PR #24944 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24944
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24944.patch

Found-by: Joshua Rogers <[email protected]>


>From 2967fdf047b6a6833ee9931b5317ba1853956144 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 7 Oct 2026 00:16:06 +0200
Subject: [PATCH 1/3] avfilter/yadif: propagate errorsl

Not a security issue. Not tested on VideoToolbox.

Unprocessed output frames Replicated through UnModified FFmpeg with CUDA and 
Vulkan call failures injected by gdb
Found-by: Joshua Rogers <[email protected]>
Suggested-by: Joshua Rogers <[email protected]>
---
 libavfilter/vf_bwdif.c              |  4 +++-
 libavfilter/vf_bwdif_cuda.c         | 14 +++++++++-----
 libavfilter/vf_bwdif_vulkan.c       |  7 +++++--
 libavfilter/vf_yadif.c              |  4 +++-
 libavfilter/vf_yadif_cuda.c         | 14 +++++++++-----
 libavfilter/vf_yadif_videotoolbox.m | 10 ++++++----
 libavfilter/yadif.h                 |  2 +-
 libavfilter/yadif_common.c          |  6 +++++-
 8 files changed, 41 insertions(+), 20 deletions(-)

diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c
index 5fba0e7a14..f7f715f3cb 100644
--- a/libavfilter/vf_bwdif.c
+++ b/libavfilter/vf_bwdif.c
@@ -108,7 +108,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
     return 0;
 }
 
-static void filter(AVFilterContext *ctx, AVFrame *dstpic,
+static int filter(AVFilterContext *ctx, AVFrame *dstpic,
                    int parity, int tff)
 {
     BWDIFContext *bwdif = ctx->priv;
@@ -135,6 +135,8 @@ static void filter(AVFilterContext *ctx, AVFrame *dstpic,
     if (yadif->current_field == YADIF_FIELD_END) {
         yadif->current_field = YADIF_FIELD_NORMAL;
     }
+
+    return 0;
 }
 
 static const enum AVPixelFormat pix_fmts[] = {
diff --git a/libavfilter/vf_bwdif_cuda.c b/libavfilter/vf_bwdif_cuda.c
index cc954ab1d3..9879d12ab4 100644
--- a/libavfilter/vf_bwdif_cuda.c
+++ b/libavfilter/vf_bwdif_cuda.c
@@ -53,7 +53,7 @@ typedef struct DeintCUDAContext {
 
 #define CHECK_CU(x) FF_CUDA_CHECK_DL(ctx, s->hwctx->internal->cuda_dl, x)
 
-static CUresult call_kernel(AVFilterContext *ctx, CUfunction func,
+static int call_kernel(AVFilterContext *ctx, CUfunction func,
                             CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr 
next,
                             CUarray_format format, int channels,
                             int src_width,  // Width is pixels per channel
@@ -122,7 +122,7 @@ exit:
     return ret;
 }
 
-static void filter(AVFilterContext *ctx, AVFrame *dst,
+static int filter(AVFilterContext *ctx, AVFrame *dst,
                    int parity, int tff)
 {
     DeintCUDAContext *s = ctx->priv;
@@ -133,7 +133,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
 
     ret = CHECK_CU(cu->cuCtxPushCurrent(s->hwctx->cuda_ctx));
     if (ret < 0)
-        return;
+        return ret;
 
     for (i = 0; i < y->csp->nb_components; i++) {
         CUfunction func;
@@ -151,6 +151,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
         channels = comp->step / pixel_size;
         if (pixel_size > 2 || channels > 2) {
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
+            ret = AVERROR(EINVAL);
             goto exit;
         }
         switch (pixel_size) {
@@ -164,6 +165,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
             break;
         default:
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
+            ret = AVERROR(EINVAL);
             goto exit;
         }
 
