047360, 1047360, 960, 2012, 0x324cbd77 +0, 1048320, 1048320, 960, 2012, 0xece0a73d +0, 1049280, 1049280, 960, 2012, 0x0dd1aefa +0, 1050240, 1050240, 960, 2012, 0xe338c866 +0, 1051200, 1051200, 960, 2012, 0xfe71bffc +0, 1052160, 1052160, 960, 2012, 0x61a5a810 +0, 1053120, 1053120, 960, 2012, 0x7c3ba074 +0, 1054080, 1054080, 960, 2012, 0x492f9d91 +0, 1055040, 1055040, 960, 2012, 0xa126a7b9 +0, 1056000, 1056000, 960, 2012, 0x7cf19a40 +0, 1056960, 1056960, 960, 2012, 0x1c2fbae6 +0, 1057920, 1057920, 960, 2012, 0x540accdf +0, 1058880, 1058880, 960, 2012, 0x5908a938 +0, 1059840, 1059840, 960, 2012, 0xe7f8b501 +0, 1060800, 1060800, 960, 2012, 0x03a8b53e +0, 1061760, 1061760, 960, 2012, 0xb4e3bdda +0, 1062720, 1062720, 960, 2012, 0x9e86abe1 +0, 1063680, 1063680, 960, 2012, 0x3234b98d +0, 1064640, 1064640, 960, 2012, 0x5caec781 +0, 1065600, 1065600, 960, 2012, 0x5c21a32e +0, 1066560, 1066560, 960, 2012, 0x8b72c112 +0, 1067520, 1067520, 960, 2012, 0x2ec2bac3 +0, 1068480, 1068480, 960, 2012, 0xd9c4adaa +0, 1069440, 1069440, 960, 2012, 0x2da1b496 +0, 1070400, 1070400, 960, 2012, 0x0a51b21e +0, 1071360, 1071360, 960, 2012, 0x6414ab0d +0, 1072320, 1072320, 960, 2012, 0x95c4b203 +0, 1073280, 1073280, 960, 2012, 0x98e0b4a2 +0, 1074240, 1074240, 960, 2012, 0x34369f5f +0, 1075200, 1075200, 960, 2012, 0x9dffa40c +0, 1076160, 1076160, 960, 2012, 0xf345b0e5 +0, 1077120, 1077120, 960, 2012, 0x6714bdbf +0, 1078080, 1078080, 960, 2012, 0xc276c3d1 +0, 1079040, 1079040, 960, 2012, 0xf199b475 +0, 1080000, 1080000, 960, 2012, 0x3395cf3b +0, 1080960, 1080960, 960, 2012, 0x4b52afb0 +0, 1081920, 1081920, 960, 2012, 0x3f74b217 +0, 1082880, 1082880, 960, 2012, 0xa25cad38 +0, 1083840, 1083840, 960, 2012, 0x3290a5b4 +0, 1084800, 1084800, 960, 2012, 0x2917b750 +0, 1085760, 1085760, 960, 2012, 0xeb3ec739 +0, 1086720, 1086720, 960, 2012, 0xbf9ea51d +0, 1087680, 1087680, 960, 2012, 0x98e2a0c1 +0, 1088640, 1088640, 960, 2012, 0xa39ba7f2 +0, 1089600, 1089600, 960, 2012, 0x6df7a05c +0, 1090560, 1090560, 960, 2012, 0x2c1bba28 +0, 1091520, 1091520, 960, 2012, 0x6099b1cd +0, 1092480, 1092480, 960, 2012, 0x9366b9f2 +0, 1093440, 1093440, 960, 2012, 0x95899570 +0, 1094400, 1094400, 960, 2012, 0x6234a0c8 +0, 1095360, 1095360, 960, 2012, 0xec2cbcfc +0, 1096320, 1096320, 960, 2012, 0x3ff7a9db +0, 1097280, 1097280, 960, 2012, 0x4e44bad7 +0, 1098240, 1098240, 960, 2012, 0x1dbbbc39 +0, 1099200, 1099200, 960, 2012, 0xf9df99be +0, 1100160, 1100160, 960, 2012, 0xa713b313 +0, 1101120, 1101120, 960, 2012, 0x8bbdbe51 +0, 1102080, 1102080, 960, 2012, 0x0d5bc786 +0, 1103040, 1103040, 960, 2012, 0x75d293f2 +0, 1104000, 1104000, 960, 2012, 0x4832b688 +0, 1104960, 1104960, 960, 2012, 0x71aba74c +0, 1105920, 1105920, 960, 2012, 0x04d5abf2 +0, 1106880, 1106880, 960, 2012, 0xaa8fbd98 +0, 1107840, 1107840, 960, 2012, 0xd93eb6d4 +0, 1108800, 1108800, 960, 2012, 0x8fb6b5a8 +0, 1109760, 1109760, 960, 2012, 0x779a92f5 +0, 1110720, 1110720, 960, 2012, 0x35c8ab3d +0, 1111680, 1111680, 960, 2012, 0x0017aaa5 +0, 1112640, 1112640, 960, 2012, 0xd6e7bafe +0, 1113600, 1113600, 960, 2012, 0xe358b423 +0, 1114560, 1114560, 960, 2012, 0x3f74bfba +0, 1115520, 1115520, 960, 2012, 0x0a5eb707 +0, 1116480, 1116480, 960, 2012, 0xedbfb0df +0, 1117440, 1117440, 960, 2012, 0x2e71a26f +0, 1118400, 1118400, 960, 2012, 0x214db1a8 +0, 1119360, 1119360, 960, 2012, 0xb632c275 +0, 1120320, 1120320, 960, 2012, 0xb597cf92 +0, 1121280, 1121280, 960, 2012, 0x18a8b508 +0, 1122240, 1122240, 960, 2012, 0x8267b4ff +0, 1123200, 1123200, 960, 2012, 0x5a9ab8d6 +0, 1124160, 1124160, 960, 2012, 0x2037a2b6 From 33588a37497bb26598234fc745eda52089c26761 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:46:17 -0300 Subject: [PATCH 062/290] avformat/movenc: write stss boxes for xHE-AAC This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 23a1c021f299655d66bcfbd69ed0d6780f68c6fc) --- libavformat/movenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index da58a7ab15..d6effda6fa 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -3196,6 +3196,7 @@ static int mov_write_stbl_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContext if ((track->par->codec_type == AVMEDIA_TYPE_VIDEO || track->par->codec_id == AV_CODEC_ID_TRUEHD || track->par->codec_id == AV_CODEC_ID_MPEGH_3D_AUDIO || + (track->par->codec_id == AV_CODEC_ID_AAC && track->par->profile == AV_PROFILE_AAC_USAC) || track->par->codec_tag == MKTAG('r','t','p',' ')) && track->has_keyframes && track->has_keyframes < track->entry) mov_write_stss_tag(pb, track, MOV_SYNC_SAMPLE); From 13282e61b808121222b043c8b965a48ef801267b Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:47:43 -0300 Subject: [PATCH 063/290] avformat/test/movenc: set audio packets as key frames Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit f938b2b3f51f959de84bc22c75529b77626b2596) --- libavformat/tests/movenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/tests/movenc.c b/libavformat/tests/movenc.c index 2fd5c67e76..23a827e97c 100644 --- a/libavformat/tests/movenc.c +++ b/libavformat/tests/movenc.c @@ -270,6 +270,7 @@ static void mux_frames(int n, int c) pkt->dts = pkt->pts = audio_dts; pkt->stream_index = 1; pkt->duration = audio_duration; + pkt->flags |= AV_PKT_FLAG_KEY; audio_dts += audio_duration; } else { if (frames == end_frames) From f1592a7ff1d38e75bd97bc6c49961e6628924e07 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:49:17 -0300 Subject: [PATCH 064/290] avformat/matroskadec: set all frames in a keyframe simple box as keyframes And not just the first, as it was being done for lacing. The spec states that the flag applies to everything inside the simple box. Signed-off-by: James Almer (cherry picked from commit f656c00bd953b1dd84c58dfef5dd645db818ba3d) --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index c8741ff2af..a2947c97e7 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4224,7 +4224,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, AVBufferRef *buf } else { res = matroska_parse_frame(matroska, track, st, buf, out_data, out_size, timecode, lace_duration, - pos, !n ? is_keyframe : 0, + pos, is_keyframe, blockmore, nb_blockmore, discard_padding); if (res) From dc9d9b8636f1e71fb839aa25955122b608f6d98f Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:54:34 -0300 Subject: [PATCH 065/290] avformat/mov: don't unconditionally set all audio packets in fragments as key frames Some audio codecs, like TrueHD, have non key frames. Signed-off-by: James Almer (cherry picked from commit 8ddbc26dedcf83962dd3aed90a6bb0a95847d386) --- libavformat/mov.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 54f8594f67..9a9a2414e7 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5843,10 +5843,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) pts = AV_NOPTS_VALUE; } - if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) - keyframe = 1; - else - keyframe = + keyframe = !(sample_flags & (MOV_FRAG_SAMPLE_FLAG_IS_NON_SYNC | MOV_FRAG_SAMPLE_FLAG_DEPENDS_YES)); if (keyframe) { From 075c6d325ac1e6b95840a72f133bac4aa8140215 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 17:56:14 -0300 Subject: [PATCH 066/290] avcodec/aac_parser: set key_frame and profile This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 64bb91fd3b5a00a8849531c7e8dd207f2a626096) --- libavcodec/aac_ac3_parser.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/aac_ac3_parser.c b/libavcodec/aac_ac3_parser.c index f45631d09f..e2361d3534 100644 --- a/libavcodec/aac_ac3_parser.c +++ b/libavcodec/aac_ac3_parser.c @@ -40,6 +40,8 @@ int ff_aac_ac3_parse(AVCodecParserContext *s1, int new_frame_start; int got_frame = 0; + s1->key_frame = -1; + if (s1->flags & PARSER_FLAG_COMPLETE_FRAMES) { i = buf_size; got_frame = 1; @@ -145,10 +147,15 @@ get_next: } else { #if CONFIG_AAC_PARSER AACADTSHeaderInfo hdr; + GetBitContext gb; + int profile; + init_get_bits8(&gb, buf, buf_size); if (buf_size < AV_AAC_ADTS_HEADER_SIZE || - ff_adts_header_parse_buf(buf, &hdr) < 0) + ff_adts_header_parse(&gb, &hdr) < 0) return i; + avctx->profile = hdr.object_type - 1; + s1->key_frame = (avctx->profile == AV_PROFILE_AAC_USAC) ? get_bits1(&gb) : 1; bit_rate = hdr.bit_rate; #endif } From 1b5bdce86a762815d2582c59c30e8f5c8f9140d3 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 20:28:38 -0300 Subject: [PATCH 067/290] avcodec/aac/aacdec: set keyframe flag in output frames Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit faea08b722de716391c3f84a265060c643ad6c22) --- libavcodec/aac/aacdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 4110bc40ca..038251d266 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -2194,6 +2194,7 @@ static int aac_decode_er_frame(AVCodecContext *avctx, AVFrame *frame, ac->frame->nb_samples = samples; ac->frame->sample_rate = avctx->sample_rate; + ac->frame->flags |= AV_FRAME_FLAG_KEY; *got_frame_ptr = 1; skip_bits_long(gb, get_bits_left(gb)); @@ -2354,6 +2355,7 @@ static int decode_frame_ga(AVCodecContext *avctx, AACDecContext *ac, if (samples) { ac->frame->nb_samples = samples; ac->frame->sample_rate = avctx->sample_rate; + ac->frame->flags |= AV_FRAME_FLAG_KEY; *got_frame_ptr = 1; } else { av_frame_unref(ac->frame); From 302f1b3882536dcbd1185778a474bc5900a57153 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 20:29:38 -0300 Subject: [PATCH 068/290] avcodec/aacenc: set keyframe flag in output packets Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit ffdace5ad4736ea720f306392ce6bdcb2aea823a) --- libavcodec/aacenc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aacenc.c b/libavcodec/aacenc.c index 88037c7f87..3ff61f788b 100644 --- a/libavcodec/aacenc.c +++ b/libavcodec/aacenc.c @@ -1177,6 +1177,8 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts, &avpkt->duration); + avpkt->flags |= AV_PKT_FLAG_KEY; + *got_packet_ptr = 1; return 0; } From 07a92c1a640de41422fd2581e996c26976b03a6a Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 24 Nov 2024 20:24:27 -0300 Subject: [PATCH 069/290] avcodec/audiotoolboxdec: set set keyframe flag in output frames Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit d3dd14bf5b4a7e5ead890b83fc905add9b261cf7) --- libavcodec/audiotoolboxdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/audiotoolboxdec.c b/libavcodec/audiotoolboxdec.c index 0f7ce8e4eb..08203c5310 100644 --- a/libavcodec/audiotoolboxdec.c +++ b/libavcodec/audiotoolboxdec.c @@ -542,6 +542,8 @@ static int ffat_decode(AVCodecContext *avctx, AVFrame *frame, frame->nb_samples = avctx->frame_size; + frame->flags |= AV_FRAME_FLAG_KEY; + out_buffers.mBuffers[0].mData = at->decoded_data; ret = AudioConverterFillComplexBuffer(at->converter, ffat_decode_callback, avctx, From f7d59ab17a751105c399cc64beb66d5c7686dcab Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 24 Nov 2024 20:24:40 -0300 Subject: [PATCH 070/290] avcodec/audiotoolboxnec: set set keyframe flag in output packets Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 495c891e3998bdee7e7680390d9aea2efb5c9a5d) --- libavcodec/audiotoolboxenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/audiotoolboxenc.c b/libavcodec/audiotoolboxenc.c index ad2b863bb9..908b56055f 100644 --- a/libavcodec/audiotoolboxenc.c +++ b/libavcodec/audiotoolboxenc.c @@ -576,6 +576,7 @@ static int ffat_encode(AVCodecContext *avctx, AVPacket *avpkt, avctx->frame_size, &avpkt->pts, &avpkt->duration); + avpkt->flags |= AV_PKT_FLAG_KEY; } else if (ret && ret != 1) { av_log(avctx, AV_LOG_ERROR, "Encode error: %i\n", ret); return AVERROR_EXTERNAL; From c13a0a2f59bd169b57ff0285e85acf4c00ab2896 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 17 Nov 2024 15:53:03 -0300 Subject: [PATCH 071/290] avcodec/libfdk-aacdec: set keyframe flag and profile in output frames Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 281b7fc02e3158ee62c3c1d41267ddebb86578f0) --- libavcodec/libfdk-aacdec.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/libfdk-aacdec.c b/libavcodec/libfdk-aacdec.c index 1324377fb4..ac221645f0 100644 --- a/libavcodec/libfdk-aacdec.c +++ b/libavcodec/libfdk-aacdec.c @@ -111,7 +111,7 @@ static const AVClass fdk_aac_dec_class = { .version = LIBAVUTIL_VERSION_INT, }; -static int get_stream_info(AVCodecContext *avctx) +static int get_stream_info(AVCodecContext *avctx, AVFrame *frame) { FDKAACDecContext *s = avctx->priv_data; CStreamInfo *info = aacDecoder_GetStreamInfo(s->handle); @@ -130,6 +130,9 @@ static int get_stream_info(AVCodecContext *avctx) } avctx->sample_rate = info->sampleRate; avctx->frame_size = info->frameSize; + avctx->profile = info->aot - 1; + + frame->flags |= AV_FRAME_FLAG_KEY * !!(info->flags & AC_INDEP); #if FDKDEC_VER_AT_LEAST(2, 5) // 2.5.10 if (!s->output_delay_set && info->outputDelay) { // Set this only once. @@ -413,7 +416,7 @@ static int fdk_aac_decode_frame(AVCodecContext *avctx, AVFrame *frame, goto end; } - if ((ret = get_stream_info(avctx)) < 0) + if ((ret = get_stream_info(avctx, frame)) < 0) goto end; frame->nb_samples = avctx->frame_size; From 26bc7827e4bed355cd197938a9ddbe107f11e8c6 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 17 Nov 2024 16:03:18 -0300 Subject: [PATCH 072/290] avcodec/libfdk-aacenc: set keyframe in output packets Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 99f87251e0cc6bf8f2a7c21e1e72e6144e5a6701) --- libavcodec/libfdk-aacenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/libfdk-aacenc.c b/libavcodec/libfdk-aacenc.c index cc0ae0d8da..4dcfb25db7 100644 --- a/libavcodec/libfdk-aacenc.c +++ b/libavcodec/libfdk-aacenc.c @@ -549,6 +549,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, } avpkt->size = out_args.numOutBytes; + avpkt->flags |= AV_PKT_FLAG_KEY; *got_packet_ptr = 1; return 0; } From 4b801baa46731f0377cbabaf485fe5715a334d93 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 24 Nov 2024 20:25:09 -0300 Subject: [PATCH 073/290] avcodec/mediacodecdec: set set keyframe flag in output frames Don't depend on the generic code setting this. This is in preparation for a following change. Signed-off-by: James Almer (cherry picked from commit 8d2d2519e04418d8565e0d6ece662c01121a35e1) --- libavcodec/mediacodecdec_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index b1ee8b609a..3770b4f3ae 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -416,6 +416,7 @@ static int mediacodec_wrap_sw_audio_buffer(AVCodecContext *avctx, frame->pts = info->presentationTimeUs; } frame->pkt_dts = AV_NOPTS_VALUE; + frame->flags |= AV_FRAME_FLAG_KEY; av_log(avctx, AV_LOG_TRACE, "Frame: format=%d channels=%d sample_rate=%d nb_samples=%d", From f265f9c9d04863180503707bfad285f48e6bf080 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 16 Nov 2024 20:32:02 -0300 Subject: [PATCH 074/290] avcodec/codec_desc: remove Intra Only prop for AAC xHE-AAC is a profile where some frames depend on other key frames, named IPF. By setting the codec as Intra Only, all frames output by decoders and all packets output by encoders/demuxers will be unconditionally flaged as keyframes, which is incorrect. Should fix ticket #11272. Signed-off-by: James Almer (cherry picked from commit 40bd6d835575bb8176774be5824ef07b71623d1e) --- libavcodec/codec_desc.c | 4 ++-- libavcodec/version.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/codec_desc.c b/libavcodec/codec_desc.c index 03dea5751a..d58c3d889c 100644 --- a/libavcodec/codec_desc.c +++ b/libavcodec/codec_desc.c @@ -2697,7 +2697,7 @@ static const AVCodecDescriptor codec_descriptors[] = { .type = AVMEDIA_TYPE_AUDIO, .name = "aac", .long_name = NULL_IF_CONFIG_SMALL("AAC (Advanced Audio Coding)"), - .props = AV_CODEC_PROP_INTRA_ONLY | AV_CODEC_PROP_LOSSY, + .props = AV_CODEC_PROP_LOSSY, .profiles = NULL_IF_CONFIG_SMALL(ff_aac_profiles), }, { @@ -3031,7 +3031,7 @@ static const AVCodecDescriptor codec_descriptors[] = { .type = AVMEDIA_TYPE_AUDIO, .name = "aac_latm", .long_name = NULL_IF_CONFIG_SMALL("AAC LATM (Advanced Audio Coding LATM syntax)"), - .props = AV_CODEC_PROP_INTRA_ONLY | AV_CODEC_PROP_LOSSY, + .props = AV_CODEC_PROP_LOSSY, .profiles = NULL_IF_CONFIG_SMALL(ff_aac_profiles), }, { diff --git a/libavcodec/version.h b/libavcodec/version.h index 4b7ec515fe..b6ca025fae 100644 --- a/libavcodec/version.h +++ b/libavcodec/version.h @@ -30,7 +30,7 @@ #include "version_major.h" #define LIBAVCODEC_VERSION_MINOR 19 -#define LIBAVCODEC_VERSION_MICRO 100 +#define LIBAVCODEC_VERSION_MICRO 101 #define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \ LIBAVCODEC_VERSION_MINOR, \ From 364f6a5f118d35058a49eee3624c5d82435be443 Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 24 Nov 2024 14:24:47 -0300 Subject: [PATCH 075/290] avcodec/ac3dec: fix downmix logic for eac3 Ensure downmixed is only set once during init, as it used to be. Fixes a regression since acbb2777e28c. Fixes ticket #11321 Signed-off-by: James Almer (cherry picked from commit 0e07a70611dc109f4e84895ffc79827a91edc045) --- libavcodec/ac3dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 0a4d3375ee..3cc20f32a9 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -199,7 +199,6 @@ static void ac3_downmix(AVCodecContext *avctx) av_channel_layout_uninit(&avctx->ch_layout); avctx->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; } - s->downmixed = 1; } /** @@ -241,6 +240,7 @@ static av_cold int ac3_decode_init(AVCodecContext *avctx) avctx->sample_fmt = AV_SAMPLE_FMT_FLTP; ac3_downmix(avctx); + s->downmixed = 1; for (i = 0; i < AC3_MAX_CHANNELS; i++) { s->xcfptr[i] = s->transform_coeffs[i]; From 10aaf84f855dbcedb8ee2e3fce307e9b98320946 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Wed, 23 Oct 2024 14:44:11 +0300 Subject: [PATCH 076/290] checkasm: Print benchmarks of C-only functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This corresponds to commit 9278a14cf406f8edb5052c42b83750112bf5b515 in dav1d. Omitting the C-only functions doesn't speed up benchmarking anyway (as those has to be benchmarked before we know if we have any corresponding assembly functions), and being able to benchmark those functions without corresponding assembly can be valuable in a number of cases. Signed-off-by: Martin Storsjö (cherry picked from commit 4b524649ff96b25edd275ce1662f5839102aa0af) --- tests/checkasm/checkasm.c | 48 +++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/tests/checkasm/checkasm.c b/tests/checkasm/checkasm.c index 73a998ae3a..5b59cdf589 100644 --- a/tests/checkasm/checkasm.c +++ b/tests/checkasm/checkasm.c @@ -618,34 +618,32 @@ static inline double avg_cycles_per_call(const CheckasmPerf *const p) static void print_benchs(CheckasmFunc *f) { if (f) { + CheckasmFuncVersion *v = &f->versions; + const CheckasmPerf *p = &v->perf; + const double baseline = avg_cycles_per_call(p); + double decicycles; + print_benchs(f->child[0]); - /* Only print functions with at least one assembly version */ - if (f->versions.cpu || f->versions.next) { - CheckasmFuncVersion *v = &f->versions; - const CheckasmPerf *p = &v->perf; - const double baseline = avg_cycles_per_call(p); - double decicycles; - do { - if (p->iterations) { - p = &v->perf; - decicycles = avg_cycles_per_call(p); - if (state.csv || state.tsv) { - const char sep = state.csv ? ',' : '\t'; - printf("%s%c%s%c%.1f\n", f->name, sep, - cpu_suffix(v->cpu), sep, - decicycles / 10.0); - } else { - const int pad_length = 10 + 50 - - printf("%s_%s:", f->name, cpu_suffix(v->cpu)); - const double ratio = decicycles ? - baseline / decicycles : 0.0; - printf("%*.1f (%5.2fx)\n", FFMAX(pad_length, 0), - decicycles / 10.0, ratio); - } + do { + if (p->iterations) { + p = &v->perf; + decicycles = avg_cycles_per_call(p); + if (state.csv || state.tsv) { + const char sep = state.csv ? ',' : '\t'; + printf("%s%c%s%c%.1f\n", f->name, sep, + cpu_suffix(v->cpu), sep, + decicycles / 10.0); + } else { + const int pad_length = 10 + 50 - + printf("%s_%s:", f->name, cpu_suffix(v->cpu)); + const double ratio = decicycles ? + baseline / decicycles : 0.0; + printf("%*.1f (%5.2fx)\n", FFMAX(pad_length, 0), + decicycles / 10.0, ratio); } - } while ((v = v->next)); - } + } + } while ((v = v->next)); print_benchs(f->child[1]); } From 88126fc4ecff16c8337bab0ff33bee858a18d555 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 29 Nov 2024 02:28:18 +0100 Subject: [PATCH 077/290] avformat/iamf_parse: reject ambisonics mode > 1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ambisonics mode > 1 does not initialize any layer but layer 0 is unconditionally dereferenced Fixes: poc-2024-11 Fixes: null pointer dereference Found-by: 苏童 <220235212@seu.edu.cn> Signed-off-by: Michael Niedermayer (cherry picked from commit 4cc1495aca45445181a107a682c32cfe31459929) --- libavformat/iamf_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index e0a138a07d..decd4bc437 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -413,7 +413,7 @@ static int ambisonics_config(void *s, AVIOContext *pb, ambisonics_mode = ffio_read_leb(pb); if (ambisonics_mode > 1) - return 0; + return AVERROR_INVALIDDATA; output_channel_count = avio_r8(pb); // C substream_count = avio_r8(pb); // N From 888a6b54bcc8ab395ebc214d764ceefaa1232d87 Mon Sep 17 00:00:00 2001 From: James Almer Date: Wed, 11 Dec 2024 23:27:00 -0300 Subject: [PATCH 078/290] avformat/iamf_parse: add checks to parameter definition durations Section 3.6.1 of the IAMF spec states "When constant_subblock_duration is equal to 0, the summation of all subblock_duration in this parameter block SHALL be equal to duration.". Signed-off-by: James Almer (cherry picked from commit d38fc25519cf12a9212dadcba1258fc176ffbade) --- libavformat/iamf_parse.c | 14 ++++++++++++-- libavformat/iamf_reader.c | 15 +++++++++++++-- 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index decd4bc437..57ccf1c199 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -496,6 +496,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, AVIAMFParamDefinition *param; unsigned int parameter_id, parameter_rate, mode; unsigned int duration = 0, constant_subblock_duration = 0, nb_subblocks = 0; + unsigned int total_duration = 0; size_t param_size; parameter_id = ffio_read_leb(pb); @@ -516,8 +517,10 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, constant_subblock_duration = ffio_read_leb(pb); if (constant_subblock_duration == 0) nb_subblocks = ffio_read_leb(pb); - else + else { nb_subblocks = duration / constant_subblock_duration; + total_duration = duration; + } } param = av_iamf_param_definition_alloc(type, nb_subblocks, ¶m_size); @@ -528,8 +531,10 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, void *subblock = av_iamf_param_definition_get_subblock(param, i); unsigned int subblock_duration = constant_subblock_duration; - if (constant_subblock_duration == 0) + if (constant_subblock_duration == 0) { subblock_duration = ffio_read_leb(pb); + total_duration += subblock_duration; + } switch (type) { case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: { @@ -557,6 +562,11 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, } } + if (!mode && !constant_subblock_duration && total_duration != duration) { + av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id); + return AVERROR_INVALIDDATA; + } + param->parameter_id = parameter_id; param->parameter_rate = parameter_rate; param->duration = duration; diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c index b00bb997ca..7ad61cb246 100644 --- a/libavformat/iamf_reader.c +++ b/libavformat/iamf_reader.c @@ -109,6 +109,7 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, AVIOContext *pb; uint8_t *buf; unsigned int duration, constant_subblock_duration; + unsigned int total_duration = 0; unsigned int nb_subblocks; unsigned int parameter_id; size_t out_param_size; @@ -147,8 +148,10 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, constant_subblock_duration = ffio_read_leb(pb); if (constant_subblock_duration == 0) nb_subblocks = ffio_read_leb(pb); - else + else { nb_subblocks = duration / constant_subblock_duration; + total_duration = duration; + } } else { duration = param->duration; constant_subblock_duration = param->constant_subblock_duration; @@ -172,8 +175,10 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, void *subblock = av_iamf_param_definition_get_subblock(out_param, i); unsigned int subblock_duration = constant_subblock_duration; - if (!param_definition->mode && !constant_subblock_duration) + if (!param_definition->mode && !constant_subblock_duration) { subblock_duration = ffio_read_leb(pb); + total_duration += subblock_duration; + } switch (param->type) { case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: { @@ -235,6 +240,12 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, av_log(s, level, "Underread in parameter_block_obu. %d bytes left at the end\n", len); } + if (!param_definition->mode && !constant_subblock_duration && total_duration != duration) { + av_log(s, AV_LOG_ERROR, "Invalid duration in parameter block\n"); + ret = AVERROR_INVALIDDATA; + goto fail; + } + switch (param->type) { case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: av_free(c->mix); From 871c69a28bf4f34d7d4fe8c0c4a91c7ecffccc96 Mon Sep 17 00:00:00 2001 From: James Almer Date: Wed, 11 Dec 2024 23:34:32 -0300 Subject: [PATCH 079/290] avformat/iamf_parse: fix setting duration for the last subblock in a parameter definition When subblock durations are constant, the last block may be smaller and the value needs to be calculated. Signed-off-by: James Almer (cherry picked from commit fb5e8ea9719c8afcd0d9e3a51e370c06c361d9ba) --- libavformat/iamf_parse.c | 3 ++- libavformat/iamf_reader.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 57ccf1c199..3486104aba 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -534,7 +534,8 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, if (constant_subblock_duration == 0) { subblock_duration = ffio_read_leb(pb); total_duration += subblock_duration; - } + } else if (i == nb_subblocks - 1) + subblock_duration = duration - i * constant_subblock_duration; switch (type) { case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: { diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c index 7ad61cb246..9f3469b64f 100644 --- a/libavformat/iamf_reader.c +++ b/libavformat/iamf_reader.c @@ -178,7 +178,8 @@ static int parameter_block_obu(AVFormatContext *s, IAMFDemuxContext *c, if (!param_definition->mode && !constant_subblock_duration) { subblock_duration = ffio_read_leb(pb); total_duration += subblock_duration; - } + } else if (i == nb_subblocks - 1) + subblock_duration = duration - i * constant_subblock_duration; switch (param->type) { case AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN: { From b168ed9b146337e7bd3c218c5d1c0f7e88bf1315 Mon Sep 17 00:00:00 2001 From: James Almer Date: Wed, 11 Dec 2024 13:30:23 -0300 Subject: [PATCH 080/290] avformat/iamf_writer: fix setting num_samples_per_frame for OPUS As per section 3.11.1 of the IAMF spec, the sample rate used in Codec Config for Opus shall be 48kHz, regardless of the original sample rate used during encoding. Signed-off-by: James Almer (cherry picked from commit 76049d1c4564a6a03c467b1f9b0bc853bc971769) --- libavformat/iamf_writer.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c index 1b620c38ee..0508c676d1 100644 --- a/libavformat/iamf_writer.c +++ b/libavformat/iamf_writer.c @@ -112,9 +112,17 @@ static int fill_codec_config(IAMFContext *iamf, const AVStreamGroup *stg, int j, ret = 0; codec_config->codec_id = st->codecpar->codec_id; - codec_config->sample_rate = st->codecpar->sample_rate; codec_config->codec_tag = st->codecpar->codec_tag; - codec_config->nb_samples = st->codecpar->frame_size; + switch (codec_config->codec_id) { + case AV_CODEC_ID_OPUS: + codec_config->sample_rate = 48000; + codec_config->nb_samples = av_rescale(st->codecpar->frame_size, 48000, st->codecpar->sample_rate); + break; + default: + codec_config->sample_rate = st->codecpar->sample_rate; + codec_config->nb_samples = st->codecpar->frame_size; + break; + } populate_audio_roll_distance(codec_config); if (st->codecpar->extradata_size) { codec_config->extradata = av_memdup(st->codecpar->extradata, st->codecpar->extradata_size); @@ -183,9 +191,9 @@ static int add_param_definition(IAMFContext *iamf, AVIAMFParamDefinition *param, } if (codec_config) { if (!param->duration) - param->duration = codec_config->nb_samples; + param->duration = av_rescale(codec_config->nb_samples, param->parameter_rate, codec_config->sample_rate); if (!param->constant_subblock_duration) - param->constant_subblock_duration = codec_config->nb_samples; + param->constant_subblock_duration = av_rescale(codec_config->nb_samples, param->parameter_rate, codec_config->sample_rate); } param_definition = av_mallocz(sizeof(*param_definition)); From 4f5769e0526252fb80c3c5a1d46d0ea414643fd6 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 27 Dec 2024 16:17:51 -0300 Subject: [PATCH 081/290] avformat/iamf_writer: ensure the stream groups are not empty Signed-off-by: James Almer (cherry picked from commit cedd9151f863e3db9c325aff2f9375c39adbbec2) --- libavformat/iamf_writer.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c index 0508c676d1..27926f859a 100644 --- a/libavformat/iamf_writer.c +++ b/libavformat/iamf_writer.c @@ -217,6 +217,10 @@ int ff_iamf_add_audio_element(IAMFContext *iamf, const AVStreamGroup *stg, void if (stg->type != AV_STREAM_GROUP_PARAMS_IAMF_AUDIO_ELEMENT) return AVERROR(EINVAL); + if (!stg->nb_streams) { + av_log(log_ctx, AV_LOG_ERROR, "Audio Element id %"PRId64" has no streams\n", stg->id); + return AVERROR(EINVAL); + } iamf_audio_element = stg->params.iamf_audio_element; if (iamf_audio_element->audio_element_type == AV_IAMF_AUDIO_ELEMENT_TYPE_SCENE) { @@ -381,6 +385,10 @@ int ff_iamf_add_mix_presentation(IAMFContext *iamf, const AVStreamGroup *stg, vo if (stg->type != AV_STREAM_GROUP_PARAMS_IAMF_MIX_PRESENTATION) return AVERROR(EINVAL); + if (!stg->nb_streams) { + av_log(log_ctx, AV_LOG_ERROR, "Mix Presentation id %"PRId64" has no streams\n", stg->id); + return AVERROR(EINVAL); + } for (int i = 0; i < iamf->nb_mix_presentations; i++) { if (stg->id == iamf->mix_presentations[i]->mix_presentation_id) { From be26ee23abb4f0fd4784eb556db9329e067e96b6 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 27 Dec 2024 19:11:47 -0300 Subject: [PATCH 082/290] avcodec/libdav1d: clear the buffered Dav1dData on decoding failure Should ensure avcodec_send_packet() doesn't return EAGAIN in scenarios where it's not meant to (e.g., ffmpeg_dec.c where avcodec_receive_frame() is called in a loop to drain all produced frames before trying to submit more packets). Fixes ticket #11377. Reviewed-by: Ronald S. Bultje Signed-off-by: James Almer (cherry picked from commit d1d9b0813a2a7e304cc29dba3b1380857d0f9816) --- libavcodec/libdav1d.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c index 546b42e9c6..ff67f44bd3 100644 --- a/libavcodec/libdav1d.c +++ b/libavcodec/libdav1d.c @@ -372,9 +372,10 @@ static int libdav1d_receive_frame_internal(AVCodecContext *c, Dav1dPicture *p) res = dav1d_get_picture(dav1d->c, p); if (res < 0) { - if (res == AVERROR(EINVAL)) + if (res == AVERROR(EINVAL)) { + dav1d_data_unref(data); res = AVERROR_INVALIDDATA; - else if (res == AVERROR(EAGAIN)) + } else if (res == AVERROR(EAGAIN)) res = c->internal->draining ? AVERROR_EOF : 1; } From 145a3a84550a1c3a3b848c12a64b53c3c41d2888 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 30 Dec 2024 00:25:41 -0300 Subject: [PATCH 083/290] avfilter/buffersrc: check for valid sample rate A sample rate <= 0 is invalid. Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set. Fixes ticket #11385. Signed-off-by: James Almer (cherry picked from commit 1446e37d3d032e1452844778b3e6ba2c20f0c322) --- libavfilter/buffersrc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c index b5682006f0..ec5898fcf9 100644 --- a/libavfilter/buffersrc.c +++ b/libavfilter/buffersrc.c @@ -414,6 +414,11 @@ static av_cold int init_audio(AVFilterContext *ctx) av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf)); } + if (s->sample_rate <= 0) { + av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n"); + return AVERROR(EINVAL); + } + if (!s->time_base.num) s->time_base = (AVRational){1, s->sample_rate}; From e4538bc88825583cca9163ef1cd61b6d069a7a81 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 30 Sep 2024 23:42:50 +0200 Subject: [PATCH 084/290] avcodec/ffv1enc: 2Pass mode is not possible with golomb coding "Fixes" Ticket7063 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 417b163c00555ccda201a963e797bfa663a26ff5) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index a6f405289e..3222496dac 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -528,6 +528,11 @@ static av_cold int encode_init(AVCodecContext *avctx) avctx->slices > 1) s->version = FFMAX(s->version, 2); + if ((avctx->flags & (AV_CODEC_FLAG_PASS1 | AV_CODEC_FLAG_PASS2)) && s->ac == AC_GOLOMB_RICE) { + av_log(avctx, AV_LOG_ERROR, "2 Pass mode is not possible with golomb coding\n"); + return AVERROR(EINVAL); + } + // Unspecified level & slices, we choose version 1.2+ to ensure multithreaded decodability if (avctx->slices == 0 && avctx->level < 0 && avctx->width * avctx->height > 720*576) s->version = FFMAX(s->version, 2); From 811fce437ecc1dbd92b46691d1fde8dc4609a7df Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 6 Oct 2023 22:23:33 +0200 Subject: [PATCH 085/290] avcodec/ffv1enc: Slice combination is unsupported We always write minimal slices, the size calculation is wrong in some corner cases but as its always 1x1 (minus1) we can for now just hard-code it This helps with ticket 5548 Signed-off-by: Michael Niedermayer (cherry picked from commit 7d514655bfa47c6e5cc1b81fbba8e750e368036e) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 3222496dac..a216fb04c7 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -925,8 +925,8 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc) put_symbol(c, state, (sc->slice_x +1)*f->num_h_slices / f->width , 0); put_symbol(c, state, (sc->slice_y +1)*f->num_v_slices / f->height , 0); - put_symbol(c, state, (sc->slice_width +1)*f->num_h_slices / f->width -1, 0); - put_symbol(c, state, (sc->slice_height+1)*f->num_v_slices / f->height-1, 0); + put_symbol(c, state, 0, 0); + put_symbol(c, state, 0, 0); for (j=0; jplane_count; j++) { put_symbol(c, state, sc->plane[j].quant_table_index, 0); av_assert0(sc->plane[j].quant_table_index == f->context_model); From 76ddc3f1e1e6a4cef8a7d04697c4b7f0d9cfe7d9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 7 Oct 2023 01:43:42 +0200 Subject: [PATCH 086/290] avcodec/ffv1: Store and reuse sx/sy Signed-off-by: Michael Niedermayer (cherry picked from commit 7151081e33425010a53c7573e84b274c68ad8087) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1.c | 2 ++ libavcodec/ffv1.h | 1 + libavcodec/ffv1enc.c | 4 ++-- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c index 333fb3d79b..56a36e479f 100644 --- a/libavcodec/ffv1.c +++ b/libavcodec/ffv1.c @@ -144,6 +144,8 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f) sc->slice_height = sye - sys; sc->slice_x = sxs; sc->slice_y = sys; + sc->sx = sx; + sc->sy = sy; sc->sample_buffer = av_malloc_array((f->width + 6), 3 * MAX_PLANES * sizeof(*sc->sample_buffer)); diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h index 9aa0452922..a35197964e 100644 --- a/libavcodec/ffv1.h +++ b/libavcodec/ffv1.h @@ -75,6 +75,7 @@ typedef struct FFV1SliceContext { int slice_height; int slice_x; int slice_y; + int sx, sy; int run_index; int slice_coding_mode; diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index a216fb04c7..266ef13b24 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -923,8 +923,8 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc) int j; memset(state, 128, sizeof(state)); - put_symbol(c, state, (sc->slice_x +1)*f->num_h_slices / f->width , 0); - put_symbol(c, state, (sc->slice_y +1)*f->num_v_slices / f->height , 0); + put_symbol(c, state, sc->sx, 0); + put_symbol(c, state, sc->sy, 0); put_symbol(c, state, 0, 0); put_symbol(c, state, 0, 0); for (j=0; jplane_count; j++) { From 3f76a333172cc25277fe0859b487743a2fbabd61 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 1 Oct 2024 22:04:58 +0200 Subject: [PATCH 087/290] avcodec/ffv1enc: Correct error message about unsupported version Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 556c767786e9e3c072f7666d60a68a31a3400438) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 266ef13b24..94d9830e07 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -557,7 +557,7 @@ static av_cold int encode_init(AVCodecContext *avctx) s->version = FFMAX(s->version, 3); if ((s->version == 2 || s->version>3) && avctx->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) { - av_log(avctx, AV_LOG_ERROR, "Version 2 needed for requested features but version 2 is experimental and not enabled\n"); + av_log(avctx, AV_LOG_ERROR, "Version 2 or 4 needed for requested features but version 2 or 4 is experimental and not enabled\n"); return AVERROR_INVALIDDATA; } From ba89c5d1ebc6f45068405ba578a86a325020c5f3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 28 Jul 2024 20:53:49 +0200 Subject: [PATCH 088/290] avformat/mov: Avoid overflow in dts This basically ignores the overflow without undefined behavior, alternatively we could detect and error out Fixes: signed integer overflow: 6310596683470275584 + 7660622966157213696 cannot be represented in type 'long' Fixes: 70433/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5483347233538048 Fixes: 369662284/clusterfuzz-testcase-minimized-media_metadata_parser_fuzzer-5327368763670528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 057b8c2066da3554072565744f4f00435cc3342b) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 9a9a2414e7..fee1a9ad32 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3537,10 +3537,10 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->stts_data[i].duration = 1; corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count; } else { - corrected_dts += sample_duration * (int64_t)sample_count; + corrected_dts += sample_duration * (uint64_t)sample_count; } - current_dts += sc->stts_data[i].duration * (int64_t)sample_count; + current_dts += sc->stts_data[i].duration * (uint64_t)sample_count; if (current_dts > corrected_dts) { int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1); From 631976108ca815d921f13dfc056e620835af70ef Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 28 Jul 2024 22:08:23 +0200 Subject: [PATCH 089/290] avformat/matroskadec: Check desc_bytes so bits fit in 64bit Likely a tighter check can be done Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long' Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit c4122406f6d2726aea833480a2a8e345833dd881) Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index a2947c97e7..0e150f9138 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4633,7 +4633,7 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; - if (desc_bytes <= 0) + if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8) return -1; desc_sec = desc_ns / nano_seconds_per_second; From d870febf88c749e88fcc9b2276e9a16305c486bd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 1 Oct 2024 22:06:40 +0200 Subject: [PATCH 090/290] avcodec/ffv1enc: Prevent generation of files with broken slices Fixes: Ticket5548 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit b7ff66a35804275b25c1176cad560540785e8750) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1.c | 7 +++++++ libavcodec/ffv1.h | 1 + libavcodec/ffv1enc.c | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c index 56a36e479f..2b8564c2f5 100644 --- a/libavcodec/ffv1.c +++ b/libavcodec/ffv1.c @@ -119,6 +119,13 @@ av_cold int ff_ffv1_init_slices_state(FFV1Context *f) return 0; } +int ff_need_new_slices(int width, int num_h_slices, int chroma_shift) { + int mpw = 1<num_h_slices * f->num_v_slices; diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h index a35197964e..e19c0df014 100644 --- a/libavcodec/ffv1.h +++ b/libavcodec/ffv1.h @@ -171,6 +171,7 @@ PlaneContext *ff_ffv1_planes_alloc(void); int ff_ffv1_allocate_initial_states(FFV1Context *f); void ff_ffv1_clear_slice_state(const FFV1Context *f, FFV1SliceContext *sc); int ff_ffv1_close(AVCodecContext *avctx); +int ff_need_new_slices(int width, int num_h_slices, int chroma_shift); static av_always_inline int fold(int diff, int bits) { diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 94d9830e07..56af7dc427 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -865,6 +865,10 @@ static av_cold int encode_init(AVCodecContext *avctx) continue; if (maxw * maxh * (int64_t)(s->bits_per_raw_sample+1) * plane_count > 8<<24) continue; + if (s->version < 4) + if ( ff_need_new_slices(avctx->width , s->num_h_slices, s->chroma_h_shift) + ||ff_need_new_slices(avctx->height, s->num_v_slices, s->chroma_v_shift)) + continue; if (avctx->slices == s->num_h_slices * s->num_v_slices && avctx->slices <= MAX_SLICES || !avctx->slices) goto slices_ok; } From 2a39eeb8deb3d46c75dea8250df8a70d2630dd32 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 10 Oct 2024 19:57:07 +0200 Subject: [PATCH 091/290] avcodec/ffv1enc: Move slice termination into threads Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 8e52b1525831987bcc389c89ccf53a76e7177fe1) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 56af7dc427..96beb86cfa 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -1097,6 +1097,13 @@ retry: ret = encode_rgb_frame(f, sc, planes, width, height, p->linesize); } + if (f->ac != AC_GOLOMB_RICE) { + sc->ac_byte_count = ff_rac_terminate(&sc->c, 1); + } else { + flush_put_bits(&sc->pb); // FIXME: nicer padding + sc->ac_byte_count += put_bytes_output(&sc->pb); + } + if (ret < 0) { av_assert0(sc->slice_coding_mode == 0); if (f->version < 4 || !f->ac) { @@ -1221,14 +1228,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt, buf_p = pkt->data; for (i = 0; i < f->slice_count; i++) { FFV1SliceContext *sc = &f->slices[i]; - int bytes; - - if (f->ac != AC_GOLOMB_RICE) { - bytes = ff_rac_terminate(&sc->c, 1); - } else { - flush_put_bits(&sc->pb); // FIXME: nicer padding - bytes = sc->ac_byte_count + put_bytes_output(&sc->pb); - } + int bytes = sc->ac_byte_count; if (i > 0 || f->version > 2) { av_assert0(bytes < pkt->size / f->slice_count); memmove(buf_p, sc->c.bytestream_start, bytes); From 26fc4bf42c19bcf1772516fc1a742fbf6e426ea4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 10 Oct 2024 20:39:23 +0200 Subject: [PATCH 092/290] avcodec/ffv1dec: Fix end computation with ec=2 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 10e5af15bf220d9da128ca12d2d474ff6ab0076e) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index 415c66be63..44b2085f78 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -347,7 +347,7 @@ static int decode_slice(AVCodecContext *c, void *arg) if (f->ac != AC_GOLOMB_RICE && f->version > 2) { int v; get_rac(&sc->c, (uint8_t[]) { 129 }); - v = sc->c.bytestream_end - sc->c.bytestream - 2 - 5*f->ec; + v = sc->c.bytestream_end - sc->c.bytestream - 2 - 5*!!f->ec; if (v) { av_log(f->avctx, AV_LOG_ERROR, "bytestream end mismatching by %d\n", v); slice_set_damaged(f, sc); From 4ca3f5102f5d99b1d52b909b3d5d9b2d33c84d6b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 10 Oct 2024 22:14:41 +0200 Subject: [PATCH 093/290] avcodec/ffv1enc: Fix RCT with RGB64 Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit c1edec3a24306f8fa31bebe67644183741cbf0e0) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 96beb86cfa..3e8f6ee445 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -980,6 +980,9 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc, int x, y, i, p, best; int16_t *sample[3]; int lbd = f->bits_per_raw_sample <= 8; + int packed = !src[1]; + int transparency = f->transparency; + int packed_size = (3 + transparency)*2; for (y = 0; y < h; y++) { int lastr=0, lastg=0, lastb=0; @@ -994,6 +997,11 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc, b = v & 0xFF; g = (v >> 8) & 0xFF; r = (v >> 16) & 0xFF; + } else if (packed) { + const uint16_t *p = ((const uint16_t*)(src[0] + x*packed_size + stride[0]*y)); + r = p[0]; + g = p[1]; + b = p[2]; } else { b = *((const uint16_t*)(src[0] + x*2 + stride[0]*y)); g = *((const uint16_t*)(src[1] + x*2 + stride[1]*y)); From 7043ef6828548c64b8e75baa1f6d9ce6fa052a72 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 3 Oct 2024 01:49:09 +0200 Subject: [PATCH 094/290] avcodec/ffv1: RCT is only possible with RGB Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 2542e9296c76524494a2d17a4423d756560b5273) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1dec.c | 2 +- libavcodec/ffv1enc.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index 44b2085f78..79374658ec 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -241,7 +241,7 @@ static int decode_slice_header(const FFV1Context *f, if (f->version > 3) { sc->slice_reset_contexts = get_rac(c, state); sc->slice_coding_mode = get_symbol(c, state, 0); - if (sc->slice_coding_mode != 1) { + if (sc->slice_coding_mode != 1 && f->colorspace == 1) { sc->slice_rct_by_coef = get_symbol(c, state, 0); sc->slice_rct_ry_coef = get_symbol(c, state, 0); if ((uint64_t)sc->slice_rct_by_coef + (uint64_t)sc->slice_rct_ry_coef > 4) { diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 3e8f6ee445..8e436358ed 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -946,7 +946,7 @@ static void encode_slice_header(FFV1Context *f, FFV1SliceContext *sc) if (sc->slice_coding_mode == 1) ff_ffv1_clear_slice_state(f, sc); put_symbol(c, state, sc->slice_coding_mode, 0); - if (sc->slice_coding_mode != 1) { + if (sc->slice_coding_mode != 1 && f->colorspace == 1) { put_symbol(c, state, sc->slice_rct_by_coef, 0); put_symbol(c, state, sc->slice_rct_ry_coef, 0); } @@ -1062,7 +1062,7 @@ static int encode_slice(AVCodecContext *c, void *arg) p->data[3] ? p->data[3] + ps*x + y*p->linesize[3] : NULL}; sc->slice_coding_mode = 0; - if (f->version > 3) { + if (f->version > 3 && f->colorspace == 1) { choose_rct_params(f, sc, planes, p->linesize, width, height); } else { sc->slice_rct_by_coef = 1; From 9f8bd56e4f57115ef2650974ffe4d7d997788b1b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 15 Oct 2024 22:39:58 +0200 Subject: [PATCH 095/290] avcodec/ffv1: add a named constant for the quant table size Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 81a360a5ed9e7dcc841e791c2779f09cbd99b5d3) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1.h | 4 +++- libavcodec/ffv1_template.c | 18 +++++++++--------- libavcodec/ffv1enc.c | 6 +++--- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h index e19c0df014..5c14907715 100644 --- a/libavcodec/ffv1.h +++ b/libavcodec/ffv1.h @@ -44,6 +44,8 @@ #define CONTEXT_SIZE 32 #define MAX_QUANT_TABLES 8 +#define MAX_QUANT_TABLE_SIZE 256 +#define MAX_QUANT_TABLE_MASK (MAX_QUANT_TABLE_SIZE - 1) #define MAX_CONTEXT_INPUTS 5 #define AC_GOLOMB_RICE 0 @@ -123,7 +125,7 @@ typedef struct FFV1Context { const AVFrame *cur_enc_frame; int plane_count; int ac; ///< 1=range coder <-> 0=golomb rice - int16_t quant_tables[MAX_QUANT_TABLES][MAX_CONTEXT_INPUTS][256]; + int16_t quant_tables[MAX_QUANT_TABLES][MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE]; int context_count[MAX_QUANT_TABLES]; uint8_t state_transition[256]; uint8_t (*initial_states[MAX_QUANT_TABLES])[32]; diff --git a/libavcodec/ffv1_template.c b/libavcodec/ffv1_template.c index d15ad11021..abb90a12e4 100644 --- a/libavcodec/ffv1_template.c +++ b/libavcodec/ffv1_template.c @@ -29,7 +29,7 @@ static inline int RENAME(predict)(TYPE *src, TYPE *last) return mid_pred(L, L + T - LT, T); } -static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPUTS][256], +static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE], TYPE *src, TYPE *last, TYPE *last2) { const int LT = last[-1]; @@ -40,14 +40,14 @@ static inline int RENAME(get_context)(const int16_t quant_table[MAX_CONTEXT_INPU if (quant_table[3][127] || quant_table[4][127]) { const int TT = last2[0]; const int LL = src[-2]; - return quant_table[0][(L - LT) & 0xFF] + - quant_table[1][(LT - T) & 0xFF] + - quant_table[2][(T - RT) & 0xFF] + - quant_table[3][(LL - L) & 0xFF] + - quant_table[4][(TT - T) & 0xFF]; + return quant_table[0][(L - LT) & MAX_QUANT_TABLE_MASK] + + quant_table[1][(LT - T) & MAX_QUANT_TABLE_MASK] + + quant_table[2][(T - RT) & MAX_QUANT_TABLE_MASK] + + quant_table[3][(LL - L) & MAX_QUANT_TABLE_MASK] + + quant_table[4][(TT - T) & MAX_QUANT_TABLE_MASK]; } else - return quant_table[0][(L - LT) & 0xFF] + - quant_table[1][(LT - T) & 0xFF] + - quant_table[2][(T - RT) & 0xFF]; + return quant_table[0][(L - LT) & MAX_QUANT_TABLE_MASK] + + quant_table[1][(LT - T) & MAX_QUANT_TABLE_MASK] + + quant_table[2][(T - RT) & MAX_QUANT_TABLE_MASK]; } diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 8e436358ed..7dcecb5905 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -317,7 +317,7 @@ static void write_quant_table(RangeCoder *c, int16_t *quant_table) uint8_t state[CONTEXT_SIZE]; memset(state, 128, sizeof(state)); - for (i = 1; i < 128; i++) + for (i = 1; i < MAX_QUANT_TABLE_SIZE/2; i++) if (quant_table[i] != quant_table[i - 1]) { put_symbol(c, state, i - last - 1, 0); last = i; @@ -326,7 +326,7 @@ static void write_quant_table(RangeCoder *c, int16_t *quant_table) } static void write_quant_tables(RangeCoder *c, - int16_t quant_table[MAX_CONTEXT_INPUTS][256]) + int16_t quant_table[MAX_CONTEXT_INPUTS][MAX_QUANT_TABLE_SIZE]) { int i; for (i = 0; i < 5; i++) @@ -718,7 +718,7 @@ static av_cold int encode_init(AVCodecContext *avctx) s->state_transition[i] = c.one_state[i]; } - for (i = 0; i < 256; i++) { + for (i = 0; i < MAX_QUANT_TABLE_SIZE; i++) { s->quant_table_count = 2; if (s->bits_per_raw_sample <= 8) { s->quant_tables[0][0][i]= quant11[i]; From a2666675bf74869233df6222bfb58d4e6c9e3af4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 16 Oct 2024 14:39:20 +0200 Subject: [PATCH 096/290] avcodec/rangecoder: only perform renorm check/loop for callers that need it Signed-off-by: Michael Niedermayer (cherry picked from commit d147b3d7ecba2bd40cb45284f920238da97a95ee) Signed-off-by: Michael Niedermayer --- libavcodec/rangecoder.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavcodec/rangecoder.h b/libavcodec/rangecoder.h index 89d178ac31..110908d6bd 100644 --- a/libavcodec/rangecoder.h +++ b/libavcodec/rangecoder.h @@ -62,7 +62,6 @@ void ff_build_rac_states(RangeCoder *c, int factor, int max_p); static inline void renorm_encoder(RangeCoder *c) { // FIXME: optimize - while (c->range < 0x100) { if (c->outstanding_byte < 0) { c->outstanding_byte = c->low >> 8; } else if (c->low <= 0xFF00) { @@ -81,7 +80,6 @@ static inline void renorm_encoder(RangeCoder *c) c->low = (c->low & 0xFF) << 8; c->range <<= 8; - } } static inline int get_rac_count(RangeCoder *c) @@ -108,7 +106,8 @@ static inline void put_rac(RangeCoder *c, uint8_t *const state, int bit) *state = c->one_state[*state]; } - renorm_encoder(c); + while (c->range < 0x100) + renorm_encoder(c); } static inline void refill(RangeCoder *c) From 2ab2803944ca2aebdffde8555e49d8b266f5b918 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 9 Oct 2024 18:59:19 +0200 Subject: [PATCH 097/290] swscale/rgb2rgb_template: Fix ff_rgb24toyv12_c() with odd height Fixes: out of array access Fixes: 368143798/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6475823425585152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 14f5d67be38dcdf04932e557b7f25975fc91c851) Signed-off-by: Michael Niedermayer --- libswscale/rgb2rgb_template.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libswscale/rgb2rgb_template.c b/libswscale/rgb2rgb_template.c index 32d90d44fe..d4204153db 100644 --- a/libswscale/rgb2rgb_template.c +++ b/libswscale/rgb2rgb_template.c @@ -640,7 +640,7 @@ static inline void uyvytoyv12_c(const uint8_t *src, uint8_t *ydst, } /** - * Height should be a multiple of 2 and width should be a multiple of 2. + * width should be a multiple of 2. * (If this is a problem for anyone then tell me, and I will fix it.) */ void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst, @@ -659,6 +659,11 @@ void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst, for (y = 0; y < height; y += 2) { int i; + if (y + 1 == height) { + ydst2 = ydst1; + src2 = src1; + } + for (i = 0; i < chromWidth; i++) { unsigned int b11 = src1[6 * i + 0]; unsigned int g11 = src1[6 * i + 1]; From 562af93025dcbded930e02db6c427bcfbfa59356 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 9 Oct 2024 20:39:07 +0200 Subject: [PATCH 098/290] swscale/output: used unsigned for bit accumulation Fixes: Integer overflow Fixes: 368725672/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5009093023563776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 3fe3014405494503a03c2e6eff4743db91a21c00) Signed-off-by: Michael Niedermayer --- libswscale/output.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libswscale/output.c b/libswscale/output.c index 31921a3cce..ae9a50637a 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -664,7 +664,7 @@ yuv2mono_2_c_template(SwsContext *c, const int16_t *buf[2], if (c->dither == SWS_DITHER_ED) { int err = 0; - int acc = 0; + unsigned acc = 0; for (i = 0; i < dstW; i +=2) { int Y; @@ -686,7 +686,8 @@ yuv2mono_2_c_template(SwsContext *c, const int16_t *buf[2], c->dither_error[0][i] = err; } else { for (i = 0; i < dstW; i += 8) { - int Y, acc = 0; + int Y; + unsigned acc = 0; Y = (buf0[i + 0] * yalpha1 + buf1[i + 0] * yalpha) >> 19; accumulate_bit(acc, Y + d128[0]); @@ -721,7 +722,7 @@ yuv2mono_1_c_template(SwsContext *c, const int16_t *buf0, if (c->dither == SWS_DITHER_ED) { int err = 0; - int acc = 0; + unsigned acc = 0; for (i = 0; i < dstW; i +=2) { int Y; @@ -743,7 +744,7 @@ yuv2mono_1_c_template(SwsContext *c, const int16_t *buf0, c->dither_error[0][i] = err; } else { for (i = 0; i < dstW; i += 8) { - int acc = 0; + unsigned acc = 0; accumulate_bit(acc, ((buf0[i + 0] + 64) >> 7) + d128[0]); accumulate_bit(acc, ((buf0[i + 1] + 64) >> 7) + d128[1]); accumulate_bit(acc, ((buf0[i + 2] + 64) >> 7) + d128[2]); From 6b0204781126b3f62a64e9b6896d04dd56f91c34 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 9 Oct 2024 20:47:34 +0200 Subject: [PATCH 099/290] avformat/mxfdec: Fix overflow in midpoint computation Fixes: signed integer overflow: 4611686016549392399 + 9223372033098784800 cannot be represented in type 'long long' Fixes: 368503277/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5928227458056192 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 23088a5ff2b549fa4fc037bb9ed833fffbc89ca0) Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 24f4ed1c33..2f8ab3890d 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -3832,7 +3832,7 @@ static int mxf_get_next_track_edit_unit(MXFContext *mxf, MXFTrack *track, int64_ a = -1; b = track->original_duration; while (b - 1 > a) { - m = (a + b) >> 1; + m = (a + (uint64_t)b) >> 1; if (mxf_edit_unit_absolute_offset(mxf, t, m, track->edit_rate, NULL, &offset, NULL, 0) < 0) return -1; if (offset < current_offset) From 0288fedf181578970f9344eda0e66da9e030dc64 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 9 Oct 2024 23:44:00 +0200 Subject: [PATCH 100/290] avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen Fixes: use of uninitialized variable Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit db7b4fc89fb18d5ff0a1426bd433c234555a3fff) Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 04565a2011..86b7c8e041 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1672,6 +1672,8 @@ static int mp4_read_iods(AVFormatContext *s, const uint8_t *buf, unsigned size, MP4DescrParseContext d; int ret; + d.predefined_SLConfigDescriptor_seen = 0; + ret = init_MP4DescrParseContext(&d, s, buf, size, descr, max_descr_count); if (ret < 0) return ret; From ded98a0919a09a7fa87763ceefc4468e6dbf5b50 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 2 Nov 2024 18:23:50 +0100 Subject: [PATCH 101/290] INSTALL: explain the circular dependency issue and solution Sponsored-by: Sovereign Tech Fund Reviewed-by: James Almer Signed-off-by: Michael Niedermayer (cherry picked from commit df00705e0010cc2c53d17d51944f847c2c852189) Signed-off-by: Michael Niedermayer --- INSTALL.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/INSTALL.md b/INSTALL.md index 3b220bc6ff..bdf5814014 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -15,3 +15,11 @@ NOTICE ------ - Non system dependencies (e.g. libx264, libvpx) are disabled by default. + +NOTICE for Package Maintainers +------------------------------ + + - It is recommended to build FFmpeg twice, first with minimal external dependencies so + that 3rd party packages, which depend on FFmpegs libavutil/libavfilter/libavcodec/libavformat + can then be built. And last build FFmpeg with full dependancies (which may in turn depend on + some of these 3rd party packages). This avoids circular dependencies during build. From 241e87afa4c5bd70c3f360afa7425623d4d2218f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 20:08:07 +0100 Subject: [PATCH 102/290] avformat/rpl: check channels Fixes: 42537199/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5447162658357248 Fixes: runtime error: signed integer overflow: -3330498059201358222 * 4 cannot be represented in type 'int64_t' (aka 'long') Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit beca13a42e9fb5341e8bd6356fd7d9c2d18aac9b) Signed-off-by: Michael Niedermayer --- libavformat/rpl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/rpl.c b/libavformat/rpl.c index 32a762b60a..e971d0588f 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -205,6 +205,8 @@ static int rpl_read_header(AVFormatContext *s) if (ast->codecpar->sample_rate < 0) return AVERROR_INVALIDDATA; channels = read_line_and_int(pb, &error); // number of audio channels + if (channels <= 0) + return AVERROR_INVALIDDATA; error |= read_line(pb, line, sizeof(line)); ast->codecpar->bits_per_coded_sample = read_int(line, &endptr, &error); // audio bits per sample av_strlcpy(audio_type, endptr, RPL_LINE_LENGTH); From e2394166bfa981bdf02f02605dd76888e6932fbf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 20:18:36 +0100 Subject: [PATCH 103/290] avformat/mccdec: Initialize and check rate.den Fixes: Assertion c > 0 failed at libavutil/mathematics.c:61 Fixes: use-of-uninitialized-value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-5939605805793280 Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit bf8e43083f68c383b9d905d2c8c791ac33ecc7bc) Signed-off-by: Michael Niedermayer --- libavformat/mccdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mccdec.c b/libavformat/mccdec.c index 85bf93cd3b..8c0ea09b6b 100644 --- a/libavformat/mccdec.c +++ b/libavformat/mccdec.c @@ -93,7 +93,7 @@ static int mcc_read_header(AVFormatContext *s) { MCCContext *mcc = s->priv_data; AVStream *st = avformat_new_stream(s, NULL); - AVRational rate; + AVRational rate = {0}; int64_t ts, pos; uint8_t out[4096]; char line[4096]; @@ -139,7 +139,7 @@ static int mcc_read_header(AVFormatContext *s) continue; } - if (av_sscanf(line, "%d:%d:%d:%d", &hh, &mm, &ss, &fs) != 4) + if (av_sscanf(line, "%d:%d:%d:%d", &hh, &mm, &ss, &fs) != 4 || rate.den <= 0) continue; ts = av_sat_add64(av_rescale(hh * 3600LL + mm * 60LL + ss, rate.num, rate.den), fs); From 1f1b309f9e18009f5957e69bf3575a8b93d9c1a8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 20:43:21 +0100 Subject: [PATCH 104/290] avformat/nistspheredec: Clear buffer Fixes: use-of-uninitialized-value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit 898f6582eb51bf77b1f88e8f55eab67ee6ee13b8) Signed-off-by: Michael Niedermayer --- libavformat/nistspheredec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/nistspheredec.c b/libavformat/nistspheredec.c index 1e6c567e01..e624036149 100644 --- a/libavformat/nistspheredec.c +++ b/libavformat/nistspheredec.c @@ -35,7 +35,7 @@ static int nist_probe(const AVProbeData *p) static int nist_read_header(AVFormatContext *s) { - char buffer[256], coding[32] = "pcm", format[32] = "01"; + char buffer[256]= {0}, coding[32] = "pcm", format[32] = "01"; int bps = 0, be = 0; int32_t header_size = -1; AVStream *st; From 445065e23a7aa9aa9fb1be705a253993479c089a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 20:47:07 +0100 Subject: [PATCH 105/290] avformat/ilbc: Check avio_read() for failure Fixes: use of uninitialized value Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit e30d957a9bacf7f7307c640aa0bd1e70cb3bbe7e) Signed-off-by: Michael Niedermayer --- libavformat/ilbc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/ilbc.c b/libavformat/ilbc.c index a24aa3da9d..6c441c21bf 100644 --- a/libavformat/ilbc.c +++ b/libavformat/ilbc.c @@ -61,7 +61,8 @@ static int ilbc_read_header(AVFormatContext *s) AVStream *st; uint8_t header[9]; - avio_read(pb, header, 9); + if (avio_read(pb, header, 9) != 9) + return AVERROR_INVALIDDATA; st = avformat_new_stream(s, NULL); if (!st) From c7aa0c4ecd28590844ea5ca572391f909492ff19 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 20:54:29 +0100 Subject: [PATCH 106/290] avformat/vividas: Check avio_read() for failure Fixes: use of uninitialized value (untested) Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5505802505355264 Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit 96d45c3b212689f82bff2530c3637405df9e9369) Signed-off-by: Michael Niedermayer --- libavformat/vividas.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 130b81ebbe..bec4ad7cec 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -567,7 +567,8 @@ static int viv_read_header(AVFormatContext *s) v = avio_r8(pb); avio_seek(pb, v, SEEK_CUR); - avio_read(pb, keybuffer, 187); + if (avio_read(pb, keybuffer, 187) != 187) + return AVERROR_INVALIDDATA; key = decode_key(keybuffer); viv->sb_key = key; From 4930dd91c6b4d47530ba3f16cc447687850b6ac7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 13 Nov 2024 19:28:15 +0100 Subject: [PATCH 107/290] doc/infra: Document gitolite Signed-off-by: Michael Niedermayer (cherry picked from commit 07904231cb9730e09e2b7948e3977e7c2eafbb10) Signed-off-by: Michael Niedermayer --- doc/infra.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/infra.txt b/doc/infra.txt index 30a85dd5ce..aea3e93e13 100644 --- a/doc/infra.txt +++ b/doc/infra.txt @@ -65,6 +65,9 @@ Github mirrors are redundantly synced by multiple people You need a new git repository related to FFmpeg ? contact root at ffmpeg.org +git repositories are managed by gitolite, every change to permissions is +logged, including when, what and by whom + Fate: ~~~~~ From f9901306ba433ad668fd72826eaa2b5c0065bbab Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 19 Nov 2024 23:18:31 +0100 Subject: [PATCH 108/290] doc/infra: Document trac backup system Signed-off-by: Michael Niedermayer (cherry picked from commit edc4855f7710c4563e7cd5773598f8341f64e019) Signed-off-by: Michael Niedermayer --- doc/infra.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/infra.txt b/doc/infra.txt index aea3e93e13..79d4e56719 100644 --- a/doc/infra.txt +++ b/doc/infra.txt @@ -23,6 +23,8 @@ Web, mail, and public facing git, also website git fftrac VM: ---------- trac.ffmpeg.org Issue tracking +gpg encrypted backups of the trac repositories are created once a day +and can be downloaded by any of the admins. ffaux VM: From d9687e6156a8b044537dbe8ea4784a2fad19754a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 16 Nov 2024 21:32:53 +0100 Subject: [PATCH 109/290] doc/developer: Document relationship between git accounts and MAINTAINERS This should have been documented long ago and i thought it was Signed-off-by: Michael Niedermayer (cherry picked from commit 7051825b0171bd5d566c5a5cc78852c5f3aa3072) Signed-off-by: Michael Niedermayer --- doc/developer.texi | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/doc/developer.texi b/doc/developer.texi index 41b21938ef..dcfb64e07d 100644 --- a/doc/developer.texi +++ b/doc/developer.texi @@ -927,6 +927,25 @@ In case you need finer control over how valgrind is invoked, use the @code{--target-exec='valgrind } option in your configure line instead. +@anchor{Maintenance} +@chapter Maintenance process + +@anchor{MAINTAINERS} +@section MAINTAINERS + +The developers maintaining each part of the codebase are listed in @file{MAINTAINERS}. +Being listed in @file{MAINTAINERS}, gives one the right to have git write access to +the specific repository. + +@anchor{Becoming a maintainer} +@section Becoming a maintainer + +People add themselves to @file{MAINTAINERS} by sending a patch like any other code +change. These get reviewed by the community like any other patch. It is expected +that, if someone has an objection to a new maintainer, she is willing to object +in public with her full name and is willing to take over maintainership for the area. + + @anchor{Release process} @chapter Release process From 3417e955c3c6ed426174bdeb46b490889df93a28 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2024 11:07:27 +0100 Subject: [PATCH 110/290] avformat/icodec: fix integer overflow with nb_pal Fixes: runtime error: signed integer overflow Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472 Found-by: ossfuzz Reported-by: Kacper Michajlow Tested-by: Kacper Michajlow Reviewed-by: Peter Ross Signed-off-by: Michael Niedermayer (cherry picked from commit 84569b6c22cb4eda9c682aabeb5f658112126780) Signed-off-by: Michael Niedermayer --- libavformat/icodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/icodec.c b/libavformat/icodec.c index afd0c71b1f..b09d0060a6 100644 --- a/libavformat/icodec.c +++ b/libavformat/icodec.c @@ -198,7 +198,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt) AV_WL32(buf + 32, image->nb_pal); } - if (image->nb_pal > INT_MAX / 4 - 14 - 40) + if (image->nb_pal > INT_MAX / 4 - 14 - 40U) return AVERROR_INVALIDDATA; AV_WL32(buf - 4, 14 + 40 + image->nb_pal * 4); From 49e4c1717ffbbfab8315963139ba4c7ed395e004 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 18 Nov 2024 23:55:05 +0100 Subject: [PATCH 111/290] avcodec/mjpegdec: Disallow progressive bayer images Fixes: Null pointer dereference Fixes: sample1.dng Found-by: South East <8billion.people@gmail.com> Signed-off-by: Michael Niedermayer (cherry picked from commit 6d8285633d8965658dfa6cd0b201cca36184c467) Signed-off-by: Michael Niedermayer --- libavcodec/mjpegdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 86ec58713c..ef4fc075b2 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -468,6 +468,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) if (s->avctx->height <= 0) return AVERROR_INVALIDDATA; } + if (s->bayer && s->progressive) { + avpriv_request_sample(s->avctx, "progressively coded bayer picture"); + return AVERROR_INVALIDDATA; + } if (s->got_picture && s->interlaced && (s->bottom_field == !s->interlace_polarity)) { if (s->progressive) { From 8ac2375b71fa432c7ce2b750b73a339d9da20ea9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 24 Nov 2024 21:13:42 +0100 Subject: [PATCH 112/290] MAINTAINERS: Remove Guillaume Poirier and Romain Dolbeau Guillaume no longer has a PPC Romain has no time CC: Guillaume POIRIER CC: Romain Dolbeau Signed-off-by: Michael Niedermayer (cherry picked from commit 224b62489d314e3c9637397cb7b95505651349e1) Signed-off-by: Michael Niedermayer --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 76651d5ff8..d1b3d993e5 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -511,7 +511,7 @@ Operating systems / CPU architectures Alpha [0] MIPS Manojkumar Bhosale, Shiyou Yin LoongArch [2] Shiyou Yin -Mac OS X / PowerPC Romain Dolbeau, Guillaume Poirier +Mac OS X / PowerPC [0] Amiga / PowerPC Colin Ward Linux / PowerPC Lauri Kasanen RISC-V [2] Rémi Denis-Courmont From 3c8b588f3c115beaff7f346f0faa7376b63506b0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 26 Nov 2024 20:38:01 +0100 Subject: [PATCH 113/290] MAINTAINERS: Lauri is still available but is really low on time nowadays CC: Lauri Kasanen Signed-off-by: Michael Niedermayer (cherry picked from commit e531b3ff27fcfa9110e71ba291888778ecb3b0f4) Signed-off-by: Michael Niedermayer --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index d1b3d993e5..8a2ee04aed 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -513,7 +513,7 @@ MIPS Manojkumar Bhosale, Shiyou Yin LoongArch [2] Shiyou Yin Mac OS X / PowerPC [0] Amiga / PowerPC Colin Ward -Linux / PowerPC Lauri Kasanen +Linux / PowerPC [1] Lauri Kasanen RISC-V [2] Rémi Denis-Courmont Windows MinGW Alex Beregszaszi, Ramiro Polla Windows Cygwin Victor Paesa From 173a978b9d8cd4925a8d01c95ebbee0382543432 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 18 Nov 2024 03:22:27 +0100 Subject: [PATCH 114/290] avcodec/h2645_parse: Ignore NAL with nuh_layer_id == 63 Comply with "For purposes other than determining the amount of data in the decoding units of the bitstream, decoders shall ignore all data that follow the value 63 for nuh_layer_id in a NAL unit" Rec. ITU-T H.265 v8 (08/2021) Page 67 Fixes: index 63 out of bounds for type 'const int8_t[63]' (aka 'const signed char[63]') Fixes: clusterfuzz-testcase-fuzzer_loadfile-5109286752026624 Reported-by: Kacper Michajlow Found-by: ossfuzz Signed-off-by: Michael Niedermayer (cherry picked from commit 360e7cafd0e65fdf4b186c95e2517a94b9f3fa4f) Signed-off-by: Michael Niedermayer --- libavcodec/h2645_parse.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c index 7b48fcae17..82816999e8 100644 --- a/libavcodec/h2645_parse.c +++ b/libavcodec/h2645_parse.c @@ -581,9 +581,11 @@ int ff_h2645_packet_split(H2645Packet *pkt, const uint8_t *buf, int length, if (codec_id == AV_CODEC_ID_VVC) ret = vvc_parse_nal_header(nal, logctx); - else if (codec_id == AV_CODEC_ID_HEVC) + else if (codec_id == AV_CODEC_ID_HEVC) { ret = hevc_parse_nal_header(nal, logctx); - else + if (nal->nuh_layer_id == 63) + continue; + } else ret = h264_parse_nal_header(nal, logctx); if (ret < 0) { av_log(logctx, AV_LOG_WARNING, "Invalid NAL unit %d, skipping.\n", From f9f4835731617b00d5c9a2eef2d5142d13c0a9c8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 19 Oct 2024 00:08:03 +0200 Subject: [PATCH 115/290] swscale/slice: clear allocated memory in alloc_lines() Fixes: use of uninitialized memory in hScale16To15_c() Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit aeec39f3c1be82863efe64ce95242de58e075e8f) Signed-off-by: Michael Niedermayer --- libswscale/slice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libswscale/slice.c b/libswscale/slice.c index 1cc3f6c405..951912fb75 100644 --- a/libswscale/slice.c +++ b/libswscale/slice.c @@ -60,7 +60,7 @@ static int alloc_lines(SwsSlice *s, int size, int width) for (j = 0; j < n; ++j) { // chroma plane line U and V are expected to be contiguous in memory // by mmx vertical scaler code - s->plane[i].line[j] = av_malloc(size * 2 + 32); + s->plane[i].line[j] = av_mallocz(size * 2 + 32); if (!s->plane[i].line[j]) { free_lines(s); return AVERROR(ENOMEM); From 851bc9927d98badf0b50753b0d3601ca1e915ba6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 19 Oct 2024 01:15:53 +0200 Subject: [PATCH 116/290] avformat/dxa: check bpc Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 7e020f21413269418180eea7933a94ecb6bf2ef8) Signed-off-by: Michael Niedermayer --- libavformat/dxa.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/dxa.c b/libavformat/dxa.c index 813e665a27..56b19a7fca 100644 --- a/libavformat/dxa.c +++ b/libavformat/dxa.c @@ -120,6 +120,8 @@ static int dxa_read_header(AVFormatContext *s) avio_skip(pb, fsize); } c->bpc = (fsize + (int64_t)c->frames - 1) / c->frames; + if (c->bpc < 0) + return AVERROR_INVALIDDATA; if(ast->codecpar->block_align) { if (c->bpc > INT_MAX - ast->codecpar->block_align + 1) return AVERROR_INVALIDDATA; From 048a545e316ea66badd03d45ce3b60a437245789 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Sep 2024 20:52:02 +0200 Subject: [PATCH 117/290] avcodec/eatgq: Check bytestream2_get_buffer() for failure Fixes: Use of uninitialized memory Fixes: 71546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-5607656650244096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4949e34d96cc751aedaace02123c2fb02b5ac174) Signed-off-by: Michael Niedermayer --- libavcodec/eatgq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/eatgq.c b/libavcodec/eatgq.c index d326c05390..c6fcb062d7 100644 --- a/libavcodec/eatgq.c +++ b/libavcodec/eatgq.c @@ -178,7 +178,8 @@ static int tgq_decode_mb(TgqContext *s, GetByteContext *gbyte, dc[4] = bytestream2_get_byte(gbyte); dc[5] = bytestream2_get_byte(gbyte); } else if (mode == 6) { - bytestream2_get_buffer(gbyte, dc, 6); + if (bytestream2_get_buffer(gbyte, dc, 6) != 6) + return AVERROR_INVALIDDATA; } else if (mode == 12) { for (i = 0; i < 6; i++) { dc[i] = bytestream2_get_byte(gbyte); From 9285b93143530f36a96ce1d855d51a5c54d868c9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Sep 2024 20:55:17 +0200 Subject: [PATCH 118/290] avformat/qcp: Check for read failure in header Fixes: Use of uninitialized value Fixes: 71551/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-4647386712965120 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit f52b9d05837c23b0c55013551bc28dce4922de0b) Signed-off-by: Michael Niedermayer --- libavformat/qcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/qcp.c b/libavformat/qcp.c index fdf18618d2..13a479a11e 100644 --- a/libavformat/qcp.c +++ b/libavformat/qcp.c @@ -105,7 +105,8 @@ static int qcp_read_header(AVFormatContext *s) st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_MONO; - avio_read(pb, buf, 16); + if (avio_read(pb, buf, 16) != 16) + return AVERROR_INVALIDDATA; if (is_qcelp_13k_guid(buf)) { st->codecpar->codec_id = AV_CODEC_ID_QCELP; } else if (!memcmp(buf, guid_evrc, 16)) { From 82d45cb004a9343caa65cb56bfe30b77d4deac72 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Sep 2024 21:21:40 +0200 Subject: [PATCH 119/290] avcodec/hevc/hevcdec: initialize qp_y_tab This does not replicate on my setup, thus this is a blind fix based on ossfuzz trace Fixes: use of uninitialized value Fixes: 71747/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5427736120721408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4fc43e45f9e7ee50d8d244bcdea15b37b5614b9b) Signed-off-by: Michael Niedermayer --- libavcodec/hevc/hevcdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 5dc605f91f..6fe72bd297 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -128,7 +128,7 @@ static int pic_arrays_init(HEVCLayerContext *l, const HEVCSPS *sps) l->filter_slice_edges = av_mallocz(ctb_count); l->tab_slice_address = av_malloc_array(pic_size_in_ctb, sizeof(*l->tab_slice_address)); - l->qp_y_tab = av_malloc_array(pic_size_in_ctb, + l->qp_y_tab = av_calloc(pic_size_in_ctb, sizeof(*l->qp_y_tab)); if (!l->qp_y_tab || !l->filter_slice_edges || !l->tab_slice_address) goto fail; From 028391aa580979d8bd5d8bde68ccc6dc99820098 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 22 Sep 2024 23:00:52 +0200 Subject: [PATCH 120/290] swscale/swscale_unscaled: Fix odd height with nv24_to_yuv420p_chroma() Fixes: out of array read Fixes: 71726/clusterfuzz-testcase-ffmpeg_SWS_fuzzer-5876893532880896 Fixes: 377735917/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6686071112400896 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Approved-by: Ramiro Polla Signed-off-by: Michael Niedermayer (cherry picked from commit d32dcc07a762185c1213fc7485cedc22b2448887) Signed-off-by: Michael Niedermayer --- libswscale/swscale_unscaled.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index dc1d5f3593..d403c953cc 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -230,6 +230,8 @@ static void nv24_to_yuv420p_chroma(uint8_t *dst1, int dstStride1, const uint8_t *src2 = src + srcStride; // average 4 pixels into 1 (interleaved U and V) for (int y = 0; y < h; y += 2) { + if (y + 1 == h) + src2 = src1; for (int x = 0; x < w; x++) { dst1[x] = (src1[4 * x + 0] + src1[4 * x + 2] + src2[4 * x + 0] + src2[4 * x + 2]) >> 2; From 886dd058fe133bcc227d291b4fbf99aaed9c9a45 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Sep 2024 19:57:28 +0200 Subject: [PATCH 121/290] avcodec/ilbcdec: Initialize tempbuff2 Fixes: Use of uninitialized value Fixes: 71350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4482218440534804d067de00ee1a4bc493c8b41d) Signed-off-by: Michael Niedermayer --- libavcodec/ilbcdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c index ba1da168bc..7fea39b43c 100644 --- a/libavcodec/ilbcdec.c +++ b/libavcodec/ilbcdec.c @@ -658,7 +658,7 @@ static void get_codebook(int16_t * cbvec, /* (o) Constructed codebook vector * int16_t k, base_size; int16_t lag; /* Stack based */ - int16_t tempbuff2[SUBL + 5]; + int16_t tempbuff2[SUBL + 5] = {0}; /* Determine size of codebook sections */ base_size = lMem - cbveclen + 1; From bc8248d07aa522c3743b1d15e0de5e7b22ca8748 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Aug 2024 16:00:01 +0200 Subject: [PATCH 122/290] avcodec/webp: Check ref_x/y Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072 Fixes: use of uninintailized value Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 7c1e732ad2e240af5afe9ffea443c91bb233aa65) Signed-off-by: Michael Niedermayer --- libavcodec/webp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/webp.c b/libavcodec/webp.c index 7c2a5f0111..b624458d67 100644 --- a/libavcodec/webp.c +++ b/libavcodec/webp.c @@ -704,6 +704,9 @@ static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role, ref_x = FFMAX(0, ref_x); ref_y = FFMAX(0, ref_y); + if (ref_y == y && ref_x >= x) + return AVERROR_INVALIDDATA; + /* copy pixels * source and dest regions can overlap and wrap lines, so just * copy per-pixel */ From 828569c0d0efaa2da23472b8391e2d251d2f8a71 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 31 Jul 2024 20:59:49 +0200 Subject: [PATCH 123/290] avcodec/aac/aacdec_usac: Clean ics2->max_sfb when first SCE fails Fixes: out of array access Fixes: 70734/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4741427068731392 Fixes: 383194070/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5302387708854272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne Signed-off-by: Michael Niedermayer (cherry picked from commit 682d710bcb8d21d8cda0182bb1725663dbbac7cd) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec_usac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 1b79d19a30..5efa248238 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -917,8 +917,10 @@ static int decode_usac_stereo_info(AACDecContext *ac, AACUSACConfig *usac, } ret = setup_sce(ac, sce1, usac); - if (ret < 0) + if (ret < 0) { + ics2->max_sfb = 0; return ret; + } ret = setup_sce(ac, sce2, usac); if (ret < 0) From b44488042243671ad62b69daa6633fa4b0e305c0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 31 Jul 2024 20:03:12 +0200 Subject: [PATCH 124/290] avcodec/aac/aacdec_usac: Dont leave type at a invalid value Fixes: Assertion 0 failed at libavcodec/aac/aacdec_usac.c:1646 Fixes: 70541/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5190889543106560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne Signed-off-by: Michael Niedermayer (cherry picked from commit a518b5540de469ac5d4f96e820462e5ce519c2db) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec_usac.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 5efa248238..2938e69387 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -265,6 +265,7 @@ static int decode_usac_extension(AACDecContext *ac, AACUsacElemConfig *e, /* No configuration needed - fallthrough (len should be 0) */ default: skip_bits(gb, 8*ext_config_len); + e->ext.type = ID_EXT_ELE_FILL; break; }; From 52461e7e8b54e408a81a7cf800073bec80961fe0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 22 Dec 2024 00:28:21 +0100 Subject: [PATCH 125/290] avutil/timecode: Avoid fps overflow in av_timecode_get_smpte_from_framenum() Fix from c94875471e3ba3dc396c6919ff3ec9b14539cd71 Found-by: Youngjae Choi Signed-off-by: Michael Niedermayer (cherry picked from commit 6ba33b50f51b17eef0449f20b3524f174dc9c3cc) Signed-off-by: Michael Niedermayer --- libavutil/timecode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavutil/timecode.c b/libavutil/timecode.c index f40a10eb38..f454466f97 100644 --- a/libavutil/timecode.c +++ b/libavutil/timecode.c @@ -61,8 +61,8 @@ uint32_t av_timecode_get_smpte_from_framenum(const AVTimecode *tc, int framenum) framenum = av_timecode_adjust_ntsc_framenum2(framenum, tc->fps); ff = framenum % fps; ss = framenum / fps % 60; - mm = framenum / (fps*60) % 60; - hh = framenum / (fps*3600) % 24; + mm = framenum / (fps*60LL) % 60; + hh = framenum / (fps*3600LL) % 24; return av_timecode_get_smpte(tc->rate, drop, hh, mm, ss, ff); } From 63505308068a813d5846236aee95c837b4cc47fe Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 8 Dec 2024 00:32:38 +0100 Subject: [PATCH 126/290] tools/target_dec_fuzzer: Adjust Threshold for indeo5 Fixes: 379768251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5981329084186624 Fixes: Timeout Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 89efc6c97c4faf97dfed558b7bce2f64f8bd61e1) Signed-off-by: Michael Niedermayer --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 432e948816..48fa0e93a1 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -255,6 +255,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_HQ_HQA: maxpixels /= 128; break; case AV_CODEC_ID_IFF_ILBM: maxpixels /= 4096; break; case AV_CODEC_ID_INDEO4: maxpixels /= 128; break; + case AV_CODEC_ID_INDEO5: maxpixels /= 1024; break; case AV_CODEC_ID_INTERPLAY_ACM: maxsamples /= 16384; break; case AV_CODEC_ID_JPEG2000: maxpixels /= 16384; break; case AV_CODEC_ID_LAGARITH: maxpixels /= 1024; break; From 364eb21d2a3472c5b3468818a413f42ce19d06ca Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 8 Dec 2024 03:04:16 +0100 Subject: [PATCH 127/290] tools/target_dec_fuzzer: Adjust threshold for MVC1 Fixes: Timeout Fixes: 378231213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVC1_fuzzer-6640960500465664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit e7230bc503a1180e6eb76f956e9c6b61352936e4) Signed-off-by: Michael Niedermayer --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 48fa0e93a1..1f01819eb8 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -271,6 +271,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_MSZH: maxpixels /= 128; break; case AV_CODEC_ID_MTS2: maxpixels /= 4096; break; case AV_CODEC_ID_MV30: maxpixels /= 128; break; + case AV_CODEC_ID_MVC1: maxpixels /= 1024; break; case AV_CODEC_ID_MVC2: maxpixels /= 128; break; case AV_CODEC_ID_MVHA: maxpixels /= 16384; break; case AV_CODEC_ID_MVDV: maxpixels /= 1024; break; From 5e17ff811ae81b8ec743cb2030b877db77551e35 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2024 21:24:00 +0100 Subject: [PATCH 128/290] tools/target_dec_fuzzer: Adjust threshold for EACMV Fixes: Timeout Fixes: 382988735/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EACMV_fuzzer-5278721465974784 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 8f4eb0fe03aca552d375e2bce019a5da785f50d5) Signed-off-by: Michael Niedermayer --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 1f01819eb8..6e6b10e138 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -237,6 +237,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_DVB_SUBTITLE: av_dict_set_int(&opts, "compute_clut", -2, 0); break; case AV_CODEC_ID_DXA: maxpixels /= 32; break; case AV_CODEC_ID_DXV: maxpixels /= 32; break; + case AV_CODEC_ID_CMV: maxpixels /= 256; break; case AV_CODEC_ID_EXR: maxpixels /= 1024; break; case AV_CODEC_ID_FFV1: maxpixels /= 32; break; case AV_CODEC_ID_FFWAVESYNTH: maxsamples /= 16384; break; From 1cb5caeb5be03358aa5b4c83e0f8667e46fcf016 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2024 21:36:11 +0100 Subject: [PATCH 129/290] avformat/matroskadec: Check pre_ns for overflow Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long' Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 361d24e6d920e4f7e4e5fa1fd6fbb6922bff35f2) Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 0e150f9138..efa3e44c85 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4618,9 +4618,10 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t // The prebuffer ends in the last Cue. Estimate how much data was // prebuffered. pre_bytes = desc_end.end_offset - desc_end.start_offset; - pre_ns = desc_end.end_time_ns - desc_end.start_time_ns; - if (pre_ns <= 0) + if (desc_end.end_time_ns <= desc_end.start_time_ns || + desc_end.end_time_ns - (uint64_t)desc_end.start_time_ns > INT64_MAX) return -1; + pre_ns = desc_end.end_time_ns - desc_end.start_time_ns; pre_sec = pre_ns / nano_seconds_per_second; prebuffer_bytes += pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / pre_sec); From 8ae93fdc426a6fc4beb19dc728daae89477fb53a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2024 22:37:07 +0100 Subject: [PATCH 130/290] avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int' Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 93270930798da368d5b1954a73ef7ff9dfa48f73) Signed-off-by: Michael Niedermayer --- libavcodec/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/utils.c b/libavcodec/utils.c index d68e672e0a..a63ca71a44 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -723,7 +723,7 @@ static int get_audio_frame_duration(enum AVCodecID id, int sr, int ch, int ba, case AV_CODEC_ID_ADPCM_IMA_WAV: if (bps < 2 || bps > 5) return 0; - tmp = blocks * (1LL + (ba - 4 * ch) / (bps * ch) * 8); + tmp = blocks * (1LL + (ba - 4 * ch) / (bps * ch) * 8LL); break; case AV_CODEC_ID_ADPCM_IMA_DK3: tmp = blocks * (((ba - 16LL) * 2 / 3 * 4) / ch); From a5ce14389510f6bcd5eaa655668df8ac680a79cd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2024 23:26:02 +0100 Subject: [PATCH 131/290] avformat/mov: dereference pointer after null check Fixes: null pointer dereference Fixes: 383397479/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4776829338058752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 954d55c2a4244b366ae97d09546ba8ce2534892b) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index fee1a9ad32..a4c5a2a93c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10030,10 +10030,11 @@ static int mov_parse_tiles(AVFormatContext *s) for (k = 0; k < mov->nb_heif_item; k++) { HEIFItem *item = mov->heif_item[k]; - AVStream *st = item->st; + AVStream *st; if (!item || item->item_id != tile_id) continue; + st = item->st; if (!st) { av_log(s, AV_LOG_WARNING, "HEIF item id %d from grid id %d doesn't " "reference a stream\n", From a82139d0e690a334ce2829b75590d10b9ecb6267 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 24 Dec 2024 21:30:32 +0100 Subject: [PATCH 132/290] avcodec/aac/aacdec: Free channel layout Fixes: 371445194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5981081124274176 Fixes: memleak Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne Signed-off-by: Michael Niedermayer (cherry picked from commit ae81beb3512855eae1eab3ce9a87cb0d4399fc67) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 038251d266..e62bf0f952 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -1102,6 +1102,8 @@ static av_cold int decode_close(AVCodecContext *avctx) for (int i = 0; i < 2; i++) { OutputConfiguration *oc = &ac->oc[i]; + av_channel_layout_uninit(&ac->oc[i].ch_layout); + AACUSACConfig *usac = &oc->usac; for (int j = 0; j < usac->nb_elems; j++) { AACUsacElemConfig *ec = &usac->elems[j]; From cac9112bf35cd016407ab8c499be9896830d6262 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 25 Dec 2024 05:13:02 +0100 Subject: [PATCH 133/290] avformat/mlvdec: Check avio_read() Fixes: use-of-uninitialized-value Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross Signed-off-by: Michael Niedermayer (cherry picked from commit bb85423142103d694d97bad1967bd3dc55440e71) Signed-off-by: Michael Niedermayer --- libavformat/mlvdec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c index 1a6d38f37c..985365326e 100644 --- a/libavformat/mlvdec.c +++ b/libavformat/mlvdec.c @@ -82,13 +82,15 @@ static int check_file_header(AVIOContext *pb, uint64_t guid) static void read_string(AVFormatContext *avctx, AVIOContext *pb, const char *tag, unsigned size) { char * value = av_malloc(size + 1); + int ret; + if (!value) { avio_skip(pb, size); return; } - avio_read(pb, value, size); - if (!value[0]) { + ret = avio_read(pb, value, size); + if (ret != size || !value[0]) { av_free(value); return; } From 615f29e301fd08e377ed69104fe0806810fac39a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 18 Nov 2024 04:09:11 +0100 Subject: [PATCH 134/290] avformat/rpl: Fix check for negative values Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long') Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376 Found-by: ossfuzz Reported-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit eab65379bf89c55d8ec4bc6f00e04f15b37d3d85) Signed-off-by: Michael Niedermayer --- libavformat/rpl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rpl.c b/libavformat/rpl.c index e971d0588f..b30d769efb 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -102,7 +102,7 @@ static AVRational read_fps(const char* line, int* error) line++; for (; *line>='0' && *line<='9'; line++) { // Truncate any numerator too large to fit into an int64_t - if (num > (INT64_MAX - 9) / 10 || den > INT64_MAX / 10) + if (num > (INT64_MAX - 9) / 10ULL || den > INT64_MAX / 10ULL) break; num = 10 * num + (*line - '0'); den *= 10; From 1a254c5354fb58c694603fdedd60923cf368c46f Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Fri, 3 Jan 2025 01:54:38 +0100 Subject: [PATCH 135/290] aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter This reduces the amount the horizontal filters read beyond the filter width to a consistent 1 pixel. The data is not used so this is usually not noticeable. It becomes a problem when the application allocates frame buffers only for the aligned picture size and the end of it is at a page boundary. This happens for picture sizes which are a multiple of the page size like 1280x640. The frame buffer allocation is based on its most likely done via mmap + MAP_ANONYMOUS so start and end of the buffer are page aligned and the previous and next page are not necessarily mapped. Under these conditions like seen by Firefox a read beyond the end of the buffer results in a segfault. After the over-read is reduced to a single pixel it's reasonable to use VP9's emulated edge motion compensation for this. Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185 Signed-off-by: Janne Grunau Signed-off-by: Ronald S. Bultje (cherry picked from commit 430c38f698a65d597e863330810b05e083682be6) --- libavcodec/aarch64/vp9mc_neon.S | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libavcodec/aarch64/vp9mc_neon.S b/libavcodec/aarch64/vp9mc_neon.S index abf2bae9db..38f44ca56d 100644 --- a/libavcodec/aarch64/vp9mc_neon.S +++ b/libavcodec/aarch64/vp9mc_neon.S @@ -230,6 +230,9 @@ function \type\()_8tap_\size\()h_\idx1\idx2 // reduced dst stride .if \size >= 16 sub x1, x1, x5 +.elseif \size == 4 + add x12, x2, #8 + add x13, x7, #8 .endif // size >= 16 loads two qwords and increments x2, // for size 4/8 it's enough with one qword and no @@ -248,9 +251,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2 .if \size >= 16 ld1 {v4.8b, v5.8b, v6.8b}, [x2], #24 ld1 {v16.8b, v17.8b, v18.8b}, [x7], #24 -.else +.elseif \size == 8 ld1 {v4.8b, v5.8b}, [x2] ld1 {v16.8b, v17.8b}, [x7] +.else // \size == 4 + ld1 {v4.8b}, [x2] + ld1 {v16.8b}, [x7] + ld1 {v5.s}[0], [x12], x3 + ld1 {v17.s}[0], [x13], x3 .endif uxtl v4.8h, v4.8b uxtl v5.8h, v5.8b From 535a8262ccf6cfd74388ee78b7ab5389f199e213 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Fri, 3 Jan 2025 01:54:39 +0100 Subject: [PATCH 136/290] arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter This reduces the amount the horizontal filters read beyond the filter width to a consistent 1 pixel. The data is not used so this is usually not noticeable. It becomes a problem when the application allocates frame buffers only for the aligned picture size and the end of it is at a page boundary. This happens for picture sizes which are a multiple of the page size like 1280x640. The frame buffer allocation is based on its most likely done via mmap + MAP_ANONYMOUS so start and end of the buffer are page aligned and the previous and next page are not necessarily mapped. This mirrors the aarch64 change. Signed-off-by: Janne Grunau Signed-off-by: Ronald S. Bultje (cherry picked from commit f3662562156c9b908588b1e58e4203fd09217cb6) --- libavcodec/arm/vp9mc_neon.S | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libavcodec/arm/vp9mc_neon.S b/libavcodec/arm/vp9mc_neon.S index bd8cda7c30..2ec729bb31 100644 --- a/libavcodec/arm/vp9mc_neon.S +++ b/libavcodec/arm/vp9mc_neon.S @@ -279,11 +279,13 @@ function \type\()_8tap_\size\()h_\idx1\idx2 sub r1, r1, r5 .endif @ size >= 16 loads two qwords and increments r2, - @ for size 4/8 it's enough with one qword and no - @ postincrement + @ size 4 loads 1 d word, increments r2 and loads 1 32-bit lane + @ for size 8 it's enough with one qword and no postincrement .if \size >= 16 sub r3, r3, r5 sub r3, r3, #8 +.elseif \size == 4 + sub r3, r3, #8 .endif @ Load the filter vector vld1.16 {q0}, [r12,:128] @@ -295,9 +297,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2 .if \size >= 16 vld1.8 {d18, d19, d20}, [r2]! vld1.8 {d24, d25, d26}, [r7]! -.else +.elseif \size == 8 vld1.8 {q9}, [r2] vld1.8 {q12}, [r7] +.else @ size == 4 + vld1.8 {d18}, [r2]! + vld1.8 {d24}, [r7]! + vld1.32 {d19[0]}, [r2] + vld1.32 {d25[0]}, [r7] .endif vmovl.u8 q8, d18 vmovl.u8 q9, d19 From 7d1532f7529796540910e034eceb96741ed2513c Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Fri, 3 Jan 2025 01:54:40 +0100 Subject: [PATCH 137/290] vp9: recon: Use emulated edge to prevent buffer overflows The arm/aarch64 horizontal filter reads one additional pixel beyond what the filter uses. This can become an issue if the application does not allocate larger buffers than what's required for the pixel data. If the motion vector points to the bottom right edge of the picture this becomes a read buffer overflow. This triggers segfaults in Firefox for video resolutions which result in a page aligned picture size like 1280x640. Prevent this by using emulated edge in this case. Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185 Signed-off-by: Janne Grunau Signed-off-by: Ronald S. Bultje (cherry picked from commit 060464105bdca82b8cfb91c7a6fb56df4c7cd9d0) --- libavcodec/vp9recon.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/vp9recon.c b/libavcodec/vp9recon.c index ef08ed17c8..ccc49d7716 100644 --- a/libavcodec/vp9recon.c +++ b/libavcodec/vp9recon.c @@ -319,7 +319,11 @@ static av_always_inline void mc_luma_unscaled(VP9TileData *td, const vp9_mc_func // The arm/aarch64 _hv filters read one more row than what actually is // needed, so switch to emulated edge one pixel sooner vertically // (!!my * 5) than horizontally (!!mx * 4). + // The arm/aarch64 _h filters read one more pixel than what actually is + // needed, so switch to emulated edge if that would read beyond the bottom + // right block. if (x < !!mx * 3 || y < !!my * 3 || + ((ARCH_AARCH64 || ARCH_ARM) && (x + !!mx * 5 > w - bw) && (y + !!my * 5 + 1 > h - bh)) || x + !!mx * 4 > w - bw || y + !!my * 5 > h - bh) { s->vdsp.emulated_edge_mc(td->edge_emu_buffer, ref - !!my * 3 * ref_stride - !!mx * 3 * bytesperpixel, @@ -358,7 +362,11 @@ static av_always_inline void mc_chroma_unscaled(VP9TileData *td, const vp9_mc_fu // The arm/aarch64 _hv filters read one more row than what actually is // needed, so switch to emulated edge one pixel sooner vertically // (!!my * 5) than horizontally (!!mx * 4). + // The arm/aarch64 _h filters read one more pixel than what actually is + // needed, so switch to emulated edge if that would read beyond the bottom + // right block. if (x < !!mx * 3 || y < !!my * 3 || + ((ARCH_AARCH64 || ARCH_ARM) && (x + !!mx * 5 > w - bw) && (y + !!my * 5 + 1 > h - bh)) || x + !!mx * 4 > w - bw || y + !!my * 5 > h - bh) { s->vdsp.emulated_edge_mc(td->edge_emu_buffer, ref_u - !!my * 3 * src_stride_u - !!mx * 3 * bytesperpixel, From 0151f1daab9224322db7a808191365d65872ed1c Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Tue, 10 Dec 2024 12:18:56 +0800 Subject: [PATCH 138/290] aarch64/vvc: Fix clip in alf Fix test failure: ./tests/checkasm/checkasm --test=vvc_alf 3607569773 (cherry picked from commit 40feba5f77e1c1dc185a9b5e6f2c7e33d211b993) --- libavcodec/aarch64/vvc/alf.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/aarch64/vvc/alf.S b/libavcodec/aarch64/vvc/alf.S index c624093640..8801b3afb6 100644 --- a/libavcodec/aarch64/vvc/alf.S +++ b/libavcodec/aarch64/vvc/alf.S @@ -148,7 +148,7 @@ sqxtun v20.8b, v20.8h str d20, [dst] .else - smin v20.8h, v20.8h, v25.8h + umin v20.8h, v20.8h, v25.8h str q20, [dst] .endif ret @@ -249,7 +249,7 @@ sqxtun v20.8b, v20.8h str s20, [dst] .else - smin v20.4h, v20.4h, v25.4h + umin v20.4h, v20.4h, v25.4h str d20, [dst] .endif ret From 89bc70ddd81b156c1442a85738a4c7fe69f771c1 Mon Sep 17 00:00:00 2001 From: Bin Peng Date: Mon, 16 Dec 2024 10:31:23 +0800 Subject: [PATCH 139/290] lavc/aarch64: Fix ff_pred8x8_plane_neon_10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix test failure on aarch64: ./tests/checkasm/checkasm --test=h264pred 479612 The mismatch between neon and C functions can also be reproduced using the following bitstream and command line. wget https://streams.videolan.org/ffmpeg/incoming/intra8x8pred_10bit.264 ./ffmpeg -cpuflags 0 -threads 1 -i intra8x8pred_10bit.264 -f framemd5 -y md5_ref ./ffmpeg -threads 1 -i intra8x8pred_10bit.264 -f framemd5 -y md5_neon Signed-off-by: Bin Peng Signed-off-by: Martin Storsjö (cherry picked from commit decc9e643cc3ac5537f42b465e2637fbefbf41cc) --- libavcodec/aarch64/h264pred_neon.S | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavcodec/aarch64/h264pred_neon.S b/libavcodec/aarch64/h264pred_neon.S index ea37689f34..168f8191ad 100644 --- a/libavcodec/aarch64/h264pred_neon.S +++ b/libavcodec/aarch64/h264pred_neon.S @@ -595,12 +595,11 @@ function ff_pred8x8_plane_neon_10, export=1 ssubl v2.4s, v2.4h, v3.4h ext v0.16b, v0.16b, v0.16b, #14 mov v0.h[0], wzr - mul v0.8h, v0.8h, v5.h[0] dup v1.4s, v2.s[0] dup v2.4s, v2.s[0] dup v3.8h, v5.h[1] - saddw v1.4s, v1.4s, v0.4h - saddw2 v2.4s, v2.4s, v0.8h + smlal v1.4s, v0.4h, v5.h[0] + smlal2 v2.4s, v0.8h, v5.h[0] mov w3, #8 mvni v4.8h, #0xFC, lsl #8 // 1023 for clipping 1: From 54331d4305909afdb8957c8567626aeb139c4fb2 Mon Sep 17 00:00:00 2001 From: Bin Peng Date: Fri, 13 Dec 2024 22:19:47 +0800 Subject: [PATCH 140/290] lavc/aarch64: Fix ff_pred16x16_plane_neon_10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix test failure on aarch64: ./tests/checkasm/checkasm --test=h264pred 367840 Signed-off-by: Peng Bin Signed-off-by: Martin Storsjö (cherry picked from commit 72a3656e8468a394373b6397aacc906d7f7794c2) --- libavcodec/aarch64/h264pred_neon.S | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/libavcodec/aarch64/h264pred_neon.S b/libavcodec/aarch64/h264pred_neon.S index 168f8191ad..d0999938ef 100644 --- a/libavcodec/aarch64/h264pred_neon.S +++ b/libavcodec/aarch64/h264pred_neon.S @@ -502,28 +502,27 @@ function ff_pred16x16_plane_neon_10, export=1 add v7.4h, v7.4h, v0.4h shl v2.4h, v7.4h, #4 ssubl v2.4s, v2.4h, v3.4h - shl v3.4h, v4.4h, #4 ext v0.16b, v0.16b, v0.16b, #14 - ssubl v6.4s, v5.4h, v3.4h + sxtl v6.4s, v5.4h // c mov v0.h[0], wzr mul v0.8h, v0.8h, v4.h[0] dup v16.4s, v2.s[0] dup v17.4s, v2.s[0] - dup v2.8h, v4.h[0] - dup v3.4s, v6.s[0] - shl v2.8h, v2.8h, #3 + dup v2.8h, v4.h[0] // b + dup v3.4s, v6.s[0] // c + sshll v2.4s, v2.4h, #3 // b * 8 saddw v16.4s, v16.4s, v0.4h saddw2 v17.4s, v17.4s, v0.8h - saddw v3.4s, v3.4s, v2.4h + sub v3.4s, v3.4s, v2.4s mov w3, #16 mvni v4.8h, #0xFC, lsl #8 // 1023 for clipping 1: sqshrun v0.4h, v16.4s, #5 sqshrun2 v0.8h, v17.4s, #5 - saddw v16.4s, v16.4s, v2.4h - saddw v17.4s, v17.4s, v2.4h + add v16.4s, v16.4s, v2.4s + add v17.4s, v17.4s, v2.4s sqshrun v1.4h, v16.4s, #5 sqshrun2 v1.8h, v17.4s, #5 add v16.4s, v16.4s, v3.4s From 15684239ca9c29d74ac6b781209fb4938c94b829 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:49 -0500 Subject: [PATCH 141/290] avformat/dvdvideodec: remove unused headers Signed-off-by: Marth64 (cherry picked from commit 3ad96243d756b2b63431410112956e36e4044e4a) --- libavformat/dvdvideodec.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 6bd1dbc17f..4e33d1aba6 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -44,8 +44,6 @@ #include "libavutil/mem.h" #include "libavutil/opt.h" #include "libavutil/samplefmt.h" -#include "libavutil/time.h" -#include "libavutil/timestamp.h" #include "avformat.h" #include "avio_internal.h" From aebce8b1b84a4bc7b98f2f7f520aaf6db8dddfd8 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:50 -0500 Subject: [PATCH 142/290] avformat/dvdvideodec: fix menu PGC number off-by-one in state Signed-off-by: Marth64 (cherry picked from commit 94346edbbfeff7a54ab04631ef4ba2781460e17c) --- libavformat/dvdvideodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 4e33d1aba6..da41a9d329 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -344,7 +344,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state) } /* make sure the PGC is valid */ - state->pgcn = c->opt_pgc - 1; + state->pgcn = c->opt_pgc; state->pgc = pgci_ut->lu[c->opt_menu_lu - 1].pgcit->pgci_srp[c->opt_pgc - 1].pgc; if (!state->pgc || !state->pgc->program_map || !state->pgc->cell_playback) { av_log(s, AV_LOG_ERROR, "Invalid PGC structure for menu [LU %d, PGC %d]\n", From 5d37c7cf081fb766e52d894ac7d9c6964a3c2347 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:51 -0500 Subject: [PATCH 143/290] avformat/dvdvideodec: measure duration of the current menu VOBU in state This will be a pre-requisite to calculating chapter markers for menus. Signed-off-by: Marth64 (cherry picked from commit 39c662f54125f55b6f0014ac61d92cb2618f5db0) --- libavformat/dvdvideodec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index da41a9d329..18c356c132 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -474,6 +474,7 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState } state->vobu_e_ptm = pci.pci_gi.vobu_e_ptm; + state->vobu_duration = pci.pci_gi.vobu_e_ptm - pci.pci_gi.vobu_s_ptm; av_log(s, AV_LOG_DEBUG, "NAV packet: sector=%d " "vobu_s_ptm=%d vobu_e_ptm=%d ts_offset=%" PRId64 "\n", From a5c48cc7a1b20fd2865b5d6e34e66b8b56da702c Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:52 -0500 Subject: [PATCH 144/290] avformat/dvdvideodec: remove "auto" value for -pg option, default to 1 The default "auto" mode is effectively useless; the reasonable default use case is to use the first PG (segment) of the selected PGC for both menus and standard titles. Just default the value to 1, since the option is irrelevant unless -pgc is also set. Note that this should not break users using this advanced option. The "auto" mode errored and asked for a PG number regardless for non-menus, and for menus the mode simply defaulted to 1. Signed-off-by: Marth64 (cherry picked from commit e1ace1d3146744439a8c7768813c8008de1e9ec6) --- doc/demuxers.texi | 3 +-- libavformat/dvdvideodec.c | 31 +++++++++---------------------- 2 files changed, 10 insertions(+), 24 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index 04293c4813..74b68778bd 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -397,8 +397,7 @@ Default is 0, automatically resolve from value of @option{title}. The entry PG to start playback, in conjunction with @option{pgc}. Alternative to setting @option{title}. Chapter markers are not supported at this time. -Default is 0, automatically resolve from value of @option{title}, or -start from the beginning (PG 1) of the menu. +Default is 1, the first PG of the PGC. @item preindex @var{bool} Enable this to have accurate chapter (PTT) markers and duration measurement, diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 18c356c132..bed7c38ff6 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -537,7 +537,7 @@ static int dvdvideo_play_open(AVFormatContext *s, DVDVideoPlaybackState *state) goto end_dvdnav_error; } - if (c->opt_pgc > 0 && c->opt_pg > 0) { + if (c->opt_pgc > 0) { if (dvdnav_program_play(state->dvdnav, c->opt_title, c->opt_pgc, c->opt_pg) != DVDNAV_STATUS_OK) { av_log(s, AV_LOG_ERROR, "Unable to start playback at title %d, PGC %d, PG %d\n", c->opt_title, c->opt_pgc, c->opt_pg); @@ -1541,13 +1541,6 @@ static int dvdvideo_read_header(AVFormatContext *s) c->opt_menu_lu = 1; } - if (!c->opt_pg) { - av_log(s, AV_LOG_INFO, "Defaulting to menu PG #1. " - "This is not always desirable, validation suggested.\n"); - - c->opt_pg = 1; - } - if ((ret = dvdvideo_ifo_open(s)) < 0 || (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 || (ret = dvdvideo_subdemux_open(s)) < 0 || @@ -1558,7 +1551,13 @@ static int dvdvideo_read_header(AVFormatContext *s) return 0; } - if (c->opt_chapter_end != 0 && c->opt_chapter_start > c->opt_chapter_end) { + if (c->opt_pgc && (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex)) { + av_log(s, AV_LOG_ERROR, "PGC extraction not compatible with chapter or preindex options\n"); + + return AVERROR(EINVAL); + } + + if (!c->opt_pgc && (c->opt_chapter_end != 0 && c->opt_chapter_start > c->opt_chapter_end)) { av_log(s, AV_LOG_ERROR, "Chapter (PTT) range [%d, %d] is invalid\n", c->opt_chapter_start, c->opt_chapter_end); @@ -1572,18 +1571,6 @@ static int dvdvideo_read_header(AVFormatContext *s) c->opt_title = 1; } - if (c->opt_pgc) { - if (c->opt_pg == 0) { - av_log(s, AV_LOG_ERROR, "Invalid coordinates. If -pgc is set, -pg must be set too.\n"); - - return AVERROR(EINVAL); - } else if (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex) { - av_log(s, AV_LOG_ERROR, "-pgc is not compatible with the -preindex or " - "-chapter_start/-chapter_end options\n"); - return AVERROR(EINVAL); - } - } - if ((ret = dvdvideo_ifo_open(s)) < 0) return ret; @@ -1761,7 +1748,7 @@ static const AVOption dvdvideo_options[] = { {"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM }, {"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, {"menu_vts", "menu VTS (0=VMG main menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, - {"pg", "entry PG number (0=auto)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=0 }, 0, 255, AV_OPT_FLAG_DECODING_PARAM }, + {"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM }, {"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM }, {"preindex", "enable for accurate chapter markers, slow (2-pass read)", OFFSET(opt_preindex), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM }, {"region", "playback region number (0=free)", OFFSET(opt_region), AV_OPT_TYPE_INT, { .i64=0 }, 0, 8, AV_OPT_FLAG_DECODING_PARAM }, From b108d17c5659f5cd78a0de61da9306c225f4bc50 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:53 -0500 Subject: [PATCH 145/290] avformat/dvdvideodec: move memcpy below missed NAV packet warning Readability improvement; the warning can be bundled beneath the preceding validations rather than awkwardly between the memcpy and return. Signed-off-by: Marth64 (cherry picked from commit 6bbaa7db49de86653bd23544e5bb55315265f828) --- libavformat/dvdvideodec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index bed7c38ff6..9246ac0863 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -804,13 +804,13 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState return AVERROR_INPUT_CHANGED; } - memcpy(buf, &nav_buf, nav_len); - if (state->pgn != cur_pgn) av_log(s, AV_LOG_WARNING, "Unexpected PG change (expected=%d actual=%d); " "this could be due to a missed NAV packet\n", state->pgn, cur_pgn); + memcpy(buf, &nav_buf, nav_len); + (*p_nav_event) = nav_event; state->is_seeking = 0; From 6f4ae5f183890928de1cfc230dc080bb93eaa5be Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:54 -0500 Subject: [PATCH 146/290] avformat/dvdvideodec: standardize the NAV packet event signal This consolidates the FFERROR_REDO handling of NAV packets to dvdvideo_subdemux_read_data(), is a pre-requisite to calculating chapter markers for menus, and a pre-requisite to fixing the frame desync issue when the subdemuxer is flushed. Signed-off-by: Marth64 (cherry picked from commit b38ca20bf2544c503e30d0f68453483ed24430c3) --- libavformat/dvdvideodec.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 9246ac0863..066edaaa27 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -390,7 +390,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state) } static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state, - uint8_t *buf, int buf_size, + uint8_t *buf, int buf_size, int *p_is_nav_packet, void (*flush_cb)(AVFormatContext *s)) { int64_t blocks_read = 0; @@ -398,6 +398,8 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState pci_t pci = (pci_t) {0}; dsi_t dsi = (dsi_t) {0}; + (*p_is_nav_packet) = 0; + if (buf_size != DVDVIDEO_BLOCK_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n", DVDVIDEO_BLOCK_SIZE, buf_size); @@ -481,7 +483,9 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState dsi.dsi_gi.nv_pck_lbn, pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ts_offset); - return FFERROR_REDO; + (*p_is_nav_packet) = 1; + + return 0; } /* we are in the middle of a VOBU, so pass on the PS packet */ @@ -611,8 +615,7 @@ end_dvdnav_error: } static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state, - uint8_t *buf, int buf_size, - int *p_nav_event, + uint8_t *buf, int buf_size, int *p_is_nav_packet, void (*flush_cb)(AVFormatContext *s)) { DVDVideoDemuxContext *c = s->priv_data; @@ -627,6 +630,8 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState pci_t *e_pci; dsi_t *e_dsi; + (*p_is_nav_packet) = 0; + if (buf_size != DVDVIDEO_BLOCK_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n", DVDVIDEO_BLOCK_SIZE, buf_size); @@ -780,9 +785,9 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState state->vobu_e_ptm = e_pci->pci_gi.vobu_e_ptm; - (*p_nav_event) = nav_event; + (*p_is_nav_packet) = 1; - return nav_len; + return 0; case DVDNAV_BLOCK_OK: if (!state->in_ps) { if (state->in_pgc) @@ -811,8 +816,6 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState memcpy(buf, &nav_buf, nav_len); - (*p_nav_event) = nav_event; - state->is_seeking = 0; return nav_len; @@ -1442,18 +1445,18 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size) AVFormatContext *s = opaque; DVDVideoDemuxContext *c = s->priv_data; - int ret = 0; - int nav_event; + int ret; + int is_nav_packet; if (c->play_end) return AVERROR_EOF; if (c->opt_menu) - ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, + ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet, dvdvideo_subdemux_flush); else - ret = dvdvideo_play_next_ps_block(opaque, &c->play_state, buf, buf_size, - &nav_event, dvdvideo_subdemux_flush); + ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet, + dvdvideo_subdemux_flush); if (ret == AVERROR_EOF) { c->mpeg_pb.pub.eof_reached = 1; @@ -1462,7 +1465,7 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size) return AVERROR_EOF; } - if (ret >= 0 && nav_event == DVDNAV_NAV_PACKET) + if (ret == 0 && is_nav_packet) return FFERROR_REDO; return ret; From ece2a9a27522f73c7157d67c7cbd99f9c902d1ce Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:55 -0500 Subject: [PATCH 147/290] avformat/dvdvideodec: enable chapter calculation for menus Menus are generally segmented by cell, so use them as the marker delimiters. Requires preindex option to be enabled. Signed-off-by: Marth64 (cherry picked from commit c1e4b6c676c4e5e587c4762a7a8ca29184bc5f46) --- doc/demuxers.texi | 1 - libavformat/dvdvideodec.c | 53 ++++++++++++++++++++++++++------------- 2 files changed, 35 insertions(+), 19 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index 74b68778bd..a03e80732a 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -405,7 +405,6 @@ which requires a slow second pass read in order to index the chapter marker timestamps from NAV packets. This is non-ideal extra work for real optical drives. It is recommended and faster to use this option with a backup of the DVD structure stored on a hard drive. Not compatible with @option{pgc} and @option{pg}. -Not applicable to menus. Default is 0, false. @item trim @var{bool} diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 066edaaa27..5df123ac44 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -909,19 +909,26 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s) { DVDVideoDemuxContext *c = s->priv_data; - int ret = 0, interrupt = 0; - int nb_chapters = 0, last_ptt = c->opt_chapter_start; + int ret, partn, last_partn; + int interrupt = 0, nb_chapters = 0; uint64_t cur_chapter_offset = 0, cur_chapter_duration = 0; DVDVideoPlaybackState state = {0}; uint8_t nav_buf[DVDVIDEO_BLOCK_SIZE]; - int nav_event; + int is_nav_packet; if (c->opt_chapter_start == c->opt_chapter_end) - return ret; + return 0; - if ((ret = dvdvideo_play_open(s, &state)) < 0) - return ret; + if (c->opt_menu) { + if ((ret = dvdvideo_menu_open(s, &state)) < 0) + return ret; + last_partn = state.celln; + } else { + if ((ret = dvdvideo_play_open(s, &state)) < 0) + return ret; + last_partn = c->opt_chapter_start; + } if (state.pgc->nr_of_programs == 1) goto end_close; @@ -930,15 +937,22 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s) "Indexing chapter markers, this will take a long time. Please wait...\n"); while (!(interrupt = ff_check_interrupt(&s->interrupt_callback))) { - ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, - &nav_event, NULL); + if (c->opt_menu) + ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet, + NULL); + else + ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet, + NULL); + if (ret < 0 && ret != AVERROR_EOF) goto end_close; - if (nav_event != DVDNAV_NAV_PACKET && ret != AVERROR_EOF) + if (!is_nav_packet && ret != AVERROR_EOF) continue; - if (state.ptt == last_ptt) { + partn = c->opt_menu ? state.celln : state.ptt; + + if (partn == last_partn) { cur_chapter_duration += state.vobu_duration; /* ensure we add the last chapter */ if (ret != AVERROR_EOF) @@ -957,7 +971,7 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s) cur_chapter_offset += cur_chapter_duration; cur_chapter_duration = state.vobu_duration; - last_ptt = state.ptt; + last_partn = partn; if (ret == AVERROR_EOF) break; @@ -977,7 +991,10 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s) ret = 0; end_close: - dvdvideo_play_close(s, &state); + if (c->opt_menu) + dvdvideo_menu_close(s, &state); + else + dvdvideo_play_close(s, &state); return ret; } @@ -1523,11 +1540,10 @@ static int dvdvideo_read_header(AVFormatContext *s) if (c->opt_menu) { if (c->opt_region || c->opt_title > 1 || - c->opt_preindex || c->opt_chapter_start > 1 || c->opt_chapter_end > 0) { av_log(s, AV_LOG_ERROR, "-menu is not compatible with the -region, -title, " - "-preindex, or -chapter_start/-chapter_end options\n"); + "or -chapter_start/-chapter_end options\n"); return AVERROR(EINVAL); } @@ -1544,10 +1560,11 @@ static int dvdvideo_read_header(AVFormatContext *s) c->opt_menu_lu = 1; } - if ((ret = dvdvideo_ifo_open(s)) < 0 || - (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 || - (ret = dvdvideo_subdemux_open(s)) < 0 || - (ret = dvdvideo_video_stream_setup(s)) < 0 || + if ((ret = dvdvideo_ifo_open(s)) < 0 || + (c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) || + (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 || + (ret = dvdvideo_subdemux_open(s)) < 0 || + (ret = dvdvideo_video_stream_setup(s)) < 0 || (ret = dvdvideo_audio_stream_add_all(s)) < 0) return ret; From 75c1943e30923b8d3c409dc65c56e9b423c50727 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:56 -0500 Subject: [PATCH 148/290] avformat/dvdvideodec: simplify dvdvideo_read_packet() The function has a few branches where it discards frames via FFERROR_REDO; consolidate is via a goto block to simplify the function and improve readability. Logging still maintains all the relevant details for the reason of the discard. Signed-off-by: Marth64 (cherry picked from commit 1964faa568c2b7bd9e172f7090a601625bb5dd9e) --- libavformat/dvdvideodec.c | 44 +++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 23 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 5df123ac44..ebcfdca9a5 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1615,8 +1615,9 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) DVDVideoDemuxContext *c = s->priv_data; int ret; - enum AVMediaType st_type; - int found_stream = 0; + int is_key = 0; + int st_mapped = 0; + AVStream *st_subdemux; if (c->play_end) return AVERROR_EOF; @@ -1629,32 +1630,27 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) if (!c->segment_started) c->segment_started = 1; - st_type = c->mpeg_ctx->streams[pkt->stream_index]->codecpar->codec_type; + st_subdemux = c->mpeg_ctx->streams[pkt->stream_index]; + is_key = pkt->flags & AV_PKT_FLAG_KEY; /* map the subdemuxer stream to the parent demuxer's stream (by startcode) */ for (int i = 0; i < s->nb_streams; i++) { - if (s->streams[i]->id == c->mpeg_ctx->streams[pkt->stream_index]->id) { + if (s->streams[i]->id == st_subdemux->id) { pkt->stream_index = s->streams[i]->index; - found_stream = 1; + st_mapped = 1; + break; } } - if (!found_stream) { - av_log(s, AV_LOG_DEBUG, "discarding frame with stream that was not in IFO headers " - "(stream id=%d)\n", c->mpeg_ctx->streams[pkt->stream_index]->id); - - return FFERROR_REDO; - } + if (!st_mapped) + goto discard; if (pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE) { if (!c->play_started) { /* try to start at the beginning of a GOP */ - if (st_type != AVMEDIA_TYPE_VIDEO || !(pkt->flags & AV_PKT_FLAG_KEY)) { - av_log(s, AV_LOG_VERBOSE, "Discarding packet which is not a video keyframe or " - "with unset PTS/DTS at start\n"); - return FFERROR_REDO; - } + if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key) + goto discard; c->first_pts = pkt->pts; c->play_started = 1; @@ -1663,13 +1659,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) pkt->pts += c->play_state.ts_offset - c->first_pts; pkt->dts += c->play_state.ts_offset - c->first_pts; - if (pkt->pts < 0) { - av_log(s, AV_LOG_VERBOSE, "Discarding packet with negative PTS (st=%d pts=%" PRId64 "), " - "this is OK at start of playback\n", - pkt->stream_index, pkt->pts); - - return FFERROR_REDO; - } + if (pkt->pts < 0) + goto discard; } else { av_log(s, AV_LOG_WARNING, "Unset PTS or DTS @ st=%d pts=%" PRId64 " dts=%" PRId64 "\n", pkt->stream_index, pkt->pts, pkt->dts); @@ -1681,6 +1672,13 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) c->play_state.ts_offset, c->first_pts); return c->play_end ? AVERROR_EOF : 0; + +discard: + av_log(s, st_mapped ? AV_LOG_VERBOSE : AV_LOG_DEBUG, + "Discarding frame @ st=%d pts=%" PRId64 " dts=%" PRId64 " is_key=%d st_mapped=%d\n", + st_mapped ? pkt->stream_index : -1, pkt->pts, pkt->dts, is_key, st_mapped); + + return FFERROR_REDO; } static int dvdvideo_close(AVFormatContext *s) From e46e1c3368a97dcf87cd93d386928ddff7b75001 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:57 -0500 Subject: [PATCH 149/290] avformat/dvdvideodec: reset the subdemuxer on discontinuity instead of flushing DVDs naturally consist of segmented MPEG-PS blobs within a VOB (i.e. VOBs are not linear). NAV packs set the segment boundaries. When switching between segments, discontinuities occur and thus the subdemuxer needs to be reset. The current approach to manage this is by invoking ff_read_frame_flush() on the subdemuxer context, via a callback function which is invoked during the menu or dvdnav block functions. The same subdemuxer context is used throughout the demux, with a stretched PTS wrap bits value (64) + disabled overflow correction, and then flushed on each segment. Eventually, a play_end context variable is set to declare EOF. However, this approach causes frame drops. The block read flushes the demuxer before the frame read is complete, causing frames to drop on discontinuity. The play_end signal likewise ends playback before the frame read is complete, causing frames to drop at end of the title. To compound the issue, the PTS wrap bits value of 64 is wrong; the VOBU limit is actually 32 and the overflow correction should work. Instead, EOF the MPEG-PS subdemuxer organically when each VOB segment ends, and re-open it if needed with the offset after the full frame read is complete. In doing so, correct the PTS wrap behavior to 32 bits and remove the play_end/segment_started signals and callback pattern. Note that the timestamps as reported by the NAV packets are known as "PTMs", so the fields storing the time prior to adjustment are renamed accordingly. This makes it more clear when we are offsetting the NAV packet reported timestamps versus what we present as a demuxer. Signed-off-by: Marth64 (cherry picked from commit a1ae66c827370b7caa90f10068bdd913f4cf2f18) --- libavformat/dvdvideodec.c | 139 ++++++++++++++++++++------------------ 1 file changed, 75 insertions(+), 64 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index ebcfdca9a5..726c45601f 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -56,7 +56,7 @@ #define DVDVIDEO_MAX_PS_SEARCH_BLOCKS 128 #define DVDVIDEO_BLOCK_SIZE 2048 #define DVDVIDEO_TIME_BASE_Q (AVRational) { 1, 90000 } -#define DVDVIDEO_PTS_WRAP_BITS 64 /* VOBUs use 32 (PES allows 33) */ +#define DVDVIDEO_PTS_WRAP_BITS 32 /* VOBUs use 32 (PES allows 33) */ #define DVDVIDEO_LIBDVDX_LOG_BUFFER_SIZE 1024 #define PCI_START_BYTE 45 /* complement dvdread's DSI_START_BYTE */ @@ -115,8 +115,9 @@ typedef struct DVDVideoPlaybackState { int pgc_nb_pg_est; /* number of PGs as reported by IFOs */ int pgcn; /* ID of the PGC we are playing */ int pgn; /* ID of the PG we are in now */ + int ptm_discont; /* signal that a PTM discontinuity occurred */ + int64_t ptm_offset; /* PTM discontinuity offset (as NAV value) */ int ptt; /* ID of the chapter we are in now */ - int64_t ts_offset; /* PTS discontinuity offset (ex. VOB change) */ uint32_t vobu_duration; /* duration of the current VOBU */ uint32_t vobu_e_ptm; /* end PTM of the current VOBU */ int vtsn; /* ID of the active VTS (video title set) */ @@ -163,11 +164,11 @@ typedef struct DVDVideoDemuxContext { /* playback control */ int64_t first_pts; /* the PTS of the first video keyframe */ - int play_end; /* signal EOF to the parent demuxer */ - DVDVideoPlaybackState play_state; /* the active playback state */ int play_started; /* signal that playback has started */ + DVDVideoPlaybackState play_state; /* the active playback state */ + int64_t pts_offset; /* PTS discontinuity offset (ex. VOB change) */ int seek_warned; /* signal that we warned about seeking limits */ - int segment_started; /* signal that subdemuxer is on a segment */ + int subdemux_reset; /* signal that subdemuxer should be reset */ } DVDVideoDemuxContext; static void dvdvideo_libdvdread_log(void *opaque, dvd_logger_level_t level, @@ -390,8 +391,7 @@ static int dvdvideo_menu_open(AVFormatContext *s, DVDVideoPlaybackState *state) } static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state, - uint8_t *buf, int buf_size, int *p_is_nav_packet, - void (*flush_cb)(AVFormatContext *s)) + uint8_t *buf, int buf_size, int *p_is_nav_packet) { int64_t blocks_read = 0; uint8_t read_buf[DVDVIDEO_BLOCK_SIZE] = {0}; @@ -399,6 +399,7 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState dsi_t dsi = (dsi_t) {0}; (*p_is_nav_packet) = 0; + state->ptm_discont = 0; if (buf_size != DVDVIDEO_BLOCK_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n", @@ -465,10 +466,8 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState if (state->in_pgc) { if (state->vobu_e_ptm != pci.pci_gi.vobu_s_ptm) { - if (flush_cb) - flush_cb(s); - - state->ts_offset += state->vobu_e_ptm - pci.pci_gi.vobu_s_ptm; + state->ptm_discont = 1; + state->ptm_offset += state->vobu_e_ptm - pci.pci_gi.vobu_s_ptm; } } else { state->in_pgc = 1; @@ -479,9 +478,10 @@ static int dvdvideo_menu_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState state->vobu_duration = pci.pci_gi.vobu_e_ptm - pci.pci_gi.vobu_s_ptm; av_log(s, AV_LOG_DEBUG, "NAV packet: sector=%d " - "vobu_s_ptm=%d vobu_e_ptm=%d ts_offset=%" PRId64 "\n", + "vobu_s_ptm=%d vobu_e_ptm=%d ptm_offset=%" PRId64 "\n", dsi.dsi_gi.nv_pck_lbn, - pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ts_offset); + pci.pci_gi.vobu_s_ptm, pci.pci_gi.vobu_e_ptm, state->ptm_offset); + (*p_is_nav_packet) = 1; @@ -615,8 +615,7 @@ end_dvdnav_error: } static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState *state, - uint8_t *buf, int buf_size, int *p_is_nav_packet, - void (*flush_cb)(AVFormatContext *s)) + uint8_t *buf, int buf_size, int *p_is_nav_packet) { DVDVideoDemuxContext *c = s->priv_data; @@ -631,6 +630,7 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState dsi_t *e_dsi; (*p_is_nav_packet) = 0; + state->ptm_discont = 0; if (buf_size != DVDVIDEO_BLOCK_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid buffer size (expected=%d actual=%d)\n", @@ -776,10 +776,8 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState state->in_ps = 1; } else { if (state->vobu_e_ptm != e_pci->pci_gi.vobu_s_ptm) { - if (flush_cb) - flush_cb(s); - - state->ts_offset += state->vobu_e_ptm - e_pci->pci_gi.vobu_s_ptm; + state->ptm_discont = 1; + state->ptm_offset += state->vobu_e_ptm - e_pci->pci_gi.vobu_s_ptm; } } @@ -938,11 +936,9 @@ static int dvdvideo_chapters_setup_preindex(AVFormatContext *s) while (!(interrupt = ff_check_interrupt(&s->interrupt_callback))) { if (c->opt_menu) - ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet, - NULL); + ret = dvdvideo_menu_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet); else - ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet, - NULL); + ret = dvdvideo_play_next_ps_block(s, &state, nav_buf, DVDVIDEO_BLOCK_SIZE, &is_nav_packet); if (ret < 0 && ret != AVERROR_EOF) goto end_close; @@ -1444,19 +1440,6 @@ static int dvdvideo_subp_stream_add_all(AVFormatContext *s) return 0; } -static void dvdvideo_subdemux_flush(AVFormatContext *s) -{ - DVDVideoDemuxContext *c = s->priv_data; - - if (!c->segment_started) - return; - - av_log(s, AV_LOG_DEBUG, "flushing sub-demuxer\n"); - avio_flush(&c->mpeg_pb.pub); - ff_read_frame_flush(c->mpeg_ctx); - c->segment_started = 0; -} - static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size) { AVFormatContext *s = opaque; @@ -1465,25 +1448,32 @@ static int dvdvideo_subdemux_read_data(void *opaque, uint8_t *buf, int buf_size) int ret; int is_nav_packet; - if (c->play_end) - return AVERROR_EOF; - if (c->opt_menu) - ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet, - dvdvideo_subdemux_flush); + ret = dvdvideo_menu_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet); else - ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet, - dvdvideo_subdemux_flush); + ret = dvdvideo_play_next_ps_block(s, &c->play_state, buf, buf_size, &is_nav_packet); - if (ret == AVERROR_EOF) { - c->mpeg_pb.pub.eof_reached = 1; - c->play_end = 1; + if (ret < 0) + goto subdemux_eof; - return AVERROR_EOF; + if (is_nav_packet) { + if (c->play_state.ptm_discont) { + c->subdemux_reset = 1; + + ret = AVERROR_EOF; + goto subdemux_eof; + } + + return FFERROR_REDO; } - if (ret == 0 && is_nav_packet) - return FFERROR_REDO; + return ret; + +subdemux_eof: + c->mpeg_pb.pub.eof_reached = 1; + c->mpeg_pb.pub.error = ret; + c->mpeg_pb.pub.read_packet = NULL; + c->mpeg_pb.pub.buf_end = c->mpeg_pb.pub.buf_ptr = c->mpeg_pb.pub.buffer; return ret; } @@ -1525,12 +1515,24 @@ static int dvdvideo_subdemux_open(AVFormatContext *s) c->mpeg_ctx->max_analyze_duration = 0; c->mpeg_ctx->interrupt_callback = s->interrupt_callback; c->mpeg_ctx->pb = &c->mpeg_pb.pub; - c->mpeg_ctx->correct_ts_overflow = 0; c->mpeg_ctx->io_open = NULL; return avformat_open_input(&c->mpeg_ctx, "", &ff_mpegps_demuxer.p, NULL); } +static int dvdvideo_subdemux_reset(AVFormatContext *s) +{ + int ret; + + av_log(s, AV_LOG_VERBOSE, "Resetting sub-demuxer\n"); + + dvdvideo_subdemux_close(s); + if ((ret = dvdvideo_subdemux_open(s)) < 0) + return ret; + + return 0; +} + static int dvdvideo_read_header(AVFormatContext *s) { DVDVideoDemuxContext *c = s->priv_data; @@ -1619,16 +1621,20 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) int st_mapped = 0; AVStream *st_subdemux; - if (c->play_end) - return AVERROR_EOF; - ret = av_read_frame(c->mpeg_ctx, pkt); + if (ret < 0) { + if (c->subdemux_reset && ret == AVERROR_EOF) { + c->subdemux_reset = 0; + c->pts_offset = c->play_state.ptm_offset; + + if ((ret = dvdvideo_subdemux_reset(s)) < 0) + return ret; + + return FFERROR_REDO; + } - if (ret < 0) return ret; - - if (!c->segment_started) - c->segment_started = 1; + } st_subdemux = c->mpeg_ctx->streams[pkt->stream_index]; is_key = pkt->flags & AV_PKT_FLAG_KEY; @@ -1656,8 +1662,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) c->play_started = 1; } - pkt->pts += c->play_state.ts_offset - c->first_pts; - pkt->dts += c->play_state.ts_offset - c->first_pts; + pkt->pts += c->pts_offset - c->first_pts; + pkt->dts += c->pts_offset - c->first_pts; if (pkt->pts < 0) goto discard; @@ -1667,11 +1673,11 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) } av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " " - "ts_offset=%" PRId64 " first_pts=%" PRId64 "\n", + "pts_offset=%" PRId64 " first_pts=%" PRId64 "\n", pkt->stream_index, pkt->pts, pkt->dts, - c->play_state.ts_offset, c->first_pts); + c->pts_offset, c->first_pts); - return c->play_end ? AVERROR_EOF : 0; + return 0; discard: av_log(s, st_mapped ? AV_LOG_VERBOSE : AV_LOG_DEBUG, @@ -1700,6 +1706,7 @@ static int dvdvideo_close(AVFormatContext *s) static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) { DVDVideoDemuxContext *c = s->priv_data; + int ret; int64_t new_nav_pts; pci_t* new_nav_pci; dsi_t* new_nav_dsi; @@ -1744,13 +1751,17 @@ static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t time c->play_state.in_ps = 0; c->play_state.is_seeking = 1; c->play_state.nav_pts = timestamp; - c->play_state.ts_offset = timestamp; + c->play_state.ptm_offset = timestamp; + c->play_state.ptm_discont = 0; c->play_state.vobu_e_ptm = new_nav_pci->pci_gi.vobu_s_ptm; c->first_pts = 0; c->play_started = 0; + c->pts_offset = timestamp; + c->subdemux_reset = 0; - dvdvideo_subdemux_flush(s); + if ((ret = dvdvideo_subdemux_reset(s)) < 0) + return ret; av_log(s, AV_LOG_DEBUG, "seeking: requested_nav_pts=%" PRId64 " new_nav_pts=%" PRId64 "\n", timestamp, new_nav_pts); From a61eb0c2c0d51567de5e8d3627bff9ba08020410 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:58 -0500 Subject: [PATCH 150/290] avformat/dvdvideodec: check the length of a NAV packet when reading titles Some discs present titles with bogus NAV packets. We apply this check for menus and for title MPEG blocks, but we should also apply it for NAV packets during title demuxing. Signed-off-by: Marth64 (cherry picked from commit afc152f564fbeca4d2ff62195e3f0b6244e28cb3) --- libavformat/dvdvideodec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 726c45601f..f7c7ba5a3b 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -740,6 +740,13 @@ static int dvdvideo_play_next_ps_block(AVFormatContext *s, DVDVideoPlaybackState return AVERROR_EOF; } + if (nav_len != DVDVIDEO_BLOCK_SIZE) { + av_log(s, AV_LOG_ERROR, "Invalid NAV packet size (expected=%d actual=%d)\n", + DVDVIDEO_BLOCK_SIZE, nav_len); + + return AVERROR_INVALIDDATA; + } + e_pci = dvdnav_get_current_nav_pci(state->dvdnav); e_dsi = dvdnav_get_current_nav_dsi(state->dvdnav); From 212546e9c61a02b92627a8945aaa893644b03acc Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:04:59 -0500 Subject: [PATCH 151/290] avformat/dvdvideodec: default menu_vts option to 1 and clarify description Menu 0 is the VIDEO_TS root menu, which does not appear to be used commonly for menu segments. Instead, default to the menu of VTS 1. Signed-off-by: Marth64 (cherry picked from commit 4a03e95ff4c3ed15d5420bd97c7868e0b62e1d0a) --- doc/demuxers.texi | 2 +- libavformat/dvdvideodec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index a03e80732a..95be82aefc 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -384,7 +384,7 @@ Default is 0, the first language unit. @item menu_vts @var{int} The VTS where the menu lives, or 0 if it is a VMG menu (root-level). -Default is 0, VMG menu. +Default is 1, menu of the first VTS. @item pgc @var{int} The entry PGC to start playback, in conjunction with @option{pg}. diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index f7c7ba5a3b..1da1865061 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1783,7 +1783,7 @@ static const AVOption dvdvideo_options[] = { {"chapter_start", "entry chapter (PTT) number", OFFSET(opt_chapter_start), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM }, {"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM }, {"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, - {"menu_vts", "menu VTS (0=VMG main menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, + {"menu_vts", "menu VTS (0=VMG root menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=1 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, {"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM }, {"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM }, {"preindex", "enable for accurate chapter markers, slow (2-pass read)", OFFSET(opt_preindex), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM }, From 340795adc9825230b77a4352e2eba6da3239541c Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:00 -0500 Subject: [PATCH 152/290] avformat/dvdvideodec: remove auto value for menu_lu option The "auto" mode serves no functional purpose except for logging a message and setting the value to 1. The documentation clearly explains what the option is for. Signed-off-by: Marth64 (cherry picked from commit 60434b483c54aa683a3249a158c8610d5db2fe4a) --- doc/demuxers.texi | 2 +- libavformat/dvdvideodec.c | 9 +-------- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index 95be82aefc..86a9158e59 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -380,7 +380,7 @@ Default is false. @item menu_lu @var{int} The menu language to demux. In DVD, menus are grouped by language. -Default is 0, the first language unit. +Default is 1, the first language unit. @item menu_vts @var{int} The VTS where the menu lives, or 0 if it is a VMG menu (root-level). diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 1da1865061..9983d34ec9 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1562,13 +1562,6 @@ static int dvdvideo_read_header(AVFormatContext *s) return AVERROR(EINVAL); } - if (!c->opt_menu_lu) { - av_log(s, AV_LOG_INFO, "Defaulting to menu language unit #1. " - "This is not always desirable, validation suggested.\n"); - - c->opt_menu_lu = 1; - } - if ((ret = dvdvideo_ifo_open(s)) < 0 || (c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) || (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 || @@ -1782,7 +1775,7 @@ static const AVOption dvdvideo_options[] = { {"chapter_end", "exit chapter (PTT) number (0=end)", OFFSET(opt_chapter_end), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, {"chapter_start", "entry chapter (PTT) number", OFFSET(opt_chapter_start), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM }, {"menu", "demux menu domain", OFFSET(opt_menu), AV_OPT_TYPE_BOOL, { .i64=0 }, 0, 1, AV_OPT_FLAG_DECODING_PARAM }, - {"menu_lu", "menu language unit (0=auto)", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=0 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, + {"menu_lu", "menu language unit", OFFSET(opt_menu_lu), AV_OPT_TYPE_INT, { .i64=1 }, 1, 99, AV_OPT_FLAG_DECODING_PARAM }, {"menu_vts", "menu VTS (0=VMG root menu)", OFFSET(opt_menu_vts), AV_OPT_TYPE_INT, { .i64=1 }, 0, 99, AV_OPT_FLAG_DECODING_PARAM }, {"pg", "entry PG number (when paired with PGC number)", OFFSET(opt_pg), AV_OPT_TYPE_INT, { .i64=1 }, 1, 255, AV_OPT_FLAG_DECODING_PARAM }, {"pgc", "entry PGC number (0=auto)", OFFSET(opt_pgc), AV_OPT_TYPE_INT, { .i64=0 }, 0, 999, AV_OPT_FLAG_DECODING_PARAM }, From 09e08d790efa49aba3ded60a1a70732bc590c475 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:01 -0500 Subject: [PATCH 153/290] avformat/dvdvideodec: open subdemuxer after initializing IFO headers It is wasteful to open the subdemuxer if an error occurs while initializing streams or reading IFO headers. Signed-off-by: Marth64 (cherry picked from commit a2c57e27d6bb7b849b4e84612bb99dc514f6bc96) --- libavformat/dvdvideodec.