Live data from Hacker News

FFmpeg and a thousand fixes

googleonlinesecurity.blogspot.com

141–150 of 150 posts

Re: FFmpeg and a thousand fixes

#142
post #136

Earlier quoted context omitted.

Yes, but how long does this exist? My guess would be that it isn't really used (yet) in ffmpeg.

Since C99 so 15 years, which is older than ffmpeg.

What I meant is how long is it supported by compilers. I know its by GCC, but I think it's not by MSCV. Is it possible to compile ffmpeg with MSVC? But ok, one could use it and just #define it away for crappy compilers.

Re: FFmpeg and a thousand fixes

#143

Earlier quoted context omitted.

Nearly all SIMD in ffmpeg/libav/x264 is just written in assembly. Back in the day, gcc's code generation for even x86 SIMD intrinsic functions was too poor to consider using it. (Plus x86's intrinsics are just plain ugly. It's easier to read asm.) As for the architecture-independent SIMD in GNU C, it's something, but not quite flexible enough. Even C is really not a good enough language to consider implementing this…

Isn't that what the restrict keyword is for?

gcc mostly ignores restrict, though it's got a little better in recent versions. icc uses it a little more.

But restrict is only good in specific situations - if you have three pointers, and #2 can alias #1 but not #3, there's no way to express that.

It also tends to be used on function arguments, not at some higher up point of declaration. So when compilers inline the function and can see more global info about it, the restrict gets lost and optimization gets worse.

I think some kind of stronger 'typedef' would be better.

Re: FFmpeg and a thousand fixes

#144
post #137

Earlier quoted context omitted.

Ya, it's definitely a language issue; barring super-intelligent compilers that can vectorize things on their own (which GCC does for certain cases), you need a means to express vectorizable operations. You don't need to work at the assembly level for this; you just need a language that can express vector operations in a way that doesn't require a compiler to solve the halting problem, and you need a compiler that kno…

Well, expressions like these look to me very clearly like a pattern that can be implemented using SIMD instructions: map (uncurry (+)) (zip [1,2,3] [4,5,6]) I guess because of these standard functions and the fact that everything in Haskell is immutable and side effect free it should be comparably easy to do SIMD optimizations. It's only a guess, though.

Not if [1,2,3] and [4,5,6] are actually lists, or aren't aligned properly, or aren't the correct bitwidth, or the expression can't saturate/wrap, etc.

The compiler needs to be able to see that the data conforms to all those restrictions (possibly more), and that's not a trivial thing to do.

Re: FFmpeg and a thousand fixes

#145
post #142

Earlier quoted context omitted.

Since C99 so 15 years, which is older than ffmpeg.

What I meant is how long is it supported by compilers. I know its by GCC, but I think it's not by MSCV. Is it possible to compile ffmpeg with MSVC? But ok, one could use it and just #define it away for crappy compilers.

According to MSDN, Visual C++ has supported the equivalent __restrict keyword since at least 2005 [1], and according to the ffmpeg documentation [2], "FFmpeg can be built with MSVC 2012 or earlier using a C99-to-C89 conversion utility and wrapper, or with MSVC 2013 and ICL natively."

[1] http://msdn.microsoft.com/en-us/library/5ft82fed(v=vs.80).as...

[2] http://www.ffmpeg.org/platform.html

Re: FFmpeg and a thousand fixes

#146
post #137

Earlier quoted context omitted.

Well, expressions like these look to me very clearly like a pattern that can be implemented using SIMD instructions: map (uncurry (+)) (zip [1,2,3] [4,5,6]) I guess because of these standard functions and the fact that everything in Haskell is immutable and side effect free it should be comparably easy to do SIMD optimizations. It's only a guess, though.

Not if [1,2,3] and [4,5,6] are actually lists, or aren't aligned properly, or aren't the correct bitwidth, or the expression can't saturate/wrap, etc. The compiler needs to be able to see that the data conforms to all those restrictions (possibly more), and that's not a trivial thing to do.