@@ -172,7 +174,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
         av_log(ctx, AV_LOG_TRACE,
                "Deinterlacing plane %d: pixel_size: %d channels: %d\n",
                comp->plane, pixel_size, channels);
-        call_kernel(ctx, func,
+        ret = call_kernel(ctx, func,
                     (CUdeviceptr)y->prev->data[i],
                     (CUdeviceptr)y->cur->data[i],
                     (CUdeviceptr)y->next->data[i],
@@ -185,6 +187,8 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
                     AV_CEIL_RSHIFT(dst->height, i ? y->csp->log2_chroma_h : 0),
                     dst->linesize[i] / comp->step,
                     parity, tff, clip_max);
+        if (ret < 0)
+            goto exit;
     }
 
     if (y->current_field == YADIF_FIELD_END) {
@@ -193,7 +197,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
 
 exit:
     CHECK_CU(cu->cuCtxPopCurrent(&dummy));
-    return;
+    return ret;
 }
 
 static av_cold void deint_cuda_uninit(AVFilterContext *ctx)
diff --git a/libavfilter/vf_bwdif_vulkan.c b/libavfilter/vf_bwdif_vulkan.c
index 2c1e4908ef..5f96d2f7a3 100644
--- a/libavfilter/vf_bwdif_vulkan.c
+++ b/libavfilter/vf_bwdif_vulkan.c
@@ -102,7 +102,7 @@ fail:
     return err;
 }
 
-static void bwdif_vulkan_filter_frame(AVFilterContext *ctx, AVFrame *dst,
+static int bwdif_vulkan_filter_frame(AVFilterContext *ctx, AVFrame *dst,
                                       int parity, int tff)
 {
     BWDIFVulkanContext *s = ctx->priv;
@@ -112,13 +112,16 @@ static void bwdif_vulkan_filter_frame(AVFilterContext 
*ctx, AVFrame *dst,
         .tff = tff,
         .current_field = y->current_field,
     };
+    int ret;
 
-    ff_vk_filter_process_Nin(&s->vkctx, &s->e, &s->shd, dst,
+    ret = ff_vk_filter_process_Nin(&s->vkctx, &s->e, &s->shd, dst,
                              (AVFrame *[]){ y->prev, y->cur, y->next }, 3,
                              VK_NULL_HANDLE, 1, &params, sizeof(params));
 
     if (y->current_field == YADIF_FIELD_END)
         y->current_field = YADIF_FIELD_NORMAL;
+
+    return ret;
 }
 
 static void bwdif_vulkan_uninit(AVFilterContext *avctx)
diff --git a/libavfilter/vf_yadif.c b/libavfilter/vf_yadif.c
index 41ba056ad4..6fe9a97a13 100644
--- a/libavfilter/vf_yadif.c
+++ b/libavfilter/vf_yadif.c
@@ -225,7 +225,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
     return 0;
 }
 
-static void filter(AVFilterContext *ctx, AVFrame *dstpic,
+static int filter(AVFilterContext *ctx, AVFrame *dstpic,
                    int parity, int tff)
 {
     YADIFContext *yadif = ctx->priv;
@@ -249,6 +249,8 @@ static void filter(AVFilterContext *ctx, AVFrame *dstpic,
         ff_filter_execute(ctx, filter_slice, &td, NULL,
                           FFMIN(h, ff_filter_get_nb_threads(ctx)));
     }
+
+    return 0;
 }
 
 static const enum AVPixelFormat pix_fmts[] = {
diff --git a/libavfilter/vf_yadif_cuda.c b/libavfilter/vf_yadif_cuda.c
index 50ac61ad8a..435657de5d 100644
--- a/libavfilter/vf_yadif_cuda.c
+++ b/libavfilter/vf_yadif_cuda.c
@@ -53,7 +53,7 @@ typedef struct DeintCUDAContext {
 
 #define CHECK_CU(x) FF_CUDA_CHECK_DL(ctx, s->hwctx->internal->cuda_dl, x)
 
-static CUresult call_kernel(AVFilterContext *ctx, CUfunction func,
+static int call_kernel(AVFilterContext *ctx, CUfunction func,
                             CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr 
next,
                             CUarray_format format, int channels,
                             int src_width,  // Width is pixels per channel
@@ -121,7 +121,7 @@ exit:
     return ret;
 }
 
-static void filter(AVFilterContext *ctx, AVFrame *dst,
+static int filter(AVFilterContext *ctx, AVFrame *dst,
                    int parity, int tff)
 {
     DeintCUDAContext *s = ctx->priv;
@@ -132,7 +132,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
 
     ret = CHECK_CU(cu->cuCtxPushCurrent(s->hwctx->cuda_ctx));
     if (ret < 0)
-        return;
+        return ret;
 
