vc1dec: Do not use random pred_flag if motion vector data is skipped

This fixes SA10143.vc1 from test-suite. Also partially fixes MC-VC1.ts from videolan streams archive. Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit 082829520e) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
update for 0.10.9
2013-09-27 03:03:40 +02:00 · 2013-09-27 02:52:04 +02:00 · 2013-09-27 02:52:04 +02:00 · 2013-09-27 02:52:04 +02:00 · 2013-09-27 02:52:04 +02:00 · 2013-09-27 02:52:04 +02:00
50 changed files with 360 additions and 166 deletions
--- a/2
+++ b/2
@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 0.10.8
+PROJECT_NUMBER         = 0.10.9

 # With the PROJECT_LOGO tag one can specify an logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
--- a/2
+++ b/2
@@ -1 +1 @@
-0.10.8
+0.10.9
--- a/2
+++ b/2
@@ -1 +1 @@
-0.10.8
+0.10.9
--- a/libavcodec/aac_ac3_parser.h
+++ b/libavcodec/aac_ac3_parser.h
@@ -28,13 +28,13 @@
 #include "parser.h"

 typedef enum {
-    AAC_AC3_PARSE_ERROR_SYNC        = -1,
-    AAC_AC3_PARSE_ERROR_BSID        = -2,
-    AAC_AC3_PARSE_ERROR_SAMPLE_RATE = -3,
-    AAC_AC3_PARSE_ERROR_FRAME_SIZE  = -4,
-    AAC_AC3_PARSE_ERROR_FRAME_TYPE  = -5,
-    AAC_AC3_PARSE_ERROR_CRC         = -6,
-    AAC_AC3_PARSE_ERROR_CHANNEL_CFG = -7,
+    AAC_AC3_PARSE_ERROR_SYNC        = -0x1030c0a,
+    AAC_AC3_PARSE_ERROR_BSID        = -0x2030c0a,
+    AAC_AC3_PARSE_ERROR_SAMPLE_RATE = -0x3030c0a,
+    AAC_AC3_PARSE_ERROR_FRAME_SIZE  = -0x4030c0a,
+    AAC_AC3_PARSE_ERROR_FRAME_TYPE  = -0x5030c0a,
+    AAC_AC3_PARSE_ERROR_CRC         = -0x6030c0a,
+    AAC_AC3_PARSE_ERROR_CHANNEL_CFG = -0x7030c0a,
 } AACAC3ParseError;

 typedef struct AACAC3ParseContext {
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -297,7 +297,7 @@ static int parse_frame_header(AC3DecodeContext *s)
        return ff_eac3_parse_header(s);
    } else {
        av_log(s->avctx, AV_LOG_ERROR, "E-AC-3 support not compiled in\n");
-        return -1;
+        return AVERROR(ENOSYS);
    }
 }

@@ -822,12 +822,12 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
            if (start_subband >= end_subband) {
                av_log(s->avctx, AV_LOG_ERROR, "invalid spectral extension "
                       "range (%d >= %d)\n", start_subband, end_subband);
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
            if (dst_start_freq >= src_start_freq) {
                av_log(s->avctx, AV_LOG_ERROR, "invalid spectral extension "
                       "copy start bin (%d >= %d)\n", dst_start_freq, src_start_freq);
-                return -1;
+                return AVERROR_INVALIDDATA;
            }

            s->spx_dst_start_freq = dst_start_freq;
@@ -904,7 +904,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)

            if (channel_mode < AC3_CHMODE_STEREO) {
                av_log(s->avctx, AV_LOG_ERROR, "coupling not allowed in mono or dual-mono\n");
-                return -1;
+                return AVERROR_INVALIDDATA;
            }