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 9983d34ec9..72565ee125 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1565,9 +1565,9 @@ static int dvdvideo_read_header(AVFormatContext *s) if ((ret = dvdvideo_ifo_open(s)) < 0 || (c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) || (ret = dvdvideo_menu_open(s, &c->play_state)) < 0 || - (ret = dvdvideo_subdemux_open(s)) < 0 || (ret = dvdvideo_video_stream_setup(s)) < 0 || - (ret = dvdvideo_audio_stream_add_all(s)) < 0) + (ret = dvdvideo_audio_stream_add_all(s)) < 0 || + (ret = dvdvideo_subdemux_open(s)) < 0) return ret; return 0; @@ -1599,16 +1599,14 @@ static int dvdvideo_read_header(AVFormatContext *s) if (!c->opt_pgc && c->opt_preindex && (ret = dvdvideo_chapters_setup_preindex(s)) < 0) return ret; - if ((ret = dvdvideo_play_open(s, &c->play_state)) < 0 || - (ret = dvdvideo_subdemux_open(s)) < 0 || - (ret = dvdvideo_video_stream_setup(s)) < 0 || - (ret = dvdvideo_audio_stream_add_all(s)) < 0 || - (ret = dvdvideo_subp_stream_add_all(s)) < 0) + if ((ret = dvdvideo_play_open(s, &c->play_state)) < 0 || + (!c->opt_pgc && !c->opt_preindex && (ret = dvdvideo_chapters_setup_simple(s)) < 0) || + (ret = dvdvideo_video_stream_setup(s)) < 0 || + (ret = dvdvideo_audio_stream_add_all(s)) < 0 || + (ret = dvdvideo_subp_stream_add_all(s)) < 0 || + (ret = dvdvideo_subdemux_open(s)) < 0) return ret; - if (!c->opt_pgc && !c->opt_preindex) - return dvdvideo_chapters_setup_simple(s); - return 0; } From 19740bcbf8c4e14c110698bedd4a6046c4f5adc7 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:02 -0500 Subject: [PATCH 154/290] avformat/dvdvideodec: remove unnecessary need_parsing argument The value is always AVSTREAM_PARSE_HEADERS. Signed-off-by: Marth64 (cherry picked from commit 3656379d9225778d9b76e4cfe6832ae6e594b8a2) --- libavformat/dvdvideodec.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 72565ee125..d64a678589 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1051,9 +1051,7 @@ static int dvdvideo_video_stream_analyze(AVFormatContext *s, video_attr_t video_ return 0; } -static int dvdvideo_video_stream_add(AVFormatContext *s, - DVDVideoVTSVideoStreamEntry *entry, - enum AVStreamParseType need_parsing) +static int dvdvideo_video_stream_add(AVFormatContext *s, DVDVideoVTSVideoStreamEntry *entry) { AVStream *st; FFStream *sti; @@ -1077,7 +1075,7 @@ static int dvdvideo_video_stream_add(AVFormatContext *s, sti = ffstream(st); sti->request_probe = 0; - sti->need_parsing = need_parsing; + sti->need_parsing = AVSTREAM_PARSE_HEADERS; sti->display_aspect_ratio = entry->dar; avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS, @@ -1101,7 +1099,7 @@ static int dvdvideo_video_stream_setup(AVFormatContext *s) video_attr = c->vts_ifo->vtsi_mat->vts_video_attr; if ((ret = dvdvideo_video_stream_analyze(s, video_attr, &entry)) < 0 || - (ret = dvdvideo_video_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0) { + (ret = dvdvideo_video_stream_add(s, &entry)) < 0) { av_log(s, AV_LOG_ERROR, "Unable to add video stream\n"); return ret; @@ -1213,8 +1211,7 @@ static int dvdvideo_audio_stream_analyze(AVFormatContext *s, audio_attr_t audio_ return 0; } -static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamEntry *entry, - enum AVStreamParseType need_parsing) +static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamEntry *entry) { AVStream *st; FFStream *sti; @@ -1239,7 +1236,7 @@ static int dvdvideo_audio_stream_add(AVFormatContext *s, DVDVideoPGCAudioStreamE sti = ffstream(st); sti->request_probe = 0; - sti->need_parsing = need_parsing; + sti->need_parsing = AVSTREAM_PARSE_HEADERS; avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS, DVDVIDEO_TIME_BASE_Q.num, DVDVIDEO_TIME_BASE_Q.den); @@ -1282,7 +1279,7 @@ static int dvdvideo_audio_stream_add_all(AVFormatContext *s) if (s->streams[j]->id == entry.startcode) continue; - if ((ret = dvdvideo_audio_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0) + if ((ret = dvdvideo_audio_stream_add(s, &entry)) < 0) goto break_error; continue; @@ -1319,8 +1316,7 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub return 0; } -static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStreamEntry *entry, - enum AVStreamParseType need_parsing) +static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStreamEntry *entry) { AVStream *st; FFStream *sti; @@ -1346,7 +1342,7 @@ static int dvdvideo_subp_stream_add(AVFormatContext *s, DVDVideoPGCSubtitleStrea sti = ffstream(st); sti->request_probe = 0; - sti->need_parsing = need_parsing; + sti->need_parsing = AVSTREAM_PARSE_HEADERS; avpriv_set_pts_info(st, DVDVIDEO_PTS_WRAP_BITS, DVDVIDEO_TIME_BASE_Q.num, DVDVIDEO_TIME_BASE_Q.den); @@ -1371,7 +1367,7 @@ static int dvdvideo_subp_stream_add_internal(AVFormatContext *s, uint32_t offset if (s->streams[i]->id == entry.startcode) return 0; - if ((ret = dvdvideo_subp_stream_add(s, &entry, AVSTREAM_PARSE_HEADERS)) < 0) + if ((ret = dvdvideo_subp_stream_add(s, &entry)) < 0) goto end_error; return 0; From 53e66c71613583783d3e7386ee4a015f41dda4bf Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:03 -0500 Subject: [PATCH 155/290] avformat/dvdvideodec: drop packets with unset PTS or DTS The packets effectively serve no purpose and we are already dropping packets with PTS less than 0. This also creates for a smoother seeking experience after the subdemuxer reset fix. Signed-off-by: Marth64 (cherry picked from commit f2f238c3a4855cd0919889940c2f45958ac47be6) --- libavformat/dvdvideodec.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index d64a678589..f20d2aa5cb 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1643,29 +1643,24 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) } } - if (!st_mapped) + if (!st_mapped || pkt->pts == AV_NOPTS_VALUE || pkt->dts == AV_NOPTS_VALUE) goto discard; - if (pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE) { - if (!c->play_started) { - /* try to start at the beginning of a GOP */ - if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key) - goto discard; - - c->first_pts = pkt->pts; - c->play_started = 1; - } - - pkt->pts += c->pts_offset - c->first_pts; - pkt->dts += c->pts_offset - c->first_pts; - - if (pkt->pts < 0) + if (!c->play_started) { + /* try to start at the beginning of a GOP */ + if (st_subdemux->codecpar->codec_type != AVMEDIA_TYPE_VIDEO || !is_key) goto discard; - } else { - av_log(s, AV_LOG_WARNING, "Unset PTS or DTS @ st=%d pts=%" PRId64 " dts=%" PRId64 "\n", - pkt->stream_index, pkt->pts, pkt->dts); + + c->first_pts = pkt->pts; + c->play_started = 1; } + pkt->pts += c->pts_offset - c->first_pts; + pkt->dts += c->pts_offset - c->first_pts; + + if (pkt->pts < 0) + goto discard; + av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " " "pts_offset=%" PRId64 " first_pts=%" PRId64 "\n", pkt->stream_index, pkt->pts, pkt->dts, From a626a08c45b0b4cefebef740612aa1c52a209bac Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:04 -0500 Subject: [PATCH 156/290] avformat/dvdvideodec: discard duplicate or partial AC3 samples Some DVD muxers signal segments to start with duplicate audio samples when starting extraction from a chapter marker or terminate seamless PGs on partial audio samples (causing corrupt AC3 frames). Clean up after these muxers by tracking frames with duplicate PTS and eliminating partial AC3 frames. This results in smoother chapter extraction and overall seeking experience, with linear PTS and AC3 delay within 32ms (1 frame) away from the video. The issue was not apparent until the flushing pattern was replaced with a full subdemux reset, as the flushing dropped the frames prematurely, along side others, as such they were never present to begin with. (cherry picked from commit 0912407b9de431fb750e74cb307ea7a11fc27e6b) --- libavformat/dvdvideodec.c | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index f20d2aa5cb..179181ce69 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -38,6 +38,7 @@ #include #include +#include "libavcodec/ac3_parser.h" #include "libavutil/avstring.h" #include "libavutil/avutil.h" #include "libavutil/intreadwrite.h" @@ -166,6 +167,7 @@ typedef struct DVDVideoDemuxContext { int64_t first_pts; /* the PTS of the first video keyframe */ int play_started; /* signal that playback has started */ DVDVideoPlaybackState play_state; /* the active playback state */ + int64_t *prev_pts; /* track the previous PTS emitted per stream */ int64_t pts_offset; /* PTS discontinuity offset (ex. VOB change) */ int seek_warned; /* signal that we warned about seeking limits */ int subdemux_reset; /* signal that subdemuxer should be reset */ @@ -1566,7 +1568,7 @@ static int dvdvideo_read_header(AVFormatContext *s) (ret = dvdvideo_subdemux_open(s)) < 0) return ret; - return 0; + goto end_ready; } if (c->opt_pgc && (c->opt_chapter_start > 1 || c->opt_chapter_end > 0 || c->opt_preindex)) { @@ -1603,6 +1605,14 @@ static int dvdvideo_read_header(AVFormatContext *s) (ret = dvdvideo_subdemux_open(s)) < 0) return ret; +end_ready: + c->prev_pts = av_malloc(s->nb_streams * sizeof(int64_t)); + if (!c->prev_pts) + return AVERROR(ENOMEM); + + for (int i = 0; i < s->nb_streams; i++) + c->prev_pts[i] = AV_NOPTS_VALUE; + return 0; } @@ -1614,6 +1624,8 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) int is_key = 0; int st_mapped = 0; AVStream *st_subdemux; + uint8_t ac3_bitstream_id; + uint16_t ac3_frame_size; ret = av_read_frame(c->mpeg_ctx, pkt); if (ret < 0) { @@ -1661,11 +1673,27 @@ static int dvdvideo_read_packet(AVFormatContext *s, AVPacket *pkt) if (pkt->pts < 0) goto discard; + /* clean up after DVD muxers which end seamless PGs on duplicate or partial AC3 samples */ + if (st_subdemux->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && + st_subdemux->codecpar->codec_id == AV_CODEC_ID_AC3) { + + if (pkt->pts <= c->prev_pts[pkt->stream_index]) + goto discard; + + ret = av_ac3_parse_header(pkt->buf->data, pkt->size, + &ac3_bitstream_id, &ac3_frame_size); + + if (ret < 0 || pkt->size != ac3_frame_size) + goto discard; + } + av_log(s, AV_LOG_TRACE, "st=%d pts=%" PRId64 " dts=%" PRId64 " " "pts_offset=%" PRId64 " first_pts=%" PRId64 "\n", pkt->stream_index, pkt->pts, pkt->dts, c->pts_offset, c->first_pts); + c->prev_pts[pkt->stream_index] = pkt->pts; + return 0; discard: @@ -1673,6 +1701,9 @@ discard: "Discarding frame @ st=%d pts=%" PRId64 " dts=%" PRId64 " is_key=%d st_mapped=%d\n", st_mapped ? pkt->stream_index : -1, pkt->pts, pkt->dts, is_key, st_mapped); + if (st_mapped) + c->prev_pts[pkt->stream_index] = pkt->pts; + return FFERROR_REDO; } @@ -1689,6 +1720,9 @@ static int dvdvideo_close(AVFormatContext *s) dvdvideo_ifo_close(s); + if (c->prev_pts) + av_freep(&c->prev_pts); + return 0; } From 7fc55c38c77629723f38fd5a78459b8253589d03 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Mon, 7 Oct 2024 18:05:05 -0500 Subject: [PATCH 157/290] avformat/dvdvideodec: don't allow seeking beyond dvdnav reported duration There is no reason to accept timestamp values beyond what dvdnav reported as the duration of the title. Signed-off-by: Marth64 (cherry picked from commit 1d55f548466516a6a4ed4cc67e118e1c29c6ae5a) --- libavformat/dvdvideodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 179181ce69..4d11480dfd 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1743,7 +1743,7 @@ static int dvdvideo_read_seek(AVFormatContext *s, int stream_index, int64_t time if ((flags & AVSEEK_FLAG_BYTE)) return AVERROR(ENOSYS); - if (timestamp < 0) + if (timestamp < 0 || timestamp > s->duration) return AVERROR(EINVAL); if (!c->seek_warned) { From 7264127438e468fdf2eb267ac7827fb0f81f6e63 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Tue, 26 Nov 2024 20:09:04 -0600 Subject: [PATCH 158/290] avformat/dvdvideodec: fix missing last chapter marker due to off-by-one When using fast chapter marker calculation (default), the last marker is inadverdently ignored due to an off-by-one. Signed-off-by: Marth64 (cherry picked from commit a5a899bfcbe458bc9e4e73f883ed63cbaacbb451) --- libavformat/dvdvideodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 4d11480dfd..9916351e86 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -874,7 +874,7 @@ static int dvdvideo_chapters_setup_simple(AVFormatContext *s) int64_t total_duration = 0; int chapter_start = c->opt_chapter_start; - int chapter_end = c->opt_chapter_end > 0 ? c->opt_chapter_end : c->play_state.pgc_nb_pg_est - 1; + int chapter_end = c->opt_chapter_end > 0 ? c->opt_chapter_end : c->play_state.pgc_nb_pg_est; /* dvdnav_describe_title_chapters() describes PGs rather than PTTs, so validate our range */ if (c->play_state.pgc_nb_pg_est == 1 || From a6d4bac44d2d7f034027fadb4920830d521b4190 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Wed, 27 Nov 2024 11:13:44 -0600 Subject: [PATCH 159/290] avformat/dvdvideodec: check return code of ff_dvdclut_yuv_to_rgb() Signed-off-by: Marth64 (cherry picked from commit e256761defe527c81521ae035ae3ee6f16265707) --- libavformat/dvdvideodec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/dvdvideodec.c b/libavformat/dvdvideodec.c index 9916351e86..f92c5ae54a 100644 --- a/libavformat/dvdvideodec.c +++ b/libavformat/dvdvideodec.c @@ -1299,6 +1299,7 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub { DVDVideoDemuxContext *c = s->priv_data; + int ret; char lang_dvd[3] = {0}; entry->startcode = 0x20 + (offset & 0x1F); @@ -1310,7 +1311,9 @@ static int dvdvideo_subp_stream_analyze(AVFormatContext *s, uint32_t offset, sub /* dvdsub palettes currently have no colorspace tagging and all muxers only support RGB */ /* this is not a lossless conversion, but no use cases are supported for the original YUV */ - ff_dvdclut_yuv_to_rgb(entry->clut, FF_DVDCLUT_CLUT_SIZE); + ret = ff_dvdclut_yuv_to_rgb(entry->clut, FF_DVDCLUT_CLUT_SIZE); + if (ret < 0) + return ret; AV_WB16(lang_dvd, subp_attr.lang_code); entry->lang_iso = ff_convert_lang_to(lang_dvd, AV_LANG_ISO639_2_BIBL); From 0ccb070863424e0f355c9d905b91c612eef7af60 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Wed, 27 Nov 2024 23:28:50 -0600 Subject: [PATCH 160/290] doc/demuxers/dvdvideo: seeking is supported, remove outdated statement Signed-off-by: Marth64 (cherry picked from commit 1c2c70fe4d17e93401f88fa9e4ec2b8404790bd3) --- doc/demuxers.texi | 1 - 1 file changed, 1 deletion(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index 86a9158e59..cc81c615dd 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -292,7 +292,6 @@ DVD-Video demuxer, powered by libdvdnav and libdvdread. Can directly ingest DVD titles, specifically sequential PGCs, into a conversion pipeline. Menu assets, such as background video or audio, can also be demuxed given the menu's coordinates (at best effort). -Seeking is not supported at this time. Block devices (DVD drives), ISO files, and directory structures are accepted. Activate with @code{-f dvdvideo} in front of one of these inputs. From 3a375e3dcf09f8ac7dcf213160789ff96da88b7c Mon Sep 17 00:00:00 2001 From: Marth64 Date: Wed, 18 Dec 2024 20:17:35 -0600 Subject: [PATCH 161/290] avcodec/cbs_av1: fix variable shadowing in cbs_av1_split_fragment() header is previously declared as an int argument then shadowed in the scope of the loop as a AV1RawOBUHeader. Signed-off-by: Marth64 (cherry picked from commit 8e8260aabf39c8c39eb99d5de9c21a76eb314747) --- libavcodec/cbs_av1.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c index 458381f038..98d745f494 100644 --- a/libavcodec/cbs_av1.c +++ b/libavcodec/cbs_av1.c @@ -728,16 +728,16 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx, } while (size > 0) { - AV1RawOBUHeader header; + AV1RawOBUHeader obu_header; uint64_t obu_size; init_get_bits(&gbc, data, 8 * size); - err = cbs_av1_read_obu_header(ctx, &gbc, &header); + err = cbs_av1_read_obu_header(ctx, &gbc, &obu_header); if (err < 0) goto fail; - if (header.obu_has_size_field) { + if (obu_header.obu_has_size_field) { if (get_bits_left(&gbc) < 8) { av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid OBU: fragment " "too short (%"SIZE_SPECIFIER" bytes).\n", size); @@ -748,7 +748,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx, if (err < 0) goto fail; } else - obu_size = size - 1 - header.obu_extension_flag; + obu_size = size - 1 - obu_header.obu_extension_flag; pos = get_bits_count(&gbc); av_assert0(pos % 8 == 0 && pos / 8 <= size); @@ -763,7 +763,7 @@ static int cbs_av1_split_fragment(CodedBitstreamContext *ctx, goto fail; } - err = ff_cbs_append_unit_data(frag, header.obu_type, + err = ff_cbs_append_unit_data(frag, obu_header.obu_type, data, obu_length, frag->data_ref); if (err < 0) goto fail; From 0a51afd21d6c76a9f4e5797135db6e067e3ad645 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Sat, 12 Oct 2024 12:18:30 -0500 Subject: [PATCH 162/290] avformat/smoothstreamingenc: check return value of avcodec_parameters_copy() Written in the dominant style of the surrounding code block. Reviewed-by: ePirat Signed-off-by: Marth64 (cherry picked from commit 3528bfed450842a991df6e076fe72d4c2eee6432) --- libavformat/smoothstreamingenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/smoothstreamingenc.c b/libavformat/smoothstreamingenc.c index 9547419d31..adf3008003 100644 --- a/libavformat/smoothstreamingenc.c +++ b/libavformat/smoothstreamingenc.c @@ -331,7 +331,9 @@ static int ism_write_header(AVFormatContext *s) if (!(st = avformat_new_stream(ctx, NULL))) { return AVERROR(ENOMEM); } - avcodec_parameters_copy(st->codecpar, s->streams[i]->codecpar); + if ((ret = avcodec_parameters_copy(st->codecpar, s->streams[i]->codecpar)) < 0) { + return ret; + } st->sample_aspect_ratio = s->streams[i]->sample_aspect_ratio; st->time_base = s->streams[i]->time_base; From 9d9b87be2b5f3119f1d92e073bbf59114a0555ed Mon Sep 17 00:00:00 2001 From: Marth64 Date: Fri, 11 Oct 2024 02:06:35 -0500 Subject: [PATCH 163/290] avformat/dashdec: return ret directly in open_demux_for_component() Signed-off-by: Marth64 Reviewed-by: Steven Liu (cherry picked from commit 6ee7555a909d263080de8490628e92bf0c5cdb15) --- libavformat/dashdec.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 99ac6197be..9ce23aec65 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -1939,16 +1939,15 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p } ret = reopen_demux_for_component(s, pls); - if (ret < 0) { - goto fail; - } + if (ret < 0) + return ret; + for (i = 0; i < pls->ctx->nb_streams; i++) { AVStream *st = avformat_new_stream(s, NULL); AVStream *ist = pls->ctx->streams[i]; - if (!st) { - ret = AVERROR(ENOMEM); - goto fail; - } + if (!st) + return AVERROR(ENOMEM); + st->id = i; avcodec_parameters_copy(st->codecpar, ist->codecpar); avpriv_set_pts_info(st, ist->pts_wrap_bits, ist->time_base.num, ist->time_base.den); @@ -1958,8 +1957,6 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p } return 0; -fail: - return ret; } static int is_common_init_section_exist(struct representation **pls, int n_pls) From ba94588afaf1dfbe280202e115f294afd5baf06a Mon Sep 17 00:00:00 2001 From: Marth64 Date: Fri, 11 Oct 2024 02:06:36 -0500 Subject: [PATCH 164/290] avformat/dashdec: check return code of avcodec_parameters_copy() Signed-off-by: Marth64 Reviewed-by: Steven Liu (cherry picked from commit 7acc2ebd5d9e09198ea235870f8e6a9a5de667f8) --- libavformat/dashdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 9ce23aec65..cd1b3da3a2 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -1949,7 +1949,11 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p return AVERROR(ENOMEM); st->id = i; - avcodec_parameters_copy(st->codecpar, ist->codecpar); + + ret = avcodec_parameters_copy(st->codecpar, ist->codecpar); + if (ret < 0) + return ret; + avpriv_set_pts_info(st, ist->pts_wrap_bits, ist->time_base.num, ist->time_base.den); // copy disposition From ae7332065bb3c17fcef0244346e5a7f4edc94d97 Mon Sep 17 00:00:00 2001 From: Marth64 Date: Fri, 11 Oct 2024 02:06:37 -0500 Subject: [PATCH 165/290] avformat/dashdec: format open_demux_for_component() Signed-off-by: Marth64 Reviewed-by: Steven Liu (cherry picked from commit 95bb47de7dc564ad8a36d6c0770400815a9b39c2) --- libavformat/dashdec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index cd1b3da3a2..a1d274f2f0 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -1932,11 +1932,10 @@ static int open_demux_for_component(AVFormatContext *s, struct representation *p int i; pls->parent = s; - pls->cur_seq_no = calc_cur_seg_no(s, pls); + pls->cur_seq_no = calc_cur_seg_no(s, pls); - if (!pls->last_seq_no) { + if (!pls->last_seq_no) pls->last_seq_no = calc_max_seg_no(pls, s->priv_data); - } ret = reopen_demux_for_component(s, pls); if (ret < 0) From dd78b9ed7c5ee97e9eb2bd03f8387c2d6348ceca Mon Sep 17 00:00:00 2001 From: Marth64 Date: Sat, 12 Oct 2024 12:25:40 -0500 Subject: [PATCH 166/290] avformat/hlsenc: check return value of avcodec_parameters_copy() Written in the dominant style of the surrounding code block. Signed-off-by: Marth64 Reviewed-by: Steven Liu (cherry picked from commit f46415f37332c4291882ae1b403aaf8179e3ea49) --- libavformat/hlsenc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 1e932b7b0e..081d91f7d9 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -887,7 +887,9 @@ static int hls_mux_init(AVFormatContext *s, VariantStream *vs) if (!(st = avformat_new_stream(loc, NULL))) return AVERROR(ENOMEM); - avcodec_parameters_copy(st->codecpar, vs->streams[i]->codecpar); + ret = avcodec_parameters_copy(st->codecpar, vs->streams[i]->codecpar); + if (ret < 0) + return ret; if (!oc->oformat->codec_tag || av_codec_get_id (oc->oformat->codec_tag, vs->streams[i]->codecpar->codec_tag) == st->codecpar->codec_id || av_codec_get_tag(oc->oformat->codec_tag, vs->streams[i]->codecpar->codec_id) <= 0) { From 60551696c0867654ee705cccf891c3b30d53b0dd Mon Sep 17 00:00:00 2001 From: Marth64 Date: Wed, 20 Nov 2024 01:35:18 -0600 Subject: [PATCH 167/290] avformat/libssh: fix credential variables typo Signed-off-by: Marth64 (cherry picked from commit 084d3515cabf1f7141e8789f21db534b304a47cc) --- libavformat/libssh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/libssh.c b/libavformat/libssh.c index 5c062a7245..523b79befe 100644 --- a/libavformat/libssh.c +++ b/libavformat/libssh.c @@ -190,13 +190,13 @@ static av_cold int libssh_close(URLContext *h) static av_cold int libssh_connect(URLContext *h, const char *url, char *path, size_t path_size) { LIBSSHContext *libssh = h->priv_data; - char proto[10], hostname[1024], credencials[1024]; + char proto[10], hostname[1024], credentials[1024]; int port = 22, ret; const char *user = NULL, *pass = NULL; char *end = NULL; av_url_split(proto, sizeof(proto), - credencials, sizeof(credencials), + credentials, sizeof(credentials), hostname, sizeof(hostname), &port, path, path_size, @@ -212,7 +212,7 @@ static av_cold int libssh_connect(URLContext *h, const char *url, char *path, si if ((ret = libssh_create_ssh_session(libssh, hostname, port)) < 0) return ret; - user = av_strtok(credencials, ":", &end); + user = av_strtok(credentials, ":", &end); pass = av_strtok(end, ":", &end); if ((ret = libssh_authentication(libssh, user, pass)) < 0) From 9328e07ad5196e2992c348b518e046c539830ca5 Mon Sep 17 00:00:00 2001 From: Eugene Zemtsov Date: Thu, 24 Oct 2024 18:54:10 -0700 Subject: [PATCH 168/290] avformat/mov: fix crash when trying to get a fragment time for a non-existing fragment Reviewed-by: Dale Curtis Reviewed-by: Marth64 Signed-off-by: Marth64 (cherry picked from commit 7c9bde1d0d26ffa74b6791666c3a27c6d5d5019f) --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index a4c5a2a93c..ff32d4160e 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1644,6 +1644,8 @@ static int64_t get_frag_time(AVFormatContext *s, AVStream *dst_st, // to fragments that referenced this stream in the sidx if (sc->has_sidx) { frag_stream_info = get_frag_stream_info(frag_index, index, sc->id); + if (!frag_stream_info) + return AV_NOPTS_VALUE; if (frag_stream_info->sidx_pts != AV_NOPTS_VALUE) return frag_stream_info->sidx_pts; if (frag_stream_info->first_tfra_pts != AV_NOPTS_VALUE) From 5b2ee11a600a847b08adb5d4aaa425950b83afa3 Mon Sep 17 00:00:00 2001 From: Eugene Zemtsov Date: Thu, 24 Oct 2024 18:52:45 -0700 Subject: [PATCH 169/290] avcodec/decode: Fix incorrect enum type used in side_data_map() It's AVPacketSideDataType, not AVFrameSideDataType. Reviewed-by: Ted (Chromium) Meyer Reviewed-by: Marth64 Signed-off-by: Marth64 (cherry picked from commit e9c3698ed23ab3d8cf1fe1fc74b3b2f8ba42c865) --- libavcodec/decode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/decode.c b/libavcodec/decode.c index c331bb8596..148af71ac4 100644 --- a/libavcodec/decode.c +++ b/libavcodec/decode.c @@ -1466,8 +1466,8 @@ static int side_data_map(AVFrame *dst, { for (int i = 0; map[i].packet < AV_PKT_DATA_NB; i++) { - const enum AVFrameSideDataType type_pkt = map[i].packet; - const enum AVFrameSideDataType type_frame = map[i].frame; + const enum AVPacketSideDataType type_pkt = map[i].packet; + const enum AVFrameSideDataType type_frame = map[i].frame; const AVPacketSideData *sd_pkt; AVFrameSideData *sd_frame; From d72536008ac377164b00d214a2521e5ce604260b Mon Sep 17 00:00:00 2001 From: Jonathan Baudanza Date: Wed, 8 Jan 2025 09:22:13 +0900 Subject: [PATCH 170/290] avformat/rtpdec: int overflow in start_time_realtime MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This was previously adjusted by me in 6b3f9c2e92b. Unfortunately, I traded one integer overflow bug for another. Currently, NTP timestamps that exceed INT64_MAX (~Jan 20, 1968) will cause an overflow when passed to av_rescale. This patch replaces av_rescale, which operates on int64_t, with ff_parse_ntp_time, which operates on uint64_t. This will give the correct values for timestamps back around the NTP epoch and present day timestamps. Fixes ticket #11388. Signed-off-by: Martin Storsjö (cherry picked from commit c0fbb6d5b7aab2e01125e30c69c0af4c07855e6f) --- libavformat/rtsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index c48fa26d90..5ea471b40c 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -2320,7 +2320,7 @@ redo: } // Make real NTP start time available in AVFormatContext if (s->start_time_realtime == AV_NOPTS_VALUE) { - s->start_time_realtime = av_rescale (rtpctx->first_rtcp_ntp_time, 1000000, 1LL << 32) - NTP_OFFSET_US; + s->start_time_realtime = ff_parse_ntp_time(rtpctx->first_rtcp_ntp_time) - NTP_OFFSET_US; if (rtpctx->st) { s->start_time_realtime -= av_rescale_q (rtpctx->rtcp_ts_offset, rtpctx->st->time_base, AV_TIME_BASE_Q); From aeb86310480382138a9046d5a427f4a8c1b866ea Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 19 Nov 2024 13:24:49 -0300 Subject: [PATCH 171/290] avformat/hevc: fix writing hvcC when no arrays are provided in hvcC-formatted input Don't reject extradata with missing PS NALUs if array_completeness is not requested. Fixes a regression since a696b28886. Signed-off-by: James Almer (cherry picked from commit 5813e5aa344b8c03c83bf62e729be0f447944ed1) --- libavformat/hevc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/hevc.c b/libavformat/hevc.c index e1f31ee1bb..7cf0b0ffb2 100644 --- a/libavformat/hevc.c +++ b/libavformat/hevc.c @@ -958,10 +958,12 @@ static int hvcc_write(AVIOContext *pb, HEVCDecoderConfigurationRecord *hvcc, /* * We need at least one of each: VPS, SPS and PPS. */ - if ((!numNalus[VPS_INDEX] || numNalus[VPS_INDEX] > HEVC_MAX_VPS_COUNT) && !is_lhvc) + if ((flags & FLAG_ARRAY_COMPLETENESS) && + (!numNalus[VPS_INDEX] || numNalus[VPS_INDEX] > HEVC_MAX_VPS_COUNT) && !is_lhvc) return AVERROR_INVALIDDATA; - if (!numNalus[SPS_INDEX] || numNalus[SPS_INDEX] > HEVC_MAX_SPS_COUNT || - !numNalus[PPS_INDEX] || numNalus[PPS_INDEX] > HEVC_MAX_PPS_COUNT) + if ((flags & FLAG_ARRAY_COMPLETENESS) && + (!numNalus[SPS_INDEX] || numNalus[SPS_INDEX] > HEVC_MAX_SPS_COUNT || + !numNalus[PPS_INDEX] || numNalus[PPS_INDEX] > HEVC_MAX_PPS_COUNT)) return AVERROR_INVALIDDATA; /* unsigned int(8) configurationVersion = 1; */ From 14af28c2f5facd07951aa048e53bd562d80826aa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 Aug 2024 22:53:47 +0200 Subject: [PATCH 172/290] avformat/mxfdec: Check that key was read sucessfull Fixes: use of uninitialized value Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4c62cbcae2612acbc7ab5e8a7e7815674a6e8df4) Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 2f8ab3890d..a263239288 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1530,7 +1530,8 @@ static int mxf_read_indirect_value(void *arg, AVIOContext *pb, int size) if (size <= 17) return 0; - avio_read(pb, key, 17); + if (avio_read(pb, key, 17) != 17) + return AVERROR_INVALIDDATA; /* TODO: handle other types of of indirect values */ if (memcmp(key, mxf_indirect_value_utf16le, 17) == 0) { return mxf_read_utf16le_string(pb, size - 17, &tagged_value->value); From 0da3deb079a614b68468fb2057796fa94663fcdf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 Aug 2024 23:15:32 +0200 Subject: [PATCH 173/290] avcodec/hapdec: Clear tex buffer The code following makes no attempt to initialize all of the buffer Fixes: use of uninitialized value Fixes: 70980/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5329909059223552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 7eeeda703b599847aa89c7c08bb433d0b3da9590) Signed-off-by: Michael Niedermayer --- libavcodec/hapdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/hapdec.c b/libavcodec/hapdec.c index 918eff7876..70bf592f2a 100644 --- a/libavcodec/hapdec.c +++ b/libavcodec/hapdec.c @@ -310,6 +310,7 @@ static int hap_decode(AVCodecContext *avctx, AVFrame *frame, ret = av_reallocp(&ctx->tex_buf, ctx->tex_size); if (ret < 0) return ret; + memset(ctx->tex_buf, 0, ctx->tex_size); avctx->execute2(avctx, decompress_chunks_thread, NULL, ctx->chunk_results, ctx->chunk_count); From f44a7207f018906cef31be86ec7d6ee276fbb54d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 7 Aug 2024 22:55:03 +0200 Subject: [PATCH 174/290] avcodec/cfhdenc: Clear dwt_tmp This occurs on a 32x32 input Fixes: use of uninitialized value Fixes: 70897/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5960860961406976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 9de721de709fa9cc06a3ce3f542a1e7d45b2b0bf) Signed-off-by: Michael Niedermayer --- libavcodec/cfhdenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cfhdenc.c b/libavcodec/cfhdenc.c index 3be6798d8d..ceea15efc4 100644 --- a/libavcodec/cfhdenc.c +++ b/libavcodec/cfhdenc.c @@ -285,7 +285,7 @@ static av_cold int cfhd_encode_init(AVCodecContext *avctx) s->plane[i].dwt_buf = av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_buf)); s->plane[i].dwt_tmp = - av_malloc_array(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp)); + av_calloc(h8 * 8 * w8 * 8, sizeof(*s->plane[i].dwt_tmp)); if (!s->plane[i].dwt_buf || !s->plane[i].dwt_tmp) return AVERROR(ENOMEM); From d32543f520576d336063b3371d1692e18541a9ea Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Aug 2024 14:47:42 +0200 Subject: [PATCH 175/290] avformat/rmdec: check that buf if completely filled Fixes: use of uninitialized value Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976 Signed-off-by: Michael Niedermayer (cherry picked from commit 9578c135d00dd9cc01491b8559d7fad5a387e90d) Signed-off-by: Michael Niedermayer --- libavformat/rmdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 25a8681cfd..4b21105d3d 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -188,7 +188,8 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, st->codecpar->ch_layout.nb_channels = avio_rb16(pb); if (version == 5) { ast->deint_id = avio_rl32(pb); - avio_read(pb, buf, 4); + if (avio_read(pb, buf, 4) != 4) + return AVERROR_INVALIDDATA; buf[4] = 0; } else { AV_WL32(buf, 0); From d322ffdef526a2913423a0ba69fb729c7f54837f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Aug 2024 16:33:43 +0200 Subject: [PATCH 176/290] avformat/jpegxl_anim_dec: clear buffer padding Fixes: use of uninitialized value Fixes: 70992/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-5735819170611200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 3f0b95bb176445a509d99e7497e90f20355b8411) Signed-off-by: Michael Niedermayer --- libavformat/jpegxl_anim_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c index 2338a2e8c0..7798f3dabc 100644 --- a/libavformat/jpegxl_anim_dec.c +++ b/libavformat/jpegxl_anim_dec.c @@ -43,7 +43,7 @@ typedef struct JXLAnimDemuxContext { static int jpegxl_anim_probe(const AVProbeData *p) { - uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE]; + uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE] = {0}; int copied = 0, ret; FFJXLMetadata meta = { 0 }; From 5129ae45bf1c4b50074309175328ea922d7bf98d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Aug 2024 17:30:45 +0200 Subject: [PATCH 177/290] avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video Fixes: Use of uninintialized value Fixes: 70993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6378949754552320 Fixes: 71104/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5001538727116800 For the AAC/USAC/SBR code which reads uninitialized memory, it would be good, if it did not a fix for that is welcome! Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit b9b4c9ebf07748993ad91ba9b9b9f06914d67865) Signed-off-by: Michael Niedermayer --- libavcodec/get_buffer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/get_buffer.c b/libavcodec/get_buffer.c index ff19f61e86..7e705380fc 100644 --- a/libavcodec/get_buffer.c +++ b/libavcodec/get_buffer.c @@ -142,7 +142,10 @@ static int update_frame_pool(AVCodecContext *avctx, AVFrame *frame) if (ret < 0) goto fail; - pool->pools[0] = av_buffer_pool_init(pool->linesize[0], NULL); + pool->pools[0] = av_buffer_pool_init(pool->linesize[0], + CONFIG_MEMORY_POISONING ? + NULL : + av_buffer_allocz); if (!pool->pools[0]) { ret = AVERROR(ENOMEM); goto fail; From 553517868db17584029fc5ecb2648be93245cab5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 5 Jan 2025 02:36:25 +0100 Subject: [PATCH 178/290] avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: out of array read Found-by: Elias Myllymäki Reviewed-by: Alexander Strasser Signed-off-by: Michael Niedermayer (cherry picked from commit b72de492959fb19eab37368232e65a4371c367f7) Signed-off-by: Michael Niedermayer --- libavfilter/vf_addroi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavfilter/vf_addroi.c b/libavfilter/vf_addroi.c index de857eced4..d6765e9d8c 100644 --- a/libavfilter/vf_addroi.c +++ b/libavfilter/vf_addroi.c @@ -39,6 +39,7 @@ enum { static const char *const addroi_var_names[] = { "iw", "ih", + NULL, }; typedef struct AddROIContext { From 601616f2de4274fd6da6ed9a80843d6c56e65131 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 6 Jan 2025 05:06:10 +0100 Subject: [PATCH 179/290] avfilter/vf_grayworld: Use the correct pointer for av_log() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: crash Found-by: Elias Myllymäki Reviewed-by: Alexander Strasser Signed-off-by: Michael Niedermayer (cherry picked from commit 9ffa127aa6853790acb40004fbab97f13ff4c72e) Signed-off-by: Michael Niedermayer --- libavfilter/vf_grayworld.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_grayworld.c b/libavfilter/vf_grayworld.c index a6a51dcb7d..91b097a4b8 100644 --- a/libavfilter/vf_grayworld.c +++ b/libavfilter/vf_grayworld.c @@ -266,10 +266,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) } /* input and output transfer will be linear */ if (in->color_trc == AVCOL_TRC_UNSPECIFIED) { - av_log(s, AV_LOG_WARNING, "Untagged transfer, assuming linear light.\n"); + av_log(ctx, AV_LOG_WARNING, "Untagged transfer, assuming linear light.\n"); out->color_trc = AVCOL_TRC_LINEAR; } else if (in->color_trc != AVCOL_TRC_LINEAR) { - av_log(s, AV_LOG_WARNING, "Gray world color correction works on linear light only.\n"); + av_log(ctx, AV_LOG_WARNING, "Gray world color correction works on linear light only.\n"); } td.in = in; From b827ac49b770635fc666f8543cb9585e1bc6308b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 6 Jan 2025 22:01:39 +0100 Subject: [PATCH 180/290] avfilter/af_pan: Fix sscanf() use Fixes: Memory Data Leak Found-by: Simcha Kosman Signed-off-by: Michael Niedermayer (cherry picked from commit b5b6391d64807578ab872dc58fb8aa621dcfc38a) Signed-off-by: Michael Niedermayer --- libavfilter/af_pan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c index 0d20b0307b..5feb2439c7 100644 --- a/libavfilter/af_pan.c +++ b/libavfilter/af_pan.c @@ -196,7 +196,7 @@ static av_cold int init(AVFilterContext *ctx) sign = 1; while (1) { gain = 1; - if (sscanf(arg, "%lf%n *%n", &gain, &len, &len)) + if (sscanf(arg, "%lf%n *%n", &gain, &len, &len) >= 1) arg += len; if (parse_channel_name(&arg, &in_ch_id, &named)){ av_log(ctx, AV_LOG_ERROR, From 658029334e078a9f0af1efbcbbd8daf871241dc2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 03:25:09 +0100 Subject: [PATCH 181/290] swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template() Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int' Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 56faee21c136942c491f30a2e82cfbbfce180beb) Signed-off-by: Michael Niedermayer --- libswscale/output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libswscale/output.c b/libswscale/output.c index ae9a50637a..366883ab1b 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -1352,9 +1352,9 @@ yuv2rgba64_full_X_c_template(SwsContext *c, const int16_t *lumFilter, B = U * c->yuv2rgb_u2b_coeff; // 8bit: 30 - 22 = 8bit, 16bit: 30bit - 14 = 16bit - output_pixel(&dest[0], av_clip_uintp2(((R_B + Y)>>14) + (1<<15), 16)); - output_pixel(&dest[1], av_clip_uintp2((( G + Y)>>14) + (1<<15), 16)); - output_pixel(&dest[2], av_clip_uintp2(((B_R + Y)>>14) + (1<<15), 16)); + output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + (unsigned)Y)>>14) + (1<<15), 16)); + output_pixel(&dest[1], av_clip_uintp2(((int)( G + (unsigned)Y)>>14) + (1<<15), 16)); + output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + (unsigned)Y)>>14) + (1<<15), 16)); if (eightbytes) { output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14); dest += 4; From da1e316a1f3ddd1db01fd25d8ee975b63238d595 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 03:31:56 +0100 Subject: [PATCH 182/290] avcodec/osq: Fixes several undefined overflows in do_decode() Fixes: signed integer overflow: 1239596184 + 2119376059 cannot be represented in type 'int' Fixes: 376136844/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6581164455821312 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 0f511b4518fa4337f603275f865eb13ac5520d0f) Signed-off-by: Michael Niedermayer --- libavcodec/osq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 1bf6264699..83b4a9d618 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -300,7 +300,7 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int dst[n] += (int)(P2 + P3) / 2 + (unsigned)p; break; case 8: - dst[n] += (int)(P2 + P3) / 2; + dst[n] += (int)(P2 + P3) / 2 + 0U; break; case 9: dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p; @@ -309,13 +309,13 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p; break; case 11: - dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2; + dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2 + 0U; break; case 12: dst[n] += (unsigned)dst[B]; break; case 13: - dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2; + dst[n] += (int)((unsigned)dst[D] + dst[B]) / 2 + 0U; break; case 14: dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p; From 585c799b1088f9f97c1ae7cde33cb3b1aceaa0cc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 21:40:43 +0100 Subject: [PATCH 183/290] avformat/iamf_parse: Check output_channel_count Fixes: -nan is outside the range of representable values of type 'int' Fixes: 377072730/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6545416570601472 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4485a0fd77c50157feb308090d84b52cd84e80a2) Signed-off-by: Michael Niedermayer --- libavformat/iamf_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 3486104aba..1ec6924908 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -417,7 +417,7 @@ static int ambisonics_config(void *s, AVIOContext *pb, output_channel_count = avio_r8(pb); // C substream_count = avio_r8(pb); // N - if (audio_element->nb_substreams != substream_count) + if (audio_element->nb_substreams != substream_count || output_channel_count == 0) return AVERROR_INVALIDDATA; order = floor(sqrt(output_channel_count - 1)); From 73fd3789955a76553d74f9453c8ca2c5f18a6fb9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 22:27:18 +0100 Subject: [PATCH 184/290] avcodec/aacsbr_template: Clear n_q on error Fixes: index 5 out of bounds for type 'uint8_t [5]' Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 3f029bfb7f9ca1c73fecb8d0eacf3c4e0550f771) Signed-off-by: Michael Niedermayer --- libavcodec/aacsbr_template.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c index 436b549fe7..9fae44d9a5 100644 --- a/libavcodec/aacsbr_template.c +++ b/libavcodec/aacsbr_template.c @@ -599,6 +599,7 @@ static int sbr_make_f_derived(AACDecContext *ac, SpectralBandReplication *sbr) if (sbr->n_q > 5) { av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q); + sbr->n_q = 1; return -1; } From 5e02e1ba96efcd052f815e6b5c51433176c7b16c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 23:30:55 +0100 Subject: [PATCH 185/290] avcodec/vc1dec: Clear block_index in vc1_decode_reset() Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472 Fixes: out of array access Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 251de1791e645f16e80b09d82999d4a5e24b1ad1) Signed-off-by: Michael Niedermayer --- libavcodec/vc1dec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 5f1a5bd437..2c314e7b55 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -788,6 +788,7 @@ static av_cold void vc1_decode_reset(AVCodecContext *avctx) for (i = 0; i < 4; i++) av_freep(&v->sr_rows[i >> 1][i & 1]); ff_mpv_common_end(&v->s); + memset(v->s.block_index, 0, sizeof(v->s.block_index)); av_freep(&v->mv_type_mb_plane); av_freep(&v->direct_mb_plane); av_freep(&v->forward_mb_plane); From 41f805228415c51a65b533de8e7f2fa42b24f8ed Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 9 Jan 2025 00:02:35 +0100 Subject: [PATCH 186/290] avformat/mov: Factorize sanity check out Signed-off-by: Michael Niedermayer (cherry picked from commit 16b3d3e3ebb9ff7b00c0fd14b0167779ada87f86) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index ff32d4160e..6918a6e045 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5021,6 +5021,24 @@ static int mov_update_iamf_streams(MOVContext *c, const AVStream *st) } #endif +static int sanity_checks(void *log_obj, MOVStreamContext *sc, int index) +{ + if ((sc->chunk_count && (!sc->stts_count || !sc->stsc_count || + (!sc->sample_size && !sc->sample_count))) || + (!sc->chunk_count && sc->sample_count)) { + av_log(log_obj, AV_LOG_ERROR, "stream %d, missing mandatory atoms, broken header\n", + index); + return 1; + } + + if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) { + av_log(log_obj, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n", + index); + return 2; + } + return 0; +} + static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; @@ -5053,19 +5071,9 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_freep(&sc->stsc_data); } - /* sanity checks */ - if ((sc->chunk_count && (!sc->stts_count || !sc->stsc_count || - (!sc->sample_size && !sc->sample_count))) || - (!sc->chunk_count && sc->sample_count)) { - av_log(c->fc, AV_LOG_ERROR, "stream %d, missing mandatory atoms, broken header\n", - st->index); - return 0; - } - if (sc->stsc_count && sc->stsc_data[ sc->stsc_count - 1 ].first > sc->chunk_count) { - av_log(c->fc, AV_LOG_ERROR, "stream %d, contradictionary STSC and STCO\n", - st->index); - return AVERROR_INVALIDDATA; - } + ret = sanity_checks(c->fc, sc, st->index); + if (ret) + return ret > 1 ? AVERROR_INVALIDDATA : 0; fix_timescale(c, sc); From 0bb8a38c10a16c6956baabbf0dd9a2f634c89a01 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 7 Jan 2025 23:21:32 +0100 Subject: [PATCH 187/290] avformat/mov: perform sanity checks for heif before index building Fixes: undefined NULL pointer use Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6363211175493632 This performs equivalent sanity checks as are done in mov_read_trak() before mov_build_index() Reported-by: Dale Curtis Signed-off-by: Michael Niedermayer (cherry picked from commit afbc3a1b23b3ba3e5a3f2820228a5fe51b517be7) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 6918a6e045..695b975147 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10136,7 +10136,8 @@ static int mov_parse_heif_items(AVFormatContext *s) st->codecpar->width = item->width; st->codecpar->height = item->height; - if (sc->sample_count != 1 || sc->chunk_count != 1) + err = sanity_checks(s, sc, item->item_id); + if (err) return AVERROR_INVALIDDATA; sc->sample_sizes[0] = item->extent_length; From 5fed7010f8586f682e2d4e2d3068569ca989e192 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 9 Jan 2025 21:35:06 +0100 Subject: [PATCH 188/290] avcodec/ffv1enc: Fix handling of 32bit unsigned symbols This may be needed for floats Sponsored-by: Sovereign Tech Fund Reviewed-by: Alexander Strasser Signed-off-by: Michael Niedermayer (cherry picked from commit 402824e9e99461f1c9e74a6730ced40894669560) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 7dcecb5905..3e80906dd0 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -198,7 +198,7 @@ static av_always_inline av_flatten void put_symbol_inline(RangeCoder *c, } while (0) if (v) { - const int a = FFABS(v); + const unsigned a = is_signed ? FFABS(v) : v; const int e = av_log2(a); put_rac(c, state + 0, 0); if (e <= 9) { From ece76d7dd4660da49a880cf3be50c2eb51278db1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 8 Jan 2025 02:59:28 +0100 Subject: [PATCH 189/290] avcodec/mpegvideo_enc: Check FLV1 resolution limits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found-by: Elias Myllymäki Reviewed-by: Alexander Strasser Signed-off-by: Michael Niedermayer (cherry picked from commit 827c073154f4cc17d1bd3777dff3b58370210bcb) Signed-off-by: Michael Niedermayer --- libavcodec/mpegvideo_enc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c index a332edd1ae..74b598d089 100644 --- a/libavcodec/mpegvideo_enc.c +++ b/libavcodec/mpegvideo_enc.c @@ -567,6 +567,12 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx) av_log(avctx, AV_LOG_ERROR, "H.263 does not support resolutions above 2048x1152\n"); return AVERROR(EINVAL); } + if (s->codec_id == AV_CODEC_ID_FLV1 && + (avctx->width > 65535 || + avctx->height > 65535 )) { + av_log(avctx, AV_LOG_ERROR, "FLV does not support resolutions above 16bit\n"); + return AVERROR(EINVAL); + } if ((s->codec_id == AV_CODEC_ID_H263 || s->codec_id == AV_CODEC_ID_H263P || s->codec_id == AV_CODEC_ID_RV20) && From 75385a729f6c4b8a47e4cc1fe4717172982efad2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 8 Jan 2025 03:11:02 +0100 Subject: [PATCH 190/290] avfilter/vf_v360: Fix NULL pointer use MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: applying zero offset to null pointer partly Fixes: verysmall.flv Found-by: Elias Myllymäki Signed-off-by: Michael Niedermayer (cherry picked from commit 66e9888bf418984a274beddbc3e87e9f1b8f5077) Signed-off-by: Michael Niedermayer --- libavfilter/vf_v360.