     for (i = 0; i < y->csp->nb_components; i++) {
         CUfunction func;
@@ -150,6 +150,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
         channels = comp->step / pixel_size;
         if (pixel_size > 2 || channels > 2) {
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
+            ret = AVERROR(EINVAL);
             goto exit;
         }
         switch (pixel_size) {
@@ -163,12 +164,13 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
             break;
         default:
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
+            ret = AVERROR(EINVAL);
             goto exit;
         }
         av_log(ctx, AV_LOG_TRACE,
                "Deinterlacing plane %d: pixel_size: %d channels: %d\n",
                comp->plane, pixel_size, channels);
-        call_kernel(ctx, func,
+        ret = call_kernel(ctx, func,
                     (CUdeviceptr)y->prev->data[i],
                     (CUdeviceptr)y->cur->data[i],
                     (CUdeviceptr)y->next->data[i],
@@ -181,11 +183,13 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
                     AV_CEIL_RSHIFT(dst->height, i ? y->csp->log2_chroma_h : 0),
                     dst->linesize[i] / comp->step,
                     parity, tff);
+        if (ret < 0)
+            goto exit;
     }
 
 exit:
     CHECK_CU(cu->cuCtxPopCurrent(&dummy));
-    return;
+    return ret;
 }
 
 static av_cold void deint_cuda_uninit(AVFilterContext *ctx)
diff --git a/libavfilter/vf_yadif_videotoolbox.m 
b/libavfilter/vf_yadif_videotoolbox.m
index 9f09947cc2..b1152987cd 100644
--- a/libavfilter/vf_yadif_videotoolbox.m
+++ b/libavfilter/vf_yadif_videotoolbox.m
@@ -100,7 +100,7 @@ static void call_kernel(AVFilterContext *ctx,
     ff_objc_release(&buffer);
 }
 
-static void filter(AVFilterContext *ctx, AVFrame *dst,
+static int filter(AVFilterContext *ctx, AVFrame *dst,
                    int parity, int tff) API_AVAILABLE(macos(10.11), ios(8.0))
 {
     YADIFVTContext *s = ctx->priv;
@@ -123,7 +123,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
         channels = comp->step / pixel_size;
         if (pixel_size > 2 || channels > 2) {
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
-            return;
+            return AVERROR(EINVAL);
         }
         switch (pixel_size) {
         case 1:
@@ -134,7 +134,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
             break;
         default:
             av_log(ctx, AV_LOG_ERROR, "Unsupported pixel format: %s\n", 
y->csp->name);
-            return;
+            return AVERROR(EINVAL);
         }
         av_log(ctx, AV_LOG_TRACE,
                "Deinterlacing plane %d: pixel_size: %d channels: %d\n",
@@ -151,7 +151,7 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
             if (cur)  CFRelease(cur);
             if (next) CFRelease(next);
             if (dest) CFRelease(dest);
-            return;
+            return AVERROR_EXTERNAL;
         }
 
         tex_prev = CVMetalTextureGetTexture(prev);
@@ -173,6 +173,8 @@ static void filter(AVFilterContext *ctx, AVFrame *dst,
     if (y->current_field == YADIF_FIELD_END) {
         y->current_field = YADIF_FIELD_NORMAL;
     }
+
+    return 0;
 }
 
 static av_cold void do_uninit(AVFilterContext *ctx) 
API_AVAILABLE(macos(10.11), ios(8.0))
diff --git a/libavfilter/yadif.h b/libavfilter/yadif.h
index 888ba12365..21c6df29c2 100644
--- a/libavfilter/yadif.h
+++ b/libavfilter/yadif.h
@@ -62,7 +62,7 @@ typedef struct YADIFContext {
     AVFrame *prev;
     AVFrame *out;
 
-    void (*filter)(AVFilterContext *ctx, AVFrame *dstpic, int parity, int tff);
+    int (*filter)(AVFilterContext *ctx, AVFrame *dstpic, int parity, int tff);
 
     /**
      * Required alignment for filter_line
diff --git a/libavfilter/yadif_common.c b/libavfilter/yadif_common.c
index a6cd981684..e2af28dea0 100644
--- a/libavfilter/yadif_common.c
+++ b/libavfilter/yadif_common.c
@@ -49,7 +49,11 @@ static int return_frame(AVFilterContext *ctx, int is_second)
             yadif->current_field = YADIF_FIELD_END;
     }
 
-    yadif->filter(ctx, yadif->out, tff ^ !is_second, tff);
+    ret = yadif->filter(ctx, yadif->out, tff ^ !is_second, tff);
+    if (ret < 0) {
+        av_frame_free(&yadif->out);
+        return ret;
+    }
 
     if (is_second) {
         int64_t cur_pts  = yadif->cur->pts;
-- 
2.52.0


>From fe497247c24f516c39099cf33110de3cb7c8477b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 7 Oct 2026 00:16:29 +0200
Subject: [PATCH 2/3] avfilter/yadif: cosmetics: Reindent after the previous
 commit

