Skip to content

Harden frame cropping - #2497

Merged
WyattBlue merged 3 commits into
masterfrom
patch
Oct 28, 2026
Merged

WyattBlue merged 3 commits into
masterfrom
patch

Conversation

@WyattBlue

@WyattBlue WyattBlue commented Oct 28, 2026 •

Copy link
Copy Markdown
Member

Follow-up to #2496.

  • Keep VideoPlane geometry in sync with its frame. A plane cached its width, height and buffer size when created but read the frame's data pointer live, so a plane made before apply_cropping() paired the shifted pointer with the old size. bytes(plane), memoryview(plane), update() and DLPack export then read or wrote past the buffer (reproduced as SIGBUS with a guard page). The geometry is now recomputed whenever the frame's dimensions, data pointer or linesize change. Also documents that FFmpeg only applies the right and bottom crop for hardware frames and 1-bit formats.
  • Validate VideoFrame crop setters. Reject a crop that would leave no pixels on its axis, the same rule av_frame_apply_cropping() uses, so nonsense values can't reach hardware filters (scale_cuda, scale_vt, scale_vulkan, amf) that read the fields unchecked.
  • Drop crop fields when reformat() resizes a frame. av_frame_copy_props() copies them onto the output; they still hold after a pixel format change but not after a resize, where they can exceed the new dimensions.

VideoPlane cached width, height and buffer_size when created, but read
the frame's data pointer live. A plane made before apply_cropping() then
paired the shifted pointer with the old size, so bytes(plane),
memoryview(plane), update() and DLPack export read or wrote past the
buffer. Recompute the geometry whenever the frame's dimensions, data
pointer or linesize change.

Also document that for hardware frames and 1-bit formats FFmpeg applies
only the right and bottom crop, leaving crop_left and crop_top set.
Reject a crop when the two crops on an axis would leave no pixels, the
same rule av_frame_apply_cropping() uses. Without this, nonsense values
reached hardware filters such as scale_cuda, scale_vt and scale_vulkan,
which read the crop fields without checking them. Zero is always
allowed so the fields can be cleared.
av_frame_copy_props() copies crop_* onto the reformatted frame. They
are in source pixels, so they still hold after a pixel format change
but not after a resize, where they can exceed the new dimensions. Clear
them when the size changes.
@WyattBlue WyattBlue changed the title Harden frame cropping and check C bindings in CI Harden frame cropping Oct 28, 2026
@WyattBlue
WyattBlue merged commit 43c8261 into master Oct 28, 2026
10 checks passed
@WyattBlue
WyattBlue deleted the patch branch October 28, 2026 08:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant