PR #24054 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24054 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24054.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23921 The mrefs/prefs boundary conditions scaled the y limits by the number of bytes per sample, even though the ref offsets are already expressed in elements. For content deeper than 8 bits this clamped perfectly valid in-bounds line taps. Found by validating the libplacebo GPU port against this filter, which matches exactly on 16-bit content everywhere except these lines. This changes the output for >8 bit content on the affected lines. From dcf567a048fae062d527b63b94eb9f1bbf03472f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Sun, 26 Jul 2026 19:12:40 +0200 Subject: [PATCH 1/2] avfilter/vf_bwdif: fix line boundary checks for >8 bits content MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The mrefs/prefs boundary conditions scaled the y limits by the number of bytes per sample, even though the ref offsets are already expressed in elements. For content deeper than 8 bits this clamped perfectly valid in-bounds line taps. Found by validating the libplacebo GPU port against this filter, which matches exactly on 16-bit content everywhere except these lines. This changes the output for >8 bit content on the affected lines. Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit 7d96c87a7382fed8d571748d6ed5c1869c192c31) --- libavfilter/vf_bwdif.c | 16 +++++----- tests/ref/fate/filter-bwdif10 | 60 +++++++++++++++++------------------ 2 files changed, 38 insertions(+), 38 deletions(-) diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c index dbe35a029b..a34f1906dd 100644 --- a/libavfilter/vf_bwdif.c +++ b/libavfilter/vf_bwdif.c @@ -79,22 +79,22 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) if (yadif->current_field == YADIF_FIELD_END) { if ((y < 3) || ((y + 3) >= td->h)) { s->dsp.filter_edge(dst, prev, cur, next, td->w, - (y + df) < td->h ? refs : -refs, - y > (df - 1) ? -refs : refs, + (y + 1) < td->h ? refs : -refs, + y > 0 ? -refs : refs, refs << 1, -(refs << 1), td->parity ^ td->tff, clip_max, (y < 2) || ((y + 3) > td->h) ? 0 : 1); } else { - s->dsp.filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs, - y > (df - 1) ? -refs : refs, - (y + 3*df) < td->h ? 3 * refs : -refs, - y > (3*df - 1) ? -3 * refs : refs, + s->dsp.filter_intra(dst, cur, td->w, (y + 1) < td->h ? refs : -refs, + y > 0 ? -refs : refs, + (y + 3) < td->h ? 3 * refs : -refs, + y > 2 ? -3 * refs : refs, td->parity ^ td->tff, clip_max); } } else if ((y < 4) || ((y + 5) > td->h)) { s->dsp.filter_edge(dst, prev, cur, next, td->w, - (y + df) < td->h ? refs : -refs, - y > (df - 1) ? -refs : refs, + (y + 1) < td->h ? refs : -refs, + y > 0 ? -refs : refs, refs << 1, -(refs << 1), td->parity ^ td->tff, clip_max, (y < 2) || ((y + 3) > td->h) ? 