---
 libavfilter/vf_bwdif.c              |  2 +-
 libavfilter/vf_bwdif_cuda.c         | 46 ++++++++++++++---------------
 libavfilter/vf_bwdif_vulkan.c       |  6 ++--
 libavfilter/vf_yadif.c              |  2 +-
 libavfilter/vf_yadif_cuda.c         | 46 ++++++++++++++---------------
 libavfilter/vf_yadif_videotoolbox.m |  2 +-
 6 files changed, 52 insertions(+), 52 deletions(-)

diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c
index f7f715f3cb..9130509ece 100644
--- a/libavfilter/vf_bwdif.c
+++ b/libavfilter/vf_bwdif.c
@@ -109,7 +109,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
 }
 
 static int filter(AVFilterContext *ctx, AVFrame *dstpic,
-                   int parity, int tff)
+                  int parity, int tff)
 {
     BWDIFContext *bwdif = ctx->priv;
     YADIFContext *yadif = &bwdif->yadif;
diff --git a/libavfilter/vf_bwdif_cuda.c b/libavfilter/vf_bwdif_cuda.c
index 9879d12ab4..ea68f3cb4f 100644
--- a/libavfilter/vf_bwdif_cuda.c
+++ b/libavfilter/vf_bwdif_cuda.c
@@ -54,16 +54,16 @@ typedef struct DeintCUDAContext {
 #define CHECK_CU(x) FF_CUDA_CHECK_DL(ctx, s->hwctx->internal->cuda_dl, x)
 
 static int call_kernel(AVFilterContext *ctx, CUfunction func,
-                            CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr 
next,
-                            CUarray_format format, int channels,
-                            int src_width,  // Width is pixels per channel
-                            int src_height, // Height is pixels per channel
-                            int src_pitch,  // Pitch is bytes
-                            CUdeviceptr dst,
-                            int dst_width,  // Width is pixels per channel
-                            int dst_height, // Height is pixels per channel
-                            int dst_pitch,  // Pitch is pixels per channel
-                            int parity, int tff, int clip_max)
+                       CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr next,
+                       CUarray_format format, int channels,
+                       int src_width,  // Width is pixels per channel
+                       int src_height, // Height is pixels per channel
+                       int src_pitch,  // Pitch is bytes
+                       CUdeviceptr dst,
+                       int dst_width,  // Width is pixels per channel
+                       int dst_height, // Height is pixels per channel
+                       int dst_pitch,  // Pitch is pixels per channel
+                       int parity, int tff, int clip_max)
 {
     DeintCUDAContext *s = ctx->priv;
     YADIFContext *y = &s->yadif;
@@ -123,7 +123,7 @@ exit:
 }
 
 static int filter(AVFilterContext *ctx, AVFrame *dst,
-                   int parity, int tff)
+                  int parity, int tff)
 {
     DeintCUDAContext *s = ctx->priv;
     YADIFContext *y = &s->yadif;
@@ -175,18 +175,18 @@ static int filter(AVFilterContext *ctx, AVFrame *dst,
                "Deinterlacing plane %d: pixel_size: %d channels: %d\n",
                comp->plane, pixel_size, channels);
         ret = call_kernel(ctx, func,
-                    (CUdeviceptr)y->prev->data[i],
-                    (CUdeviceptr)y->cur->data[i],
-                    (CUdeviceptr)y->next->data[i],
-                    format, channels,
-                    AV_CEIL_RSHIFT(y->cur->width, i ? y->csp->log2_chroma_w : 
0),
-                    AV_CEIL_RSHIFT(y->cur->height, i ? y->csp->log2_chroma_h : 
0),
-                    y->cur->linesize[i],
-                    (CUdeviceptr)dst->data[i],
-                    AV_CEIL_RSHIFT(dst->width, i ? y->csp->log2_chroma_w : 0),
-                    AV_CEIL_RSHIFT(dst->height, i ? y->csp->log2_chroma_h : 0),
-                    dst->linesize[i] / comp->step,
-                    parity, tff, clip_max);
+                          (CUdeviceptr)y->prev->data[i],
+                          (CUdeviceptr)y->cur->data[i],
+                          (CUdeviceptr)y->next->data[i],
+                          format, channels,
+                          AV_CEIL_RSHIFT(y->cur->width, i ? 
y->csp->log2_chroma_w : 0),
+                          AV_CEIL_RSHIFT(y->cur->height, i ? 
y->csp->log2_chroma_h : 0),
+                          y->cur->linesize[i],
+                          (CUdeviceptr)dst->data[i],
+                          AV_CEIL_RSHIFT(dst->width, i ? y->csp->log2_chroma_w 
: 0),
+                          AV_CEIL_RSHIFT(dst->height, i ? 
y->csp->log2_chroma_h : 0),
+                          dst->linesize[i] / comp->step,
+                          parity, tff, clip_max);
         if (ret < 0)
             goto exit;
     }
diff --git a/libavfilter/vf_bwdif_vulkan.c b/libavfilter/vf_bwdif_vulkan.c
index 5f96d2f7a3..4ddb77a840 100644
--- a/libavfilter/vf_bwdif_vulkan.c
+++ b/libavfilter/vf_bwdif_vulkan.c
@@ -103,7 +103,7 @@ fail:
 }
 
