rff-codec-av2 0.2.2

Remade FFmpeg (Rust): AV2 decoder, backed by the in-house pure-Rust rusty_av2d engine (no C/FFI).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# rff-codec-av2

AV2 decoding for [`remade_ffmpeg_rs`](https://github.com/Remade-With-Rust/remade_ffmpeg_rs),
backed by the pure-Rust [`rusty_av2d`](https://crates.io/crates/rusty_av2d)
engine — no C, no FFI.

This crate is a thin adapter. `register()` wires the decoder into a
`CodecRegistry`; a private wrapper translates between the rff `Decoder` trait
and `rusty_av2d`'s push/pull API. All codec logic — the decoder that is
byte-identical to AOM's `avmdec` across a 45-clip conformance corpus — lives in
`rusty_av2d`.

> ### ⚠️ Decode robustness: sandbox untrusted AV2 in debug builds
>
> `rusty_av2d 0.2.8` performs an **unchecked subtraction** (`av2_gdf.rs:549`)
> that trips Rust's arithmetic-overflow check, and aborts
> (`STATUS_STACK_BUFFER_OVERRUN`) on malformed OBU input. An `abort()` is not a
> panic, so `catch_unwind` cannot contain it — a hostile file takes the process
> down.
>
> This affects **debug builds only**. Verified 2026-08-27 against a release
> build: valid AV2 decodes **byte-identically to the reference**, and a fuzz
> sweep over malformed input passes with AV2 included. A shipped release binary
> therefore neither crashes on hostile AV2 nor mis-decodes valid AV2.
>
> Treat the unchecked arithmetic as a defect to fix upstream, not a property to
> rely on: a wrap that is correct today is correct by accident, not by contract.
> If you decode untrusted input in a debug or CI build, sandbox this path.

```rust
let mut registry = rff_codec::CodecRegistry::new();
rff_codec_av2::register(&mut registry);
let mut decoder = registry.find_decoder(rff_core::CodecId::Av2)?;
```

From the CLI, AV2 in an IVF container (fourcc `AV02`) is detected automatically:

```sh
rff -i input.ivf -c:v rawvideo out.y4m
```

## Scope

**Decode only** — there is no AV2 encoder, and the registry does not advertise
one.

**Research preview.** AV2 is not a finalized standard: there are no official
conformance vectors, correctness is defined against the AVM reference as of the
pinned `rusty_av2d` release, and the bitstream may still change. Performance is
unoptimized. See `rusty_av2d`'s `STATUS.md` for the full scope statement.

Monochrome (4:0:0) output is refused rather than approximated — no corpus clip
exercises it.

## Linking alongside AV1

`rusty_av2d` and `rusty_av1d` share the dav1d symbol lineage, so their C ABI and
assembly table exports collide at link time. This crate depends on `rusty_av2d`
with `default-features = false`, which drops both and leaves the safe Rust API —
that is how this workspace links AV1 and AV2 into one binary.

## License

Apache-2.0 (this adapter). The underlying `rusty_av2d` engine is BSD-2-Clause.