            /* check for enhanced coupling */
@@ -934,7 +934,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
            if (cpl_start_subband >= cpl_end_subband) {
                av_log(s->avctx, AV_LOG_ERROR, "invalid coupling range (%d >= %d)\n",
                       cpl_start_subband, cpl_end_subband);
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
            s->start_freq[CPL_CH] = cpl_start_subband * 12 + 37;
            s->end_freq[CPL_CH]   = cpl_end_subband   * 12 + 37;
@@ -956,7 +956,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
        if (!blk) {
            av_log(s->avctx, AV_LOG_ERROR, "new coupling strategy must "
                   "be present in block 0\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        } else {
            s->cpl_in_use[blk] = s->cpl_in_use[blk-1];
        }
@@ -986,7 +986,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
                } else if (!blk) {
                    av_log(s->avctx, AV_LOG_ERROR, "new coupling coordinates must "
                           "be present in block 0\n");
-                    return -1;
+                    return AVERROR_INVALIDDATA;
                }
            } else {
                /* channel not in coupling */
@@ -1041,7 +1041,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
                int bandwidth_code = get_bits(gbc, 6);
                if (bandwidth_code > 60) {
                    av_log(s->avctx, AV_LOG_ERROR, "bandwidth code = %d > 60\n", bandwidth_code);
-                    return -1;
+                    return AVERROR_INVALIDDATA;
                }
                s->end_freq[ch] = bandwidth_code * 3 + 73;
            }
@@ -1064,7 +1064,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
                                 s->num_exp_groups[ch], s->dexps[ch][0],
                                 &s->dexps[ch][s->start_freq[ch]+!!ch])) {
                av_log(s->avctx, AV_LOG_ERROR, "exponent out-of-range\n");
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
            if (ch != CPL_CH && ch != s->lfe_ch)
                skip_bits(gbc, 2); /* skip gainrng */
@@ -1084,7 +1084,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
        } else if (!blk) {
            av_log(s->avctx, AV_LOG_ERROR, "new bit allocation info must "
                   "be present in block 0\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        }
    }

@@ -1115,7 +1115,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
            }
        } else if (!s->eac3 && !blk) {
            av_log(s->avctx, AV_LOG_ERROR, "new snr offsets must be present in block 0\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        }
    }

@@ -1154,7 +1154,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
        } else if (!s->eac3 && !blk) {
            av_log(s->avctx, AV_LOG_ERROR, "new coupling leak info must "
                   "be present in block 0\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        }
        s->first_cpl_leak = 0;
    }
@@ -1166,7 +1166,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
            s->dba_mode[ch] = get_bits(gbc, 2);
            if (s->dba_mode[ch] == DBA_RESERVED) {
                av_log(s->avctx, AV_LOG_ERROR, "delta bit allocation strategy reserved\n");
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
            bit_alloc_stages[ch] = FFMAX(bit_alloc_stages[ch], 2);
        }
@@ -1207,7 +1207,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
                                           s->dba_offsets[ch], s->dba_lengths[ch],
                                           s->dba_values[ch],  s->mask[ch])) {
                av_log(s->avctx, AV_LOG_ERROR, "error in bit allocation\n");
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
        }
        if (bit_alloc_stages[ch] > 0) {
@@ -1328,7 +1328,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
        switch (err) {
        case AAC_AC3_PARSE_ERROR_SYNC:
            av_log(avctx, AV_LOG_ERROR, "frame sync error\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        case AAC_AC3_PARSE_ERROR_BSID:
            av_log(avctx, AV_LOG_ERROR, "invalid bitstream id\n");
            break;
@@ -1342,17 +1342,20 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
            /* skip frame if CRC is ok. otherwise use error concealment. */
            /* TODO: add support for substreams and dependent frames */
            if (s->frame_type == EAC3_FRAME_TYPE_DEPENDENT || s->substreamid) {
-                av_log(avctx, AV_LOG_ERROR, "unsupported frame type : "
+                av_log(avctx, AV_LOG_WARNING, "unsupported frame type : "
                       "skipping frame\n");
                *got_frame_ptr = 0;
-                return s->frame_size;
+                return buf_size;
            } else {
                av_log(avctx, AV_LOG_ERROR, "invalid frame type\n");
            }
            break;
-        default:
-            av_log(avctx, AV_LOG_ERROR, "invalid header\n");
+        case AAC_AC3_PARSE_ERROR_CRC:
+        case AAC_AC3_PARSE_ERROR_CHANNEL_CFG:
            break;
+        default: // Normal AVERROR do not try to recover.
+            *got_frame_ptr = 0;
+            return err;
        }
    } else {
        /* check that reported frame size fits in input buffer */
@@ -1373,8 +1376,10 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
    if (!err) {
        avctx->sample_rate = s->sample_rate;
        avctx->bit_rate    = s->bit_rate;
+    }

-        /* channel config */
+    /* channel config */
+    if (!err || (s->channels && s->out_channels != s->channels)) {
        s->out_channels = s->channels;
        s->output_mode  = s->channel_mode;
        if (s->lfe_on)
@@ -1397,18 +1402,18 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
                s->fbw_channels == s->out_channels)) {
            set_downmix_coeffs(s);
        }
-    } else if (!s->out_channels) {
-        s->out_channels = avctx->channels;
-        if (s->out_channels < s->channels)
-            s->output_mode  = s->out_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO;
+    } else if (!s->channels) {
+        av_log(avctx, AV_LOG_ERROR, "unable to determine channel mode\n");
+        return AVERROR_INVALIDDATA;
    }
+    avctx->channels = s->out_channels;
+
    /* set audio service type based on bitstream mode for AC-3 */
    avctx->audio_service_type = s->bitstream_mode;
    if (s->bitstream_mode == 0x7 && s->channels > 1)
        avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE;