 static int bwdif_vulkan_filter_frame(AVFilterContext *ctx, AVFrame *dst,
-                                      int parity, int tff)
+                                     int parity, int tff)
 {
     BWDIFVulkanContext *s = ctx->priv;
     YADIFContext *y = &s->yadif;
@@ -115,8 +115,8 @@ static int bwdif_vulkan_filter_frame(AVFilterContext *ctx, 
AVFrame *dst,
     int ret;
 
     ret = ff_vk_filter_process_Nin(&s->vkctx, &s->e, &s->shd, dst,
-                             (AVFrame *[]){ y->prev, y->cur, y->next }, 3,
-                             VK_NULL_HANDLE, 1, &params, sizeof(params));
+                                   (AVFrame *[]){ y->prev, y->cur, y->next }, 
3,
+                                   VK_NULL_HANDLE, 1, &params, sizeof(params));
 
     if (y->current_field == YADIF_FIELD_END)
         y->current_field = YADIF_FIELD_NORMAL;
diff --git a/libavfilter/vf_yadif.c b/libavfilter/vf_yadif.c
index 6fe9a97a13..7e6ac171f1 100644
--- a/libavfilter/vf_yadif.c
+++ b/libavfilter/vf_yadif.c
@@ -226,7 +226,7 @@ static int filter_slice(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
 }
 
 static int filter(AVFilterContext *ctx, AVFrame *dstpic,
-                   int parity, int tff)
+                  int parity, int tff)
 {
     YADIFContext *yadif = ctx->priv;
     ThreadData td = { .frame = dstpic, .parity = parity, .tff = tff };
diff --git a/libavfilter/vf_yadif_cuda.c b/libavfilter/vf_yadif_cuda.c
index 435657de5d..eacaf28731 100644
--- a/libavfilter/vf_yadif_cuda.c
+++ b/libavfilter/vf_yadif_cuda.c
@@ -54,16 +54,16 @@ typedef struct DeintCUDAContext {
 #define CHECK_CU(x) FF_CUDA_CHECK_DL(ctx, s->hwctx->internal->cuda_dl, x)
 
 static int call_kernel(AVFilterContext *ctx, CUfunction func,
-                            CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr 
next,
-                            CUarray_format format, int channels,
-                            int src_width,  // Width is pixels per channel
-                            int src_height, // Height is pixels per channel
-                            int src_pitch,  // Pitch is bytes
-                            CUdeviceptr dst,
-                            int dst_width,  // Width is pixels per channel
-                            int dst_height, // Height is pixels per channel
-                            int dst_pitch,  // Pitch is pixels per channel
-                            int parity, int tff)
+                       CUdeviceptr prev, CUdeviceptr cur, CUdeviceptr next,
+                       CUarray_format format, int channels,
+                       int src_width,  // Width is pixels per channel
+                       int src_height, // Height is pixels per channel
+                       int src_pitch,  // Pitch is bytes
+                       CUdeviceptr dst,
+                       int dst_width,  // Width is pixels per channel
+                       int dst_height, // Height is pixels per channel
+                       int dst_pitch,  // Pitch is pixels per channel
+                       int parity, int tff)
 {
     DeintCUDAContext *s = ctx->priv;
     CudaFunctions *cu = s->hwctx->internal->cuda_dl;
@@ -122,7 +122,7 @@ exit:
 }
 