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index 12e40205ba..4ba389e335 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4255,8 +4255,8 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) int16_t *u = r->u[p] + ((j - slice_start) * uv_linesize + i) * elements; int16_t *v = r->v[p] + ((j - slice_start) * uv_linesize + i) * elements; int16_t *ker = r->ker[p] + ((j - slice_start) * uv_linesize + i) * elements; - uint8_t *mask8 = p ? NULL : r->mask + ((j - slice_start) * s->pr_width[0] + i); - uint16_t *mask16 = p ? NULL : (uint16_t *)r->mask + ((j - slice_start) * s->pr_width[0] + i); + uint8_t *mask8 = (p || !r->mask) ? NULL : r->mask + ((j - slice_start) * s->pr_width[0] + i); + uint16_t *mask16 = (p || !r->mask) ? NULL : (uint16_t *)r->mask + ((j - slice_start) * s->pr_width[0] + i); int in_mask, out_mask; if (s->out_transpose) From ac9c710e180880d77fd6844cf3a2435681bf6419 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 15 Jan 2025 03:30:21 +0100 Subject: [PATCH 191/290] avutil/avstring: dont mess with NULL pointers in av_match_list() Fixes: applying zero offset to null pointer Signed-off-by: Michael Niedermayer (cherry picked from commit c6c54943d161812b3c4034116cb14f3f5c05dc43) Signed-off-by: Michael Niedermayer --- libavutil/avstring.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavutil/avstring.c b/libavutil/avstring.c index 2071dd36a5..875eb691db 100644 --- a/libavutil/avstring.c +++ b/libavutil/avstring.c @@ -452,10 +452,12 @@ int av_match_list(const char *name, const char *list, char separator) if (k && (!p[k] || p[k] == separator)) return 1; q = strchr(q, separator); - q += !!q; + if(q) + q++; } p = strchr(p, separator); - p += !!p; + if (p) + p++; } return 0; From c3c7ecfe48d464a0b06564f2e92504b1d9c91d69 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 16 Jan 2025 00:22:05 +0100 Subject: [PATCH 192/290] avformat/dashdec: Check whitelist Fixes: CVE-2023-6602, V. DASH Playlist SSRF Found-by: Harvey Phillips of Amazon Element55 (element55) Signed-off-by: Michael Niedermayer (cherry picked from commit 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf) Signed-off-by: Michael Niedermayer --- libavformat/dashdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index a1d274f2f0..71d79067a9 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -446,7 +446,7 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, av_freep(pb); av_dict_copy(&tmp, *opts, 0); av_dict_copy(&tmp, opts2, 0); - ret = avio_open2(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp); + ret = ffio_open_whitelist(pb, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp, s->protocol_whitelist, s->protocol_blacklist); if (ret >= 0) { // update cookies on http response with setcookies. char *new_cookies = NULL; @@ -1225,7 +1225,7 @@ static int parse_manifest(AVFormatContext *s, const char *url, AVIOContext *in) close_in = 1; av_dict_copy(&opts, c->avio_opts, 0); - ret = avio_open2(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts); + ret = ffio_open_whitelist(&in, url, AVIO_FLAG_READ, c->interrupt_callback, &opts, s->protocol_whitelist, s->protocol_blacklist); av_dict_free(&opts); if (ret < 0) return ret; From 5ee56ebd30488be9c44d3744458222673df53bf5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 19 Jan 2025 02:02:52 +0100 Subject: [PATCH 193/290] avcodec/ffv1enc: Fix RCT for GBR colorspace It performs better when its less buggy Compression changes for rgb_scanline_half_piz_dw_t08 (using float16 with remaping) from 56086 byte to 34371 (with a single slice its 28122 byte) prior remap it was 188186 bytes ACES_OT_VWG_SampleFrames/ACES_OT_VWG_SampleFrames improves too but only by a fraction of a percent Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer (cherry picked from commit 62c98cdd549a44d59d5b01d42dfbe35aed413d37) Signed-off-by: Michael Niedermayer --- libavcodec/ffv1enc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c index 3e80906dd0..7b8ed7acc6 100644 --- a/libavcodec/ffv1enc.c +++ b/libavcodec/ffv1enc.c @@ -1002,6 +1002,10 @@ static void choose_rct_params(const FFV1Context *f, FFV1SliceContext *sc, r = p[0]; g = p[1]; b = p[2]; + } else if (f->use32bit || transparency) { + g = *((const uint16_t *)(src[0] + x*2 + stride[0]*y)); + b = *((const uint16_t *)(src[1] + x*2 + stride[1]*y)); + r = *((const uint16_t *)(src[2] + x*2 + stride[2]*y)); } else { b = *((const uint16_t*)(src[0] + x*2 + stride[0]*y)); g = *((const uint16_t*)(src[1] + x*2 + stride[1]*y)); From 30bef79c6929540655ccf7b86ce565b31f9c6564 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 26 Dec 2024 01:46:49 +0100 Subject: [PATCH 194/290] avformat/vqf: Check avio_read() in add_metadata() Fixes: use of uninitialized data Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit c43dbecbdad152a91eadc7538b545852eee562ae) Signed-off-by: Michael Niedermayer --- libavformat/vqf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/vqf.c b/libavformat/vqf.c index 4820e0817c..79deb33744 100644 --- a/libavformat/vqf.c +++ b/libavformat/vqf.c @@ -63,7 +63,8 @@ static void add_metadata(AVFormatContext *s, uint32_t tag, buf = av_malloc(len+1); if (!buf) return; - avio_read(s->pb, buf, len); + if (len != avio_read(s->pb, buf, len)) + return; buf[len] = 0; AV_WL32(key, tag); av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL); From c82813c966084e553abb35f00aeaab59038b11d9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 31 Dec 2024 04:13:25 +0100 Subject: [PATCH 195/290] avformat/vqf: Propagate errors from add_metadata() Suggested-by: Marton Balint Reviewed-by: Alexander Strasser Signed-off-by: Michael Niedermayer (cherry picked from commit 49fa3f6c5ba6d43cc4b3ade4f8d9dc2fdbc71f0a) Signed-off-by: Michael Niedermayer --- libavformat/vqf.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/libavformat/vqf.c b/libavformat/vqf.c index 79deb33744..58b1546f53 100644 --- a/libavformat/vqf.c +++ b/libavformat/vqf.c @@ -51,23 +51,28 @@ static int vqf_probe(const AVProbeData *probe_packet) return AVPROBE_SCORE_EXTENSION; } -static void add_metadata(AVFormatContext *s, uint32_t tag, +static int add_metadata(AVFormatContext *s, uint32_t tag, unsigned int tag_len, unsigned int remaining) { int len = FFMIN(tag_len, remaining); char *buf, key[5] = {0}; + int ret; if (len == UINT_MAX) - return; + return AVERROR_INVALIDDATA; buf = av_malloc(len+1); if (!buf) - return; - if (len != avio_read(s->pb, buf, len)) - return; + return AVERROR(ENOMEM); + + ret = avio_read(s->pb, buf, len); + if (ret < 0) + return ret; + if (len != ret) + return AVERROR_INVALIDDATA; buf[len] = 0; AV_WL32(key, tag); - av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL); + return av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL); } static const AVMetadataConv vqf_metadata_conv[] = { @@ -165,7 +170,9 @@ static int vqf_read_header(AVFormatContext *s) avio_skip(s->pb, FFMIN(len, header_size)); break; default: - add_metadata(s, chunk_tag, len, header_size); + ret = add_metadata(s, chunk_tag, len, header_size); + if (ret < 0) + return ret; break; } From f710d5af0a749c0c2e29eac3a202b211791562a7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 1 Jan 2025 05:03:08 +0100 Subject: [PATCH 196/290] avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex Fixes: use-of-uninitialized-value Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit e81d410242ea604c4f667da4a415836c1575d72f) Signed-off-by: Michael Niedermayer --- libavcodec/cbs_vp9.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_vp9.c b/libavcodec/cbs_vp9.c index 816d06da04..ff99fe32fb 100644 --- a/libavcodec/cbs_vp9.c +++ b/libavcodec/cbs_vp9.c @@ -375,7 +375,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx, superframe_header = frag->data[frag->data_size - 1]; if ((superframe_header & 0xe0) == 0xc0) { - VP9RawSuperframeIndex sfi; + VP9RawSuperframeIndex sfi = {0}; GetBitContext gbc; size_t index_size, pos; int i; From 1646840988ed12aefc35ef283bb44f91df277ad9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 26 Dec 2024 02:53:45 +0100 Subject: [PATCH 197/290] avformat/wtvdec: Initialize buf ff_parse_mpeg2_descriptor() reads over what is initialized Fixes: use of uninitialized memory Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 17b019c517af26c6d2f0c6266938c60d36db1fa3) Signed-off-by: Michael Niedermayer --- libavformat/wtvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index 730c7fca78..21c9649869 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -833,7 +833,7 @@ static int parse_chunks(AVFormatContext *s, int mode, int64_t seekts, int *len_p int stream_index = ff_find_stream_index(s, sid); if (stream_index >= 0) { AVStream *st = s->streams[stream_index]; - uint8_t buf[258]; + uint8_t buf[258] = {0}; const uint8_t *pbuf = buf; int buf_size; From 43eaca54bc88f86be84b3c7b276bd03a71a72653 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 26 Dec 2024 03:07:51 +0100 Subject: [PATCH 198/290] avformat/ipmovie: Check signature_buffer read Fixes: use of uninitilaized data Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 788abe0d253b2034af15876d7889265d4746df2b) Signed-off-by: Michael Niedermayer --- libavformat/ipmovie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/ipmovie.c b/libavformat/ipmovie.c index 5d1748953a..3701be276f 100644 --- a/libavformat/ipmovie.c +++ b/libavformat/ipmovie.c @@ -614,7 +614,8 @@ static int ipmovie_read_header(AVFormatContext *s) ipmovie->avf = s; - avio_read(pb, signature_buffer, sizeof(signature_buffer)); + if (avio_read(pb, signature_buffer, sizeof(signature_buffer)) != sizeof(signature_buffer)) + return AVERROR_INVALIDDATA; while (memcmp(signature_buffer, signature, sizeof(signature))) { memmove(signature_buffer, signature_buffer + 1, sizeof(signature_buffer) - 1); signature_buffer[sizeof(signature_buffer) - 1] = avio_r8(pb); From 5f337bd79837e1f7a94d934de21729062acd40b7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 26 Dec 2024 03:28:53 +0100 Subject: [PATCH 199/290] avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet() Fixes: Use of uninitialized memory Fixes: 377642312/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554550985424896 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit aec2933344b2b32fc931bdf0b46eef1bd42225ff) Signed-off-by: Michael Niedermayer --- libavformat/iamf_reader.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c index 9f3469b64f..d331e1315e 100644 --- a/libavformat/iamf_reader.c +++ b/libavformat/iamf_reader.c @@ -282,7 +282,7 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c, int read = 0; while (1) { - uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE]; + uint8_t header[MAX_IAMF_OBU_HEADER_SIZE + AV_INPUT_BUFFER_PADDING_SIZE] = {0}; enum IAMF_OBU_Type type; unsigned obu_size; unsigned skip_samples, discard_padding; @@ -294,6 +294,8 @@ int ff_iamf_read_packet(AVFormatContext *s, IAMFDemuxContext *c, size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size)); if (size < 0) return size; + if (size != FFMIN(MAX_IAMF_OBU_HEADER_SIZE, max_size)) + return AVERROR_INVALIDDATA; len = ff_iamf_parse_obu_header(header, size, &obu_size, &start_pos, &type, &skip_samples, &discard_padding); From 293e4ddd986f97622d887002820c61e895a348db Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 30 Nov 2024 01:48:22 +0100 Subject: [PATCH 200/290] avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream() Fixes: use of uninitialized memory Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit ef71552cf970876085d99834abdb8e429aea9730) Signed-off-by: Michael Niedermayer --- libavcodec/huffyuvdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c index a8ccb724f5..c98904d497 100644 --- a/libavcodec/huffyuvdec.c +++ b/libavcodec/huffyuvdec.c @@ -783,6 +783,8 @@ static void decode_gray_bitstream(HYuvDecContext *s, int count) for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) { READ_2PIX(s->temp[0][2 * i], s->temp[0][2 * i + 1], 0); } + for (; i < count; i++) + s->temp[0][2 * i] = s->temp[0][2 * i + 1] = 0; } else { for (i = 0; i < count; i++) { READ_2PIX(s->temp[0][2 * i], s->temp[0][2 * i + 1], 0); From a7a6d92e841815780f1fc137e60cc88317f634bd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Sep 2024 20:05:37 +0200 Subject: [PATCH 201/290] avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet() Fixes: Use of uninitialized memory Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 6ecc96f4d08d74b0590ab03f39f93f386910c4c0) Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index a263239288..682f724260 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -671,7 +671,8 @@ static int mxf_decrypt_triplet(AVFormatContext *s, AVPacket *pkt, KLVPacket *klv if (size < 32 || size - 32 < orig_size || (int)orig_size != orig_size) return AVERROR_INVALIDDATA; avio_read(pb, ivec, 16); - avio_read(pb, tmpbuf, 16); + if (avio_read(pb, tmpbuf, 16) != 16) + return AVERROR_INVALIDDATA; if (mxf->aesc) av_aes_crypt(mxf->aesc, tmpbuf, tmpbuf, 1, ivec, 1); if (memcmp(tmpbuf, checkv, 16)) From dc07f98934edb0d78d7a7cdacd65188af9423045 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 23 Jan 2025 01:21:59 +0100 Subject: [PATCH 202/290] Changelog: update Signed-off-by: Michael Niedermayer --- Changelog | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 186 insertions(+) diff --git a/Changelog b/Changelog index 17bec3ceee..56f7993e72 100644 --- a/Changelog +++ b/Changelog @@ -1,6 +1,192 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 7.1.1: + avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet() + avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream() + avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet() + avformat/ipmovie: Check signature_buffer read + avformat/wtvdec: Initialize buf + avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex + avformat/vqf: Propagate errors from add_metadata() + avformat/vqf: Check avio_read() in add_metadata() + avcodec/ffv1enc: Fix RCT for GBR colorspace + avformat/dashdec: Check whitelist + avutil/avstring: dont mess with NULL pointers in av_match_list() + avfilter/vf_v360: Fix NULL pointer use + avcodec/mpegvideo_enc: Check FLV1 resolution limits + avcodec/ffv1enc: Fix handling of 32bit unsigned symbols + avformat/mov: perform sanity checks for heif before index building + avformat/mov: Factorize sanity check out + avcodec/vc1dec: Clear block_index in vc1_decode_reset() + avcodec/aacsbr_template: Clear n_q on error + avformat/iamf_parse: Check output_channel_count + avcodec/osq: Fixes several undefined overflows in do_decode() + swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template() + avfilter/af_pan: Fix sscanf() use + avfilter/vf_grayworld: Use the correct pointer for av_log() + avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]() + avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video + avformat/jpegxl_anim_dec: clear buffer padding + avformat/rmdec: check that buf if completely filled + avcodec/cfhdenc: Clear dwt_tmp + avcodec/hapdec: Clear tex buffer + avformat/mxfdec: Check that key was read sucessfull + avformat/hevc: fix writing hvcC when no arrays are provided in hvcC-formatted input + avformat/rtpdec: int overflow in start_time_realtime + avcodec/decode: Fix incorrect enum type used in side_data_map() + avformat/mov: fix crash when trying to get a fragment time for a non-existing fragment + avformat/libssh: fix credential variables typo + avformat/hlsenc: check return value of avcodec_parameters_copy() + avformat/dashdec: format open_demux_for_component() + avformat/dashdec: check return code of avcodec_parameters_copy() + avformat/dashdec: return ret directly in open_demux_for_component() + avformat/smoothstreamingenc: check return value of avcodec_parameters_copy() + avcodec/cbs_av1: fix variable shadowing in cbs_av1_split_fragment() + doc/demuxers/dvdvideo: seeking is supported, remove outdated statement + avformat/dvdvideodec: check return code of ff_dvdclut_yuv_to_rgb() + avformat/dvdvideodec: fix missing last chapter marker due to off-by-one + avformat/dvdvideodec: don't allow seeking beyond dvdnav reported duration + avformat/dvdvideodec: discard duplicate or partial AC3 samples + avformat/dvdvideodec: drop packets with unset PTS or DTS + avformat/dvdvideodec: remove unnecessary need_parsing argument + avformat/dvdvideodec: open subdemuxer after initializing IFO headers + avformat/dvdvideodec: remove auto value for menu_lu option + avformat/dvdvideodec: default menu_vts option to 1 and clarify description + avformat/dvdvideodec: check the length of a NAV packet when reading titles + avformat/dvdvideodec: reset the subdemuxer on discontinuity instead of flushing + avformat/dvdvideodec: simplify dvdvideo_read_packet() + avformat/dvdvideodec: enable chapter calculation for menus + avformat/dvdvideodec: standardize the NAV packet event signal + avformat/dvdvideodec: move memcpy below missed NAV packet warning + avformat/dvdvideodec: remove "auto" value for -pg option, default to 1 + avformat/dvdvideodec: measure duration of the current menu VOBU in state + avformat/dvdvideodec: fix menu PGC number off-by-one in state + avformat/dvdvideodec: remove unused headers + lavc/aarch64: Fix ff_pred16x16_plane_neon_10 + lavc/aarch64: Fix ff_pred8x8_plane_neon_10 + aarch64/vvc: Fix clip in alf + vp9: recon: Use emulated edge to prevent buffer overflows + arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter + aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter + avformat/rpl: Fix check for negative values + avformat/mlvdec: Check avio_read() + avcodec/aac/aacdec: Free channel layout + avformat/mov: dereference pointer after null check + avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV + avformat/matroskadec: Check pre_ns for overflow + tools/target_dec_fuzzer: Adjust threshold for EACMV + tools/target_dec_fuzzer: Adjust threshold for MVC1 + tools/target_dec_fuzzer: Adjust Threshold for indeo5 + avutil/timecode: Avoid fps overflow in av_timecode_get_smpte_from_framenum() + avcodec/aac/aacdec_usac: Dont leave type at a invalid value + avcodec/aac/aacdec_usac: Clean ics2->max_sfb when first SCE fails + avcodec/webp: Check ref_x/y + avcodec/ilbcdec: Initialize tempbuff2 + swscale/swscale_unscaled: Fix odd height with nv24_to_yuv420p_chroma() + avcodec/hevc/hevcdec: initialize qp_y_tab + avformat/qcp: Check for read failure in header + avcodec/eatgq: Check bytestream2_get_buffer() for failure + avformat/dxa: check bpc + swscale/slice: clear allocated memory in alloc_lines() + avcodec/h2645_parse: Ignore NAL with nuh_layer_id == 63 + MAINTAINERS: Lauri is still available but is really low on time nowadays + MAINTAINERS: Remove Guillaume Poirier and Romain Dolbeau + avcodec/mjpegdec: Disallow progressive bayer images + avformat/icodec: fix integer overflow with nb_pal + doc/developer: Document relationship between git accounts and MAINTAINERS + doc/infra: Document trac backup system + doc/infra: Document gitolite + avformat/vividas: Check avio_read() for failure + avformat/ilbc: Check avio_read() for failure + avformat/nistspheredec: Clear buffer + avformat/mccdec: Initialize and check rate.den + avformat/rpl: check channels + INSTALL: explain the circular dependency issue and solution + avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen + avformat/mxfdec: Fix overflow in midpoint computation + swscale/output: used unsigned for bit accumulation + swscale/rgb2rgb_template: Fix ff_rgb24toyv12_c() with odd height + avcodec/rangecoder: only perform renorm check/loop for callers that need it + avcodec/ffv1: add a named constant for the quant table size + avcodec/ffv1: RCT is only possible with RGB + avcodec/ffv1enc: Fix RCT with RGB64 + avcodec/ffv1dec: Fix end computation with ec=2 + avcodec/ffv1enc: Move slice termination into threads + avcodec/ffv1enc: Prevent generation of files with broken slices + avformat/matroskadec: Check desc_bytes so bits fit in 64bit + avformat/mov: Avoid overflow in dts + avcodec/ffv1enc: Correct error message about unsupported version + avcodec/ffv1: Store and reuse sx/sy + avcodec/ffv1enc: Slice combination is unsupported + avcodec/ffv1enc: 2Pass mode is not possible with golomb coding + avfilter/buffersrc: check for valid sample rate + avcodec/libdav1d: clear the buffered Dav1dData on decoding failure + avformat/iamf_writer: ensure the stream groups are not empty + avformat/iamf_writer: fix setting num_samples_per_frame for OPUS + avformat/iamf_parse: fix setting duration for the last subblock in a parameter definition + avformat/iamf_parse: add checks to parameter definition durations + avformat/iamf_parse: reject ambisonics mode > 1 + checkasm: Print benchmarks of C-only functions + avcodec/ac3dec: fix downmix logic for eac3 + avcodec/codec_desc: remove Intra Only prop for AAC + avcodec/mediacodecdec: set set keyframe flag in output frames + avcodec/libfdk-aacenc: set keyframe in output packets + avcodec/libfdk-aacdec: set keyframe flag and profile in output frames + avcodec/audiotoolboxnec: set set keyframe flag in output packets + avcodec/audiotoolboxdec: set set keyframe flag in output frames + avcodec/aacenc: set keyframe flag in output packets + avcodec/aac/aacdec: set keyframe flag in output frames + avcodec/aac_parser: set key_frame and profile + avformat/mov: don't unconditionally set all audio packets in fragments as key frames + avformat/matroskadec: set all frames in a keyframe simple box as keyframes + avformat/test/movenc: set audio packets as key frames + avformat/movenc: write stss boxes for xHE-AAC + avformat/spdifdec: parse headers for audio codecs + avformat/movenc: don't disable edit lists when writing CMAF output + avcodec/libfdk-aacenc: export CPB properties + avformat/movenc: don't write a calculated avgBitrate when the provided one is unset + libavutil/riscv: Make use of elf_aux_info() on FreeBSD / OpenBSD riscv + libavutil/ppc: defines involving bit shifts should be unsigned + libavutil/ppc: Include the hardware feature flags like the other archs + lavu/riscv: fix compilation without Vector support + avfilter/f_loop: fix aloop activate logic + avfilter/f_loop: fix length of aloop leftover buffer + avfilter/vf_zscale: align the frame buffers + lavfi/vf_zscale: fix call to av_pix_fmt_count_planes + lavfi/vf_zscale: fix tmp buffer ptr alignment for zimg_filter_graph_process + avfilter/framepool: align the frame buffers + avcodec/h2645_sei: use the RefStruct API for film_grain_characteristics + avcodec/aom_film_grain: allocate film grain metadata dynamically + avformat/mov: use an array of pointers for heif_item + avformat/mov: split off heif item initialization to its own function + avformat/mov: factorize getting the current item + lavc/h264idct: fix RISC-V group multiplier + lavc/h264dsp: move RISC-V fn pointers to .data.rel.ro + avcodec/jpegxl_parser: fix reading lz77-pair as initial entropy symbol + avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value + avcodec/cbs_h266: Fix regression in DVB clip introduced by 93281630a71c06642adfebebb0d4b105a4e02e91 + avcodec/x86/vvc: add prototypes for OF functions + Document stream specifier syntax change from 46cbe4ab5c + fftools/ffplay: fix crash when vk renderer is null + avutil/wchar_filename: re-introduce explicit cast of void* to char* + fate/ffmpeg: add samples dependency to fate-ffmpeg-spec-disposition + fftools/ffmpeg_filter: treat apad filter as a source + lavc/avcodec: fix global/private option precendence + avfilter/framesync: fix forward EOF pts + avcodec/vaapi_encode: fix compilation without CONFIG_VAAPI_1 + libavcodec: x86: Remove an explicit include of config.asm + checkasm: lls: Use relative tolerances rather than absolute ones + arm: Consistently use proper interworking function returns + avcodec/libx265: unbreak build for X265_BUILD >= 213 + fftools: log unconnected filter output label + fftools: do not access out of bounds filtergraph + avcodec/mediacodecenc: Fix access of uninitialized value + avformat/img2enc: Fix integer truncation when frame_pts is enabled + avformat/internal: Add ff_get_frame_filename + avformat/mov: don't return the latest stream when an item stream is expected + + version 7.1: - Raw Captions with Time (RCWT) closed caption demuxer - LC3/LC3plus decoding/encoding using external library liblc3 From a4bf50b5c0e9ea55f1bbadc38ce6fb690ece63d8 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 28 Jan 2025 21:23:11 -0300 Subject: [PATCH 203/290] avformat/mov: fix overflow in drift timestamp calculation Fixes: signed integer overflow: 7803923888585309955 - -3407677434275325337 cannot be represented in type 'int64_t' (aka 'long') Fixes: 377736723/clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5052449500889088 Signed-off-by: James Almer (cherry picked from commit 02958ab7156b4e14f1918f2b72c6d3678852698f) --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 695b975147..63e8fe31ff 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3545,7 +3545,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) current_dts += sc->stts_data[i].duration * (uint64_t)sample_count; if (current_dts > corrected_dts) { - int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1); + int64_t drift = av_sat_sub64(current_dts, corrected_dts) / FFMAX(sample_count, 1); uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1; current_dts -= correction * (uint64_t)sample_count; sc->stts_data[i].duration -= correction; From 8a72775d5dba3253c4ffd9b7ec91f73beda42641 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 27 Dec 2024 11:53:16 -0300 Subject: [PATCH 204/290] avutil/downmix_info: zero the allocated buffer Signed-off-by: James Almer (cherry picked from commit 0bed1b89530042f0a835b8d1178aa52b40a751f6) (cherry picked from commit a649b2a8313571fcec101143e9479299eb8bc214) --- libavutil/downmix_info.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavutil/downmix_info.c b/libavutil/downmix_info.c index c634c6a79f..83771a3051 100644 --- a/libavutil/downmix_info.c +++ b/libavutil/downmix_info.c @@ -27,9 +27,12 @@ AVDownmixInfo *av_downmix_info_update_side_data(AVFrame *frame) side_data = av_frame_get_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO); - if (!side_data) + if (!side_data) { side_data = av_frame_new_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO, sizeof(AVDownmixInfo)); + if (side_data) + memset(side_data->data, 0, sizeof(AVDownmixInfo)) + } if (!side_data) return NULL; From 57a53adf2b1237965ce6f5546398b1a81599be38 Mon Sep 17 00:00:00 2001 From: Steven Zhou Date: Sat, 23 Nov 2024 01:20:36 +0000 Subject: [PATCH 205/290] avfilter/drawtext: fix memory leak when using "reinit" runtime command Free AVOption in drawtext private context when freeing old copy of drawtext private context during processing of "reinit" runtime command. Signed-off-by: Steven Zhou Signed-off-by: James Almer (cherry picked from commit d1fa9cf4b496361ebae3c950153756c6f0baf501) --- libavfilter/vf_drawtext.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavfilter/vf_drawtext.c b/libavfilter/vf_drawtext.c index 4c55a01155..daaa1fd83a 100644 --- a/libavfilter/vf_drawtext.c +++ b/libavfilter/vf_drawtext.c @@ -1217,6 +1217,7 @@ static int command(AVFilterContext *ctx, const char *cmd, const char *arg, char ctx->priv = old; uninit(ctx); + av_opt_free(old); av_freep(&old); ctx->priv = new; From 8accee8b56a8be0485332e78b8d4cb14f6d27760 Mon Sep 17 00:00:00 2001 From: Patrice Dumas Date: Fri, 1 Nov 2024 15:57:07 +0100 Subject: [PATCH 206/290] doc/t2h: Support texinfo 7.1 and 7.2 pretest Here is a proposed patch for portability of doc/t2h.pm for GNU Texinfo 7.1 and 7.1.90 (7.2 pretest). I tested against 7.1 and 7.1.90 (7.2 pretest). There is a difference in the headings compared to the website version, maybe related to FA_ICONS not being set the same, but the result seems correct. I also renamed $element to $output_unit in ffmpeg_heading_command as in new equivalent makeinfo/texi2any code the $element variable is the $command variable in ffmpeg_heading_command, which is very confusing. I left as is the $command variable to have a patch easier to read, but it could make sense to rename $command as $element later on. The patch could also have effects with Texinfo 7.0, since some of the changes are for that version, but that probably never show up because it is for situations that may not exist in ffmpeg manuals (for example @node without sectioning command), or because the code is robust to some missing information (case of $heading_level in ffmpeg_heading_command that was not set, as far as I can tell). Signed-off-by: James Almer (cherry picked from commit 4d9cdf82ee36a7da4f065821c86165fe565aeac2) --- doc/t2h.pm | 169 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 129 insertions(+), 40 deletions(-) diff --git a/doc/t2h.pm b/doc/t2h.pm index b7485e1f1e..4875d66305 100644 --- a/doc/t2h.pm +++ b/doc/t2h.pm @@ -54,12 +54,24 @@ sub get_formatting_function($$) { } # determine texinfo version -my $program_version_num = version->declare(ff_get_conf('PACKAGE_VERSION'))->numify; +my $package_version = ff_get_conf('PACKAGE_VERSION'); +$package_version =~ s/\+dev$//; +my $program_version_num = version->declare($package_version)->numify; my $program_version_6_8 = $program_version_num >= 6.008000; # no navigation elements ff_set_from_init_file('HEADERS', 0); +my %sectioning_commands = %Texinfo::Common::sectioning_commands; +if (scalar(keys(%sectioning_commands)) == 0) { + %sectioning_commands = %Texinfo::Commands::sectioning_heading_commands; +} + +my %root_commands = %Texinfo::Common::root_commands; +if (scalar(keys(%root_commands)) == 0) { + %root_commands = %Texinfo::Commands::root_commands; +} + sub ffmpeg_heading_command($$$$$) { my $self = shift; @@ -77,6 +89,9 @@ sub ffmpeg_heading_command($$$$$) return $result; } + # no need to set it as the $element_id is output unconditionally + my $heading_id; + my $element_id = $self->command_id($command); $result .= "\n" if (defined($element_id) and $element_id ne ''); @@ -84,24 +99,40 @@ sub ffmpeg_heading_command($$$$$) print STDERR "Process $command " .Texinfo::Structuring::_print_root_command_texi($command)."\n" if ($self->get_conf('DEBUG')); - my $element; - if ($Texinfo::Common::root_commands{$command->{'cmdname'}} - and $command->{'parent'} - and $command->{'parent'}->{'type'} - and $command->{'parent'}->{'type'} eq 'element') { - $element = $command->{'parent'}; + my $output_unit; + if ($root_commands{$command->{'cmdname'}}) { + if ($command->{'associated_unit'}) { + $output_unit = $command->{'associated_unit'}; + } elsif ($command->{'structure'} + and $command->{'structure'}->{'associated_unit'}) { + $output_unit = $command->{'structure'}->{'associated_unit'}; + } elsif ($command->{'parent'} + and $command->{'parent'}->{'type'} + and $command->{'parent'}->{'type'} eq 'element') { + $output_unit = $command->{'parent'}; + } } - if ($element) { + + if ($output_unit) { $result .= &{get_formatting_function($self, 'format_element_header')}($self, $cmdname, - $command, $element); + $command, $output_unit); } my $heading_level; # node is used as heading if there is nothing else. if ($cmdname eq 'node') { - if (!$element or (!$element->{'extra'}->{'section'} - and $element->{'extra'}->{'node'} - and $element->{'extra'}->{'node'} eq $command + if (!$output_unit or + (((!$output_unit->{'extra'}->{'section'} + and $output_unit->{'extra'}->{'node'} + and $output_unit->{'extra'}->{'node'} eq $command) + or + ((($output_unit->{'extra'}->{'unit_command'} + and $output_unit->{'extra'}->{'unit_command'} eq $command) + or + ($output_unit->{'unit_command'} + and $output_unit->{'unit_command'} eq $command)) + and $command->{'extra'} + and not $command->{'extra'}->{'associated_section'})) # bogus node may not have been normalized and defined($command->{'extra'}->{'normalized'}))) { if ($command->{'extra'}->{'normalized'} eq 'Top') { @@ -111,7 +142,15 @@ sub ffmpeg_heading_command($$$$$) } } } else { - $heading_level = $command->{'level'}; + if (defined($command->{'extra'}) + and defined($command->{'extra'}->{'section_level'})) { + $heading_level = $command->{'extra'}->{'section_level'}; + } elsif ($command->{'structure'} + and defined($command->{'structure'}->{'section_level'})) { + $heading_level = $command->{'structure'}->{'section_level'}; + } else { + $heading_level = $command->{'level'}; + } } my $heading = $self->command_text($command); @@ -119,8 +158,8 @@ sub ffmpeg_heading_command($$$$$) # if there is an error in the node. if (defined($heading) and $heading ne '' and defined($heading_level)) { - if ($Texinfo::Common::root_commands{$cmdname} - and $Texinfo::Common::sectioning_commands{$cmdname}) { + if ($root_commands{$cmdname} + and $sectioning_commands{$cmdname}) { my $content_href = $self->command_contents_href($command, 'contents', $self->{'current_filename'}); if ($content_href) { @@ -140,7 +179,13 @@ sub ffmpeg_heading_command($$$$$) } } - if ($self->in_preformatted()) { + my $in_preformatted; + if ($program_version_num >= 7.001090) { + $in_preformatted = $self->in_preformatted_context(); + } else { + $in_preformatted = $self->in_preformatted(); + } + if ($in_preformatted) { $result .= $heading."\n"; } else { # if the level was changed, set the command name right @@ -149,21 +194,25 @@ sub ffmpeg_heading_command($$$$$) $cmdname = $Texinfo::Common::level_to_structuring_command{$cmdname}->[$heading_level]; } - # format_heading_text expects an array of headings for texinfo >= 7.0 if ($program_version_num >= 7.000000) { - $heading = [$heading]; - } - $result .= &{get_formatting_function($self,'format_heading_text')}( + $result .= &{get_formatting_function($self,'format_heading_text')}($self, + $cmdname, [$cmdname], $heading, + $heading_level +$self->get_conf('CHAPTER_HEADER_LEVEL') -1, + $heading_id, $command); + + } else { + $result .= &{get_formatting_function($self,'format_heading_text')}( $self, $cmdname, $heading, $heading_level + $self->get_conf('CHAPTER_HEADER_LEVEL') - 1, $command); + } } } $result .= $content if (defined($content)); return $result; } -foreach my $command (keys(%Texinfo::Common::sectioning_commands), 'node') { +foreach my $command (keys(%sectioning_commands), 'node') { texinfo_register_command_formatting($command, \&ffmpeg_heading_command); } @@ -188,28 +237,56 @@ sub ffmpeg_begin_file($$$) my $filename = shift; my $element = shift; - my $command; - if ($element and $self->get_conf('SPLIT')) { - $command = $self->element_command($element); + my ($element_command, $node_command, $command_for_title); + if ($element) { + if ($element->{'unit_command'}) { + $element_command = $element->{'unit_command'}; + } elsif ($self->can('tree_unit_element_command')) { + $element_command = $self->tree_unit_element_command($element); + } elsif ($self->can('tree_unit_element_command')) { + $element_command = $self->element_command($element); + } + + $node_command = $element_command; + if ($element_command and $element_command->{'cmdname'} + and $element_command->{'cmdname'} ne 'node' + and $element_command->{'extra'} + and $element_command->{'extra'}->{'associated_node'}) { + $node_command = $element_command->{'extra'}->{'associated_node'}; + } + + $command_for_title = $element_command if ($self->get_conf('SPLIT')); } - my ($title, $description, $encoding, $date, $css_lines, - $doctype, $bodytext, $copying_comment, $after_body_open, - $extra_head, $program_and_version, $program_homepage, + my ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype, + $root_html_element_attributes, $body_attributes, $copying_comment, + $after_body_open, $extra_head, $program_and_version, $program_homepage, $program, $generator); - if ($program_version_num >= 7.000000) { - ($title, $description, $encoding, $date, $css_lines, - $doctype, $bodytext, $copying_comment, $after_body_open, + if ($program_version_num >= 7.001090) { + ($title, $description, $keywords, $encoding, $date, $css_lines, $doctype, + $root_html_element_attributes, $body_attributes, $copying_comment, + $after_body_open, $extra_head, $program_and_version, $program_homepage, + $program, $generator) = $self->_file_header_information($command_for_title, + $filename); + } elsif ($program_version_num >= 7.000000) { + ($title, $description, $encoding, $date, $css_lines, $doctype, + $root_html_element_attributes, $copying_comment, $after_body_open, $extra_head, $program_and_version, $program_homepage, - $program, $generator) = $self->_file_header_information($command); + $program, $generator) = $self->_file_header_information($command_for_title, + $filename); } else { ($title, $description, $encoding, $date, $css_lines, - $doctype, $bodytext, $copying_comment, $after_body_open, - $extra_head, $program_and_version, $program_homepage, - $program, $generator) = $self->_file_header_informations($command); + $doctype, $root_html_element_attributes, $copying_comment, + $after_body_open, $extra_head, $program_and_version, $program_homepage, + $program, $generator) = $self->_file_header_informations($command_for_title); } - my $links = $self->_get_links ($filename, $element); + my $links; + if ($program_version_num >= 7.000000) { + $links = $self->_get_links($filename, $element, $node_command); + } else { + $links = $self->_get_links ($filename, $element); + } my $head1 = $ENV{"FFMPEG_HEADER1"} || < @@ -252,13 +329,25 @@ sub ffmpeg_program_string($) if (defined($self->get_conf('PROGRAM')) and $self->get_conf('PROGRAM') ne '' and defined($self->get_conf('PACKAGE_URL'))) { - return $self->convert_tree( + if ($program_version_num >= 7.001090) { + return $self->convert_tree( + $self->cdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.', + { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')}, + 'program' => {'text' => $self->get_conf('PROGRAM') }})); + } else { + return $self->convert_tree( $self->gdt('This document was generated using @uref{{program_homepage}, @emph{{program}}}.', - { 'program_homepage' => $self->get_conf('PACKAGE_URL'), - 'program' => $self->get_conf('PROGRAM') })); + { 'program_homepage' => {'text' => $self->get_conf('PACKAGE_URL')}, + 'program' => {'text' => $self->get_conf('PROGRAM') }})); + } } else { - return $self->convert_tree( - $self->gdt('This document was generated automatically.')); + if ($program_version_num >= 7.001090) { + return $self->convert_tree( + $self->cdt('This document was generated automatically.')); + } else { + return $self->convert_tree( + $self->gdt('This document was generated automatically.')); + } } } if ($program_version_6_8) { From e0f3c1018a0973abb18e240cbf0bc98daf15f6b6 Mon Sep 17 00:00:00 2001 From: James Almer Date: Thu, 6 Feb 2025 18:44:04 -0300 Subject: [PATCH 207/290] avutil/downmix_info: add missing semicolon Fixes compilation broken by 8a72775d5dba3253c4ffd9b7ec91f73beda42641. Signed-off-by: James Almer --- libavutil/downmix_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavutil/downmix_info.c b/libavutil/downmix_info.c index 83771a3051..7e6c3e854d 100644 --- a/libavutil/downmix_info.c +++ b/libavutil/downmix_info.c @@ -31,7 +31,7 @@ AVDownmixInfo *av_downmix_info_update_side_data(AVFrame *frame) side_data = av_frame_new_side_data(frame, AV_FRAME_DATA_DOWNMIX_INFO, sizeof(AVDownmixInfo)); if (side_data) - memset(side_data->data, 0, sizeof(AVDownmixInfo)) + memset(side_data->data, 0, sizeof(AVDownmixInfo)); } if (!side_data) From 31f0084cbbaa863af4a733bd9fb8202388ac5c4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 24 Jan 2025 23:32:52 +0200 Subject: [PATCH 208/290] configure: Improve the check for the rsync --contimeout option MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Traditionally, macOS has shipped an old version of rsync that lacked support for this option, hence this check (added in a8b3f0c5cf548f654e30c981988bb71981a3f8d3). However, in macOS 15.x, Apple have switched to providing rsync as a different tool, openrsync. The version of openrsync in at least macOS 15.2 does include "[--contimeout]" (note the lack of "=" after the option), in the output of "rsync --help", but when used, the tool errors out with "rsync: --contimeout=60: unknown option". So apparently the tool erroenously lists the option as supported, while it really isn't. The original rsync tool (with a new enough version) prints "--contimeout=SECONDS" in the output of "rsync --help". It is unclear which version of openrsync Apple are shipping; the latest upstream openrsync from OpenBSD does support the option and includes "[--contimeout=seconds]" in the output of "--help", and older versions don't seem to include the option as listed at all. Therefore, check for "--conntimeout=" with the "=", this should properly detect both new enough rsync and openrsync. This fixes running "fate-rsync" on macOS 15.x. Signed-off-by: Martin Storsjö (cherry picked from commit 3cd4e8470a1ef82223d124523f8219691dfefb60) --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index d77a55b653..9c013505f2 100755 --- a/configure +++ b/configure @@ -7175,7 +7175,7 @@ enabled makeinfo \ disabled makeinfo_html && texi2html --help 2> /dev/null | grep -q 'init-file' && enable texi2html || disable texi2html perl -v > /dev/null 2>&1 && enable perl || disable perl pod2man --help > /dev/null 2>&1 && enable pod2man || disable pod2man -rsync --help 2> /dev/null | grep -q 'contimeout' && enable rsync_contimeout || disable rsync_contimeout +rsync --help 2> /dev/null | grep -q 'contimeout=' && enable rsync_contimeout || disable rsync_contimeout xmllint --version > /dev/null 2>&1 && enable xmllint || disable xmllint check_headers linux/fb.h From ac494b8325cc9612a382e9762e1f4c7819009c0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Thu, 23 Jan 2025 12:53:10 +0200 Subject: [PATCH 209/290] rtmpproto: Avoid rare crashes in the fail: codepath in rtmp_open MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When running the cleanup in rtmp_close on failures in rtmp_open, we can in rare cases end up using rt->playpath, assuming that it is still set. The crash could happen if we hit the fail codepath in rtmp_open while publishing (rt->is_input == 0) with rt->state set to a value > STATE_FCPUBLISH. This would normally not happen while publishing; either we have an error (and rt->state <= STATE_FCPUBLISH) or we reach rt->state = STATE_PUBLISHING, and then we also return successfully from rtmp_open. The unexpected combination of states could happen if the server responds with e.g. "NetStream.Play.Stop" while expecting "NetStream.Publish.Start"; this sets rt->state to STATE_STOPPED, which also fulfills the condition "> STATE_FCPUBLISH". We don't need to free the rt->playpath/tcurl/flashver strings here; they're handled via AVOption, and thus are freed automatically when the protocol instance is freed (that's why they aren't freed manually within the rtmp_close function either). We also don't need to free the AVDictionary with options; it's owned by the caller. A smaller fix would be to just call rtmp_close before freeing the strings and dictionary, but as we don't need to free them at all, let's remove that redundant code. Signed-off-by: Martin Storsjö (cherry picked from commit 8f4819ce01584e0858fdc312aa8a17c55e350a92) --- libavformat/rtmpproto.