PR #25043 opened by Graham Vosloo (GrahamV) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25043 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25043.patch
HMV1, VMV1, HMV2 and VMV2 in the mode B payload header are 7-bit two's complement fields, but the signed predictors were passed to put_bits(), which requires the value to fit in n bits. A negative predictor sets every bit written before it in the same bit-buffer word: with the 32-bit buffer the I, U, S and A flags and the preceding motion vector fields became all ones, with the 64-bit buffer used on x86-64 the whole header did. --assert-level=2 aborts on it. Use put_sbits(), which keeps the low 7 bits. Only mode B packets with a negative predictor change, e.g. 9 of 44 mode B packets (217 packets in total) of 12 CIF frames with -ps 300 -mb_info 300 -pkt_size 1000. The output no longer depends on the width of the bit buffer. Signed-off-by: Graham Vosloo <[email protected]> >From 89da09632457e626a4ffd011a422e37922d41df8 Mon Sep 17 00:00:00 2001 From: Graham Vosloo <[email protected]> Date: Tue, 13 Oct 2026 06:51:46 -0700 Subject: [PATCH] avformat/rtpenc_h263_rfc2190: write the MV predictors with put_sbits() HMV1, VMV1, HMV2 and VMV2 in the mode B payload header are 7-bit two's complement fields, but the signed predictors were passed to put_bits(), which requires the value to fit in n bits. A negative predictor sets every bit written before it in the same bit-buffer word: with the 32-bit buffer the I, U, S and A flags and the preceding motion vector fields became all ones, with the 64-bit buffer used on x86-64 the whole header did. --assert-level=2 aborts on it. Use put_sbits(), which keeps the low 7 bits. Only mode B packets with a negative predictor change, e.g. 9 of 44 mode B packets (217 packets in total) of 12 CIF frames with -ps 300 -mb_info 300 -pkt_size 1000. The output no longer depends on the width of the bit buffer. Assisted-by: Claude Opus 5.5 Signed-off-by: Graham Vosloo <[email protected]> --- libavformat/rtpenc_h263_rfc2190.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/rtpenc_h263_rfc2190.c b/libavformat/rtpenc_h263_rfc2190.c index 590cbc75b6..8721bac10e 100644 --- a/libavformat/rtpenc_h263_rfc2190.c +++ b/libavformat/rtpenc_h263_rfc2190.c @@ -88,10 +88,10 @@ static void send_mode_b(AVFormatContext *s1, const struct H263Info *info, put_bits(&pb, 1, info->u); /* U - unrestricted motion vector */ put_bits(&pb, 1, info->s); /* S - syntax-baesd arithmetic coding */ put_bits(&pb, 1, info->a); /* A - advanced prediction */ - put_bits(&pb, 7, state->hmv1); /* HVM1 - horizontal motion vector 1 */ - put_bits(&pb, 7, state->vmv1); /* VMV1 - vertical motion vector 1 */ - put_bits(&pb, 7, state->hmv2); /* HVM2 - horizontal motion vector 2 */ - put_bits(&pb, 7, state->vmv2); /* VMV2 - vertical motion vector 2 */ + put_sbits(&pb, 7, state->hmv1); /* HVM1 - horizontal motion vector 1 */ + put_sbits(&pb, 7, state->vmv1); /* VMV1 - vertical motion vector 1 */ + put_sbits(&pb, 7, state->hmv2); /* HVM2 - horizontal motion vector 2 */ + put_sbits(&pb, 7, state->vmv2); /* VMV2 - vertical motion vector 2 */ flush_put_bits(&pb); memcpy(s->buf + 8, buf, len); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
