Function av_frame_to_owned_image_frame 

pub unsafe fn av_frame_to_owned_image_frame(
    av_frame: *const AVFrame,
    limits: FrameLimits,
) -> Result<ImageFrame<PixelFormat, ImageFrameExtra, FfmpegBytes>, ConvertError>

av_frame_to_image_frame on the owned lane, which copies every byte it reads and therefore has no aliasing obligation.

Safety

The source must be live for the duration of the call.