Commit Graph

52202 Commits

Author SHA1 Message Date
Michael Niedermayer f6986e75be avcodec/speexdec: Pass and check remaining packets to decode functions
Fixes: out of array access
Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-05-30 22:07:09 +02:00
Michael Niedermayer 67040773dc avcodec/ffv1enc_template: Fix remaining space check
Fixes: Assertion sc->slice_coding_mode == 0 failed at libavcodec/ffv1enc.c:1667
Fixes: 408838118/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6493138204295168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-05-30 22:07:09 +02:00
Andreas Rheinhardt 27c5e4b39a avcodec/libaomenc: Increase code locality
Reviewed-by: Niklas Haas <ffmpeg@haasn.xyz>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-30 19:35:32 +02:00
Andreas Rheinhardt 1b5a291dcc avcodec/dovi_rpuenc: Use av_unreachable() instead of av_assert0(0)
Reviewed-by: Niklas Haas <ffmpeg@haasn.xyz>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-30 19:35:27 +02:00
Andreas Rheinhardt 0adfe15829 avcodec/dovi_rpuenc: Use av_cold for ff_dovi_configure init functions
Reviewed-by: Niklas Haas <ffmpeg@haasn.xyz>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-30 19:35:21 +02:00
Andreas Rheinhardt 8d45dc858e avcodec/dovi_rpuenc: Avoid intermediate codec par in ff_dovi_configure()
It invalidates (removes by duplicates)  AVCodecContext.extradata
and AVCodecContext.coded_side_data which is quite surprising
and leads to bugs like #11617 where an AVCPBProperties
is used after it has been freed in ff_dovi_configure().

Reported-by: Ayose
Reviewed-by: Niklas Haas <ffmpeg@haasn.xyz>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-30 19:35:06 +02:00
Lynne ab37c7e49f ffv1enc: do not hardcode 1024 slices
Instead use a field where possible and the defined constant when not.

Tested by using 4096 slices.
2025-05-30 01:45:58 +09:00
Andreas Rheinhardt 75960ac270 avcodec/asvenc: Fix crash with unaligned pointers/linesizes
This happens on systems where get_pixels really needs
to be properly aligned, like ARMV7 or RISC-V. For these
systems, 0401ca714a caused
a bus error for the vsynth3-asv[12] tests, because
the stride in these tests is unaligned. See e.g.
https://fate.ffmpeg.org/report.cgi?slot=armv7-linux-gcc-13&time=20250527020548
https://fate.ffmpeg.org/report.cgi?slot=rv64gcvb-linux-gnu-gcc&time=20250527001827

It can also happen (even before said commit) if the pointers
itself are unaligned, e.g. by using the crop filter:
ffmpeg -filter_complex nullsrc=s=740x576:r=25,format=yuv420p,crop=w=720:x=2 \
-c:v asv2 -f null -

The alignment requirements for the frames passed to encoders are
mostly undocumented; the only thing I could find is the documentation
of AVFrame.linesize: "For video the linesizes should be multiples
of the CPUs alignment preference". This means that the FFmpeg cli
violates our API.

Yet as the above command line shows, it can also happen with
unaligned pointers and there does not seem to be a prohibition
of this, so we need to handle this case. This commit does so
by using get_pixels_unaligned when needed.

Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-29 08:00:21 +02:00
Lynne bf6d3dc339 ffv1enc_vulkan: allow slicecrc=2
For parity with the software encoder.
2025-05-27 21:50:35 +09:00
Andreas Rheinhardt 1c78db8ffc avcodec/vc2enc: Use LUT to avoid repeated av_log2()
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-27 13:49:26 +02:00
Andreas Rheinhardt a6bcc773b5 avcodec/ffv1enc: Fix explicitly set -slicecrc 2
crcref needs to be set properly iff ec is two, regardless
of whether it has been explicitly set by the user or set
by default based on level/version.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-27 13:45:21 +02:00
Lynne 3cbe3418b2 vulkan_ffv1: fix golomb coding for non-RGB streams
The run_index is reset on each plane, unlike with RGB, where
its reset once per slice.
2025-05-27 06:40:33 +09:00
Lynne c395ad7c2c vulkan_ffv1: small cleanup for golomb
Split up computation of the offset in the same way that
the range coder version does it.
2025-05-27 06:40:29 +09:00
Henrik Gramner eda0ac7e5f avcodec/x86/vp9: Add AVX-512ICL for 16x16 and 32x32 10bpc inverse transforms 2025-05-26 15:26:11 +02:00
Andreas Rheinhardt 43a69886b2 avcodec/mpeg4videodec: Use union to save space
At most one of block32 and dpcm_macroblock is used at any given time.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 05:03:43 +02:00
Andreas Rheinhardt ac1e6d2171 avcodec/mpegvideo: Remove h263_plus
It is only used to indicate to ff_h263_show_pict_info()
that we are decoding H.263+; pass this information
via a function parameter instead.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 05:03:29 +02:00
Andreas Rheinhardt da5c2a419b avcodec/ituh263enc: Don't use h263_plus field
It is equal to codec_id == AV_CODEC_ID_H263P, check for that instead.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 05:03:15 +02:00
Andreas Rheinhardt 8987c29390 avcodec/mpegvideo: Check h263_aic, not h263_plus for allocating dc_val
This means that these buffers won't be allocated any more
for H.263+ with AIC disabled.
Also remove setting h263_plus for the RV20 encoder,
as it has only been done to force allocating dc_val.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:59:11 +02:00
Andreas Rheinhardt ed73675832 avcodec/mpegvideo: Move mpeg_quant to {Mpeg4Dec,MPVEnc}Context
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:58:42 +02:00
Andreas Rheinhardt 778c0a48fa avcodec/mpegvideo_dec: Simplify check for unquantizing inter blocks
Just ensure that dct_unquantize_inter is set iff it is used
and check for the function pointer instead.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:53:32 +02:00
Andreas Rheinhardt f2c04fd587 avcodec/mpegvideo_dec: Document which codecs take which codepath
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:52:57 +02:00
Andreas Rheinhardt 2e8a3e6645 avcodec/idctdsp: Only try to initialize xvid idct if it is used
This allows to remove checks from ff_xvid_idct_init()
(and also the AVCodecContext* parameter).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:50:34 +02:00
Andreas Rheinhardt 6349a3324d avcodec/xvididct: Remove always-true checks
ff_xvid_idct_init() is now only called from ff_idctdsp_init()
and only if idct_algo is FF_IDCT_XVID.
This also implies that it is unnecessary to initalize
the permutation on our own.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:50:23 +02:00
Andreas Rheinhardt eb5d900f87 avcodec/mpeg4videodec: Remove unnecessary ff_xvid_idct_init()
It is unnecessary: If the dst context is not already initialized,
then it will be initialized by memcpy(dst, src, sizeof(*dst),
which already initializes the IDCT to the desired one, potentially
followed by ff_mpv_common_init(), which does not touch the IDCT.

(This call has been added in f89d76c10355242c39b08f253c1d1524f45ef778;
the aforementioned copying took place back then, too, but
ff_mpv_common_init() reinitialized the IDCT to a non-xvid one,
therefore the initialization here has been added to fix
multithreaded decoding.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:47:02 +02:00
Andreas Rheinhardt 6af1bcb180 avcodec/mpeg4videoenc: Use smaller scope for variable
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:46:56 +02:00
Andreas Rheinhardt 7267e4dab8 avcodec/mpeg4videoenc: Split writing blocks into intra and inter
These are sufficiently different to warrant their own functions;
in particular, the earlier code had two callsites for the actual
"write block" function, one for intra and one for inter, yet
the "write block" function nevertheless performed a check
(that the compiler can't optimize away) for whether the current
MB is intra or not.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:24:16 +02:00
Andreas Rheinhardt f7bd2a5af8 avcodec/mpeg4videoenc: Remove no-output code
While it offers modest speedups compared to the ordinary code,
removing it completely offers even bigger speedups; and given
that these speedups also exist in the ordinary mode, they are
even more important. The no-output code has a 7.8% performance
improvement (based on benchmarking mpeg4_encode_mb()), yet
removing the no-output code resulted in a 9.4% improvement.

Furthermore, the no-output code was broken for the majority of
its existence (until 9207dc3b0d)
and no one complained, so it is likely not used at all.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:23:56 +02:00
Andreas Rheinhardt 2a59cb0c82 avcodec/mpeg4video: Nuke ff_mpeg4_init_rl_intra()
The MPEG-4 decoder can now initialize ff_mpeg4_rl_intra
directly given that the MPEG-4 encoder no longer wants
it performed, too.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:22:11 +02:00
Andreas Rheinhardt d75a398d00 avcodec/mpeg4videoenc: Simplify creating LUT
There four cases for the LUT entry: An ordinary entry
or one of three escaping methods. Three of these methods
are only rarely possible --they correspond to the 102
codes of the underlying VLC and so only 102 of 16384 entries
are possible.

The earlier code would nevertheless try them all for every
LUT entry and use the best one; the new code meanwhile only
uses one method (the fallback one (i.e. the worst)) for them all
and only processes the 102 valid entries afterwards.

The implementation used also means that index_run, max_level
and max_run of the RLTable are no longer needed; the earlier
code would initialize said static tables although they are only
used for a short time to initialize something else.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:21:34 +02:00
Andreas Rheinhardt 295abb1fdc avcodec/mpegvideo_enc: Reduce stack usage
Multiple PutBitContexts are used when encoding partitioned
frames. When there are multiple candidates for macroblock types,
multiple states (namely the state before encoding the current MB,
the best state among the ones already tried and the current one)
need to be kept; duplicates of the PutBitContexts are among this
state. The temporary buffers for them are kept on the stack
in encode_thread() and their size is quite generous (MAX_MB_SIZE
- 3000 bytes). This commit uses tighter bounds, bringing the
size of the pb2 buffer down to 15 bytes.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:02:58 +02:00
Andreas Rheinhardt f887a2b006 avcodec/mpeg4videodec: Don't initialize unused parts of RLTables
The reversible VLC tables use a simpler escaping method
than the ordinary VLCs: It does not use max_run, max_level etc.
and therefore one does not need to initialize these at all.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:02:41 +02:00
Andreas Rheinhardt a0a136e57b avcodec/h263dec: Move calculating gob_index to {intel,itu}h263dec.c
This avoids checks for whether it should be calculated at all.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:02:32 +02:00
Andreas Rheinhardt 9918741967 avcodec/mpegvideo_enc: Set gob_index once during init
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 04:00:08 +02:00
Andreas Rheinhardt 7ae20272b7 avcodec/pcm: Use av_unreachable() for unreachable code
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:38:37 +02:00
Andreas Rheinhardt 0d73ce4bc4 avcodec/h263dec: Use av_unreachable() for unreachable code
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:38:37 +02:00
Andreas Rheinhardt ded08d0b1b avcodec/msmpeg4dec: Use av_unreachable() for unreachable code
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:38:37 +02:00
Andreas Rheinhardt ef95a8d7b5 avcodec/mpegvideo_enc: Use av_unreachable() for unreachable code
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:38:37 +02:00
Andreas Rheinhardt a5ff6ea32d avcodec/asvenc: Simplify writing extradata
It is confusing, because the AV_RL32("ASUS") already
returns an endian-independent value, so converting
it via av_le2ne32() makes no real sense: one would need
to transform the native value to le and write it as
a natie endian uint32_t for it to make sense (the current
code only works because le2ne32 and ne2le32 are the same
for both endianness that we care about). Or one can just
use AV_RL32 and create the number via MKTAG().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:37:09 +02:00
Andreas Rheinhardt 05a5e2b576 avcodec/asvenc: Combine writing bits
Removes implicit checks for "do I need to output the buffer now?".
Codesize with Clang 19 with -O3 decreased from 7136B to 6108B
(although asv2_put_level() is now inlined).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:37:09 +02:00
Andreas Rheinhardt 0401ca714a avcodec/asvenc: Don't waste bits encoding non-visible part
Up until now, the encoder replicated all the border pixels
for incomplete 16x16 macroblocks. In case the available width
or height is <= 8, some of the luma blocks of the MB
do not correspond to actual input, so that we should encode
them using the least amount of bits. Zeroing the block coefficients
(as this commit does) achieves this, replicating the pixels
and performing an FDCT does not.