Shouldn't the compiler be able to see this? After all, Haskell is statically typed. Ok, maybe the compiler (optimizer) needs to look across function boundaries, but it should be possible, shouldn't it?

Re: FFmpeg and a thousand fixes

#147
post #146

Earlier quoted context omitted.

Not if [1,2,3] and [4,5,6] are actually lists, or aren't aligned properly, or aren't the correct bitwidth, or the expression can't saturate/wrap, etc. The compiler needs to be able to see that the data conforms to all those restrictions (possibly more), and that's not a trivial thing to do.

Shouldn't the compiler be able to see this? After all, Haskell is statically typed. Ok, maybe the compiler (optimizer) needs to look across function boundaries, but it should be possible, shouldn't it?

In the simplest cases, sure. But inferring that amount of information in general programs is very much an open problem. Even with GCC, which incorporates what is roughly (at least within an order of magnitude) state-of-the-art autovectorization, you have to be careful how you write your loops and structure your arrays or the compiler won't pick up on it.

Here's an example in Haskell: consider the case that the list of numbers was generated from a list of some other structure; something like "map x coordinates" to get all the X values from a list of X-Y-Z coordinates. For vectorization to work, those values need to be packed together in memory; however the structure isn't organized as such (at best, you'd have XYZXYZXYZ). That means a nontrivial memory copy, which will cost much more than the vectorization will gain you. So the structure needs to be reorganized, but then that might cause other pessimizations.

Re: FFmpeg and a thousand fixes

#148
post #146

Earlier quoted context omitted.

Shouldn't the compiler be able to see this? After all, Haskell is statically typed. Ok, maybe the compiler (optimizer) needs to look across function boundaries, but it should be possible, shouldn't it?

In the simplest cases, sure. But inferring that amount of information in general programs is very much an open problem. Even with GCC, which incorporates what is roughly (at least within an order of magnitude) state-of-the-art autovectorization, you have to be careful how you write your loops and structure your arrays or the compiler won't pick up on it. Here's an example in Haskell: consider the case that the list o…

I see.

Re: FFmpeg and a thousand fixes

#149
post #70
post #21

Earlier quoted context omitted.

Chrome is also in userland - and it has a sandboxing system. Assuming they're sandboxing ffmpeg, these bugs are more risky for VLC users than Chrome users. Plus, Chrome is more diligent with security updates and the auto-update mechanism is fully automatic. A sandboxing system provided by either ffmpeg or VLC would be a very good idea, though it would be some work... encoded data in, decoded frames out via shared mem…

> Negligible performance impact. Memcpying complete video frame in HD at 30 or 60 fps is not negligible performance impact. But I agree it would be a good idea.

You snipped out the part where I suggested shared memory :)

It might get hairier if the platform graphics api wants to supply you a buffer to render into, and you can't pass it a shared memory buffer yourself (that is accessible by that sandboxed process).

Re: FFmpeg and a thousand fixes

#150
post #52

Earlier quoted context omitted.

Be aware that these are open-source projects. I don't see you starting a fork in a better language.

I find this, 'don't complain, fork/fix' mentality ridiculous. Why should he? If his goal is get people off C, communicating/persuading in a developer community comments is probably more effective than him creating a project in some other language that no one would likely ever use.

In what way is asking someone, somewhere, to move a project to another, unnamed language, going to be more effective than actually starting a project and putting code into it? Sure, "go do it yourself" is not a pleasant response, but "go take the tens of thousands of lines of code that mostly works, and spend person-years rewriting it in another language so that a certain set of bugs aren't an issue anymore, instead of fixing the mostly working code" is in no way a reasonable request. "What can be done to help reduce the bug count, by a casual user?" might be. Contacting Coverity or another static analysis company that occasionally runs their tools on open source programs to help the world (and get the free press out of it...), might result in a huge list of subtle (and hideously obvious) bugs getting squashed.
Post reply on HN