0 : 1); diff --git a/tests/ref/fate/filter-bwdif10 b/tests/ref/fate/filter-bwdif10 index d97acea991..70a7f9d3ed 100644 --- a/tests/ref/fate/filter-bwdif10 +++ b/tests/ref/fate/filter-bwdif10 @@ -3,33 +3,33 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 9, 9, 1, 1244160, 0x4f0e6e1c -0, 10, 10, 1, 1244160, 0x57152296 -0, 11, 11, 1, 1244160, 0x0074598b -0, 12, 12, 1, 1244160, 0x44537bb8 -0, 13, 13, 1, 1244160, 0x6f27ab9c -0, 14, 14, 1, 1244160, 0x1f195e10 -0, 15, 15, 1, 1244160, 0xc5644298 -0, 16, 16, 1, 1244160, 0x24c1230e -0, 17, 17, 1, 1244160, 0x2651b213 -0, 18, 18, 1, 1244160, 0x88efe863 -0, 19, 19, 1, 1244160, 0x8bf0ada1 -0, 20, 20, 1, 1244160, 0x8b6c013a -0, 21, 21, 1, 1244160, 0x69ebc579 -0, 22, 22, 1, 1244160, 0xa45d0f0c -0, 23, 23, 1, 1244160, 0x272162e4 -0, 24, 24, 1, 1244160, 0x8c456817 -0, 25, 25, 1, 1244160, 0x872c58ee -0, 26, 26, 1, 1244160, 0x9318cb95 -0, 27, 27, 1, 1244160, 0xcaec95f1 -0, 28, 28, 1, 1244160, 0x8b01a105 -0, 29, 29, 1, 1244160, 0x956de85e -0, 30, 30, 1, 1244160, 0xa2998ab9 -0, 31, 31, 1, 1244160, 0xa56b5621 -0, 32, 32, 1, 1244160, 0x7bd6b161 -0, 33, 33, 1, 1244160, 0xbcb75d7a -0, 34, 34, 1, 1244160, 0xe5e94727 -0, 35, 35, 1, 1244160, 0xf3145c67 -0, 36, 36, 1, 1244160, 0xcf63df5a -0, 37, 37, 1, 1244160, 0x77d08ec8 -0, 38, 38, 1, 1244160, 0xc99d2eb2 +0, 9, 9, 1, 1244160, 0xee7d128d +0, 10, 10, 1, 1244160, 0x6c25ebe8 +0, 11, 11, 1, 1244160, 0xae8e297d +0, 12, 12, 1, 1244160, 0x20284ad0 +0, 13, 13, 1, 1244160, 0x95c57238 +0, 14, 14, 1, 1244160, 0x5ae32569 +0, 15, 15, 1, 1244160, 0x92401342 +0, 16, 16, 1, 1244160, 0x95ed0c85 +0, 17, 17, 1, 1244160, 0xb79398df +0, 18, 18, 1, 1244160, 0x66a0dda3 +0, 19, 19, 1, 1244160, 0x906596c3 +0, 20, 20, 1, 1244160, 0x26f1da33 +0, 21, 21, 1, 1244160, 0xe317ad64 +0, 22, 22, 1, 1244160, 0x2f5fe488 +0, 23, 23, 1, 1244160, 0x7bd64c7b +0, 24, 24, 1, 1244160, 0x7470479e +0, 25, 25, 1, 1244160, 0x61653bee +0, 26, 26, 1, 1244160, 0xb249a6cc +0, 27, 27, 1, 1244160, 0x2cce6f74 +0, 28, 28, 1, 1244160, 0x711d7631 +0, 29, 29, 1, 1244160, 0xa304c119 +0, 30, 30, 1, 1244160, 0x3fb66044 +0, 31, 31, 1, 1244160, 0x97c11ba5 +0, 32, 32, 1, 1244160, 0xd8f37fed +0, 33, 33, 1, 1244160, 0x33d541e7 +0, 34, 34, 1, 1244160, 0x2e2e2535 +0, 35, 35, 1, 1244160, 0xe26132bd +0, 36, 36, 1, 1244160, 0x13b9b37b +0, 37, 37, 1, 1244160, 0x05825e47 +0, 38, 38, 1, 1244160, 0x44f6f505 -- 2.52.0 From 03d9533176e98bb9fbf569c1f34968e73e948dd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Sun, 26 Jul 2026 19:56:11 +0200 Subject: [PATCH 2/2] Revert "lavfi/bwdif: fix heap-buffer-overflow with small height videos" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 795bccdaf57772b1803914dee2f32d52776518e2. The heap-buffer-overflow was a symptom of the >8 bit boundary conditions bug fixed in the previous commit. This workaround is no longer needed. This restores spatial-only interpolation of the whole frame for the first and last fields, instead of running the temporal edge filter against cloned reference frames on the