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index b3b1eedacb..91f18b6088 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -2918,10 +2918,6 @@ reconnect: return 0; fail: - av_freep(&rt->playpath); - av_freep(&rt->tcurl); - av_freep(&rt->flashver); - av_dict_free(opts); rtmp_close(s); return ret; } From f2b85c8aa1e194c62e16493f28487765c006c7d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Wed, 5 Feb 2025 22:51:56 +0200 Subject: [PATCH 210/290] x86: aacencdsp: Fix negating signed values in aac_quantize_bands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, we would do OR with the sign bit, forcing the output to a negative value, while we want to negate it, by inverting the sign bit. Signed-off-by: Martin Storsjö (cherry picked from commit 8b3e0061e10bf6d4224813774c537866c6b23b12) --- libavcodec/x86/aacencdsp.asm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/x86/aacencdsp.asm b/libavcodec/x86/aacencdsp.asm index 86eaebcbe5..8e435b7d2a 100644 --- a/libavcodec/x86/aacencdsp.asm +++ b/libavcodec/x86/aacencdsp.asm @@ -96,7 +96,7 @@ cglobal aac_quantize_bands, 5, 5, 6, out, in, scaled, size, is_signed, maxval, Q addps m2, m1 minps m2, m3 andps m5, m4, [inq+sizeq] - orps m2, m5 + xorps m2, m5 cvttps2dq m2, m2 mova [outq+sizeq], m2 add sizeq, mmsize From 283e5a4fa071d43f0d539dfaa33443668a0a6dc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Wed, 29 Jan 2025 10:55:22 +0200 Subject: [PATCH 211/290] checkasm: aacencdsp: Actually test nonzero values in quant_bands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, we read elements from ff_aac_pow34sf_tab; however that table is initialized to zero; one needs to call ff_aac_float_common_init() to make sure that the table is initialized. However, given the range of the input values, a large number of entries in ff_aac_pow34sf_tab would give results outside of the range for signed 32 bit integers. As the largest aac_cb_maxval entry is 16, it seems more reasonable to produce values within an order of mangitude of that value. (When hitting INT_MIN, implementations may end up with different results depending on whether the value is negated as a float or as an int. This corner case is irrelevant in practice as this is way outside of the expected value range here.) Coincidentally, this fixes linking checkasm with Apple's older linker. (In Xcode 15, Apple switched to a new linker. The one in older toolchains seems to have a bug where it won't figure out to load object files from a static library, if the only symbol referenced in the object file is a "common" symbol, i.e. one for a zero-initialized variable. This issue can also be reproduced with newer Apple toolchains by passing -Wl,-ld_classic to the linker.) Signed-off-by: Martin Storsjö (cherry picked from commit e75a0f3c75551dfb57e0b4f34fd5b57e9543fade) --- tests/checkasm/aacencdsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/checkasm/aacencdsp.c b/tests/checkasm/aacencdsp.c index 5308a2ac03..713284211c 100644 --- a/tests/checkasm/aacencdsp.c +++ b/tests/checkasm/aacencdsp.c @@ -67,7 +67,7 @@ static void test_abs_pow34(AACEncDSPContext *s) static void test_quant_bands(AACEncDSPContext *s) { int maxval = randomize_elem(aac_cb_maxval); - float q34 = randomize_elem(ff_aac_pow34sf_tab); + float q34 = (float)rnd() / (UINT_MAX / 1024); float rounding = (rnd() & 1) ? ROUND_TO_ZERO : ROUND_STANDARD; LOCAL_ALIGNED_16(float, in, [BUF_SIZE]); LOCAL_ALIGNED_16(float, scaled, [BUF_SIZE]); From 745e70f1d5b01db845a8e3d05b6ecf04ed0dd70e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Thu, 12 Dec 2024 14:27:25 +0200 Subject: [PATCH 212/290] fate: Add a dependency on ffprobe for fate-flcl1905 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes occasional failed tests, if doing "make fate" without a regular "make" or "make all" inbetween. Signed-off-by: Martin Storsjö (cherry picked from commit eb79c316c7b205f45e7003e91f77c253818e6685) --- tests/fate/audio.mak | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/fate/audio.mak b/tests/fate/audio.mak index 4d6c479b6b..6e091760ea 100644 --- a/tests/fate/audio.mak +++ b/tests/fate/audio.mak @@ -82,10 +82,12 @@ fate-smacker-audio: CMD = framecrc -i $(TARGET_SAMPLES)/smacker/wetlogo.smk -vn FATE_SAMPLES_AUDIO-$(call DEMDEC, WSVQA, WS_SND1, ARESAMPLE_FILTER) += fate-ws_snd fate-ws_snd: CMD = md5 -i $(TARGET_SAMPLES)/vqa/ws_snd.vqa -f s16le -af aresample -FATE_SAMPLES_AUDIO-$(call DEMDEC, WAV, WMAV2, FILE_PROTOCOL) += fate-flcl1905 +FATE_SAMPLES_AUDIO_FFPROBE-$(call DEMDEC, WAV, WMAV2, FILE_PROTOCOL) += fate-flcl1905 fate-flcl1905: CMD = run ffprobe$(PROGSSUF)$(EXESUF) -show_frames -show_packets -print_format compact $(TARGET_SAMPLES)/wav/FLCL_Ending_My-short.wav FATE_SAMPLES_AUDIO += $(FATE_SAMPLES_AUDIO-yes) +FATE_SAMPLES_AUDIO_FFPROBE += $(FATE_SAMPLES_AUDIO_FFPROBE-yes) FATE_SAMPLES_FFMPEG += $(FATE_SAMPLES_AUDIO) -fate-audio: $(FATE_SAMPLES_AUDIO) +FATE_SAMPLES_FFPROBE += $(FATE_SAMPLES_AUDIO_FFPROBE) +fate-audio: $(FATE_SAMPLES_AUDIO) $(FATE_SAMPLES_AUDIO_FFPROBE) From 8cabfd922a726a964eeae8b5276583f470df39c3 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 10 Oct 2024 16:01:21 +0200 Subject: [PATCH 213/290] lavc/hevcdec: unbreak WPP/progress2 code The "progress2" API in pthread_slice.c currently associates a progress value with a thread rather than a job, relying on the broken assumption that a job's thread number is equal to its job number modulo thread count. This removes this API entirely, and changes hevcdec to use a ThreadProgress-based implementation that associates a mutex/cond/progress value with every job. Fixes races and deadlocks in hevdec with slice threading, e.g. some of those mentioned in #11221. (cherry picked from commit 79c47dfd25f101b6842bbec8c6ffef8d5077c3ae) --- libavcodec/hevc/hevcdec.c | 57 ++++++++++++++++----- libavcodec/hevc/hevcdec.h | 3 ++ libavcodec/pthread_slice.c | 102 ------------------------------------- libavcodec/thread.h | 4 -- libavcodec/utils.c | 19 ------- 5 files changed, 46 insertions(+), 139 deletions(-) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 6fe72bd297..6f0ae12558 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -54,6 +54,7 @@ #include "progressframe.h" #include "refstruct.h" #include "thread.h" +#include "threadprogress.h" static const uint8_t hevc_pel_weight[65] = { [2] = 0, [4] = 1, [6] = 2, [8] = 3, [12] = 4, [16] = 5, [24] = 6, [32] = 7, [48] = 8, [64] = 9 }; @@ -2751,6 +2752,8 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist, const uint8_t *data = s->data + s->sh.offset[ctb_row]; const size_t data_size = s->sh.size[ctb_row]; + int progress = 0; + int ret; if (ctb_row) @@ -2762,13 +2765,15 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist, hls_decode_neighbour(lc, l, pps, sps, x_ctb, y_ctb, ctb_addr_ts); - ff_thread_await_progress2(s->avctx, ctb_row, thread, SHIFT_CTB_WPP); + if (ctb_row) + ff_thread_progress_await(&s->wpp_progress[ctb_row - 1], + progress + SHIFT_CTB_WPP + 1); /* atomic_load's prototype requires a pointer to non-const atomic variable * (due to implementations via mutexes, where reads involve writes). * Of course, casting const away here is nevertheless safe. */ if (atomic_load((atomic_int*)&s->wpp_err)) { - ff_thread_report_progress2(s->avctx, ctb_row , thread, SHIFT_CTB_WPP); + ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX); return 0; } @@ -2792,19 +2797,19 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist, ctb_addr_ts++; ff_hevc_save_states(lc, pps, ctb_addr_ts); - ff_thread_report_progress2(s->avctx, ctb_row, thread, 1); + ff_thread_progress_report(&s->wpp_progress[ctb_row], ++progress); ff_hevc_hls_filters(lc, l, pps, x_ctb, y_ctb, ctb_size); if (!more_data && (x_ctb+ctb_size) < sps->width && ctb_row != s->sh.num_entry_point_offsets) { /* Casting const away here is safe, because it is an atomic operation. */ atomic_store((atomic_int*)&s->wpp_err, 1); - ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP); + ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX); return 0; } if ((x_ctb+ctb_size) >= sps->width && (y_ctb+ctb_size) >= sps->height ) { ff_hevc_hls_filter(lc, l, pps, x_ctb, y_ctb, ctb_size); - ff_thread_report_progress2(s->avctx, ctb_row , thread, SHIFT_CTB_WPP); + ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX); return ctb_addr_ts; } ctb_addr_rs = pps->ctb_addr_ts_to_rs[ctb_addr_ts]; @@ -2814,17 +2819,43 @@ static int hls_decode_entry_wpp(AVCodecContext *avctx, void *hevc_lclist, break; } } - ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP); + ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX); return 0; error: l->tab_slice_address[ctb_addr_rs] = -1; /* Casting const away here is safe, because it is an atomic operation. */ atomic_store((atomic_int*)&s->wpp_err, 1); - ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP); + ff_thread_progress_report(&s->wpp_progress[ctb_row], INT_MAX); return ret; } +static int wpp_progress_init(HEVCContext *s, unsigned count) +{ + if (s->nb_wpp_progress < count) { + void *tmp = av_realloc_array(s->wpp_progress, count, + sizeof(*s->wpp_progress)); + if (!tmp) + return AVERROR(ENOMEM); + + s->wpp_progress = tmp; + memset(s->wpp_progress + s->nb_wpp_progress, 0, + (count - s->nb_wpp_progress) * sizeof(*s->wpp_progress)); + + for (int i = s->nb_wpp_progress; i < count; i++) { + int ret = ff_thread_progress_init(&s->wpp_progress[i], 1); + if (ret < 0) + return ret; + s->nb_wpp_progress = i + 1; + } + } + + for (int i = 0; i < count; i++) + ff_thread_progress_reset(&s->wpp_progress[i]); + + return 0; +} + static int hls_slice_data_wpp(HEVCContext *s, const H2645NAL *nal) { const HEVCPPS *const pps = s->pps; @@ -2909,7 +2940,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const H2645NAL *nal) } atomic_store(&s->wpp_err, 0); - res = ff_slice_thread_allocz_entries(s->avctx, s->sh.num_entry_point_offsets + 1); + res = wpp_progress_init(s, s->sh.num_entry_point_offsets + 1); if (res < 0) return res; @@ -3827,6 +3858,10 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx) ff_hevc_ps_uninit(&s->ps); + for (int i = 0; i < s->nb_wpp_progress; i++) + ff_thread_progress_destroy(&s->wpp_progress[i]); + av_freep(&s->wpp_progress); + av_freep(&s->sh.entry_point_offset); av_freep(&s->sh.offset); av_freep(&s->sh.size); @@ -3981,12 +4016,6 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx) HEVCContext *s = avctx->priv_data; int ret; - if (avctx->active_thread_type & FF_THREAD_SLICE) { - ret = ff_slice_thread_init_progress(avctx); - if (ret < 0) - return ret; - } - ret = hevc_init_context(avctx); if (ret < 0) return ret; diff --git a/libavcodec/hevc/hevcdec.h b/libavcodec/hevc/hevcdec.h index 6ba2ca3887..473709b4e8 100644 --- a/libavcodec/hevc/hevcdec.h +++ b/libavcodec/hevc/hevcdec.h @@ -540,6 +540,9 @@ typedef struct HEVCContext { /** The target for the common_cabac_state of the local contexts. */ HEVCCABACState cabac; + struct ThreadProgress *wpp_progress; + unsigned nb_wpp_progress; + atomic_int wpp_err; const uint8_t *data; diff --git a/libavcodec/pthread_slice.c b/libavcodec/pthread_slice.c index a4d31c6f4d..ac455e48ed 100644 --- a/libavcodec/pthread_slice.c +++ b/libavcodec/pthread_slice.c @@ -41,11 +41,6 @@ typedef int (action_func)(AVCodecContext *c, void *arg); typedef int (action_func2)(AVCodecContext *c, void *arg, int jobnr, int threadnr); typedef int (main_func)(AVCodecContext *c); -typedef struct Progress { - pthread_cond_t cond; - pthread_mutex_t mutex; -} Progress; - typedef struct SliceThreadContext { AVSliceThread *thread; action_func *func; @@ -54,11 +49,6 @@ typedef struct SliceThreadContext { void *args; int *rets; int job_size; - - int *entries; - int entries_count; - int thread_count; - Progress *progress; } SliceThreadContext; static void main_function(void *priv) { @@ -82,18 +72,9 @@ static void worker_func(void *priv, int jobnr, int threadnr, int nb_jobs, int nb void ff_slice_thread_free(AVCodecContext *avctx) { SliceThreadContext *c = avctx->internal->thread_ctx; - int i; avpriv_slicethread_free(&c->thread); - for (i = 0; i < c->thread_count; i++) { - Progress *const progress = &c->progress[i]; - pthread_mutex_destroy(&progress->mutex); - pthread_cond_destroy(&progress->cond); - } - - av_freep(&c->entries); - av_freep(&c->progress); av_freep(&avctx->internal->thread_ctx); } @@ -175,86 +156,3 @@ int ff_slice_thread_init(AVCodecContext *avctx) avctx->execute2 = thread_execute2; return 0; } - -int av_cold ff_slice_thread_init_progress(AVCodecContext *avctx) -{ - SliceThreadContext *const p = avctx->internal->thread_ctx; - int err, i = 0, thread_count = avctx->thread_count; - - p->progress = av_calloc(thread_count, sizeof(*p->progress)); - if (!p->progress) { - err = AVERROR(ENOMEM); - goto fail; - } - - for (; i < thread_count; i++) { - Progress *const progress = &p->progress[i]; - err = pthread_mutex_init(&progress->mutex, NULL); - if (err) { - err = AVERROR(err); - goto fail; - } - err = pthread_cond_init (&progress->cond, NULL); - if (err) { - err = AVERROR(err); - pthread_mutex_destroy(&progress->mutex); - goto fail; - } - } - err = 0; -fail: - p->thread_count = i; - return err; -} - -void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n) -{ - SliceThreadContext *p = avctx->internal->thread_ctx; - Progress *const progress = &p->progress[thread]; - int *entries = p->entries; - - pthread_mutex_lock(&progress->mutex); - entries[field] +=n; - pthread_cond_signal(&progress->cond); - pthread_mutex_unlock(&progress->mutex); -} - -void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift) -{ - SliceThreadContext *p = avctx->internal->thread_ctx; - Progress *progress; - int *entries = p->entries; - - if (!entries || !field) return; - - thread = thread ? thread - 1 : p->thread_count - 1; - progress = &p->progress[thread]; - - pthread_mutex_lock(&progress->mutex); - while ((entries[field - 1] - entries[field]) < shift){ - pthread_cond_wait(&progress->cond, &progress->mutex); - } - pthread_mutex_unlock(&progress->mutex); -} - -int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count) -{ - if (avctx->active_thread_type & FF_THREAD_SLICE) { - SliceThreadContext *p = avctx->internal->thread_ctx; - - if (p->entries_count == count) { - memset(p->entries, 0, p->entries_count * sizeof(*p->entries)); - return 0; - } - av_freep(&p->entries); - - p->entries = av_calloc(count, sizeof(*p->entries)); - if (!p->entries) { - p->entries_count = 0; - return AVERROR(ENOMEM); - } - p->entries_count = count; - } - - return 0; -} diff --git a/libavcodec/thread.h b/libavcodec/thread.h index 47c00a0ed2..7df5839ed0 100644 --- a/libavcodec/thread.h +++ b/libavcodec/thread.h @@ -56,10 +56,6 @@ int ff_thread_get_buffer(AVCodecContext *avctx, AVFrame *f, int flags); int ff_slice_thread_execute_with_mainfunc(AVCodecContext *avctx, int (*action_func2)(AVCodecContext *c, void *arg, int jobnr, int threadnr), int (*main_func)(AVCodecContext *c), void *arg, int *ret, int job_count); -int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count); -int ff_slice_thread_init_progress(AVCodecContext *avctx); -void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n); -void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift); enum ThreadingStatus { FF_THREAD_IS_COPY, diff --git a/libavcodec/utils.c b/libavcodec/utils.c index a63ca71a44..6909a5ba2b 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -913,25 +913,6 @@ int ff_thread_can_start_frame(AVCodecContext *avctx) { return 1; } - -int ff_slice_thread_init_progress(AVCodecContext *avctx) -{ - return 0; -} - -int ff_slice_thread_allocz_entries(AVCodecContext *avctx, int count) -{ - return 0; -} - -void ff_thread_await_progress2(AVCodecContext *avctx, int field, int thread, int shift) -{ -} - -void ff_thread_report_progress2(AVCodecContext *avctx, int field, int thread, int n) -{ -} - #endif const uint8_t *avpriv_find_start_code(const uint8_t *restrict p, From 04fd3f69b3c3b608ca2654e3688dae7adc3adc8d Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 13 Jan 2025 17:28:02 -0300 Subject: [PATCH 214/290] avformat/iamf_parse: add missing av_free() call on failure path Fixes ticket #11416 Signed-off-by: James Almer (cherry picked from commit d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd) --- libavformat/iamf_parse.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 1ec6924908..1ccb1007e9 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -565,6 +565,7 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, if (!mode && !constant_subblock_duration && total_duration != duration) { av_log(s, AV_LOG_ERROR, "Invalid subblock durations in parameter_id %u\n", parameter_id); + av_free(param); return AVERROR_INVALIDDATA; } From b06845c6727a7c4391a7d5f607ae078aa0073c43 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 17 Feb 2025 11:41:24 -0300 Subject: [PATCH 215/290] avformat/iamf_parse: add missing constrains for num_parameters in audio_element_oub() Fixes ticket #11475. Signed-off-by: James Almer (cherry picked from commit 0526535cd58444dd264e810b2f3348b4d96cff3b) --- libavformat/iamf_parse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 1ccb1007e9..7c784c6955 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -728,6 +728,12 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) } num_parameters = ffio_read_leb(pbc); + if (num_parameters > 2 && audio_element_type == 0) { + av_log(s, AV_LOG_ERROR, "Audio Element parameter count %u is invalid" + " for Channel representations\n", num_parameters); + ret = AVERROR_INVALIDDATA; + goto fail; + } if (num_parameters && audio_element_type != 0) { av_log(s, AV_LOG_ERROR, "Audio Element parameter count %u is invalid" " for Scene representations\n", num_parameters); From 9abf2aef37a4c1bd81f89a9ff76dfee3e61710e6 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 17 Feb 2025 11:41:25 -0300 Subject: [PATCH 216/290] avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements Should prevent potential memory leaks on invalid files. Signed-off-by: James Almer (cherry picked from commit 5470d024e18968b3bdef2b745966f7617f1eb9f2) --- libavformat/iamf_parse.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 7c784c6955..7b3b1e87fa 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -747,11 +747,19 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) type = ffio_read_leb(pbc); if (type == AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN) ret = AVERROR_INVALIDDATA; - else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING) + else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING) { + if (element->demixing_info) { + ret = AVERROR_INVALIDDATA; + goto fail; + } ret = param_parse(s, c, pbc, type, audio_element, &element->demixing_info); - else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) + } else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) { + if (element->recon_gain_info) { + ret = AVERROR_INVALIDDATA; + goto fail; + } ret = param_parse(s, c, pbc, type, audio_element, &element->recon_gain_info); - else { + } else { unsigned param_definition_size = ffio_read_leb(pbc); avio_skip(pbc, param_definition_size); } From b753bac08f6881b2d3dea8f1ab84c81550f35897 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 16 Jan 2025 01:28:46 +0100 Subject: [PATCH 217/290] avformat/hls: Be more picky on extensions This blocks disallowed extensions from probing It also requires all available segments to have matching extensions to the format mpegts is treated independent of the extension It is recommended to set the whitelists correctly instead of depending on extensions, but this should help a bit, and this is easier to backport Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification The other parts of CVE-2023-6602 have been fixed by prior commits Found-by: Harvey Phillips of Amazon Element55 (element55) Signed-off-by: Michael Niedermayer (cherry picked from commit 91d96dc8ddaebe0b6cb393f672085e6bfaf15a31) Signed-off-by: Michael Niedermayer --- doc/demuxers.texi | 7 +++++++ libavformat/hls.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index cc81c615dd..2324b3b469 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -564,6 +564,13 @@ prefer to use #EXT-X-START if it's in playlist instead of live_start_index. @item allowed_extensions ',' separated list of file extensions that hls is allowed to access. +@item extension_picky +This blocks disallowed extensions from probing +It also requires all available segments to have matching extensions to the format +except mpegts, which is always allowed. +It is recommended to set the whitelists correctly instead of depending on extensions +Enabled by default. + @item max_reload Maximum number of times a insufficient list is attempted to be reloaded. Default value is 1000. diff --git a/libavformat/hls.c b/libavformat/hls.c index 62473a15dd..34abcb6e0d 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -223,6 +223,7 @@ typedef struct HLSContext { AVDictionary *avio_opts; AVDictionary *seg_format_opts; char *allowed_extensions; + int extension_picky; int max_reload; int http_persistent; int http_multiple; @@ -731,6 +732,40 @@ static int open_url(AVFormatContext *s, AVIOContext **pb, const char *url, return ret; } +static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct playlist *pls, struct segment *seg) +{ + HLSContext *c = s->priv_data; + int matchA = 3; + int matchF = 0; + + if (!c->extension_picky) + return 0; + + if (strcmp(c->allowed_extensions, "ALL")) + matchA = av_match_ext (seg->url, c->allowed_extensions) + + 2*(ff_match_url_ext(seg->url, c->allowed_extensions) > 0); + + if (!matchA) { + av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url); + return AVERROR_INVALIDDATA; + } + + if (in_fmt) { + if (in_fmt->extensions) { + matchF = av_match_ext( seg->url, in_fmt->extensions) + + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0); + } else if (!strcmp(in_fmt->name, "mpegts")) + matchF = 3; + + if (!(matchA & matchF)) { + av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches allowed extensions in url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url); + return AVERROR_INVALIDDATA; + } + } + + return 0; +} + static int parse_playlist(HLSContext *c, const char *url, struct playlist *pls, AVIOContext *in) { @@ -989,6 +1024,14 @@ static int parse_playlist(HLSContext *c, const char *url, goto fail; } + ret = test_segment(c->ctx, pls->ctx ? pls->ctx->iformat : NULL, pls, seg); + if (ret < 0) { + av_free(seg->url); + av_free(seg->key); + av_free(seg); + goto fail; + } + if (duration < 0.001 * AV_TIME_BASE) { av_log(c->ctx, AV_LOG_WARNING, "Cannot get correct #EXTINF value of segment %s," " set to default value to 1ms.\n", seg->url); @@ -2114,6 +2157,11 @@ static int hls_read_header(AVFormatContext *s) pls->ctx->interrupt_callback = s->interrupt_callback; url = av_strdup(pls->segments[0]->url); ret = av_probe_input_buffer(&pls->pb.pub, &in_fmt, url, NULL, 0, 0); + + for (int n = 0; n < pls->n_segments; n++) + if (ret >= 0) + ret = test_segment(s, in_fmt, pls, pls->segments[n]); + if (ret < 0) { /* Free the ctx - it isn't initialized properly at this point, * so avformat_close_input shouldn't be called. If @@ -2576,6 +2624,8 @@ static const AVOption hls_options[] = { OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"}, INT_MIN, INT_MAX, FLAGS}, + {"extension_picky", "Be picky with all extensions matching", + OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS}, {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded", OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 3}, 0, INT_MAX, FLAGS}, {"m3u8_hold_counters", "The maximum number of times to load m3u8 when it refreshes without new segments", From 9dea077922bce2e2e1359fc62b82448459ddcd42 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 28 Jan 2025 12:51:58 +0100 Subject: [PATCH 218/290] avformat/hls: Print input format in error message Signed-off-by: Michael Niedermayer (cherry picked from commit d8455331302c72cde2f0b72f255004a91189dd93) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 34abcb6e0d..fdf1df0906 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -758,7 +758,7 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct matchF = 3; if (!(matchA & matchF)) { - av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches allowed extensions in url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url); + av_log(s, AV_LOG_ERROR, "detected format %s extension %s mismatches allowed extensions in url %s\n", in_fmt->name, in_fmt->extensions ? in_fmt->extensions : "none", seg->url); return AVERROR_INVALIDDATA; } } From c74740fcd543a545d66ca830e3f2a122f730cae3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 30 Jan 2025 02:28:32 +0100 Subject: [PATCH 219/290] avcodec/h263dec: Check against previous dimensions instead of coded Fixes: out of array access Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c Found-by: Kacper Michajlow Reviewed-by: Kacper Michajlow Signed-off-by: Michael Niedermayer (cherry picked from commit 0fe33c99a26a06a6875c4abfb96362a65145264b) Signed-off-by: Michael Niedermayer --- libavcodec/h263dec.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index 0c23012584..5eefdc4602 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -431,6 +431,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict, MpegEncContext *s = avctx->priv_data; int ret; int slice_ret = 0; + int bak_width, bak_height; /* no supplementary picture */ if (buf_size == 0) { @@ -482,6 +483,9 @@ retry: if (ret < 0) return ret; + bak_width = s->width; + bak_height = s->height; + /* let's go :-) */ if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) { ret = ff_wmv2_decode_picture_header(s); @@ -501,11 +505,12 @@ retry: } if (ret < 0 || ret == FRAME_SKIPPED) { - if ( s->width != avctx->coded_width - || s->height != avctx->coded_height) { + if ( s->width != bak_width + || s->height != bak_height) { av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n"); - s->width = avctx->coded_width; - s->height= avctx->coded_height; + s->width = bak_width; + s->height= bak_height; + } } if (ret == FRAME_SKIPPED) From 880007e75cf53b33dada07d1e4649df17938201a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 28 Jan 2025 13:26:34 +0100 Subject: [PATCH 220/290] avformat/hls: .ts is always ok even if its a mov/mp4 Maybe fixes: 11435 Signed-off-by: Michael Niedermayer (cherry picked from commit 9e12572933dc1c49e9b35d772ddcae896c2ba8a8) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/hls.c b/libavformat/hls.c index fdf1df0906..1b2ebce2ab 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -754,6 +754,10 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct if (in_fmt->extensions) { matchF = av_match_ext( seg->url, in_fmt->extensions) + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0); + if(av_match_name("mp4", in_fmt->name)) { + matchF |= av_match_ext( seg->url, "ts") + + 2*(ff_match_url_ext(seg->url, "ts") > 0); + } } else if (!strcmp(in_fmt->name, "mpegts")) matchF = 3; From 6c4e56f07d1a703435854f2156c881885f7798da Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 28 Jan 2025 23:07:54 +0100 Subject: [PATCH 221/290] libavformat/hls: Be more restrictive on mpegts extensions Signed-off-by: Michael Niedermayer (cherry picked from commit 0113e30806b205111344e266bc69ff9657a3ca02) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 1b2ebce2ab..ef79ad3353 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -758,8 +758,10 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct matchF |= av_match_ext( seg->url, "ts") + 2*(ff_match_url_ext(seg->url, "ts") > 0); } - } else if (!strcmp(in_fmt->name, "mpegts")) - matchF = 3; + } else if (!strcmp(in_fmt->name, "mpegts")) { + matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") + + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); + } if (!(matchA & matchF)) { av_log(s, AV_LOG_ERROR, "detected format %s extension %s mismatches allowed extensions in url %s\n", in_fmt->name, in_fmt->extensions ? in_fmt->extensions : "none", seg->url); From 4018b915a63f74c6433ad8987f49d8737bb35176 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 2 Feb 2025 21:25:45 +0100 Subject: [PATCH 222/290] avcodec/vvc/refs: fix negative pps_scaling_win offsets The spec seems to allow these to be negative Fixes: left shift of negative value -15 Fixes: 392687035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-6559804532785152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Frank Plowman Signed-off-by: Michael Niedermayer (cherry picked from commit 33679f5325f5ad82993eb2bda89ef5fe37f2e5da) Signed-off-by: Michael Niedermayer --- libavcodec/vvc/refs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/vvc/refs.c b/libavcodec/vvc/refs.c index 133ff9eaba..bf093bea98 100644 --- a/libavcodec/vvc/refs.c +++ b/libavcodec/vvc/refs.c @@ -146,10 +146,10 @@ static VVCFrame *alloc_frame(VVCContext *s, VVCFrameContext *fc) for (int j = 0; j < frame->ctb_count; j++) frame->rpl_tab[j] = frame->rpl; - win->left_offset = pps->r->pps_scaling_win_left_offset << sps->hshift[CHROMA]; - win->right_offset = pps->r->pps_scaling_win_right_offset << sps->hshift[CHROMA]; - win->top_offset = pps->r->pps_scaling_win_top_offset << sps->vshift[CHROMA]; - win->bottom_offset = pps->r->pps_scaling_win_bottom_offset << sps->vshift[CHROMA]; + win->left_offset = pps->r->pps_scaling_win_left_offset * (1 << sps->hshift[CHROMA]); + win->right_offset = pps->r->pps_scaling_win_right_offset * (1 << sps->hshift[CHROMA]); + win->top_offset = pps->r->pps_scaling_win_top_offset * (1 << sps->vshift[CHROMA]); + win->bottom_offset = pps->r->pps_scaling_win_bottom_offset * (1 << sps->vshift[CHROMA]); frame->ref_width = pps->r->pps_pic_width_in_luma_samples - win->left_offset - win->right_offset; frame->ref_height = pps->r->pps_pic_height_in_luma_samples - win->bottom_offset - win->top_offset; From 43ba995a31d892c2c6cc575b60c40b2fb9d2078d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 6 Feb 2025 13:09:08 +0100 Subject: [PATCH 223/290] avformat/hls: Fix twitter Allow mp4 with all mpegts extensions Fixes: Ticket11435 Reviewed-by: Steven Liu Signed-off-by: Michael Niedermayer (cherry picked from commit cef3422b4819e3b6f07086625fa7890eaa8d45e7) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index ef79ad3353..fbc88c8f88 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -755,8 +755,8 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct matchF = av_match_ext( seg->url, in_fmt->extensions) + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0); if(av_match_name("mp4", in_fmt->name)) { - matchF |= av_match_ext( seg->url, "ts") - + 2*(ff_match_url_ext(seg->url, "ts") > 0); + matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") + + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); } } else if (!strcmp(in_fmt->name, "mpegts")) { matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") From c388bc1774f0c3559e600d75c9ac1f9b148e70ae Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 5 Feb 2025 03:47:52 +0100 Subject: [PATCH 224/290] avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long' Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin Signed-off-by: Michael Niedermayer (cherry picked from commit 8a6ad9eab2f1c37a18c2f30e6660260edd7c0c16) Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 682f724260..8905008202 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -3887,7 +3887,7 @@ static int64_t mxf_set_current_edit_unit(MXFContext *mxf, AVStream *st, int64_t int64_t new_edit_unit; MXFIndexTable *t = mxf_find_index_table(mxf, track->index_sid); - if (!t || track->wrapping == UnknownWrapped) + if (!t || track->wrapping == UnknownWrapped || edit_unit > INT64_MAX - track->edit_units_per_packet) return -1; if (mxf_edit_unit_absolute_offset(mxf, t, edit_unit + track->edit_units_per_packet, track->edit_rate, NULL, &next_ofs, NULL, 0) < 0 && From 6acfaa1084fb71e1e1014dfc3cd8f98ca88b304a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Feb 2025 01:24:37 +0100 Subject: [PATCH 225/290] avformat/wavdec: Fix overflow of intermediate in block_align check Fixes: signed integer overflow: -251517880 * 32 cannot be represented in type 'int' Fixes: 385224934/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4909298151915520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 1afbc40875069312dd729b5959fb04950c3938db) Signed-off-by: Michael Niedermayer --- libavformat/wavdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 78e37b88d7..ae6ff0e022 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -912,10 +912,10 @@ static int w64_read_header(AVFormatContext *s) if (st->codecpar->block_align && st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS && st->codecpar->bits_per_coded_sample < 128) { - int block_align = st->codecpar->block_align; + int64_t block_align = st->codecpar->block_align; block_align = FFMAX(block_align, - ((st->codecpar->bits_per_coded_sample + 7) / 8) * + ((st->codecpar->bits_per_coded_sample + 7LL) / 8) * st->codecpar->ch_layout.nb_channels); if (block_align > st->codecpar->block_align) { av_log(s, AV_LOG_WARNING, "invalid block_align: %d, broken file.\n", From 2e7364727caa44ce040056f9498e1c0c93bb9511 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Feb 2025 02:33:21 +0100 Subject: [PATCH 226/290] avformat/mlvdec: fix size checks Fixes: heap-buffer-overflow Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 251d43aef0df9262f2688c1c848af993bbb67d08) Signed-off-by: Michael Niedermayer --- libavformat/mlvdec.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c index 985365326e..20a6f3629a 100644 --- a/libavformat/mlvdec.c +++ b/libavformat/mlvdec.c @@ -437,19 +437,25 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt) if (size < 16) return AVERROR_INVALIDDATA; avio_skip(pb, 12); //timestamp, frameNumber - if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) + size -= 12; + if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) { + if (size < 8) + return AVERROR_INVALIDDATA; avio_skip(pb, 8); // cropPosX, cropPosY, panPosX, panPosY + size -= 8; + } space = avio_rl32(pb); + if (size < space + 4LL) + return AVERROR_INVALIDDATA; avio_skip(pb, space); + size -= space; if ((mlv->class[st->id] & (MLV_CLASS_FLAG_DELTA|MLV_CLASS_FLAG_LZMA))) { ret = AVERROR_PATCHWELCOME; } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) { ret = av_get_packet(pb, pkt, (st->codecpar->width * st->codecpar->height * st->codecpar->bits_per_coded_sample + 7) >> 3); } else { // AVMEDIA_TYPE_AUDIO - if (space > UINT_MAX - 24 || size < (24 + space)) - return AVERROR_INVALIDDATA; - ret = av_get_packet(pb, pkt, size - (24 + space)); + ret = av_get_packet(pb, pkt, size - 4); } if (ret < 0) From 0e5b6a715627b8166ae5276a75ba5459d87b344e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Feb 2025 23:31:20 +0100 Subject: [PATCH 227/290] avcodec/aac/aacdec: Clear SFO on error types and SFO become confused for a USAC stream Fixes: out of array access Fixes: 383854203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4996677847547904.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit d1be369af6a6f01976be8c80be1177dc524983e5) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index e62bf0f952..39edf73fb7 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -1745,6 +1745,7 @@ int ff_aac_decode_ics(AACDecContext *ac, SingleChannelElement *sce, return 0; fail: + memset(sce->sfo, 0, sizeof(sce->sfo)); tns->present = 0; return ret; } From bf8c0be971351158e33c02f9e20931114d498119 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 8 Feb 2025 00:18:24 +0100 Subject: [PATCH 228/290] avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors() Signed-off-by: Michael Niedermayer (cherry picked from commit 41cd72d76e14137a68c50f5a4e7dcab1c367e39c) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec_usac.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 2938e69387..ccdf58bc8e 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -567,15 +567,8 @@ static int decode_usac_scale_factors(AACDecContext *ac, int offset_sf = global_gain; for (int g = 0; g < ics->num_window_groups; g++) { for (int sfb = 0; sfb < ics->max_sfb; sfb++) { - /* First coefficient is just the global gain */ - if (!g && !sfb) { - /* The cannonical representation of quantized scalefactors - * in the spec is with 100 subtracted. */ - sce->sfo[0] = offset_sf - 100; - continue; - } - - offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO; + if (g || sfb) + offset_sf += get_vlc2(gb, ff_vlc_scalefactors, 7, 3) - SCALE_DIFF_ZERO; if (offset_sf > 255U) { av_log(ac->avctx, AV_LOG_ERROR, "Scalefactor (%d) out of range.\n", offset_sf); From 6646dd2825ef088746356d7db97e8d5b2b506e75 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 8 Feb 2025 22:16:38 +0100 Subject: [PATCH 229/290] avcodec/aac/aacdec_lpd: Limit get_unary() The limit is based on later code storing 32bits Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 464fb861b17b4cd9fc7ba8a18d0be040458bdfc7) Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec_lpd.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libavcodec/aac/aacdec_lpd.c b/libavcodec/aac/aacdec_lpd.c index 20bbb007ff..a4b91a510f 100644 --- a/libavcodec/aac/aacdec_lpd.c +++ b/libavcodec/aac/aacdec_lpd.c @@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) { if (nk_mode == 1) { for (int k = 0; k < no_qn; k++) { - qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges + qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges if (qn[k]) qn[k]++; } @@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) if (nk_mode == 2) { for (int k = 0; k < no_qn; k++) { if (qn[k] > 4) { - qn[k] = get_unary(gb, 0, INT32_MAX);; + qn[k] = get_unary(gb, 0, 65); if (qn[k]) qn[k] += 4; } @@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) for (int k = 0; k < no_qn; k++) { if (qn[k] > 4) { - int qn_ext = get_unary(gb, 0, INT32_MAX);; + int qn_ext = get_unary(gb, 0, 65); switch (qn_ext) { case 0: qn[k] = 5; break; case 1: qn[k] = 6; break; @@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv, } } + if (nk > 25) + return AVERROR_PATCHWELCOME; + skip_bits(gb, 4*n); if (nk > 0) From d3929313917fddc8689f8faecda0966d0a4498a3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 9 Feb 2025 01:28:17 +0100 Subject: [PATCH 230/290] avformat/iff: Check that we have a stream in read_dst_frame() Fixes: null pointer dereference Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross Signed-off-by: Michael Niedermayer (cherry picked from commit 8668957ef604bd2b99175310638bc5031ae0d991) Signed-off-by: Michael Niedermayer --- libavformat/iff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/iff.c b/libavformat/iff.c index 7601baa629..6b4503fdb3 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -360,6 +360,9 @@ static int read_dst_frame(AVFormatContext *s, AVPacket *pkt) uint64_t chunk_pos, data_pos, data_size; int ret = AVERROR_EOF; + if (s->nb_streams < 1) + return AVERROR_INVALIDDATA; + while (!avio_feof(pb)) { chunk_pos = avio_tell(pb); if (chunk_pos >= iff->body_end) From 3e16202c39b6b92337d5d417f536de46aba03f71 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 26 Feb 2025 03:19:17 +0100 Subject: [PATCH 231/290] Changelog: update Signed-off-by: Michael Niedermayer --- Changelog | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/Changelog b/Changelog index 56f7993e72..4247ece409 100644 --- a/Changelog +++ b/Changelog @@ -2,6 +2,35 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. version 7.1.1: + avformat/iff: Check that we have a stream in read_dst_frame() + avcodec/aac/aacdec_lpd: Limit get_unary() + avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors() + avcodec/aac/aacdec: Clear SFO on error + avformat/mlvdec: fix size checks + avformat/wavdec: Fix overflow of intermediate in block_align check + avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit() + avformat/hls: Fix twitter + avcodec/vvc/refs: fix negative pps_scaling_win offsets + libavformat/hls: Be more restrictive on mpegts extensions + avformat/hls: .ts is always ok even if its a mov/mp4 + avcodec/h263dec: Check against previous dimensions instead of coded + avformat/hls: Print input format in error message + avformat/hls: Be more picky on extensions + avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements + avformat/iamf_parse: add missing constrains for num_parameters in audio_element_oub() + avformat/iamf_parse: add missing av_free() call on failure path + lavc/hevcdec: unbreak WPP/progress2 code + fate: Add a dependency on ffprobe for fate-flcl1905 + checkasm: aacencdsp: Actually test nonzero values in quant_bands + x86: aacencdsp: Fix negating signed values in aac_quantize_bands + rtmpproto: Avoid rare crashes in the fail: codepath in rtmp_open + configure: Improve the check for the rsync --contimeout option + avutil/downmix_info: add missing semicolon + doc/t2h: Support texinfo 7.1 and 7.2 pretest + avfilter/drawtext: fix memory leak when using "reinit" runtime command + avutil/downmix_info: zero the allocated buffer + avformat/mov: fix overflow in drift timestamp calculation + Changelog: update avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet() avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream() avformat/iamf_reader: Initialize padding and check read in ff_iamf_read_packet() From 71889a8437d04124e8cb6919ee078f436082ab41 Mon Sep 17 00:00:00 2001 From: Pavel Koshevoy Date: Sun, 23 Feb 2025 09:43:56 -0700 Subject: [PATCH 232/290] avformat/mov: (v4) fix get_eia608_packet The problem is reproducible with "Test for Quicktime 608 CC file.mov" from https://samples.ffmpeg.org/MPEG2/subcc/ ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov See https://trac.ffmpeg.org/ticket/11470 --- libavformat/mov.c | 70 +++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 11 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 63e8fe31ff..41ca280c8a 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10526,25 +10526,73 @@ static int mov_change_extradata(AVStream *st, AVPacket *pkt) return 0; } -static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int size) +static int get_eia608_packet(AVIOContext *pb, AVPacket *pkt, int src_size) { - int new_size, ret; + /* We can't make assumptions about the structure of the payload, + because it may include multiple cdat and cdt2 samples. */ + const uint32_t cdat = AV_RB32("cdat"); + const uint32_t cdt2 = AV_RB32("cdt2"); + int ret, out_size = 0; - if (size <= 8) + /* a valid payload must have size, 4cc, and at least 1 byte pair: */ + if (src_size < 10) return AVERROR_INVALIDDATA; - new_size = ((size - 8) / 2) * 3; - ret = av_new_packet(pkt, new_size); + + /* avoid an int overflow: */ + if ((src_size - 8) / 2 >= INT_MAX / 3) + return AVERROR_INVALIDDATA; + + ret = av_new_packet(pkt, ((src_size - 8) / 2) * 3); if (ret < 0) return ret; - avio_skip(pb, 8); - for (int j = 0; j < new_size; j += 3) { - pkt->data[j] = 0xFC; - pkt->data[j+1] = avio_r8(pb); - pkt->data[j+2] = avio_r8(pb); + /* parse and re-format the c608 payload in one pass. */ + while (src_size >= 10) { + const uint32_t atom_size = avio_rb32(pb); + const uint32_t atom_type = avio_rb32(pb); + const uint32_t data_size = atom_size - 8; + const uint8_t cc_field = + atom_type == cdat ? 1 : + atom_type == cdt2 ? 2 : + 0; + + /* account for bytes consumed for atom size and type. */ + src_size -= 8; + + /* make sure the data size stays within the buffer boundaries. */ + if (data_size < 2 || data_size > src_size) { + ret = AVERROR_INVALIDDATA; + break; + } + + /* make sure the data size is consistent with N byte pairs. */ + if (data_size % 2 != 0) { + ret = AVERROR_INVALIDDATA; + break; + } + + if (!cc_field) { + /* neither cdat or cdt2 ... skip it */ + avio_skip(pb, data_size); + src_size -= data_size; + continue; + } + + for (uint32_t i = 0; i < data_size; i += 2) { + pkt->data[out_size] = (0x1F << 3) | (1 << 2) | (cc_field - 1); + pkt->data[out_size + 1] = avio_r8(pb); + pkt->data[out_size + 2] = avio_r8(pb); + out_size += 3; + src_size -= 2; + } } - return 0; + if (src_size > 0) + /* skip any remaining unread portion of the input payload */ + avio_skip(pb, src_size); + + av_shrink_packet(pkt, out_size); + return ret; } static int mov_finalize_packet(AVFormatContext *s, AVStream *st, AVIndexEntry *sample, From a8a3fc84afa21de2d704101244f5ad5d88be3421 Mon Sep 17 00:00:00 2001 From: softworkz Date: Thu, 27 Feb 2025 16:36:56 +0000 Subject: [PATCH 233/290] avformat/hls: Partially revert "reduce default max reload to 3" (setting to 100 as a reasonable compromise) The change has caused regressions for many users and consumers. Playlist reloads only happen when a playlist doesn't indicate that it has ended (via #EXT-X-ENDLIST), which means that the addition of future segments is still expected. It is well possible that an HLS server is temporarily unable to serve further segments but resumes after some time, either indicating a discontinuity or even by fully catching up. With a segment length of 3s, a max_reload value of 1000 corresponds to a duration of 50 minutes which appears to be a reasonable default. Signed-off-by: Michael Niedermayer (cherry picked from commit ace9f03a6c0a58b84a02701df1b6e5d5ac1d1b8e) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index fbc88c8f88..b96c5ab9d2 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -2633,7 +2633,7 @@ static const AVOption hls_options[] = { {"extension_picky", "Be picky with all extensions matching", OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS}, {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded", - OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 3}, 0, INT_MAX, FLAGS}, + OFFSET(max_reload), AV_OPT_TYPE_INT, {.i64 = 100}, 0, INT_MAX, FLAGS}, {"m3u8_hold_counters", "The maximum number of times to load m3u8 when it refreshes without new segments", OFFSET(m3u8_hold_counters), AV_OPT_TYPE_INT, {.i64 = 1000}, 0, INT_MAX, FLAGS}, {"http_persistent", "Use persistent HTTP connections", From 68af2cc3feb8c78aec2722c728fd87f03515fa7c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 2 Mar 2025 16:29:39 +0100 Subject: [PATCH 234/290] Prepare for 7.1.1 Signed-off-by: Michael Niedermayer --- Changelog | 2 ++ RELEASE | 2 +- doc/Doxyfile | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Changelog b/Changelog index 4247ece409..4b35e446cd 100644 --- a/Changelog +++ b/Changelog @@ -2,6 +2,8 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. version 7.1.1: + avformat/hls: Partially revert "reduce default max reload to 3" + avformat/mov: (v4) fix get_eia608_packet avformat/iff: Check that we have a stream in read_dst_frame() avcodec/aac/aacdec_lpd: Limit get_unary() avcodec/aac/aacdec_usac: Simplify decode_usac_scale_factors() diff --git a/RELEASE b/RELEASE index 0f0fefae5a..21c8c7b46b 100644 --- a/RELEASE +++ b/RELEASE @@ -1 +1 @@ -7.1 +7.1.1 diff --git a/doc/Doxyfile b/doc/Doxyfile index c6dc306197..16f3a78735 100644 --- a/doc/Doxyfile +++ b/doc/Doxyfile @@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 7.1 +PROJECT_NUMBER = 7.1.1 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a From db69d06eeeab4f46da15030a80d539efb4503ca8 Mon Sep 17 00:00:00 2001 From: Lynne Date: Wed, 1 Jan 2025 18:03:33 +0900 Subject: [PATCH 235/290] configure: update copyright year On 01/01/2025 19:05, Peter Ross wrote: > FFmpeg turns 25 this year. (cherry picked from commit d3aa99a4f436e89773246339d9d363587a1d21df) Signed-off-by: Michael Niedermayer --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index 9c013505f2..ffa407d53d 100755 --- a/configure +++ b/configure @@ -8191,7 +8191,7 @@ cat > $TMPH < Date: Thu, 27 Feb 2025 23:38:09 -0300 Subject: [PATCH 236/290] fftools/ffmpeg_filter: also remove display matrix side data from buffered frames Some frames may be buffered before a complex filtergraph can be configured. This change ensures the side data removal in the cases where autorotation is enabled also applies to them. Fixes ticket #11487 Signed-off-by: James Almer (cherry picked from commit 01f63ef0b44fa70d87edaf52f19fcdb2ae7446b3) --- fftools/ffmpeg_filter.