 static int filter(AVFilterContext *ctx, AVFrame *dst,
-                   int parity, int tff)
+                  int parity, int tff)
 {
     DeintCUDAContext *s = ctx->priv;
     YADIFContext *y = &s->yadif;
@@ -171,18 +171,18 @@ static int filter(AVFilterContext *ctx, AVFrame *dst,
                "Deinterlacing plane %d: pixel_size: %d channels: %d\n",
                comp->plane, pixel_size, channels);
         ret = call_kernel(ctx, func,
-                    (CUdeviceptr)y->prev->data[i],
-                    (CUdeviceptr)y->cur->data[i],
-                    (CUdeviceptr)y->next->data[i],
-                    format, channels,
-                    AV_CEIL_RSHIFT(y->cur->width, i ? y->csp->log2_chroma_w : 
0),
-                    AV_CEIL_RSHIFT(y->cur->height, i ? y->csp->log2_chroma_h : 
0),
-                    y->cur->linesize[i],
-                    (CUdeviceptr)dst->data[i],
-                    AV_CEIL_RSHIFT(dst->width, i ? y->csp->log2_chroma_w : 0),
-                    AV_CEIL_RSHIFT(dst->height, i ? y->csp->log2_chroma_h : 0),
-                    dst->linesize[i] / comp->step,
-                    parity, tff);
+                          (CUdeviceptr)y->prev->data[i],
+                          (CUdeviceptr)y->cur->data[i],
+                          (CUdeviceptr)y->next->data[i],
+                          format, channels,
+                          AV_CEIL_RSHIFT(y->cur->width, i ? 
y->csp->log2_chroma_w : 0),
+                          AV_CEIL_RSHIFT(y->cur->height, i ? 
y->csp->log2_chroma_h : 0),
+                          y->cur->linesize[i],
+                          (CUdeviceptr)dst->data[i],
+                          AV_CEIL_RSHIFT(dst->width, i ? y->csp->log2_chroma_w 
: 0),
+                          AV_CEIL_RSHIFT(dst->height, i ? 
y->csp->log2_chroma_h : 0),
+                          dst->linesize[i] / comp->step,
+                          parity, tff);
         if (ret < 0)
             goto exit;
     }
diff --git a/libavfilter/vf_yadif_videotoolbox.m 
b/libavfilter/vf_yadif_videotoolbox.m
index b1152987cd..4fb2a9d96a 100644
--- a/libavfilter/vf_yadif_videotoolbox.m
+++ b/libavfilter/vf_yadif_videotoolbox.m
@@ -101,7 +101,7 @@ static void call_kernel(AVFilterContext *ctx,
 }
 
 static int filter(AVFilterContext *ctx, AVFrame *dst,
-                   int parity, int tff) API_AVAILABLE(macos(10.11), ios(8.0))
+                  int parity, int tff) API_AVAILABLE(macos(10.11), ios(8.0))
 {
     YADIFVTContext *s = ctx->priv;
     YADIFContext *y = &s->yadif;
-- 
2.52.0


>From f41ee4a4478ce8c6a46c0c4343c70665f2c4871e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 7 Oct 2026 00:54:53 +0200
Subject: [PATCH 3/3] avfilter/vf_yadif_cuda: Pass 0 or 1 as skip_spatial_check

The kernel takes a bool, but got the value 2 for the modes that skip
the spatial interlacing check, which with a cuda-llvm build was taken
as false, so modes 2 and 3 gave the output of modes 0 and 1.

Ignored mode Replicated through UnModified FFmpeg
Found during triage of the security report LQ8PDMaG6fL1
---
 libavfilter/vf_yadif_cuda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_yadif_cuda.c b/libavfilter/vf_yadif_cuda.c
index eacaf28731..b3b98f3ccd 100644
--- a/libavfilter/vf_yadif_cuda.c
+++ b/libavfilter/vf_yadif_cuda.c
@@ -69,7 +69,7 @@ static int call_kernel(AVFilterContext *ctx, CUfunction func,
     CudaFunctions *cu = s->hwctx->internal->cuda_dl;
     CUtexObject tex_prev = 0, tex_cur = 0, tex_next = 0;
     int ret;
-    int skip_spatial_check = s->yadif.mode&2;
+    int skip_spatial_check = !!(s->yadif.mode&2);
 
     void *args[] = { &dst, &tex_prev, &tex_cur, &tex_next,
                      &dst_width, &dst_height, &dst_pitch,
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to