    /* get output buffer */
-    avctx->channels = s->out_channels;
    s->frame.nb_samples = s->num_blocks * 256;
    if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -717,7 +717,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
            src++;
            *samples++ = cs->predictor;
        }
-        for (n = nb_samples >> (1 - st); n > 0; n--, src++) {
+        for (n = (nb_samples >> (1 - st)) - 1; n > 0; n--, src++) {
            uint8_t v = *src;
            *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4  , 3);
            *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3);
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -1159,6 +1159,12 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame,
    return 0;
 }

+static inline int als_weighting(GetBitContext *gb, int k, int off)
+{
+    int idx = av_clip(decode_rice(gb, k) + off,
+                      0, FF_ARRAY_ELEMS(mcc_weightings) - 1);
+    return mcc_weightings[idx];
+}

 /** Read the channel data.
  */
@@ -1179,14 +1185,14 @@ static int read_channel_data(ALSDecContext *ctx, ALSChannelData *cd, int c)

        if (current->master_channel != c) {
            current->time_diff_flag = get_bits1(gb);
-            current->weighting[0]   = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 31)];
-            current->weighting[1]   = mcc_weightings[av_clip(decode_rice(gb, 2) + 14, 0, 31)];
-            current->weighting[2]   = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 31)];
+            current->weighting[0]   = als_weighting(gb, 1, 16);
+            current->weighting[1]   = als_weighting(gb, 2, 14);
+            current->weighting[2]   = als_weighting(gb, 1, 16);

            if (current->time_diff_flag) {
-                current->weighting[3] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 31)];
-                current->weighting[4] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 31)];
-                current->weighting[5] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 31)];
+                current->weighting[3] = als_weighting(gb, 1, 16);
+                current->weighting[4] = als_weighting(gb, 1, 16);
+                current->weighting[5] = als_weighting(gb, 1, 16);

                current->time_diff_sign  = get_bits1(gb);
                current->time_diff_index = get_bits(gb, ctx->ltp_lag_length - 3) + 3;
--- a/libavcodec/atrac3.c
+++ b/libavcodec/atrac3.c
@@ -690,7 +690,8 @@ static int decodeChannelSoundUnit (ATRAC3Context *q, GetBitContext *gb, channel_
    if (result) return result;

    pSnd->numComponents = decodeTonalComponents (gb, pSnd->components, pSnd->bandsCoded);
-    if (pSnd->numComponents == -1) return -1;
+    if (pSnd->numComponents < 0)
+        return pSnd->numComponents;

    numSubbands = decodeSpectrum (gb, pSnd->spectrum);

@@ -772,7 +773,7 @@ static int decodeFrame(ATRAC3Context *q, const uint8_t* databuf,


        /* set the bitstream reader at the start of the second Sound Unit*/
-        init_get_bits(&q->gb,ptr1,q->bits_per_frame);
+        init_get_bits(&q->gb, ptr1, (q->bytes_per_frame - i) * 8);

        /* Fill the Weighting coeffs delay buffer */
        memmove(q->weighting_delay,&(q->weighting_delay[2]),4*sizeof(int));
@@ -975,6 +976,8 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx)
    if (q->codingMode == STEREO) {
        av_log(avctx,AV_LOG_DEBUG,"Normal stereo detected.\n");
    } else if (q->codingMode == JOINT_STEREO) {
+        if (avctx->channels != 2)
+            return AVERROR_INVALIDDATA;
        av_log(avctx,AV_LOG_DEBUG,"Joint stereo detected.\n");
    } else {
        av_log(avctx,AV_LOG_ERROR,"Unknown channel coding mode %x!\n",q->codingMode);
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -679,6 +679,9 @@ static int read_dct_coeffs(GetBitContext *gb, int32_t block[64], const uint8_t *
        quant_idx = q;
    }