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fftools/ffmpeg_filter.c b/fftools/ffmpeg_filter.c index 38c7676a7e..3ef6818c72 100644 --- a/fftools/ffmpeg_filter.c +++ b/fftools/ffmpeg_filter.c @@ -1998,6 +1998,10 @@ static int configure_filtergraph(FilterGraph *fg, FilterGraphThread *fgt) if (ifp->type_src == AVMEDIA_TYPE_SUBTITLE) { sub2video_frame(&ifp->ifilter, tmp, !fgt->graph); } else { + if (ifp->type_src == AVMEDIA_TYPE_VIDEO) { + if (ifp->displaymatrix_applied) + av_frame_remove_side_data(tmp, AV_FRAME_DATA_DISPLAYMATRIX); + } ret = av_buffersrc_add_frame(ifp->filter, tmp); } av_frame_free(&tmp); From 68b5db246407f0b0e398ce3b10ee57f738f0c524 Mon Sep 17 00:00:00 2001 From: Gyan Doshi Date: Sat, 22 Feb 2025 10:38:53 +0530 Subject: [PATCH 237/290] avcodec/libsvtav1: unbreak build with latest svtav1 SVT-AV1 made a change in their public API in 988e930c but without a version bump or any other accessible marker, thus breaking ffmpeg build with current versions of SVT-AV1. They have finally bumped versions a month later, so check added. (cherry picked from commit d1ed5c06e3edc5f2b5f3664c80121fa55b0baa95) --- libavcodec/libsvtav1.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/libsvtav1.c b/libavcodec/libsvtav1.c index 79b28eb4df..43fe531fde 100644 --- a/libavcodec/libsvtav1.c +++ b/libavcodec/libsvtav1.c @@ -435,7 +435,11 @@ static av_cold int eb_enc_init(AVCodecContext *avctx) svt_enc->eos_flag = EOS_NOT_REACHED; +#if SVT_AV1_CHECK_VERSION(3, 0, 0) + svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, &svt_enc->enc_params); +#else svt_ret = svt_av1_enc_init_handle(&svt_enc->svt_handle, svt_enc, &svt_enc->enc_params); +#endif if (svt_ret != EB_ErrorNone) { return svt_print_error(avctx, svt_ret, "Error initializing encoder handle"); } From ea34bf796251d1108f34b0962a8529fe78586f8d Mon Sep 17 00:00:00 2001 From: Brad Smith Date: Fri, 18 Aug 2023 15:32:39 -0400 Subject: [PATCH 238/290] lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang Add a check for the existence of the vec_xl() function. Clang provides the function even with VSX not enabled. (cherry picked from commit 30a8641465f7b7923e92d8724ef6a595fccb9e58) Signed-off-by: Brad Smith --- configure | 8 ++++++++ libswscale/ppc/yuv2rgb_altivec.c | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/configure b/configure index ffa407d53d..eedf066c38 100755 --- a/configure +++ b/configure @@ -2212,6 +2212,7 @@ ARCH_EXT_LIST_PPC=" ldbrx power8 ppc4xx + vec_xl vsx " @@ -2759,6 +2760,7 @@ altivec_deps="ppc" dcbzl_deps="ppc" ldbrx_deps="ppc" ppc4xx_deps="ppc" +vec_xl_deps="altivec" vsx_deps="altivec" power8_deps="vsx" @@ -6389,6 +6391,11 @@ elif enabled ppc; then check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)" fi + if enabled altivec && disabled vsx; then + check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 }; + vector unsigned char y0 = vec_xl(0, y1i);" + fi + elif enabled riscv; then enabled rv && check_inline_asm rv '".option arch, +zbb\nrev8 t0, t1"' @@ -7941,6 +7948,7 @@ if enabled ppc; then echo "POWER8 enabled ${power8-no}" echo "PPC 4xx optimizations ${ppc4xx-no}" echo "dcbzl available ${dcbzl-no}" + echo "vec_xl available ${vec_xl-no}" fi if enabled loongarch; then echo "LSX enabled ${lsx-no}" diff --git a/libswscale/ppc/yuv2rgb_altivec.c b/libswscale/ppc/yuv2rgb_altivec.c index 5e1033a973..8b0a93796f 100644 --- a/libswscale/ppc/yuv2rgb_altivec.c +++ b/libswscale/ppc/yuv2rgb_altivec.c @@ -284,7 +284,7 @@ static inline void cvtyuvtoRGB(SwsContext *c, vector signed short Y, * ------------------------------------------------------------------------------ */ -#if !HAVE_VSX +#if !HAVE_VEC_XL static inline vector unsigned char vec_xl(signed long long offset, const ubyte *addr) { const vector unsigned char *v_addr = (const vector unsigned char *) (addr + offset); @@ -292,7 +292,7 @@ static inline vector unsigned char vec_xl(signed long long offset, const ubyte * return (vector unsigned char) vec_perm(v_addr[0], v_addr[1], align_perm); } -#endif /* !HAVE_VSX */ +#endif /* !HAVE_VEC_XL */ #define DEFCSP420_CVT(name, out_pixels) \ static int altivec_ ## name(SwsContext *c, const unsigned char **in, \ From dca3b4760f2f77aa2f71ad2ebb63bb0144d7edfd Mon Sep 17 00:00:00 2001 From: Brad Smith Date: Tue, 11 Mar 2025 00:31:47 -0400 Subject: [PATCH 239/290] lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang v2 v2: test for function if AltiVec is enabled instead of with AltiVec and without VSX (cherry picked from commit 49c8f33262d7c113c71cee9cd30b990a92afa0a1) Signed-off-by: Brad Smith --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index eedf066c38..ed56cf0155 100755 --- a/configure +++ b/configure @@ -6391,7 +6391,7 @@ elif enabled ppc; then check_cpp_condition power8 "altivec.h" "defined(_ARCH_PWR8)" fi - if enabled altivec && disabled vsx; then + if enabled altivec; then check_cc vec_xl altivec.h "const unsigned char *y1i = { 0 }; vector unsigned char y0 = vec_xl(0, y1i);" fi From 276bd388f33b5071799691aee6e0cd99c7133d61 Mon Sep 17 00:00:00 2001 From: Peter Ross Date: Thu, 19 Dec 2024 09:50:42 +1100 Subject: [PATCH 240/290] avcodec/Makefile: include aom_film_grain.o file for h264_sei component h264_sei depends on h2645_sei, which in turn depends on aom_film_grain for ff_aom_uninit_film_grain_params() (cherry picked from commit 7aeae8d1ae846302ba1e9955cf64fe83f02b7a57) --- libavcodec/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/Makefile b/libavcodec/Makefile index a4fcce3b42..153a9e3881 100644 --- a/libavcodec/Makefile +++ b/libavcodec/Makefile @@ -108,7 +108,7 @@ OBJS-$(CONFIG_H264PARSE) += h264_parse.o h264_ps.o h264data.o \ h2645data.o h2645_parse.o h2645_vui.o OBJS-$(CONFIG_H264PRED) += h264pred.o OBJS-$(CONFIG_H264QPEL) += h264qpel.o -OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o +OBJS-$(CONFIG_H264_SEI) += h264_sei.o h2645_sei.o aom_film_grain.o OBJS-$(CONFIG_HEVCPARSE) += h2645data.o h2645_parse.o h2645_vui.o OBJS-$(CONFIG_HEVC_SEI) += h2645_sei.o aom_film_grain.o \ dynamic_hdr_vivid.o From 48c0f071d4b5dd3c06c9978a2edc0fdcbbc3717a Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Fri, 11 Oct 2024 15:49:44 +0800 Subject: [PATCH 241/290] avcodec/mediacodecdec_common: Workaround MTK broken crop implementation MediaTek SOC return broken crop info, e.g., width: int32(3840) height: int32(2160) crop: Rect(0, 0, 318, 238) It will notify the right crop info with infoOutputFormatChanged, but too late. Signed-off-by: Zhao Zhili (cherry picked from commit 7fe9d12f2571265b2a7b5c763d62ee80f9a9e2e2) --- libavcodec/mediacodecdec_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index 3770b4f3ae..8a270f2f29 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -594,7 +594,8 @@ static int mediacodec_dec_parse_video_format(AVCodecContext *avctx, MediaCodecDe AMEDIAFORMAT_GET_INT32(s->crop_right, "crop-right", 0); // Try "crop" for NDK - if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec) + // MediaTek SOC return some default value like Rect(0, 0, 318, 238) + if (!(s->crop_right && s->crop_bottom) && s->use_ndk_codec && !strstr(s->codec_name, ".mtk.")) ff_AMediaFormat_getRect(s->format, "crop", &s->crop_left, &s->crop_top, &s->crop_right, &s->crop_bottom); if (s->crop_right && s->crop_bottom) { From 579e7b85c8cd6c3960ff23216987c4038f146ba7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Wed, 25 Sep 2024 15:13:34 +0300 Subject: [PATCH 242/290] configure: Silence Xcode warnings about duplicate libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since Xcode 15, macOS developer tools use a new linker. The new linker by default warns for duplicate -l options. As this is a known and expected thing, not to be considered an issue, ask for the warning to be silenced. This silences linker warnings like this: ld: warning: ignoring duplicate libraries: '-lc++', '-lcrypto', '-lm', '-logg', '-lpthread', '-lssl', '-lvorbis', '-lvpx', '-lz' The linker can also warn about duplicate -rpath options, and there's currently no option to silence those warnings. Signed-off-by: Martin Storsjö (cherry picked from commit bd22d7e601933ef8a0975fc9252cee2d44632f61) --- configure | 1 + 1 file changed, 1 insertion(+) diff --git a/configure b/configure index ed56cf0155..1610d00e7c 100755 --- a/configure +++ b/configure @@ -6487,6 +6487,7 @@ check_cc intrinsics_sse2 emmintrin.h "__m128i test = _mm_setzero_si128()" check_ldflags -Wl,--as-needed check_ldflags -Wl,-z,noexecstack +check_ldflags -Wl,-no_warn_duplicate_libraries if ! disabled network; then check_func getaddrinfo $network_extralibs From c91d887a25d33ba3b180b80187405aa38f19f2ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Mon, 14 Oct 2024 23:43:11 +0300 Subject: [PATCH 243/290] configure: Only try to use the -no_warn_duplicate_libraries flag on Darwin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While we only add the flag if the linker seems to support it, it turns out that ld.bfd had a bug where the flag is accidentally accepted, and the flag produces an output file named "_warn_duplicate_libraries". The ld.bfd bug was fixed in binutils 2.36, in https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3991c7acb29aa8d7d52150695eb3efa03a08dd50. Signed-off-by: Martin Storsjö (cherry picked from commit 38d08f5c451a312d9064b81472fa05ff53b2e780) --- configure | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/configure b/configure index 1610d00e7c..156d72e119 100755 --- a/configure +++ b/configure @@ -6487,7 +6487,9 @@ check_cc intrinsics_sse2 emmintrin.h "__m128i test = _mm_setzero_si128()" check_ldflags -Wl,--as-needed check_ldflags -Wl,-z,noexecstack -check_ldflags -Wl,-no_warn_duplicate_libraries +if [ $target_os = "darwin" ]; then + check_ldflags -Wl,-no_warn_duplicate_libraries +fi if ! disabled network; then check_func getaddrinfo $network_extralibs From 652a765ecb366d92d9b8f917dee2304c689aa5d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Tue, 29 Apr 2025 10:42:48 +0300 Subject: [PATCH 244/290] configure: Enable -fno-common for Darwin targets, avoid linker warnings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since GCC 10 and llvm.org Clang 11, -fno-common is the default. However Apple's Xcode Clang hasn't followed suit yet, and still defaults to -fcommon. Compiling with -fcommon causes uninitialized global variables to be treated as "common" (which allows multiple object files to have similar definitions). Common variables seem to have the issue that their intended alignment isn't signaled, so the linker assumes that they may need alignment according to their full size. With large global tables, this can lead to linker warnings like this, with Xcode 16.3: ld: warning: reducing alignment of section __DATA,__common from 0x8000 to 0x4000 because it exceeds segment maximum alignment This can be reproduced with a small snippet like this: char table[16385]; int main(int argc, char* argv[]) { return 0; } Compiling with -fno-common avoids this issue and warning, and matches the default behaviour of other compilers. (Compiling with -fno-common also avoids the risk of accidentally accepting duplicate definitions of global variables, as long as they are uninitialized.) Signed-off-by: Martin Storsjö (cherry picked from commit f4e72eb5a3dbd25ed3ab6c9f89c42adcfc0b5e3d) --- configure | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/configure b/configure index 156d72e119..0aa7b72af3 100755 --- a/configure +++ b/configure @@ -5807,6 +5807,13 @@ case $target_os in clang_version=$($cc -dumpversion) test ${clang_version%%.*} -eq 11 && add_cflags -fno-stack-check fi + + # Xcode Clang doesn't default to -fno-common while upstream llvm.org + # Clang (and GCC) do. This avoids linker warnings on Xcode 16.3 about + # "reducing alignment of section __DATA,__common from 0x8000 to 0x4000 + # because it exceeds segment maximum alignment". + check_cflags -fno-common + ;; msys*) die "Native MSYS builds are discouraged, please use the MINGW environment." From c6c20e04ccad29732bc5c2c8eafecad90b48ee61 Mon Sep 17 00:00:00 2001 From: Tobias Rapp Date: Wed, 30 Apr 2025 10:37:52 +0200 Subject: [PATCH 245/290] avfilter/vf_setparams: Fix chroma_location being cleared Fix chroma_location being cleared by setrange and setfield filters. This was forgotten in 201f1cba150d44de6fedfeee4e8647170ed5fbca. Signed-off-by: Tobias Rapp (cherry picked from commit 0f751d383667661e22261ae47cdc36cebd3cdc62) --- libavfilter/vf_setparams.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/vf_setparams.c b/libavfilter/vf_setparams.c index 14a16477c9..b12e46e354 100644 --- a/libavfilter/vf_setparams.c +++ b/libavfilter/vf_setparams.c @@ -246,6 +246,7 @@ static av_cold int init_setrange(AVFilterContext *ctx) s->color_primaries = -1; s->color_trc = -1; s->colorspace = -1; + s->chroma_location = -1; return 0; } @@ -282,6 +283,7 @@ static av_cold int init_setfield(AVFilterContext *ctx) s->color_primaries = -1; s->color_trc = -1; s->colorspace = -1; + s->chroma_location = -1; return 0; } From 9237125e51a4ecae76dc476b620e8e492c7aaf8b Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Thu, 17 Apr 2025 20:12:49 +0800 Subject: [PATCH 246/290] avformat/mov: Reduce seek when interleaved_read is disabled Don't select sample with small dts when interleaved_read is disabled. Signed-off-by: Zhao Zhili (cherry picked from commit ca964ba139695fc0064d07ac6503626d549520c7) --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 41ca280c8a..97a9cfecae 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -10449,7 +10449,7 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st) ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && ((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb && dts != AV_NOPTS_VALUE && ((dtsdiff <= AV_TIME_BASE && current_sample->pos < sample->pos) || - (dtsdiff > AV_TIME_BASE && dts < best_dts)))))) { + (dtsdiff > AV_TIME_BASE && dts < best_dts && mov->interleaved_read)))))) { sample = current_sample; best_dts = dts; *st = avst; From 94784d0918932a25a8f013f29e6c862b61ecfa45 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Fri, 25 Apr 2025 01:08:36 +0800 Subject: [PATCH 247/290] avcodec/bsf/h264_mp4toannexb: Fix mixed bitstream format This bsf converts AV_PKT_DATA_NEW_EXTRADATA side data in avcc format to in-band annexb format. However, the side data wasn't been removed and copied from input packet to output packet. So the output packet has mixed bitstream format. We don't support mixed bitstream format. For example, h264_metadata report error in the following case: ffmpeg -i foo.flv \ -bsf:v "h264_mp4toannexb,h264_metadata" \ -c copy -f null This patch removed NEW_EXTRADATA side data after process. This patch also add a check so only NEW_EXTRADATA in avcc format is processed. NEW_EXTRADATA in annexb format is copied to output as is. Reported-by: jiangjie Signed-off-by: Zhao Zhili (cherry picked from commit 25812d303398552a7768dac04f2992bcb09ea000) --- libavcodec/bsf/h264_mp4toannexb.c | 22 ++++++++++++---------- tests/fate/h264.mak | 4 ++-- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/libavcodec/bsf/h264_mp4toannexb.c b/libavcodec/bsf/h264_mp4toannexb.c index dda064287e..36b09b4dd6 100644 --- a/libavcodec/bsf/h264_mp4toannexb.c +++ b/libavcodec/bsf/h264_mp4toannexb.c @@ -93,6 +93,11 @@ static int h264_extradata_to_annexb(AVBSFContext *ctx, const int padding = AV_INPUT_BUFFER_PADDING_SIZE; int length_size, pps_offset = 0; + if (extradata_size < 7) { + av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extradata_size); + return AVERROR_INVALIDDATA; + } + bytestream2_init(gb, extradata, extradata_size); bytestream2_skipu(gb, 4); @@ -262,16 +267,11 @@ static int h264_mp4toannexb_init(AVBSFContext *ctx) (extra_size >= 4 && AV_RB32(ctx->par_in->extradata) == 1)) { av_log(ctx, AV_LOG_VERBOSE, "The input looks like it is Annex B already\n"); - } else if (extra_size >= 7) { - return h264_extradata_to_annexb(ctx, - ctx->par_in->extradata, - ctx->par_in->extradata_size); - } else { - av_log(ctx, AV_LOG_ERROR, "Invalid extradata size: %d\n", extra_size); - return AVERROR_INVALIDDATA; + return 0; } - - return 0; + return h264_extradata_to_annexb(ctx, + ctx->par_in->extradata, + ctx->par_in->extradata_size); } static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt) @@ -293,10 +293,12 @@ static int h264_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *opkt) extradata = av_packet_get_side_data(in, AV_PKT_DATA_NEW_EXTRADATA, &extradata_size); - if (extradata) { + if (extradata && extradata[0] == 1) { ret = h264_extradata_to_annexb(ctx, extradata, extradata_size); if (ret < 0) goto fail; + av_packet_side_data_remove(in->side_data, &in->side_data_elems, + AV_PKT_DATA_NEW_EXTRADATA); } /* nothing to filter */ diff --git a/tests/fate/h264.mak b/tests/fate/h264.mak index e7038387ea..d93751f093 100644 --- a/tests/fate/h264.mak +++ b/tests/fate/h264.mak @@ -224,7 +224,7 @@ FATE_H264-$(call FRAMECRC, MOV, H264) += fate-h264-unescaped-extradata # this sample contains field-coded frames, with both fields in a single packet FATE_H264-$(call FRAMECRC, MOV, H264) += fate-h264-twofields-packet -FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata +FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF H264_METADATA_BSF SCALE_FILTER) += fate-h264-bsf-mp4toannexb-new-extradata FATE_H264-$(call DEMMUX, MOV, H264, H264_MP4TOANNEXB_BSF) += fate-h264-bsf-mp4toannexb \ fate-h264-bsf-mp4toannexb-2 \ @@ -438,7 +438,7 @@ fate-h264-bsf-mp4toannexb: CMD = md5 -i $(TARGET_SAMPLES) fate-h264-bsf-mp4toannexb-2: CMD = md5 -i $(TARGET_SAMPLES)/h264/ps_prefix_first_idr.mp4 -c:v copy -f h264 fate-h264-bsf-mp4toannexb-2: CMP = oneline fate-h264-bsf-mp4toannexb-2: REF = cffcfa6a2d0b58c9de1f5785f099f41d -fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-map 0:v" +fate-h264-bsf-mp4toannexb-new-extradata: CMD = stream_remux mov $(TARGET_SAMPLES)/h264/extradata-reload-multi-stsd.mov "" h264 "-bsf h264_mp4toannexb,h264_metadata -map 0:v" fate-h264-bsf-dts2pts: CMD = transcode "h264" $(TARGET_SAMPLES)/h264-conformance/CAPAMA3_Sand_F.264 \ mov "-c:v copy -bsf:v dts2pts -frames:v 50" "-c:v copy" fate-h264_mp4toannexb_ticket5927: CMD = transcode "mp4" $(TARGET_SAMPLES)/h264/thezerotheorem-cut.mp4 \ From 4991c1ec92874737a9c4b1bce1b3f73a23b78b20 Mon Sep 17 00:00:00 2001 From: Zhao Zhili Date: Wed, 23 Apr 2025 20:59:41 +0800 Subject: [PATCH 248/290] avformat/hls: Fix get key file error The offset and end_offset options are meant for segment, not for key. Signed-off-by: Zhao Zhili (cherry picked from commit bb0c4649fb63591a2c9f5e3962815c2db8de50fc) --- libavformat/hls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index b96c5ab9d2..896deb23d5 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -1351,7 +1351,7 @@ static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg, if (seg->key_type == KEY_AES_128 || seg->key_type == KEY_SAMPLE_AES) { if (strcmp(seg->key, pls->key_url)) { AVIOContext *pb = NULL; - if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, opts, NULL) == 0) { + if (open_url(pls->parent, &pb, seg->key, &c->avio_opts, NULL, NULL) == 0) { ret = avio_read(pb, pls->key, sizeof(pls->key)); if (ret != sizeof(pls->key)) { av_log(pls->parent, AV_LOG_ERROR, "Unable to read key file %s\n", From 7eaa8c110e830cb831781dad1bba8fe2365176fb Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 24 Mar 2025 13:51:15 -0300 Subject: [PATCH 249/290] avcodec/h264_slice: insert LCEVC side data before get_buffer() call Otherwise it will not be taken into account or applied at all. Signed-off-by: James Almer (cherry picked from commit 25b0a8e295749a60a238ba0d6fe7a3742937b6bb) --- libavcodec/h264_slice.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 84595b1a8b..01c43a652e 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -191,6 +191,13 @@ static int alloc_picture(H264Context *h, H264Picture *pic) av_assert0(!pic->f->data[0]); + if (h->sei.common.lcevc.info) { + HEVCSEILCEVC *lcevc = &h->sei.common.lcevc; + ret = ff_frame_new_side_data_from_buf(h->avctx, pic->f, AV_FRAME_DATA_LCEVC, &lcevc->info); + if (ret < 0) + return ret; + } + pic->tf.f = pic->f; ret = ff_thread_get_ext_buffer(h->avctx, &pic->tf, pic->reference ? AV_GET_BUFFER_FLAG_REF : 0); From 59576ad4c5ce3667e0e1d967af57ad0c3f2d334a Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Fri, 9 May 2025 00:18:29 +0200 Subject: [PATCH 250/290] avformat/wavdec: increase requested probe score for codec probe Codec probing was primarily added to the wav demuxer to support DTS-in-wav files, but DTS probing functions return AVPROBE_SCORE_EXTENSION+1, so we can be a bit more strict with the required score. This fixes MP3 misdetections for some wav files. Fixes ticket #11581. Signed-off-by: Marton Balint (cherry picked from commit ce01c7fb58597f525e130f47a13ff77f1db62bf4) --- libavformat/wavdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index ae6ff0e022..7748a2fbb4 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -178,7 +178,7 @@ static void handle_stream_probing(AVStream *st) { if (st->codecpar->codec_id == AV_CODEC_ID_PCM_S16LE) { FFStream *const sti = ffstream(st); - sti->request_probe = AVPROBE_SCORE_EXTENSION; + sti->request_probe = AVPROBE_SCORE_EXTENSION + 1; sti->probe_packets = FFMIN(sti->probe_packets, 32); } } From 0b065663d46a0c38186b78bc91fe4849cd30493b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= Date: Fri, 10 May 2024 22:30:03 +0200 Subject: [PATCH 251/290] avcodec/libzvbi-teletextdec: change new lines to \n in ASS header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes remaining \r\n is ASS header after 57c545090d. Fixes AVERROR_BUG error during init as this decoder expected `\r\n` in default ASS header. strstr(..., "\r\n[Events]\r\n") failed after changes in 57c545090d. Fixes ticket #11545. Fixes: 57c545090d Signed-off-by: Kacper Michajłow Signed-off-by: Marton Balint (cherry picked from commit eb6dc952cbd479bf43673af9ca0bc83f37f8f329) --- libavcodec/libzvbi-teletextdec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/libzvbi-teletextdec.c b/libavcodec/libzvbi-teletextdec.c index 68ffe1f76c..e02ecb8b3a 100644 --- a/libavcodec/libzvbi-teletextdec.c +++ b/libavcodec/libzvbi-teletextdec.c @@ -91,7 +91,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx) if (ret < 0) return ret; - event_pos = strstr(avctx->subtitle_header, "\r\n[Events]\r\n"); + event_pos = strstr(avctx->subtitle_header, "\n[Events]\n"); if (!event_pos) return AVERROR_BUG; @@ -106,7 +106,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx) "0,0," /* Spacing, Angle */ "3,0.1,0," /* BorderStyle, Outline, Shadow */ "5,1,1,1," /* Alignment, Margin[LRV] */ - "0\r\n" /* Encoding */ + "0\n" /* Encoding */ "Style: " "Subtitle," /* Name */ "Monospace,16," /* Font{name,size} */ @@ -116,7 +116,7 @@ static int my_ass_subtitle_header(AVCodecContext *avctx) "0,0," /* Spacing, Angle */ "1,1,1," /* BorderStyle, Outline, Shadow */ "8,48,48,20," /* Alignment, Margin[LRV] */ - "0\r\n" /* Encoding */ + "0\n" /* Encoding */ , event_pos); if (!new_header) From 24de8a98cfb33b10992772ba54f650eb61c96d44 Mon Sep 17 00:00:00 2001 From: Pavel Koshevoy Date: Sun, 18 May 2025 08:57:31 -0600 Subject: [PATCH 252/290] avformat/mpegts: update stream info when PMT ES stream_type changes I have several .ts captures where video and audio codec changes even though the PMT version does not change and the PIDs stay the same. This happens during transition to/from slate (mpeg2 video and audio) to network broadcast (hevc video and eac3 audio in private PES). I've updated fate ts-demux expected results. --- libavformat/mpegts.c | 4 +++- tests/ref/fate/ts-demux | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 86b7c8e041..b5f29aee65 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -938,6 +938,8 @@ static int mpegts_set_stream_info(AVStream *st, PESContext *pes, mpegts_find_stream_type(st, pes->stream_type, ISO_types); if (pes->stream_type == 4 || pes->stream_type == 0x0f) sti->request_probe = 50; + if (pes->stream_type == STREAM_TYPE_PRIVATE_DATA) + sti->request_probe = AVPROBE_SCORE_STREAM_RETRY; if ((prog_reg_desc == AV_RL32("HDMV") || prog_reg_desc == AV_RL32("HDPR")) && st->codecpar->codec_id == AV_CODEC_ID_NONE) { @@ -2496,7 +2498,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len if (!st) goto out; - if (pes && !pes->stream_type) + if (pes && pes->stream_type != stream_type) mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc); add_pid_to_program(prg, pid); diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux index 45522c2bfb..732f9d0289 100644 --- a/tests/ref/fate/ts-demux +++ b/tests/ref/fate/ts-demux @@ -24,6 +24,6 @@ packet|codec_type=video|stream_index=0|pts=3912686363|pts_time=43474.292922|dts= packet|codec_type=audio|stream_index=1|pts=3912644825|pts_time=43473.831389|dts=3912644825|dts_time=43473.831389|duration=2880|duration_time=0.032000|size=906|pos=474888|flags=K__|data_hash=CRC32:0893d398 packet|codec_type=audio|stream_index=2|pts=3912645580|pts_time=43473.839778|dts=3912645580|dts_time=43473.839778|duration=2880|duration_time=0.032000|size=354|pos=491808|flags=K__|data_hash=CRC32:f5963fa6 stream|index=0|codec_name=mpeg2video|profile=4|codec_type=video|codec_tag_string=[2][0][0][0]|codec_tag=0x0002|width=1280|height=720|coded_width=0|coded_height=0|closed_captions=0|film_grain=0|has_b_frames=1|sample_aspect_ratio=1:1|display_aspect_ratio=16:9|pix_fmt=yuv420p|level=4|color_range=tv|color_space=unknown|color_transfer=unknown|color_primaries=unknown|chroma_location=left|field_order=progressive|refs=1|ts_id=32776|ts_packetsize=188|id=0x31|r_frame_rate=60000/1001|avg_frame_rate=60000/1001|time_base=1/90000|start_pts=3912669846|start_time=43474.109400|duration_ts=19519|duration=0.216878|bit_rate=15000000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=15|extradata_size=150|extradata_hash=CRC32:53134fa8|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|side_datum/cpb_properties:side_data_type=CPB properties|side_datum/cpb_properties:max_bitrate=15000000|side_datum/cpb_properties:min_bitrate=0|side_datum/cpb_properties:avg_bitrate=0|side_datum/cpb_properties:buffer_size=9781248|side_datum/cpb_properties:vbv_delay=-1 -stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng -stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es +stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng +stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es format|filename=mp3ac325-4864-small.ts|nb_streams=3|nb_programs=1|nb_stream_groups=0|format_name=mpegts|start_time=43473.703389|duration=0.622889|size=512000|bit_rate=6575810|probe_score=50 From ccbd089467382a6693f792b1ea1c23e3bdda089d Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Thu, 22 May 2025 21:21:24 +0000 Subject: [PATCH 253/290] avfilter/avfiltergraph: fix regression in picking channel layout Signed-off-by: James Almer (cherry picked from commit 1b3f4842c18409dba5a345ef9e7b3de7a4fa3657) --- libavfilter/avfiltergraph.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/avfiltergraph.c b/libavfilter/avfiltergraph.c index 38077ff701..1744298ee5 100644 --- a/libavfilter/avfiltergraph.c +++ b/libavfilter/avfiltergraph.c @@ -1067,8 +1067,8 @@ static void swap_channel_layouts_on_filter(AVFilterContext *filter) } /* no penalty for LFE channel mismatch */ - if (av_channel_layout_channel_from_index(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 && - av_channel_layout_channel_from_index(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0) + if (av_channel_layout_index_from_channel(&in_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0 && + av_channel_layout_index_from_channel(&out_chlayout, AV_CHAN_LOW_FREQUENCY) >= 0) score += 10; av_channel_layout_from_mask(&in_chlayout, av_channel_layout_subset(&in_chlayout, ~AV_CH_LOW_FREQUENCY)); av_channel_layout_from_mask(&out_chlayout, av_channel_layout_subset(&out_chlayout, ~AV_CH_LOW_FREQUENCY)); From 4c78a357d082b1097c4269dd1af116bb01ddc83e Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 16 May 2025 16:54:52 -0300 Subject: [PATCH 254/290] avcodec/lcevcdec: don't try to write to output frames directly The buffer references may not be writable at this point, as the decoder calls get_buffer2() with the AV_GET_BUFFER_FLAG_REF flag. Fixes races as reported by tsan, producing correct output regardless of threading choices. Signed-off-by: James Almer (cherry picked from commit 8eae65dc5c8960c9770017737d968eca2aa7f502) --- libavcodec/decode.c | 39 ++++++++++++++++++++---- libavcodec/lcevcdec.c | 69 ++++++++++++++++++++++++------------------- libavcodec/lcevcdec.h | 5 ++++ 3 files changed, 78 insertions(+), 35 deletions(-) diff --git a/libavcodec/decode.c b/libavcodec/decode.c index 148af71ac4..828013197c 100644 --- a/libavcodec/decode.c +++ b/libavcodec/decode.c @@ -1671,22 +1671,49 @@ static void update_frame_props(AVCodecContext *avctx, AVFrame *frame) } } -static void attach_post_process_data(AVCodecContext *avctx, AVFrame *frame) +static int attach_post_process_data(AVCodecContext *avctx, AVFrame *frame) { AVCodecInternal *avci = avctx->internal; DecodeContext *dc = decode_ctx(avci); if (dc->lcevc_frame) { FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data; + FFLCEVCFrame *frame_ctx; + int ret; - fdd->post_process_opaque = ff_refstruct_ref(dc->lcevc); - fdd->post_process_opaque_free = ff_lcevc_unref; - fdd->post_process = ff_lcevc_process; + frame_ctx = av_mallocz(sizeof(*frame_ctx)); + if (!frame_ctx) + return AVERROR(ENOMEM); + + frame_ctx->frame = av_frame_alloc(); + if (!frame_ctx->frame) { + av_free(frame_ctx); + return AVERROR(ENOMEM); + } + + frame_ctx->lcevc = ff_refstruct_ref(dc->lcevc); + frame_ctx->frame->width = frame->width; + frame_ctx->frame->height = frame->height; + frame_ctx->frame->format = frame->format; frame->width = dc->width; frame->height = dc->height; + + ret = avctx->get_buffer2(avctx, frame_ctx->frame, 0); + if (ret < 0) { + ff_lcevc_unref(frame_ctx); + return ret; + } + + validate_avframe_allocation(avctx, frame_ctx->frame); + + fdd->post_process_opaque = frame_ctx; + fdd->post_process_opaque_free = ff_lcevc_unref; + fdd->post_process = ff_lcevc_process; } dc->lcevc_frame = 0; + + return 0; } int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags) @@ -1747,7 +1774,9 @@ int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags) if (ret < 0) goto fail; - attach_post_process_data(avctx, frame); + ret = attach_post_process_data(avctx, frame); + if (ret < 0) + goto fail; end: if (avctx->codec_type == AVMEDIA_TYPE_VIDEO && !override_dimensions && diff --git a/libavcodec/lcevcdec.c b/libavcodec/lcevcdec.c index ceeece3aa9..601e97b3a1 100644 --- a/libavcodec/lcevcdec.c +++ b/libavcodec/lcevcdec.c @@ -45,7 +45,7 @@ static LCEVC_ColorFormat map_format(int format) return LCEVC_ColorFormat_Unknown; } -static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder, +static int alloc_base_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *frame, LCEVC_PictureHandle *picture) { LCEVC_PictureDesc desc; @@ -68,22 +68,22 @@ static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder, desc.sampleAspectRatioDen = frame->sample_aspect_ratio.den; /* Allocate LCEVC Picture */ - res = LCEVC_AllocPicture(decoder, &desc, picture); + res = LCEVC_AllocPicture(lcevc->decoder, &desc, picture); if (res != LCEVC_Success) { return AVERROR_EXTERNAL; } - res = LCEVC_LockPicture(decoder, *picture, LCEVC_Access_Write, &lock); + res = LCEVC_LockPicture(lcevc->decoder, *picture, LCEVC_Access_Write, &lock); if (res != LCEVC_Success) return AVERROR_EXTERNAL; - res = LCEVC_GetPicturePlaneCount(decoder, *picture, &planes); + res = LCEVC_GetPicturePlaneCount(lcevc->decoder, *picture, &planes); if (res != LCEVC_Success) return AVERROR_EXTERNAL; for (unsigned i = 0; i < planes; i++) { LCEVC_PicturePlaneDesc plane; - res = LCEVC_GetPictureLockPlaneDesc(decoder, lock, i, &plane); + res = LCEVC_GetPictureLockPlaneDesc(lcevc->decoder, lock, i, &plane); if (res != LCEVC_Success) return AVERROR_EXTERNAL; @@ -94,43 +94,43 @@ static int alloc_base_frame(void *logctx, LCEVC_DecoderHandle decoder, av_image_copy2(data, linesizes, frame->data, frame->linesize, frame->format, frame->width, frame->height); - res = LCEVC_UnlockPicture(decoder, lock); + res = LCEVC_UnlockPicture(lcevc->decoder, lock); if (res != LCEVC_Success) return AVERROR_EXTERNAL; return 0; } -static int alloc_enhanced_frame(void *logctx, LCEVC_DecoderHandle decoder, - const AVFrame *frame, LCEVC_PictureHandle *picture) +static int alloc_enhanced_frame(void *logctx, FFLCEVCFrame *frame_ctx, + LCEVC_PictureHandle *picture) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureDesc desc ; - LCEVC_ColorFormat fmt = map_format(frame->format); + LCEVC_ColorFormat fmt = map_format(frame_ctx->frame->format); LCEVC_PicturePlaneDesc planes[4] = { 0 }; - int width = frame->width * 2 / FFMAX(frame->sample_aspect_ratio.den, 1); - int height = frame->height * 2 / FFMAX(frame->sample_aspect_ratio.num, 1); LCEVC_ReturnCode res; - res = LCEVC_DefaultPictureDesc(&desc, fmt, width, height); + res = LCEVC_DefaultPictureDesc(&desc, fmt, frame_ctx->frame->width, frame_ctx->frame->height); if (res != LCEVC_Success) return AVERROR_EXTERNAL; /* Set plane description */ for (int i = 0; i < 4; i++) { - planes[i].firstSample = frame->data[i]; - planes[i].rowByteStride = frame->linesize[i]; + planes[i].firstSample = frame_ctx->frame->data[i]; + planes[i].rowByteStride = frame_ctx->frame->linesize[i]; } /* Allocate LCEVC Picture */ - res = LCEVC_AllocPictureExternal(decoder, &desc, NULL, planes, picture); + res = LCEVC_AllocPictureExternal(lcevc->decoder, &desc, NULL, planes, picture); if (res != LCEVC_Success) { return AVERROR_EXTERNAL; } return 0; } -static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame *in) +static int lcevc_send_frame(void *logctx, FFLCEVCFrame *frame_ctx, const AVFrame *in) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; const AVFrameSideData *sd = av_frame_get_side_data(in, AV_FRAME_DATA_LCEVC); LCEVC_PictureHandle picture; LCEVC_ReturnCode res; @@ -143,7 +143,7 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame * if (res != LCEVC_Success) return AVERROR_EXTERNAL; - ret = alloc_base_frame(logctx, lcevc->decoder, in, &picture); + ret = alloc_base_frame(logctx, lcevc, in, &picture); if (ret < 0) return ret; @@ -152,7 +152,7 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame * return AVERROR_EXTERNAL; memset(&picture, 0, sizeof(picture)); - ret = alloc_enhanced_frame(logctx, lcevc->decoder, in, &picture); + ret = alloc_enhanced_frame(logctx, frame_ctx, &picture); if (ret < 0) return ret; @@ -163,8 +163,9 @@ static int lcevc_send_frame(void *logctx, FFLCEVCContext *lcevc, const AVFrame * return 0; } -static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) +static int generate_output(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureDesc desc; LCEVC_DecodeInformation info; LCEVC_PictureHandle picture; @@ -184,6 +185,11 @@ static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) out->crop_right = desc.cropRight; out->sample_aspect_ratio.num = desc.sampleAspectRatioNum; out->sample_aspect_ratio.den = desc.sampleAspectRatioDen; + + av_frame_copy_props(frame_ctx->frame, out); + av_frame_unref(out); + av_frame_move_ref(out, frame_ctx->frame); + out->width = desc.width + out->crop_left + out->crop_right; out->height = desc.height + out->crop_top + out->crop_bottom; @@ -194,13 +200,14 @@ static int generate_output(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) return 0; } -static int lcevc_receive_frame(void *logctx, FFLCEVCContext *lcevc, AVFrame *out) +static int lcevc_receive_frame(void *logctx, FFLCEVCFrame *frame_ctx, AVFrame *out) { + FFLCEVCContext *lcevc = frame_ctx->lcevc; LCEVC_PictureHandle picture; LCEVC_ReturnCode res; int ret; - ret = generate_output(logctx, lcevc, out); + ret = generate_output(logctx, frame_ctx, out); if (ret < 0) return ret; @@ -247,12 +254,7 @@ static int lcevc_init(FFLCEVCContext *lcevc, void *logctx) #if CONFIG_LIBLCEVC_DEC LCEVC_AccelContextHandle dummy = { 0 }; const int32_t event = LCEVC_Log; -#endif - if (lcevc->initialized) - return 0; - -#if CONFIG_LIBLCEVC_DEC if (LCEVC_CreateDecoder(&lcevc->decoder, dummy) != LCEVC_Success) { av_log(logctx, AV_LOG_ERROR, "Failed to create LCEVC decoder\n"); return AVERROR_EXTERNAL; @@ -277,7 +279,8 @@ static int lcevc_init(FFLCEVCContext *lcevc, void *logctx) int ff_lcevc_process(void *logctx, AVFrame *frame) { FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data; - FFLCEVCContext *lcevc = fdd->post_process_opaque; + FFLCEVCFrame *frame_ctx = fdd->post_process_opaque; + FFLCEVCContext *lcevc = frame_ctx->lcevc; int ret; if (!lcevc->initialized) { @@ -287,11 +290,14 @@ int ff_lcevc_process(void *logctx, AVFrame *frame) } #if CONFIG_LIBLCEVC_DEC - ret = lcevc_send_frame(logctx, lcevc, frame); + av_assert0(frame_ctx->frame); + + + ret = lcevc_send_frame(logctx, frame_ctx, frame); if (ret) return ret < 0 ? ret : 0; - lcevc_receive_frame(logctx, lcevc, frame); + lcevc_receive_frame(logctx, frame_ctx, frame); if (ret < 0) return ret; @@ -315,5 +321,8 @@ int ff_lcevc_alloc(FFLCEVCContext **plcevc) void ff_lcevc_unref(void *opaque) { - ff_refstruct_unref(&opaque); + FFLCEVCFrame *lcevc = opaque; + ff_refstruct_unref(&lcevc->lcevc); + av_frame_free(&lcevc->frame); + av_free(opaque); } diff --git a/libavcodec/lcevcdec.h b/libavcodec/lcevcdec.h index 7334d3a645..f0d17c0412 100644 --- a/libavcodec/lcevcdec.h +++ b/libavcodec/lcevcdec.h @@ -36,6 +36,11 @@ typedef struct FFLCEVCContext { struct AVFrame; +typedef struct FFLCEVCFrame { + FFLCEVCContext *lcevc; + struct AVFrame *frame; +} FFLCEVCFrame; + int ff_lcevc_alloc(FFLCEVCContext **plcevc); int ff_lcevc_process(void *logctx, struct AVFrame *frame); void ff_lcevc_unref(void *opaque); From 9373b442a689455bb5fcfddcfe70dfb8e4352fbc Mon Sep 17 00:00:00 2001 From: Coia Prant Date: Fri, 23 May 2025 17:32:00 +0800 Subject: [PATCH 255/290] configure: Use MSYSTEM_CARCH for default arch on msys2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On msys2, `uname -m` returns the architecture of the base msys2 layer. On Windows on arm64, the base msys2 layer itself is still x86_64 only, even if running with e.g. the clangarm64 where the windows native applications are built as aarch64. If MSYSTEM_CARCH is set, use this instead of `uname -m` for the default architecture. This gives the correct behaviour for the clangarm64 environments. It also gives the correct default for the 32 bit x86 environments such as `mingw32`. (On `mingw32`, the fact that `uname -m` returned `x86_64` hasn't been an issue, as both that and `i686` gets normalized into `x86` internally in ffmpeg's configure.) Signed-off-by: Coia Prant Signed-off-by: Martin Storsjö (cherry picked from commit df967d095ae6a42a46cd4c46b96d61cc1c319b23) --- configure | 2 ++ 1 file changed, 2 insertions(+) diff --git a/configure b/configure index 0aa7b72af3..b559dca5d0 100755 --- a/configure +++ b/configure @@ -4112,6 +4112,8 @@ if test "$target_os_default" = aix; then arch_default=$(uname -p) strip_default="strip -X32_64" nm_default="nm -g -X32_64" +elif test "$MSYSTEM_CARCH" != ""; then + arch_default="$MSYSTEM_CARCH" else arch_default=$(uname -m) fi From 0755e038ca9cee6094ba7310f4b40a3105735055 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Sun, 25 May 2025 05:12:05 +0200 Subject: [PATCH 256/290] avformat/matroskadec: Fix VfW extradata size The structure is padded to an even length with an internal size field to indicate the real size. The matroska-matroska-display-metadata test (writing FFV1 in VFW mode) was affected by this. It should also fix ticket #11613. Reviewed-by: compn Signed-off-by: Andreas Rheinhardt (cherry picked from commit 92e310eb82e04713e55d248b65c22f0eb95afada) --- libavformat/matroskadec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index efa3e44c85..105a90a937 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2876,6 +2876,11 @@ static int mkv_parse_video_codec(MatroskaTrack *track, AVCodecParameters *par, { if (!strcmp(track->codec_id, "V_MS/VFW/FOURCC") && track->codec_priv.size >= 40) { + uint32_t size = AV_RL32A(track->codec_priv.data); + // VFW extradata is padded to an even length, yet + // the size field contains the real length. + if (size & 1 && size == track->codec_priv.size - 1) + --track->codec_priv.size; track->ms_compat = 1; par->bits_per_coded_sample = AV_RL16(track->codec_priv.data + 14); par->codec_tag = AV_RL32(track->codec_priv.data + 16); From 0f1fe3d153e8869b4e768a548ad9b5148a45280f Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Sun, 25 May 2025 03:31:17 +0200 Subject: [PATCH 257/290] avformat/matroska: Support JPEG2000 for demuxing Legal since commit 1cd0a9be4b2d1e7c60184ec68404e00e46e3123e (Jan 4) in the Cellar Matroska specification git repo. We still hold out on muxing it due to compatibility with old demuxers. Reviewed-by: compn Signed-off-by: Andreas Rheinhardt (cherry picked from commit 8a936b8726e10d84a06cacc872d267020f1ef156) --- libavformat/matroska.c | 1 + libavformat/matroskaenc.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/matroska.c b/libavformat/matroska.c index d0ecfbeb6a..7d94ed236f 100644 --- a/libavformat/matroska.c +++ b/libavformat/matroska.c @@ -82,6 +82,7 @@ const CodecTags ff_mkv_codec_tags[]={ {"V_AVS3" , AV_CODEC_ID_AVS3}, {"V_DIRAC" , AV_CODEC_ID_DIRAC}, {"V_FFV1" , AV_CODEC_ID_FFV1}, + {"V_JPEG2000" , AV_CODEC_ID_JPEG2000}, {"V_MJPEG" , AV_CODEC_ID_MJPEG}, {"V_MPEG1" , AV_CODEC_ID_MPEG1VIDEO}, {"V_MPEG2" , AV_CODEC_ID_MPEG2VIDEO}, diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index 60c896e964..5d00b26729 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -1956,8 +1956,8 @@ static int mkv_write_track(AVFormatContext *s, MatroskaMuxContext *mkv, // look for a codec ID string specific to mkv to use, // if none are found, use AVI codes - if (par->codec_id == AV_CODEC_ID_FFV1) { - /* FFV1 is actually supported natively in Matroska, + if (par->codec_id == AV_CODEC_ID_FFV1 || par->codec_id == AV_CODEC_ID_JPEG2000) { + /* FFV1 and JPEG2000 are actually supported natively in Matroska, * yet we use the VfW way to mux it for compatibility * with old demuxers. (FIXME: Are they really important?) */ } else if (par->codec_id != AV_CODEC_ID_RAWVIDEO || par->codec_tag) { From 937051872de89676db882275d66f36b737b1c938 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 9 Jun 2025 13:29:29 +0200 Subject: [PATCH 258/290] Revert "avformat/mpegts: update stream info when PMT ES stream_type changes" This fixes mixing up contexts, use of uninitialized data and crashes. More specifically: ==1001752== Conditional jump or move depends on uninitialised value(s) ==1001752== at 0xA9ED82: avpriv_h264_has_num_reorder_frames (h264dec.c:64) ==1001752== by 0x668C7E: has_decode_delay_been_guessed (demux.c:757) ==1001752== by 0x66AB13: compute_pkt_fields (demux.c:1137) ==1001752== by 0x66B2E9: parse_packet (demux.c:1265) ==1001752== by 0x66BD84: read_frame_internal (demux.c:1449) ==1001752== by 0x67085B: avformat_find_stream_info (demux.c:2692) ==1001752== by 0x25157C: ifile_open (ffmpeg_demux.c:1814) ==1001752== by 0x272B15: open_files (ffmpeg_opt.c:1366) ==1001752== by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415) ==1001752== by 0x2925C9: main (ffmpeg.c:991) ==1001752== Uninitialised value was created by a heap allocation ==1001752== at 0x483E0F0: memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so) ==1001752== by 0x483E212: posix_memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so) ==1001752== by 0x14882CE: av_malloc (mem.c:107) ==1001752== by 0x1463785: av_buffer_alloc (buffer.c:82) ==1001752== by 0x146423F: pool_alloc_buffer (buffer.c:369) ==1001752== by 0x14643C4: av_buffer_pool_get (buffer.c:407) ==1001752== by 0x752C4B: buffer_pool_get (mpegts.c:1142) ==1001752== by 0x7538F2: mpegts_push_data (mpegts.c:1407) ==1001752== by 0x758893: handle_packet (mpegts.c:2909) ==1001752== by 0x758E90: handle_packets (mpegts.c:3048) ==1001752== by 0x759B1D: mpegts_read_packet (mpegts.c:3290) ==1001752== by 0x6687A3: ff_read_packet (demux.c:649) ==1001752== by 0x66B594: read_frame_internal (demux.c:1346) ==1001752== by 0x67085B: avformat_find_stream_info (demux.c:2692) ==1001752== by 0x25157C: ifile_open (ffmpeg_demux.c:1814) ==1001752== by 0x272B15: open_files (ffmpeg_opt.c:1366) ==1001752== by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415) ==1001752== by 0x2925C9: main (ffmpeg.c:991) Found-by: Alexander A. Shvedov CC: Pavel Koshevoy This reverts commit 0021484d05f9b0f032fa319399de6e24eea0c04f. Signed-off-by: Michael Niedermayer --- libavformat/mpegts.c | 4 +--- tests/ref/fate/ts-demux | 4 ++-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index b5f29aee65..86b7c8e041 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -938,8 +938,6 @@ static int mpegts_set_stream_info(AVStream *st, PESContext *pes, mpegts_find_stream_type(st, pes->stream_type, ISO_types); if (pes->stream_type == 4 || pes->stream_type == 0x0f) sti->request_probe = 50; - if (pes->stream_type == STREAM_TYPE_PRIVATE_DATA) - sti->request_probe = AVPROBE_SCORE_STREAM_RETRY; if ((prog_reg_desc == AV_RL32("HDMV") || prog_reg_desc == AV_RL32("HDPR")) && st->codecpar->codec_id == AV_CODEC_ID_NONE) { @@ -2498,7 +2496,7 @@ static void pmt_cb(MpegTSFilter *filter, const uint8_t *section, int section_len if (!st) goto out; - if (pes && pes->stream_type != stream_type) + if (pes && !pes->stream_type) mpegts_set_stream_info(st, pes, stream_type, prog_reg_desc); add_pid_to_program(prg, pid); diff --git a/tests/ref/fate/ts-demux b/tests/ref/fate/ts-demux index 732f9d0289..45522c2bfb 100644 --- a/tests/ref/fate/ts-demux +++ b/tests/ref/fate/ts-demux @@ -24,6 +24,6 @@ packet|codec_type=video|stream_index=0|pts=3912686363|pts_time=43474.292922|dts= packet|codec_type=audio|stream_index=1|pts=3912644825|pts_time=43473.831389|dts=3912644825|dts_time=43473.831389|duration=2880|duration_time=0.032000|size=906|pos=474888|flags=K__|data_hash=CRC32:0893d398 packet|codec_type=audio|stream_index=2|pts=3912645580|pts_time=43473.839778|dts=3912645580|dts_time=43473.839778|duration=2880|duration_time=0.032000|size=354|pos=491808|flags=K__|data_hash=CRC32:f5963fa6 stream|index=0|codec_name=mpeg2video|profile=4|codec_type=video|codec_tag_string=[2][0][0][0]|codec_tag=0x0002|width=1280|height=720|coded_width=0|coded_height=0|closed_captions=0|film_grain=0|has_b_frames=1|sample_aspect_ratio=1:1|display_aspect_ratio=16:9|pix_fmt=yuv420p|level=4|color_range=tv|color_space=unknown|color_transfer=unknown|color_primaries=unknown|chroma_location=left|field_order=progressive|refs=1|ts_id=32776|ts_packetsize=188|id=0x31|r_frame_rate=60000/1001|avg_frame_rate=60000/1001|time_base=1/90000|start_pts=3912669846|start_time=43474.109400|duration_ts=19519|duration=0.216878|bit_rate=15000000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=15|extradata_size=150|extradata_hash=CRC32:53134fa8|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|side_datum/cpb_properties:side_data_type=CPB properties|side_datum/cpb_properties:max_bitrate=15000000|side_datum/cpb_properties:min_bitrate=0|side_datum/cpb_properties:avg_bitrate=0|side_datum/cpb_properties:buffer_size=9781248|side_datum/cpb_properties:vbv_delay=-1 -stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng -stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[6][0][0][0]|codec_tag=0x0006|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es +stream|index=1|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=6|channel_layout=5.1(side)|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x34|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912633305|start_time=43473.703389|duration_ts=14400|duration=0.160000|bit_rate=384000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=eng +stream|index=2|codec_name=ac3|profile=unknown|codec_type=audio|codec_tag_string=[4][0][0][0]|codec_tag=0x0004|sample_fmt=fltp|sample_rate=48000|channels=2|channel_layout=stereo|bits_per_sample=0|initial_padding=0|ts_id=32776|ts_packetsize=188|id=0x35|r_frame_rate=0/0|avg_frame_rate=0/0|time_base=1/90000|start_pts=3912634060|start_time=43473.711778|duration_ts=14400|duration=0.160000|bit_rate=192000|max_bit_rate=N/A|bits_per_raw_sample=N/A|nb_frames=N/A|nb_read_frames=N/A|nb_read_packets=5|disposition:default=0|disposition:dub=0|disposition:original=0|disposition:comment=0|disposition:lyrics=0|disposition:karaoke=0|disposition:forced=0|disposition:hearing_impaired=0|disposition:visual_impaired=0|disposition:clean_effects=0|disposition:attached_pic=0|disposition:timed_thumbnails=0|disposition:non_diegetic=0|disposition:captions=0|disposition:descriptions=0|disposition:metadata=0|disposition:dependent=0|disposition:still_image=0|disposition:multilayer=0|tag:language=es format|filename=mp3ac325-4864-small.ts|nb_streams=3|nb_programs=1|nb_stream_groups=0|format_name=mpegts|start_time=43473.703389|duration=0.622889|size=512000|bit_rate=6575810|probe_score=50 From e77b52b6cde5e7474439797b40fb1cad6085515b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 1 Apr 2025 02:00:41 +0200 Subject: [PATCH 259/290] doc: replace http/git by https urls These are more secure Reviewed-by: Gyan Doshi Signed-off-by: Michael Niedermayer (cherry picked from commit b4d165c68fe74f4b9c7fa4cbc2e1467a0bafea37) Signed-off-by: Michael Niedermayer --- doc/fate_config.sh.template | 2 +- doc/git-howto.texi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/fate_config.sh.template b/doc/fate_config.sh.template index 8681805d65..4ff8629d44 100644 --- a/doc/fate_config.sh.template +++ b/doc/fate_config.sh.template @@ -1,5 +1,5 @@ slot= # some unique identifier -repo=git://source.ffmpeg.org/ffmpeg.git # the source repository +repo=https://git.ffmpeg.org/ffmpeg.git # the source repository #branch=release/2.6 # the branch to test samples= # path to samples directory workdir= # directory in which to do all the work diff --git a/doc/git-howto.texi b/doc/git-howto.texi index 075b188abe..3e050dbd4a 100644 --- a/doc/git-howto.texi +++ b/doc/git-howto.texi @@ -143,7 +143,7 @@ git log @end example You may also use the graphical tools like @command{gitview} or @command{gitk} -or the web interface available at @url{http://source.ffmpeg.org/}. +or the web interface available at @url{https://git.ffmpeg.org/ffmpeg.git}. @section Checking source tree status From e7e022094ae4e3deaffb8062437899760836fb31 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 7 Feb 2025 00:04:25 -0300 Subject: [PATCH 260/290] avcodec/libtheora: fix setting keyframe_mask t_info.keyframe_granule_shift is set to the library default of 6, which is ok for gop sizes up to 63. Since there's apparently no way to query the updated value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE, calculate it manually instead. Fixes ticket #11454. Signed-off-by: James Almer (cherry picked from commit 22aa71d4da37a4ad2b0d28deeace64b57aa2ef50) Signed-off-by: Michael Niedermayer --- libavcodec/libtheoraenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/libtheoraenc.c b/libavcodec/libtheoraenc.c index 8844f4be6a..761cd45d44 100644 --- a/libavcodec/libtheoraenc.c +++ b/libavcodec/libtheoraenc.c @@ -234,7 +234,7 @@ static av_cold int encode_init(AVCodecContext* avc_context) return AVERROR_EXTERNAL; } - h->keyframe_mask = (1 << t_info.keyframe_granule_shift) - 1; + h->keyframe_mask = (1 << av_ceil_log2(avc_context->gop_size)) - 1; /* Clear up theora_info struct */ th_info_clear(&t_info); From e5350ef107eccccfa148311af8e8c727a9330f55 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 4 Feb 2025 03:58:44 +0100 Subject: [PATCH 261/290] swscale/output: Fix integer overflow in yuv2gbrp_full_X_c() Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int' Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit ce538ef97a7b1fdab6f2a3c8afc538c1cc3760d9) Signed-off-by: Michael Niedermayer --- libswscale/output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libswscale/output.c b/libswscale/output.c index 366883ab1b..2172e4b53b 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -2289,9 +2289,9 @@ yuv2gbrp_full_X_c(SwsContext *c, const int16_t *lumFilter, Y -= c->yuv2rgb_y_offset; Y *= c->yuv2rgb_y_coeff; Y += 1 << (SH-1); - R = Y + V * c->yuv2rgb_v2r_coeff; - G = Y + V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff; - B = Y + U * c->yuv2rgb_u2b_coeff; + R = Y + V * (unsigned)c->yuv2rgb_v2r_coeff; + G = Y + V * (unsigned)c->yuv2rgb_v2g_coeff + U * (unsigned)c->yuv2rgb_u2g_coeff; + B = Y + U * (unsigned)c->yuv2rgb_u2b_coeff; if ((R | G | B) & 0xC0000000) { R = av_clip_uintp2(R, 30); From 2fa3801507023e41110605774b6a91d7ca39198e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 4 Feb 2025 03:58:45 +0100 Subject: [PATCH 262/290] avcodec/osq: avoid undefined negation Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself Fixes: 390646659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5040277374435328 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit c6a889f3e09249d2a643a6beb7d44a8e42ea3541) Signed-off-by: Michael Niedermayer --- libavcodec/osq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/osq.c b/libavcodec/osq.c index 83b4a9d618..5c7826778d 100644 --- a/libavcodec/osq.c +++ b/libavcodec/osq.c @@ -190,7 +190,7 @@ static uint32_t get_urice(GetBitContext *gb, int k) static int32_t get_srice(GetBitContext *gb, int x) { - int32_t y = get_urice(gb, x); + uint32_t y = get_urice(gb, x); return get_bits1(gb) ? -y : y; } From d1cef18c5cacd3af19c72e73581642b82b7e6865 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 24 Mar 2025 02:57:46 +0100 Subject: [PATCH 263/290] configure: Clearer documentation for "disable-safe-bitstream-reader" Signed-off-by: Michael Niedermayer (cherry picked from commit 979608dde7a833b7af50a9f6bad81fc483c1ff04) Signed-off-by: Michael Niedermayer --- configure | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/configure b/configure index b559dca5d0..98b582a5d5 100755 --- a/configure +++ b/configure @@ -434,7 +434,9 @@ Advanced options (experts only): --enable-hardcoded-tables use hardcoded tables instead of runtime generation --disable-safe-bitstream-reader disable buffer boundary checking in bitreaders - (faster, but may crash) + (This disables some security checks and can cause undefined behavior, + crashes and arbitrary code execution, it may be faster, but + should only be used with trusted input) --sws-max-filter-size=N the max filter size swscale uses [$sws_max_filter_size_default] Optimization options (experts only): From 0b7e43fb17b59668ad7e6838b066790e1d299647 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 22 Apr 2025 03:35:31 +0200 Subject: [PATCH 264/290] postproc/postprocess_template: Fix reading uninitialized pixels in dering_C() This issue was found through the new blocktest Signed-off-by: Michael Niedermayer (cherry picked from commit 0118f392be916784f92508474e8d64243fd6fa97) Signed-off-by: Michael Niedermayer --- libpostproc/postprocess_altivec_template.c | 2 +- libpostproc/postprocess_template.c | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/libpostproc/postprocess_altivec_template.c b/libpostproc/postprocess_altivec_template.c index a9d4cd29a3..eebceb7bcd 100644 --- a/libpostproc/postprocess_altivec_template.c +++ b/libpostproc/postprocess_altivec_template.c @@ -530,7 +530,7 @@ static inline void doVertDefFilter_altivec(uint8_t src[], int stride, PPContext STORE(5) } -static inline void dering_altivec(uint8_t src[], int stride, PPContext *c) { +static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) { const vector signed int vsint32_8 = vec_splat_s32(8); const vector unsigned int vuint32_4 = vec_splat_u32(4); const vector signed char neg1 = vec_splat_s8(-1); diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c index d56b45d3b4..9da640e552 100644 --- a/libpostproc/postprocess_template.c +++ b/libpostproc/postprocess_template.c @@ -831,7 +831,7 @@ static inline void RENAME(doVertDefFilter)(uint8_t src[], int stride, PPContext #endif //TEMPLATE_PP_ALTIVEC #if !TEMPLATE_PP_ALTIVEC -static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c) +static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) { #if TEMPLATE_PP_MMXEXT && HAVE_7REGS DECLARE_ALIGNED(8, uint64_t, tmp)[3]; @@ -1047,7 +1047,7 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5, for(y=0; y<10; y++){ int t = 0; - if(src[stride*y + 0] > avg) t+= 1; + if(!leftborder && src[stride*y + 0] > avg) t+= 1; if(src[stride*y + 1] > avg) t+= 2; if(src[stride*y + 2] > avg) t+= 4; if(src[stride*y + 3] > avg) t+= 8; @@ -1056,7 +1056,7 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5, if(src[stride*y + 6] > avg) t+= 64; if(src[stride*y + 7] > avg) t+= 128; if(src[stride*y + 8] > avg) t+= 256; - if(src[stride*y + 9] > avg) t+= 512; + if(!rightborder && src[stride*y + 9] > avg) t+= 512; t |= (~t)<<16; t &= (t<<1) & (t>>1); @@ -1073,8 +1073,8 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5, int x; int t = s[y-1]; - p= src + stride*y; - for(x=1; x<9; x++){ + p= src + stride*y + leftborder; + for(x=1+leftborder; x<9-rightborder; x++){ p++; if(t & (1<0) RENAME(dering)(dstBlock - stride - 8, stride, c); + if(y>0) RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0); } if(mode & TEMP_NOISE_FILTER) @@ -3233,7 +3233,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ } if(mode & DERING){ - if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c); + if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1); } if((mode & TEMP_NOISE_FILTER)){ From 64911ffc20b78683d19e61be63b60de91d945685 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 22 Apr 2025 21:04:37 +0200 Subject: [PATCH 265/290] postproc/postprocess_template: fix handling of first row of dering_C Signed-off-by: Michael Niedermayer (cherry picked from commit 142eb90f07a43a1658d0b61c4ae447f76e88f66b) Signed-off-by: Michael Niedermayer --- libpostproc/postprocess_altivec_template.c | 5 ++++- libpostproc/postprocess_template.c | 12 +++++++----- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/libpostproc/postprocess_altivec_template.c b/libpostproc/postprocess_altivec_template.c index eebceb7bcd..4dea0036ce 100644 --- a/libpostproc/postprocess_altivec_template.c +++ b/libpostproc/postprocess_altivec_template.c @@ -530,7 +530,7 @@ static inline void doVertDefFilter_altivec(uint8_t src[], int stride, PPContext STORE(5) } -static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) { +static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder) { const vector signed int vsint32_8 = vec_splat_s32(8); const vector unsigned int vuint32_4 = vec_splat_u32(4); const vector signed char neg1 = vec_splat_s8(-1); @@ -577,6 +577,9 @@ static inline void dering_altivec(uint8_t src[], int stride, PPContext *c, int l const vector signed int zero = vec_splat_s32(0); vector unsigned char v_dt = vec_splat(vec_ld(0, dt), 0); + if (topborder) + return; + #define LOAD_LINE(i) \ const vector unsigned char perm##i = \ vec_lvsl(i * stride, srcCopy); \ diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c index 9da640e552..309ea9d25a 100644 --- a/libpostproc/postprocess_template.c +++ b/libpostproc/postprocess_template.c @@ -831,9 +831,11 @@ static inline void RENAME(doVertDefFilter)(uint8_t src[], int stride, PPContext #endif //TEMPLATE_PP_ALTIVEC #if !TEMPLATE_PP_ALTIVEC -static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder) +static inline void RENAME(dering)(uint8_t src[], int stride, PPContext *c, int leftborder, int rightborder, int topborder) { #if TEMPLATE_PP_MMXEXT && HAVE_7REGS + if (topborder) + return; DECLARE_ALIGNED(8, uint64_t, tmp)[3]; __asm__ volatile( "pxor %%mm6, %%mm6 \n\t" @@ -1044,7 +1046,8 @@ DERING_CORE((%0, %1, 8) ,(%%FF_REGd, %1, 4),%%mm2,%%mm4,%%mm0,%%mm3,%%mm5, if(max - min avg) t+= 1; @@ -3210,8 +3213,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ } #endif //TEMPLATE_PP_MMX if(mode & DERING){ - //FIXME filter first line - if(y>0) RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0); + RENAME(dering)(dstBlock - stride - 8, stride, c, x<=8, 0, y<=0); } if(mode & TEMP_NOISE_FILTER) @@ -3233,7 +3235,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ } if(mode & DERING){ - if(y > 0) RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1); + RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1, y<=0); } if((mode & TEMP_NOISE_FILTER)){ From eb922deff1841e6d3a8367b61e3e4d69dcc5fa1b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 Apr 2025 12:30:04 +0200 Subject: [PATCH 266/290] avformat/hls: Add cmfv and cmfa to allowed_extensions Fixes: www.nicovideo.jp Fixes: Ticket11526 Signed-off-by: Michael Niedermayer (cherry picked from commit 2352145e416c7cbdcf9679ea690c9c1dee4a7936) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 896deb23d5..e409f161f0 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -2628,7 +2628,9 @@ static const AVOption hls_options[] = { OFFSET(prefer_x_start), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, FLAGS}, {"allowed_extensions", "List of file extensions that hls is allowed to access", OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, - {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,wav"}, + {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" + ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp + }, INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS}, From f2d135332be9ce4f8ba190f18c9ea667675c7c3b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 Apr 2025 12:43:12 +0200 Subject: [PATCH 267/290] avformat/hls: Add ec3 to allowed_extensions Fixes part of Ticket11435 Fixes: Elisa Viihde (Finnish online recording service) Signed-off-by: Michael Niedermayer (cherry picked from commit 68644994fd7cf55613e8b17bcc95b29226285ec5) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/hls.c b/libavformat/hls.c index e409f161f0..6e528ef987 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -2630,6 +2630,7 @@ static const AVOption hls_options[] = { OFFSET(allowed_extensions), AV_OPT_TYPE_STRING, {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp + ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) }, INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", From 84e237a58e7887b621b4264d57cd59288019d7ee Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 Apr 2025 12:47:34 +0200 Subject: [PATCH 268/290] avformat/hls: add fmp4 to allowed_extensions Fixes: yt-dlp/issues/12700 Signed-off-by: Michael Niedermayer (cherry picked from commit d82016c7302e0ede8626fc3d92f1418c567fbab4) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/hls.c b/libavformat/hls.c index 6e528ef987..83c02d003a 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -2631,6 +2631,7 @@ static const AVOption hls_options[] = { {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) + ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 }, INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", From b8eb5f0cbd7a258c2f2197c1a7d86ca5ab69be51 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 Apr 2025 18:52:05 +0200 Subject: [PATCH 269/290] avformat/hls: Fix Youtube AAC Fixes: Ticket11435 Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE Signed-off-by: Michael Niedermayer (cherry picked from commit 48c0dba23b3ce8c2bcb180bd2c8029c3c2875424) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 83c02d003a..0df61d0753 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -754,7 +754,8 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct if (in_fmt->extensions) { matchF = av_match_ext( seg->url, in_fmt->extensions) + 2*(ff_match_url_ext(seg->url, in_fmt->extensions) > 0); - if(av_match_name("mp4", in_fmt->name)) { + // Youtube uses aac files with .ts extension + if(av_match_name("mp4", in_fmt->name) || av_match_name("aac", in_fmt->name)) { matchF |= av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); } From 56e100a799ac25dddc42bda69588833c44a6581c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 30 Apr 2025 01:37:27 +0200 Subject: [PATCH 270/290] avformat/hls: Split allowed_segment_extensions off allowed_extensions This allows the user to set only the one that is needed to ALL or a specific "wrong" extension like html Signed-off-by: Michael Niedermayer (cherry picked from commit f99f223eb1ac9a6e36dab0e31756369214b5564f) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 0df61d0753..b404ded47d 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -223,6 +223,7 @@ typedef struct HLSContext { AVDictionary *avio_opts; AVDictionary *seg_format_opts; char *allowed_extensions; + char *allowed_segment_extensions; int extension_picky; int max_reload; int http_persistent; @@ -741,12 +742,12 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct if (!c->extension_picky) return 0; - if (strcmp(c->allowed_extensions, "ALL")) - matchA = av_match_ext (seg->url, c->allowed_extensions) - + 2*(ff_match_url_ext(seg->url, c->allowed_extensions) > 0); + if (strcmp(c->allowed_segment_extensions, "ALL")) + matchA = av_match_ext (seg->url, c->allowed_segment_extensions) + + 2*(ff_match_url_ext(seg->url, c->allowed_segment_extensions) > 0); if (!matchA) { - av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_extensions\n", seg->url); + av_log(s, AV_LOG_ERROR, "URL %s is not in allowed_segment_extensions\n", seg->url); return AVERROR_INVALIDDATA; } @@ -2635,6 +2636,14 @@ static const AVOption hls_options[] = { ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 }, INT_MIN, INT_MAX, FLAGS}, + {"allowed_segment_extensions", "List of file extensions that hls is allowed to access", + OFFSET(allowed_segment_extensions), AV_OPT_TYPE_STRING, + {.str = "3gp,aac,avi,ac3,eac3,flac,mkv,m3u8,m4a,m4s,m4v,mpg,mov,mp2,mp3,mp4,mpeg,mpegts,ogg,ogv,oga,ts,vob,vtt,wav,webvtt" + ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp + ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) + ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 + }, + INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", OFFSET(extension_picky), AV_OPT_TYPE_BOOL, {.i64 = 1}, 0, 1, FLAGS}, {"max_reload", "Maximum number of times a insufficient list is attempted to be reloaded", From 6153d693353540eb656705ebf84e33fdd3a5efc0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 30 Apr 2025 01:05:18 +0200 Subject: [PATCH 271/290] avformat/hls: Fix flash1.bogulus.cfd support Signed-off-by: Michael Niedermayer (cherry picked from commit 75be669ca1c986cc3510a5ad847e82785e2682e0) Signed-off-by: Michael Niedermayer --- libavformat/hls.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index b404ded47d..0b01f406f6 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -761,8 +761,11 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); } } else if (!strcmp(in_fmt->name, "mpegts")) { - matchF = av_match_ext( seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") - + 2*(ff_match_url_ext(seg->url, "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts") > 0); + const char *str = "ts,m2t,m2ts,mts,mpg,m4s,mpeg,mpegts" + ",html" // https://flash1.bogulus.cfd/ + ; + matchF = av_match_ext( seg->url, str) + + 2*(ff_match_url_ext(seg->url, str) > 0); } if (!(matchA & matchF)) { @@ -2642,6 +2645,7 @@ static const AVOption hls_options[] = { ",cmfv,cmfa" // Ticket11526 www.nicovideo.jp ",ec3" // part of Ticket11435 (Elisa Viihde (Finnish online recording service)) ",fmp4" // https://github.com/yt-dlp/yt-dlp/issues/12700 + ",html" // https://flash1.bogulus.cfd/ }, INT_MIN, INT_MAX, FLAGS}, {"extension_picky", "Be picky with all extensions matching", From ba06c473ba2e495e68a8cfab781eed257e76e470 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 1 May 2025 21:20:31 +0200 Subject: [PATCH 272/290] libpostproc: check minimum size Signed-off-by: Michael Niedermayer (cherry picked from commit 917c15435ae2e11a90de5d1a1153405bd3686fbe) Signed-off-by: Michael Niedermayer --- libpostproc/postprocess.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libpostproc/postprocess.c b/libpostproc/postprocess.c index 015bc9d501..c7f18c09e6 100644 --- a/libpostproc/postprocess.c +++ b/libpostproc/postprocess.c @@ -898,6 +898,11 @@ void pp_postprocess(const uint8_t * src[3], const int srcStride[3], int minStride= FFMAX(FFABS(srcStride[0]), FFABS(dstStride[0])); int absQPStride = FFABS(QPStride); + if (width < 16 || height < 16) { + av_log(c, AV_LOG_ERROR, "Postproc is designed to filter 16x16 macroblock based formats, the minimum size is 1 macroblock\n"); + return; + } + // c->stride and c->QPStride are always positive if(c->stride < minStride || c->qpStride < absQPStride) reallocBuffers(c, width, height, From 2f0af494b6c8dc564821c08bc7b131721ec07bcf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 1 May 2025 21:50:13 +0200 Subject: [PATCH 273/290] postproc/postprocess_template: fix dering with a 16x16 image Signed-off-by: Michael Niedermayer (cherry picked from commit fd9adbdbfbd548ef320975552695cfc5c819e339) Signed-off-by: Michael Niedermayer --- libpostproc/postprocess_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c index 309ea9d25a..f6ddb417bc 100644 --- a/libpostproc/postprocess_template.c +++ b/libpostproc/postprocess_template.c @@ -3235,7 +3235,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ } if(mode & DERING){ - RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, 0, 1, y<=0); + RENAME(dering)(dstBlock - dstStride - 8, dstStride, c, x<=8, 1, y<=0); } if((mode & TEMP_NOISE_FILTER)){ From 6786f8f038bdcf5906e720f422ac8cf5b4a400c8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 5 May 2025 19:53:57 +0200 Subject: [PATCH 274/290] tests/fate/filter-video: Fix dependancy for codecview Signed-off-by: Michael Niedermayer (cherry picked from commit 1b643e3f65d75a4e6a25986466254bdd4fc1a01a) Signed-off-by: Michael Niedermayer --- tests/fate/filter-video.mak | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/fate/filter-video.mak b/tests/fate/filter-video.mak index 5b8a294afd..e827026a5a 100644 --- a/tests/fate/filter-video.mak +++ b/tests/fate/filter-video.mak @@ -498,7 +498,7 @@ fate-filter-pp7: CMD = framecrc -flags bitexact -export_side_data venc_params -i FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, SPP, AVI, MPEG4) += spp fate-filter-spp: CMD = framecrc -flags bitexact -export_side_data venc_params -idct simple -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf "spp=idct=simple:dct=int" -FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, PP, AVI, MPEG4) += codecview +FATE_FILTER_VSYNTH1_MPEG4_QPRD-$(call FILTERDEMDEC, CODECVIEW, AVI, MPEG4) += codecview fate-filter-codecview: CMD = framecrc -flags bitexact -idct simple -flags2 +export_mvs -i $(TARGET_PATH)/tests/data/fate/vsynth1-mpeg4-qprd.avi -frames:v 5 -flags +bitexact -vf codecview=mv=pf+bf+bb # The above tests use vsynth1-mpeg4-qprd.avi created by fate-vsynth1-mpeg4-qprd From 6fb3c736a60ee1323957124302538867303c490c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 8 May 2025 23:10:52 +0200 Subject: [PATCH 275/290] avformat/iff: Check nb_channels == 0 in MHDR Fixes: division by 0 Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670 Reviewed-by: Peter Ross Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit ce1fd73d637a34551161fd8054ce3d410631982c) Signed-off-by: Michael Niedermayer --- libavformat/iff.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/iff.c b/libavformat/iff.c index 6b4503fdb3..3f75e135e5 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -497,6 +497,8 @@ static int iff_read_header(AVFormatContext *s) st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_MONO; else if (st->codecpar->ch_layout.nb_channels == 2) st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; + else if (st->codecpar->ch_layout.nb_channels == 0) + return AVERROR_INVALIDDATA; break; case ID_ABIT: From dd21a1462e0846bd892b4089a84b6bd946c27bcc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 8 May 2025 23:46:04 +0200 Subject: [PATCH 276/290] avcodec/hevc/ps: Fix dependant layer id check Fixes: shift exponent 49 is too large for 32-bit type 'int' Fixes: 398060145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5023082406543360 Reviewed-by: James Almer Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 4e5523c98597a417eb43555933b1075d18ec5f8b) Signed-off-by: Michael Niedermayer --- libavcodec/hevc/ps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc/ps.c b/libavcodec/hevc/ps.c index f18b88489b..8b48cba8e0 100644 --- a/libavcodec/hevc/ps.c +++ b/libavcodec/hevc/ps.c @@ -612,8 +612,8 @@ static int decode_vps_ext(GetBitContext *gb, AVCodecContext *avctx, HEVCVPS *vps } /* Consequence of established layer dependencies */ - if (layer1_id_included != ((1 << vps->layer_id_in_nuh[0]) | - (1 << vps->layer_id_in_nuh[1]))) { + if (layer1_id_included != ((1ULL << vps->layer_id_in_nuh[0]) | + (1ULL << vps->layer_id_in_nuh[1]))) { av_log(avctx, AV_LOG_ERROR, "Dependent layer not included in layer ID?\n"); return AVERROR_PATCHWELCOME; } From 7c068e5550356f5b25c3f8e50e91c6f8c020c2d5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 Apr 2025 16:49:31 +0200 Subject: [PATCH 277/290] avcodec/vorbisdec: Dont treat overread as error This differs from libvorbis by stddev: 2.44 PSNR: 88.58 MAXDIFF: 41 bytes: 834304/ 834304 for the file from the ticket Fixes: Ticket11427 Regression since: dc89cf804a811c0d25f4649a99f7fab4b5b416fa This is a similar solution to what james proposed earlier in [FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals Signed-off-by: Michael Niedermayer (cherry picked from commit fd5a3c5fed2c190446b2beb9bc532887db360cf7) Signed-off-by: Michael Niedermayer --- libavcodec/vorbisdec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 218e855f7a..32944af311 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -1469,8 +1469,10 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc, unsigned step = FASTDIV(vr->partition_size << 1, dim << 1); vorbis_codebook codebook = vc->codebooks[vqbook]; - if (get_bits_left(gb) <= 0) - return AVERROR_INVALIDDATA; + if (get_bits_left(gb) < 0) { + av_log(vc->avctx, AV_LOG_ERROR, "Overread %d bits\n", -get_bits_left(gb)); + return 0; + } if (vr_type == 0) { From 9ddab572c0bae2cbde7f15f2c56911e8a48dea3b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 16 Apr 2025 02:25:00 +0200 Subject: [PATCH 278/290] avcodec/h264_mb: Fix tmp_cr for arm When decoding a bitstream with weighted-bipred enabled, the results on ARM and x86 platforms may differ. The reason for the inconsistency is that the value of STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN is set to the buffer stride of temporary buffers for U and V components in mc_part_weighted. If the buffer stride is 32 or 64 (as on x86 platforms), the U and V pixels can be interleaved row by row without overlapping, resulting in correct output. However, on ARM platforms where the stride is 16, the V component did overwrite part of the U component's pixels, leading to incorrect predicted pixels. The bug can be reproduced by the following bitstream. https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264 Fixes: ticket 11357 Commit-msg-mostly-by: Bin Peng Reviewed-by: Bin Peng Signed-off-by: Michael Niedermayer (cherry picked from commit 74fd2c3ddbaf1fef5c4777784aa72b5747ad389c) Signed-off-by: Michael Niedermayer --- libavcodec/h264_mb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/h264_mb.c b/libavcodec/h264_mb.c index 4e94136313..2db0670478 100644 --- a/libavcodec/h264_mb.c +++ b/libavcodec/h264_mb.c @@ -407,7 +407,7 @@ static av_always_inline void mc_part_weighted(const H264Context *h, H264SliceCon /* don't optimize for luma-only case, since B-frames usually * use implicit weights => chroma too. */ uint8_t *tmp_cb = sl->bipred_scratchpad; - uint8_t *tmp_cr = sl->bipred_scratchpad + (16 << pixel_shift); + uint8_t *tmp_cr = sl->bipred_scratchpad + (8 << pixel_shift + (chroma_idc == 3)); uint8_t *tmp_y = sl->bipred_scratchpad + 16 * sl->mb_uvlinesize; int refn0 = sl->ref_cache[0][scan8[n]]; int refn1 = sl->ref_cache[1][scan8[n]]; From d432d24777874cb742b3463c112d74286ca702b3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 May 2025 22:05:07 +0200 Subject: [PATCH 279/290] MAINTAINERS: Add entry for samples-request This is based on discussion with the GA and its simply the people who have done or tried to do some uploads recently. Everyone who has a shell account on ffmpeg.org should have powers to upload samples. CC: compn CC: Thilo Borgmann Signed-off-by: Michael Niedermayer (cherry picked from commit 1a5ed492e577707bc7eb48e25c27a14906adb6d8) Signed-off-by: Michael Niedermayer --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 8a2ee04aed..f8339d9196 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -56,6 +56,7 @@ presets [0] metadata subsystem Aurelien Jacobs release management Michael Niedermayer API tests [0] +samples-request [2] Thilo Borgmann, James Almer, Ben Littler Communication From 6c0ec7b61dfee40df19f27e8cfdacc39d501125f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 May 2025 01:55:27 +0200 Subject: [PATCH 280/290] avformat/avidec: Ignore duplicate GAB2 Fixes: memleak Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 6a47046981d05c59f6ac766d5fbf6586261a216f) Signed-off-by: Michael Niedermayer --- libavformat/avidec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 1ae09efc15..81a0ae31ba 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1122,6 +1122,10 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt) int size; AVProbeData pd; unsigned int desc_len; + + if (ast->sub_ctx) + return 0; + AVIOContext *pb = avio_alloc_context(pkt->data + 7, pkt->size - 7, 0, NULL, NULL, NULL, NULL); From 2ac90a049c8a4a8fbb5028e6bcbc3f930671bd3f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 May 2025 23:39:53 +0200 Subject: [PATCH 281/290] avformat/mov: reject negative ELST durations Fixes: multiple integer overflows Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 9fc2702f6f502064d0d2d75c97ece33f4b56eb84) Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 97a9cfecae..b9761efbac 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -6223,6 +6223,11 @@ static int mov_read_elst(MOVContext *c, AVIOContext *pb, MOVAtom atom) c->fc->nb_streams-1, i, e->time); return AVERROR_INVALIDDATA; } + if (e->duration < 0) { + av_log(c->fc, AV_LOG_ERROR, "Track %d, edit %d: Invalid edit list duration=%"PRId64"\n", + c->fc->nb_streams-1, i, e->duration); + return AVERROR_INVALIDDATA; + } } sc->elst_count = i; From 72d65a3a69cc5ddb5166118d9342b7fb94a12e2b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 May 2025 23:52:57 +0200 Subject: [PATCH 282/290] avformat/imf_cpl: do not continue looping forever Fixes: infinite loop Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824 Regression since: 61fa1e14e4178d3f2550c76f7a36484220f6dc0c Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 39800d78b07e65a6b29a69366d651f80105b95a1) Signed-off-by: Michael Niedermayer --- libavformat/imf_cpl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c index 137cff2a63..6ddea62abe 100644 --- a/libavformat/imf_cpl.c +++ b/libavformat/imf_cpl.c @@ -709,8 +709,7 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL * av_log(log_ctx, AV_LOG_DEBUG, "Processing IMF CPL Segment\n"); sequence_list_elem = ff_imf_xml_get_child_element_by_name(segment_elem, "SequenceList"); - if (!sequence_list_elem) - continue; + if (sequence_list_elem) { sequence_elem = xmlFirstElementChild(sequence_list_elem); while (sequence_elem) { @@ -735,6 +734,7 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL * sequence_elem = xmlNextElementSibling(sequence_elem); } + } segment_elem = xmlNextElementSibling(segment_elem); } From f9a3e1ac198184c6b6838fb1bab27428f53e46c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 May 2025 23:55:24 +0200 Subject: [PATCH 283/290] avformat/imf_cpl: fix indention after previous commit (cherry picked from commit d28bec8c4d1bcab3760463f501e14e51fd7b28c1) Signed-off-by: Michael Niedermayer --- libavformat/imf_cpl.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/libavformat/imf_cpl.c b/libavformat/imf_cpl.c index 6ddea62abe..8c3530f412 100644 --- a/libavformat/imf_cpl.c +++ b/libavformat/imf_cpl.c @@ -711,29 +711,29 @@ static int fill_virtual_tracks(void *log_ctx, xmlNodePtr cpl_element, FFIMFCPL * sequence_list_elem = ff_imf_xml_get_child_element_by_name(segment_elem, "SequenceList"); if (sequence_list_elem) { - sequence_elem = xmlFirstElementChild(sequence_list_elem); - while (sequence_elem) { - if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0) - ret = push_marker_sequence(log_ctx, sequence_elem, cpl); + sequence_elem = xmlFirstElementChild(sequence_list_elem); + while (sequence_elem) { + if (xmlStrcmp(sequence_elem->name, "MarkerSequence") == 0) + ret = push_marker_sequence(log_ctx, sequence_elem, cpl); - else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0) - ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl); + else if (xmlStrcmp(sequence_elem->name, "MainImageSequence") == 0) + ret = push_main_image_2d_sequence(log_ctx, sequence_elem, cpl); - else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0) - ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl); + else if (xmlStrcmp(sequence_elem->name, "MainAudioSequence") == 0) + ret = push_main_audio_sequence(log_ctx, sequence_elem, cpl); - else - av_log(log_ctx, - AV_LOG_INFO, - "The following Sequence is not supported and is ignored: %s\n", - sequence_elem->name); + else + av_log(log_ctx, + AV_LOG_INFO, + "The following Sequence is not supported and is ignored: %s\n", + sequence_elem->name); - /* abort parsing only if memory error occurred */ - if (ret == AVERROR(ENOMEM)) - return ret; + /* abort parsing only if memory error occurred */ + if (ret == AVERROR(ENOMEM)) + return ret; - sequence_elem = xmlNextElementSibling(sequence_elem); - } + sequence_elem = xmlNextElementSibling(sequence_elem); + } } segment_elem = xmlNextElementSibling(segment_elem); From 534c87eb242bf3dfb221945289d60c729464802c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 May 2025 01:08:06 +0200 Subject: [PATCH 284/290] avcodec/sonic: Check num_taps The encoder uses max 128 taps, which is quiet a lot already If work is done to improve sonic, it will be more radical than changing the taps Fixes: Timeout Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit fd0a792766c8ae513dd849fc47fa9e899cc5664b) Signed-off-by: Michael Niedermayer --- libavcodec/sonic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c index 46c15b5fb1..d2057ac181 100644 --- a/libavcodec/sonic.c +++ b/libavcodec/sonic.c @@ -924,6 +924,9 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx) if (get_bits1(&gb)) // XXX FIXME av_log(avctx, AV_LOG_INFO, "Custom quant table\n"); + if (s->num_taps > 128) + return AVERROR_INVALIDDATA; + s->block_align = 2048LL*s->samplerate/(44100*s->downsampling); s->frame_size = s->channels*s->block_align*s->downsampling; // avctx->frame_size = s->block_align; From 1bd79545eea716ea18c84846141fca86412c7aa5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 May 2025 01:35:29 +0200 Subject: [PATCH 285/290] avcodec/svq3: Check there are bits left before decompression Fixes: out of array read Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit c06f5b3ab97b1b1d0420309201568e38b3920860) Signed-off-by: Michael Niedermayer --- libavcodec/svq3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index f730358e2f..6319e9b021 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1253,6 +1253,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx) uint8_t *buf; if (watermark_height <= 0 || + get_bits_left(&gb) <= 0 || (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) return AVERROR_INVALIDDATA; From 3a418442dca1b9bcab98f03ba6f09d6b1bec8542 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 May 2025 23:09:07 +0200 Subject: [PATCH 286/290] avcodec/takdec: Check remaining space for first predictors Fixes: Timeout Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 8e6db875afcd147d48718130fde4a05c3ac406db) Signed-off-by: Michael Niedermayer --- libavcodec/takdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/takdec.c b/libavcodec/takdec.c index cfa69f4217..84c19f648f 100644 --- a/libavcodec/takdec.c +++ b/libavcodec/takdec.c @@ -434,6 +434,9 @@ static int decode_subframe(TAKDecContext *s, int32_t *decoded, return AVERROR_INVALIDDATA; } + if (get_bits_left(gb) < 2*10 + 2*size) + return AVERROR_INVALIDDATA; + s->predictors[0] = get_sbits(gb, 10); s->predictors[1] = get_sbits(gb, 10); s->predictors[2] = get_sbits(gb, size) * (1 << (10 - size)); From ebcd40e701a194edca5bd2f4a8e5262aa6ab1841 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 May 2025 23:18:19 +0200 Subject: [PATCH 287/290] avformat/matroskadec: check that channels fit in signed 32bit int Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long' Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 05f8c8c4c2b8f3a0b206ecb7e1b5bba68a9820b8) Signed-off-by: Michael Niedermayer --- libavformat/matroskadec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 105a90a937..b6af422a4d 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2843,6 +2843,8 @@ static int mka_parse_audio(MatroskaTrack *track, AVStream *st, par->sample_rate = track->audio.out_samplerate; // channel layout may be already set by codec private checks above if (!av_channel_layout_check(&par->ch_layout)) { + if (track->audio.channels > INT32_MAX) + return AVERROR_PATCHWELCOME; par->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC; par->ch_layout.nb_channels = track->audio.channels; } From 2c4ca52c8aed6108063c733ce40043742aff5b3b Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 10 May 2025 12:50:37 -0300 Subject: [PATCH 288/290] avformat/iamf_parse: increase PutBytes buffer when writing AAC extradata We may write up to 43 bits, so 5 bytes is not enough. Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406 Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer --- libavformat/iamf_parse.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 7b3b1e87fa..9107f16003 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -285,10 +285,11 @@ static int update_extradata(AVCodecParameters *codecpar) AV_WL16A(codecpar->extradata + 16, AV_RB16A(codecpar->extradata + 16)); // Byte swap Output Gain break; case AV_CODEC_ID_AAC: { - uint8_t buf[5]; + uint8_t buf[6]; + int size = FFMIN(codecpar->extradata_size, sizeof(buf)); - init_put_bits(&pb, buf, sizeof(buf)); - ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); + init_put_bits(&pb, buf, size); + ret = init_get_bits8(&gb, codecpar->extradata, size); if (ret < 0) return ret; @@ -304,6 +305,10 @@ static int update_extradata(AVCodecParameters *codecpar) skip_bits(&gb, 4); put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config ret = put_bits_left(&pb); + while (ret >= 32) { + put_bits32(&pb, get_bits_long(&gb, 32)); + ret -= 32; + } put_bits(&pb, ret, get_bits_long(&gb, ret)); flush_put_bits(&pb); From 6400860b9d4bec5ace91ec3a5e43ad76f9660579 Mon Sep 17 00:00:00 2001 From: James Almer Date: Mon, 23 Jun 2025 12:31:37 -0300 Subject: [PATCH 289/290] avformat/iamf_parse: prevent overreads in update_extradata Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406 Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer --- libavformat/iamf_parse.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 9107f16003..a7a2b7deb5 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -288,7 +288,7 @@ static int update_extradata(AVCodecParameters *codecpar) uint8_t buf[6]; int size = FFMIN(codecpar->extradata_size, sizeof(buf)); - init_put_bits(&pb, buf, size); + init_put_bits(&pb, buf, sizeof(buf)); ret = init_get_bits8(&gb, codecpar->extradata, size); if (ret < 0) return ret; @@ -304,7 +304,10 @@ static int update_extradata(AVCodecParameters *codecpar) skip_bits(&gb, 4); put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config - ret = put_bits_left(&pb); + ret = get_bits_left(&gb); + if (ret < 0) + return AVERROR_INVALIDDATA; + ret = FFMIN(ret, put_bits_left(&pb)); while (ret >= 32) { put_bits32(&pb, get_bits_long(&gb, 32)); ret -= 32; @@ -317,9 +320,10 @@ static int update_extradata(AVCodecParameters *codecpar) } case AV_CODEC_ID_FLAC: { uint8_t buf[13]; + int size = FFMIN(codecpar->extradata_size, sizeof(buf)); init_put_bits(&pb, buf, sizeof(buf)); - ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); + ret = init_get_bits8(&gb, codecpar->extradata, size); if (ret < 0) return ret; @@ -328,11 +332,14 @@ static int update_extradata(AVCodecParameters *codecpar) put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate skip_bits(&gb, 3); put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1); - ret = put_bits_left(&pb); + ret = get_bits_left(&gb); + if (ret < 0) + return AVERROR_INVALIDDATA; + ret = FFMIN(ret, put_bits_left(&pb)); put_bits(&pb, ret, get_bits(&gb, ret)); flush_put_bits(&pb); - memcpy(codecpar->extradata, buf, sizeof(buf)); + memcpy(codecpar->extradata, buf, put_bytes_output(&pb)); break; } } From ca5c0a959d3a456fafa37fc84bf029af23a52ba4 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 8 Jul 2025 15:00:29 -0300 Subject: [PATCH 290/290] fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated Regardless of the source being an AVFMT_NOTIMESTAMPS format, if the timestamps are generated like when using the use_wallclock_as_timestamps demuxer option, then they are reliable. Fixes ticket #11268 Signed-off-by: James Almer (cherry picked from commit 1787fade209b1ecbd4b911c9d77a52bcdec13fa6) --- fftools/ffmpeg_demux.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 13aef15eab..d44dce1119 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -912,9 +912,18 @@ static int ist_use(InputStream *ist, int decoding_needed, if (decoding_needed && ds->sch_idx_dec < 0) { int is_audio = ist->st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO; + int is_unreliable = !!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS); + int64_t use_wallclock_as_timestamps; + + ret = av_opt_get_int(d->f.ctx, "use_wallclock_as_timestamps", 0, &use_wallclock_as_timestamps); + if (ret < 0) + return ret; + + if (use_wallclock_as_timestamps) + is_unreliable = 0; ds->dec_opts.flags |= (!!ist->fix_sub_duration * DECODER_FLAG_FIX_SUB_DURATION) | - (!!(d->f.ctx->iformat->flags & AVFMT_NOTIMESTAMPS) * DECODER_FLAG_TS_UNRELIABLE) | + (!!is_unreliable * DECODER_FLAG_TS_UNRELIABLE) | (!!(d->loop && is_audio) * DECODER_FLAG_SEND_END_TS) #if FFMPEG_OPT_TOP | ((ist->top_field_first >= 0) * DECODER_FLAG_TOP_FIELD_FIRST)