outermost lines. Because of that first frame references are updated to pre-fix values. Signed-off-by: Kacper Michajłow <[email protected]> (cherry picked from commit 3cd408c2a6e5a7de8b6d641dedd12d523b94014c) --- libavfilter/vf_bwdif.c | 19 +++++-------------- tests/ref/fate/filter-bwdif-mode0 | 2 +- tests/ref/fate/filter-bwdif-mode1 | 2 +- tests/ref/fate/filter-bwdif10 | 2 +- 4 files changed, 8 insertions(+), 17 deletions(-) diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c index a34f1906dd..5fba0e7a14 100644 --- a/libavfilter/vf_bwdif.c +++ b/libavfilter/vf_bwdif.c @@ -77,20 +77,11 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) uint8_t *next = &yadif->next->data[td->plane][y * linesize]; uint8_t *dst = &td->frame->data[td->plane][y * td->frame->linesize[td->plane]]; if (yadif->current_field == YADIF_FIELD_END) { - if ((y < 3) || ((y + 3) >= td->h)) { - s->dsp.filter_edge(dst, prev, cur, next, td->w, - (y + 1) < td->h ? refs : -refs, - y > 0 ? -refs : refs, - refs << 1, -(refs << 1), - td->parity ^ td->tff, clip_max, - (y < 2) || ((y + 3) > td->h) ? 0 : 1); - } else { - s->dsp.filter_intra(dst, cur, td->w, (y + 1) < td->h ? refs : -refs, - y > 0 ? -refs : refs, - (y + 3) < td->h ? 3 * refs : -refs, - y > 2 ? -3 * refs : refs, - td->parity ^ td->tff, clip_max); - } + s->dsp.filter_intra(dst, cur, td->w, (y + 1) < td->h ? refs : -refs, + y > 0 ? -refs : refs, + (y + 3) < td->h ? 3 * refs : -refs, + y > 2 ? -3 * refs : refs, + td->parity ^ td->tff, clip_max); } else if ((y < 4) || ((y + 5) > td->h)) { s->dsp.filter_edge(dst, prev, cur, next, td->w, (y + 1) < td->h ? refs : -refs, diff --git a/tests/ref/fate/filter-bwdif-mode0 b/tests/ref/fate/filter-bwdif-mode0 index 91b47dbe70..23dcaee900 100644 --- a/tests/ref/fate/filter-bwdif-mode0 +++ b/tests/ref/fate/filter-bwdif-mode0 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 9, 9, 1, 622080, 0x3f25bfc2 +0, 9, 9, 1, 622080, 0xd435648a 0, 10, 10, 1, 622080, 0x62085455 0, 11, 11, 1, 622080, 0x60f943a0 0, 12, 12, 1, 622080, 0x5396f14a diff --git a/tests/ref/fate/filter-bwdif-mode1 b/tests/ref/fate/filter-bwdif-mode1 index 1e604646e7..e8db88c932 100644 --- a/tests/ref/fate/filter-bwdif-mode1 +++ b/tests/ref/fate/filter-bwdif-mode1 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 18, 18, 1, 622080, 0x3f25bfc2 +0, 18, 18, 1, 622080, 0xd435648a 0, 19, 19, 1, 622080, 0xef4617cc 0, 20, 20, 1, 622080, 0x62085455 0, 21, 21, 1, 622080, 0x5b5ae735 diff --git a/tests/ref/fate/filter-bwdif10 b/tests/ref/fate/filter-bwdif10 index 70a7f9d3ed..76fcb8882e 100644 --- a/tests/ref/fate/filter-bwdif10 +++ b/tests/ref/fate/filter-bwdif10 @@ -3,7 +3,7 @@ #codec_id 0: rawvideo #dimensions 0: 720x576 #sar 0: 16/15 -0, 9, 9, 1, 1244160, 0xee7d128d +0, 9, 9, 1, 1244160, 0x71ca561b 0, 10, 10, 1, 1244160, 0x6c25ebe8 0, 11, 11, 1, 1244160, 0xae8e297d 0, 12, 12, 1, 1244160, 0x20284ad0 -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