+    if (quant_idx >= 16)
+        return AVERROR_INVALIDDATA;
+
    quant = quant_matrices[quant_idx];

    block[0] = (block[0] * quant[0]) >> 11;
--- a/libavcodec/dca.c
+++ b/libavcodec/dca.c
@@ -804,6 +804,13 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index)
                       "Invalid channel mode %d\n", am);
                return AVERROR_INVALIDDATA;
            }
+
+            if (s->prim_channels > FF_ARRAY_ELEMS(dca_default_coeffs[0])) {
+                av_log_ask_for_sample(s->avctx, "Downmixing %d channels",
+                                      s->prim_channels);
+                return AVERROR_PATCHWELCOME;
+            }
+
            for (j = base_channel; j < s->prim_channels; j++) {
                s->downmix_coef[j][0] = dca_default_coeffs[am][j][0];
                s->downmix_coef[j][1] = dca_default_coeffs[am][j][1];
@@ -1253,6 +1260,7 @@ static int dca_subsubframe(DCAContext *s, int base_channel, int block_index)
 #endif
        } else {
            av_log(s->avctx, AV_LOG_ERROR, "Didn't get subframe DSYNC\n");
+            return AVERROR_INVALIDDATA;
        }
    }

--- a/libavcodec/dsicinav.c
+++ b/libavcodec/dsicinav.c
@@ -188,11 +188,13 @@ static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char
    while (src < src_end && dst < dst_end) {
        code = *src++;
        if (code & 0x80) {
+            if (src >= src_end)
+                break;
            len = code - 0x7F;
            memset(dst, *src++, FFMIN(len, dst_end - dst));
        } else {
            len = code + 1;
-            memcpy(dst, src, FFMIN(len, dst_end - dst));
+            memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src));
            src += len;
        }
        dst += len;
--- a/libavcodec/dsputil.c
+++ b/libavcodec/dsputil.c
@@ -1912,7 +1912,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){

 static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
    long i;
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
        long a = *(long*)(src+i);
        long b = *(long*)(dst+i);
        *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
@@ -1937,7 +1937,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
        }
    }else
 #endif
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
        long a = *(long*)(src1+i);
        long b = *(long*)(src2+i);
        *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);
--- a/libavcodec/dsputil.h
+++ b/libavcodec/dsputil.h
@@ -33,6 +33,7 @@
 #include "libavutil/intreadwrite.h"
 #include "avcodec.h"

+typedef int emuedge_linesize_type;

 //#define DEBUG
 /* dct code */
--- a/libavcodec/dxa.c
+++ b/libavcodec/dxa.c
@@ -255,6 +255,12 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
    case 5:
        c->pic.key_frame = !(compr & 1);
        c->pic.pict_type = (compr & 1) ? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;
+
+        if (!tmpptr && !c->pic.key_frame) {
+            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
        for(j = 0; j < avctx->height; j++){
            if(compr & 1){
                for(i = 0; i < avctx->width; i++)
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -451,7 +451,7 @@ static av_always_inline int encode_line(FFV1Context *s, int w,
    int run_mode=0;

    if(s->ac){
-        if(c->bytestream_end - c->bytestream < w*20){
+        if(c->bytestream_end - c->bytestream < w*35){
            av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\n");
            return -1;
        }
--- a/libavcodec/flashsv.c
+++ b/libavcodec/flashsv.c
@@ -388,6 +388,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                    }
                    s->diff_start  = get_bits(&gb, 8);
                    s->diff_height = get_bits(&gb, 8);
+                    if (s->diff_start + s->diff_height > cur_blk_height) {
+                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                    av_log(avctx, AV_LOG_DEBUG,
                           "%dx%d diff start %d height %d\n",
                           i, j, s->diff_start, s->diff_height);
--- a/libavcodec/h261dec.c
+++ b/libavcodec/h261dec.c
@@ -287,7 +287,8 @@ static int h261_decode_mb(H261Context *h){
    // Read mtype
    h->mtype = get_vlc2(&s->gb, h261_mtype_vlc.table, H261_MTYPE_VLC_BITS, 2);
    if (h->mtype < 0) {
-        av_log(s->avctx, AV_LOG_ERROR, "illegal mtype %d\n", h->mtype);
+        av_log(s->avctx, AV_LOG_ERROR, "Invalid mtype index %d\n",
+               h->mtype);
        return SLICE_ERROR;
    }
    h->mtype = h261_mtype_map[h->mtype];
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -514,7 +514,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx,
        }
    } else if (avctx->codec_tag == MKTAG('I','L','B','M')) { // interleaved
        if (avctx->pix_fmt == PIX_FMT_PAL8 || avctx->pix_fmt == PIX_FMT_GRAY8) {
-            for(y = 0; y < avctx->height; y++ ) {
+            for (y = 0; y < avctx->height && buf < buf_end; y++ ) {
                uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ];
                memset(row, 0, avctx->width);
                for (plane = 0; plane < s->bpp && buf < buf_end; plane++) {
--- a/libavcodec/imc.c
+++ b/libavcodec/imc.c
@@ -365,6 +365,10 @@ static int bit_allocation (IMCContext* q, int stream_format_code, int freebits,
        iacc += q->bandWidthT[i];
        summa += q->bandWidthT[i] * q->flcoeffs4[i];
    }
+
+    if (!iacc)
+        return AVERROR_INVALIDDATA;
+
    q->bandWidthT[BANDS-1] = 0;
    summa = (summa * 0.5 - freebits) / iacc;

