Merge pull request 'libva-v4l2-request-fourier: bump pin to 2860d75 (#13 bounds-check fix)' (#66) from claude-noether/marfrit-packages:bump-libva-fourier-2860d75-issue-13 into main

Reviewed-on: marfrit/marfrit-packages#66

arch/libva-v4l2-request-fourier/PKGBUILD

@@ -24,29 +24,28 @@ pkgname=libva-v4l2-request-fourier
 epoch=1
 _upstreampkg=libva-v4l2-request
 
-# Pin the fork tip. 77f9236 = PR #12 merge "av1: populate
-# V4L2_CID_STATELESS_AV1_SEQUENCE in codec_set_controls (#11 libva side)"
-# — addresses the libva-side portion of marfrit/libva-v4l2-request-fourier#11.
-# Adds src/av1.{c,h} with av1_set_controls that maps VAAPI's
-# VAPictureParameterBufferAV1.seq_info_fields onto struct
-# v4l2_ctrl_av1_sequence and queues V4L2_CID_STATELESS_AV1_SEQUENCE via
-# S_EXT_CTRLS. The daedalus_v4l2 daemon track is the consumer that turns
-# the ctrl into an OBU_SEQUENCE_HEADER and prepends it to the slice
-# bitstream so libdav1d can parse the (sequence-header-stripped) OUTPUT
-# buffer that ffmpeg-vaapi delivers. Until the daemon side lands the ctrl
-# is just sitting in the request unused — no-cost no-op for HW decoders
-# (vpu981 parses OBU bytes directly).
+# Pin the fork tip. 2860d75 = PR #14 merge "picture: bounds-check
+# codec_store_buffer slice writes against source_size (#13)" — addresses
+# marfrit/libva-v4l2-request-fourier#13. Guards the three append sites
+# in codec_store_buffer's VASliceDataBufferType branch (H.264 Annex-B
+# start code, VP8 uncompressed-header pad, slice payload) against the
+# OUTPUT pool slot's fixed sizeimage; returns
+# VA_STATUS_ERROR_ALLOCATION_FAILED with a request_log line instead of
+# memcpy'ing past the mmap on a resolution upshift mid-stream (SIGSEGV
+# in mpv --hwdec=vaapi-copy, heap-corruption hazard in Firefox RDD).
+# The root-cause refactor (re-init OUTPUT pool / re-create surfaces on
+# resolution change, or grow source_data on demand) is tracked as the
+# follow-up backlog item; this PR is the memory-safety floor.
 #
-# Prior pin (c1bb444) = PR #9 merge — h264_set_controls
-# max_num_ref_frames fallback + libva-boundary instrumentation for the
-# daedalus consumer-strict path (issue #8 libva side).
-_commit=77f92364661419f6e5a7bd827c1b845b4e426569
+# Prior pin (77f9236) = PR #12 merge — av1_set_controls
+# (V4L2_CID_STATELESS_AV1_SEQUENCE for the daedalus daemon track).
+_commit=2860d75afe6a8e34df6afb508ff85c822bf9e908
 
 # Project version from meson.build (1.0.0) + commit count + short sha,
 # matching the ffmpeg-v4l2-request-fourier convention. Recomputed at
 # build time by pkgver() below; the static value here is a placeholder
 # so AUR-style consumers see something coherent before src/ exists.
-pkgver=1.0.0.r386.77f9236
+pkgver=1.0.0.r388.2860d75
 pkgrel=1
 pkgdesc="VA-API backend for V4L2 stateless decoders (multiplanar fork — fourier umbrella)"
 arch=('aarch64')

debian/libva-v4l2-request-fourier/build-deb.sh

@@ -10,22 +10,23 @@
 # Upstream fork: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 set -euo pipefail
 
-# Same pin as the Arch PKGBUILD.  77f9236 = PR #12 merge "av1:
-# populate V4L2_CID_STATELESS_AV1_SEQUENCE in codec_set_controls
-# (#11 libva side)" — adds src/av1.{c,h} with av1_set_controls that
-# maps VAAPI's VAPictureParameterBufferAV1.seq_info_fields onto
-# struct v4l2_ctrl_av1_sequence and queues V4L2_CID_STATELESS_AV1_
-# SEQUENCE via S_EXT_CTRLS.  The daedalus_v4l2 daemon track is the
-# consumer that turns the ctrl into an OBU_SEQUENCE_HEADER and
-# prepends it to the slice bitstream so libdav1d can parse the
-# (sequence-header-stripped) OUTPUT buffer that ffmpeg-vaapi
-# delivers.
+# Same pin as the Arch PKGBUILD.  2860d75 = PR #14 merge "picture:
+# bounds-check codec_store_buffer slice writes against source_size
+# (#13)" — guards the three append sites in codec_store_buffer's
+# VASliceDataBufferType branch (H.264 Annex-B start code, VP8
+# uncompressed-header pad, slice payload) against the OUTPUT pool
+# slot's fixed sizeimage; returns VA_STATUS_ERROR_ALLOCATION_FAILED
+# with a request_log line instead of memcpy'ing past the mmap on a
+# resolution upshift mid-stream.  Fixes a SIGSEGV in mpv
+# --hwdec=vaapi-copy and a heap-corruption hazard in Firefox RDD.
+# The root-cause refactor (re-init OUTPUT pool / re-create surfaces
+# on resolution change, or grow source_data on demand) is tracked
+# as the follow-up backlog item; this is the memory-safety floor.
 #
-# Prior pin (c1bb444) = PR #9 merge — h264_set_controls
-# max_num_ref_frames fallback + libva-boundary instrumentation for
-# the daedalus consumer-strict path (issue #8 libva side).
-UPSTREAM_COMMIT=77f92364661419f6e5a7bd827c1b845b4e426569
-PKGVER=1.0.0+r386+g77f9236
+# Prior pin (77f9236) = PR #12 merge — av1_set_controls
+# (V4L2_CID_STATELESS_AV1_SEQUENCE for the daedalus daemon track).
+UPSTREAM_COMMIT=2860d75afe6a8e34df6afb508ff85c822bf9e908
+PKGVER=1.0.0+r388+g2860d75
 PKGREL=1
 
 HERE=$(dirname "$(readlink -f "$0")")