This commit also removes the frame copying code for insufficiently
aligned dimensions.

The vsynth3-asv[12] FATE tests use a 34x34 input file and are
therefore affected by this. As the ref updates show, the size
and checksum of the encoded changes, yet the decoded output
stays the same.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-05-26 03:37:09 +02:00
Frank Plowman ae0f71a387 lavc/h2645_parse: More descriptive NALU header error
Signed-off-by: Frank Plowman <post@frankplowman.com>
2025-05-25 09:54:42 +08:00
Frank Plowman 0382291811 lavc/vvc: Fix divide-by-zero in LMCS param derivation
Add three missing requirements on bitstream conformance from 7.4.3.19 of
H.266 (V3).  Issue found using fuzzing.

Signed-off-by: Frank Plowman <post@frankplowman.com>
2025-05-25 09:35:21 +08:00
Frank Plowman 670089304a lavc/vvc: Avoid UB in DB strength derivation for PLT CUs
When called for palette-predicted CUs, boundary_strength could cause
undefined behaviour due to accessing uninitialised motion information.
The spec doesn't include this, but in the reference software it seems
the deblock strength is always set to 0 for palette CUs due to some
implementation details: perhaps this is a spec issue?

Signed-off-by: Frank Plowman <post@frankplowman.com>
2025-05-24 21:50:46 +08:00
Frank Plowman a18b2c2696 lavc/vvc: Detect subpic overlaps at CTU level
In d5dbcc00d8, it was hoped that detection
of subpicture overlaps could be performed at the tile level, so as to
avoid introducing per-CTU checks. Unfortunately since that patch,
fuzzing has indicated there are some structures involving
pps_subpic_one_or_more_tiles_slice where tile-level checking is not
sufficient.  Performing the check at the CTU level should (touch wood)
be the be-all and and-all of this, as CTUs are the lowest common
denominator of the picture partitioning.

Signed-off-by: Frank Plowman <post@frankplowman.com>
2025-05-24 10:57:20 +08:00
Nuo Mi 363a7a34f6 lavc/vvc/plt: validate run and signalled_entries
Fixes a crash triggered by a fuzzed clip:
https://github.com/ffvvc/tests/tree/main/fuzz/passed/000256.bit

Reproduce with:
ffmpeg -i 000256.bit -f null -
2025-05-24 10:36:19 +08:00
Maxime Gervais cbdb5e2477 ffv1enc_vulkan: fix array overflow 2025-05-24 02:28:13 +09:00
Lynne 56b85b689d aacdec_ac: fix signed overflow in ff_aac_ac_update_context()
The issue is that state->cur[] is 8-bits, but a+b+1 can overflow
before being clipped to 0xF in the following line, causing an incorrect
state to be saved for the next symbol.

This solves numerous bitstream desyncs, particularly when coefficients
with magnitude greater than 127 are sent.
2025-05-24 02:19:18 +09:00
James Almer 8eae65dc5c avcodec/lcevcdec: don't try to write to output frames directly
The buffer references may not be writable at this point, as the decoder
calls get_buffer2() with the AV_GET_BUFFER_FLAG_REF flag.

Fixes races as reported by tsan, producing correct output regardless of
threading choices.

Signed-off-by: James Almer <jamrial@gmail.com>
2025-05-22 19:28:35 -03:00
Lynne 977d1a24bc vulkan/ffv1: fix sync issue in cached bitstream reader/writer
The issue is that there is an explicit lack of synchronization as only the very
first invocation writes symbols and updates the state, which other invocations
then store.
2025-05-23 05:23:44 +09:00
Dmitrii Ovchinnikov f1b3e51950 avcodec/amfenc_h264: improve B-frame usability and simplify options
- Query GPU caps for B-frame support and warn if unsupported.
- Make `-max_b_frames` optional
- Drop explicit `-pa_lookahead_buffer_depth` requirement in
adaptive mode.
2025-05-21 15:42:30 +02:00