--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -354,6 +354,12 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                av_log(avctx, AV_LOG_ERROR, "Custom scan pattern encountered!\n");
                return AVERROR_INVALIDDATA;
            }
+            if (scan_indx > 4 && scan_indx < 10) {
+                if (band->blk_size != 4)
+                    return AVERROR_INVALIDDATA;
+            } else if (band->blk_size != 8)
+                return AVERROR_INVALIDDATA;
+
            band->scan = scan_index_to_tab[scan_indx];

            band->quant_mat = get_bits(&ctx->gb, 5);
@@ -361,6 +367,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n");
                return AVERROR_INVALIDDATA;
            }
+            if (band->quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) {
+                av_log_ask_for_sample(avctx, "Quantization matrix %d",
+                                      band->quant_mat);
+                return AVERROR_INVALIDDATA;
+            }
        }

        /* decode block huffman codebook */
@@ -463,7 +474,7 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
                }

                mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
-                if (band->inherit_mv) {
+                if (band->inherit_mv && ref_mb) {
                    /* motion vector inheritance */
                    if (mv_scale) {
                        mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
@@ -475,7 +486,10 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
                }
            } else {
                if (band->inherit_mv) {
-                    mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
+                    /* copy mb_type from corresponding reference mb */
+                    if (!ref_mb)
+                        return AVERROR_INVALIDDATA;
+                    mb->type = ref_mb->type;
                } else if (ctx->frame_type == FRAMETYPE_INTRA) {
                    mb->type = 0; /* mb_type is always INTRA for intra-frames */
                } else {
@@ -498,14 +512,15 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
                    mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
                } else {
                    if (band->inherit_mv) {
-                        /* motion vector inheritance */
-                        if (mv_scale) {
-                            mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
-                            mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
-                        } else {
-                            mb->mv_x = ref_mb->mv_x;
-                            mb->mv_y = ref_mb->mv_y;
-                        }
+                        if (ref_mb)
+                            /* motion vector inheritance */
+                            if (mv_scale) {
+                                mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
+                                mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
+                            } else {
+                                mb->mv_x = ref_mb->mv_x;
+                                mb->mv_y = ref_mb->mv_y;
+                            }
                    } else {
                        /* decode motion vector deltas */
                        mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -74,7 +74,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
    tile_size = (ctx->gop_flags & 0x40) ? 64 << get_bits(&ctx->gb, 2) : 0;
    if (tile_size > 256) {
        av_log(avctx, AV_LOG_ERROR, "Invalid tile size: %d\n", tile_size);
-        return -1;
+        return AVERROR_INVALIDDATA;
    }

    /* decode number of wavelet bands */
@@ -85,7 +85,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
    if (is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
        av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
               pic_conf.luma_bands, pic_conf.chroma_bands);
-        return -1;
+        return AVERROR_INVALIDDATA;
    }

    pic_size_indx = get_bits(&ctx->gb, 4);
@@ -98,8 +98,8 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
    }

    if (ctx->gop_flags & 2) {
-        av_log(avctx, AV_LOG_ERROR, "YV12 picture format not supported!\n");
-        return -1;
+        av_log_missing_feature(avctx, "YV12 picture format", 0);
+        return AVERROR_PATCHWELCOME;
    }

    pic_conf.chroma_height = (pic_conf.pic_height + 3) >> 2;
@@ -115,9 +115,9 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
    /* check if picture layout was changed and reallocate buffers */
    if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
        result = ff_ivi_init_planes(ctx->planes, &pic_conf);
-        if (result) {
+        if (result < 0) {
            av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
-            return -1;
+            return result;
        }
        ctx->pic_conf = pic_conf;
        ctx->is_scalable = is_scalable;
@@ -141,8 +141,8 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
            }

            if (get_bits1(&ctx->gb)) {
-                av_log(avctx, AV_LOG_ERROR, "Extended transform info encountered!\n");
-                return -1;
+                av_log_missing_feature(avctx, "Extended transform info", 0);
+                return AVERROR_PATCHWELCOME;
            }

