Commit af6d20f30c for ffmpeg

commit af6d20f30cf0377142a127b4fe352d64e318b18e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 6 23:18:48 2026 +0200

    avutil/hwcontext: Fail with ENOSYS when a transfer callback is missing

    This is not a security issue, FFmpeg itself does not create such frames,
    only an API user setting such a hw_frames_ctx on a frame can.

    Reported in AISLE-2026-0100-00080 (F7BbuzcmJjqW), not replicated as no
    OpenHarmony or Android build was available.
    Found-by: Joshua Rogers <joshua.rogers@aisle.com>
    Suggested-by: Joshua Rogers <joshua.rogers@aisle.com>

diff --git a/libavutil/hwcontext.c b/libavutil/hwcontext.c
index 83bd7457e8..c9e7d99f1d 100644
--- a/libavutil/hwcontext.c
+++ b/libavutil/hwcontext.c
@@ -478,8 +478,10 @@ int av_hwframe_transfer_data(AVFrame *dst, const AVFrame *src, int flags)
             return AVERROR(ENOSYS);
         }

-        ret = src_ctx->hw_type->transfer_data_from(&src_ctx->p, dst, src);
-        if (ret == AVERROR(ENOSYS))
+        ret = AVERROR(ENOSYS);
+        if (src_ctx->hw_type->transfer_data_from)
+            ret = src_ctx->hw_type->transfer_data_from(&src_ctx->p, dst, src);
+        if (ret == AVERROR(ENOSYS) && dst_ctx->hw_type->transfer_data_to)
             ret = dst_ctx->hw_type->transfer_data_to(&dst_ctx->p, dst, src);
         if (ret < 0)
             return ret;
@@ -487,12 +489,18 @@ int av_hwframe_transfer_data(AVFrame *dst, const AVFrame *src, int flags)
         if (src->hw_frames_ctx) {
             FFHWFramesContext *ctx = (FFHWFramesContext*)src->hw_frames_ctx->data;

+            if (!ctx->hw_type->transfer_data_from)
+                return AVERROR(ENOSYS);
+
             ret = ctx->hw_type->transfer_data_from(&ctx->p, dst, src);
             if (ret < 0)
                 return ret;
         } else if (dst->hw_frames_ctx) {
             FFHWFramesContext *ctx = (FFHWFramesContext*)dst->hw_frames_ctx->data;

+            if (!ctx->hw_type->transfer_data_to)
+                return AVERROR(ENOSYS);
+
             ret = ctx->hw_type->transfer_data_to(&ctx->p, dst, src);
             if (ret < 0)
                 return ret;