            /* select transform function and scan pattern according to plane and band number */
@@ -206,7 +206,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)

            if (get_bits(&ctx->gb, 2)) {
                av_log(avctx, AV_LOG_ERROR, "End marker missing!\n");
-                return -1;
+                return AVERROR_INVALIDDATA;
            }
        }
    }
@@ -235,17 +235,17 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
    if (blk_size_changed) {
        result = ff_ivi_init_tiles(ctx->planes, pic_conf.tile_width,
                                   pic_conf.tile_height);
-        if (result) {
+        if (result < 0) {
            av_log(avctx, AV_LOG_ERROR,
                   "Couldn't reallocate internal structures!\n");
-            return -1;
+            return result;
        }
    }

    if (ctx->gop_flags & 8) {
        if (get_bits(&ctx->gb, 3)) {
            av_log(avctx, AV_LOG_ERROR, "Alignment bits are not zero!\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
        }

        if (get_bits1(&ctx->gb))
@@ -294,25 +294,27 @@ static inline void skip_hdr_extension(GetBitContext *gb)
 */
 static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
 {
+    int ret;
+
    if (get_bits(&ctx->gb, 5) != 0x1F) {
        av_log(avctx, AV_LOG_ERROR, "Invalid picture start code!\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
    }

    ctx->prev_frame_type = ctx->frame_type;
    ctx->frame_type      = get_bits(&ctx->gb, 3);
    if (ctx->frame_type >= 5) {
        av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d \n", ctx->frame_type);
-        return -1;
+        return AVERROR_INVALIDDATA;
    }

    ctx->frame_num = get_bits(&ctx->gb, 8);

    if (ctx->frame_type == FRAMETYPE_INTRA) {
        ctx->gop_invalid = 1;
-        if (decode_gop_header(ctx, avctx)) {
+        if ((ret = decode_gop_header(ctx, avctx)) < 0) {
            av_log(avctx, AV_LOG_ERROR, "Invalid GOP header, skipping frames.\n");
-            return AVERROR_INVALIDDATA;
+            return ret;
        }
        ctx->gop_invalid = 0;
    }
@@ -329,8 +331,10 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
            skip_hdr_extension(&ctx->gb); /* XXX: untested */

        /* decode macroblock huffman codebook */
-        if (ff_ivi_dec_huff_desc(&ctx->gb, ctx->frame_flags & 0x40, IVI_MB_HUFF, &ctx->mb_vlc, avctx))
-            return -1;
+        ret = ff_ivi_dec_huff_desc(&ctx->gb, ctx->frame_flags & 0x40,
+                                   IVI_MB_HUFF, &ctx->mb_vlc, avctx);
+        if (ret < 0)
+            return ret;

        skip_bits(&ctx->gb, 3); /* FIXME: unknown meaning! */
    }
@@ -352,7 +356,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
 static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                           AVCodecContext *avctx)
 {
-    int         i;
+    int         i, ret;
    uint8_t     band_flags;

    band_flags = get_bits(&ctx->gb, 8);
@@ -376,7 +380,7 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
        if (band->num_corr > 61) {
            av_log(avctx, AV_LOG_ERROR, "Too many corrections: %d\n",
                   band->num_corr);
-            return -1;
+            return AVERROR_INVALIDDATA;
        }

        /* read correction pairs */
@@ -388,8 +392,10 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
    band->rvmap_sel = (band_flags & 0x40) ? get_bits(&ctx->gb, 3) : 8;

    /* decode block huffman codebook */
-    if (ff_ivi_dec_huff_desc(&ctx->gb, band_flags & 0x80, IVI_BLK_HUFF, &band->blk_vlc, avctx))
-        return -1;
+    ret = ff_ivi_dec_huff_desc(&ctx->gb, band_flags & 0x80, IVI_BLK_HUFF,
+                               &band->blk_vlc, avctx);
+    if (ret < 0)
+        return ret;

    band->checksum_present = get_bits1(&ctx->gb);
    if (band->checksum_present)
@@ -456,7 +462,7 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
            if (get_bits1(&ctx->gb)) {
                if (ctx->frame_type == FRAMETYPE_INTRA) {
                    av_log(avctx, AV_LOG_ERROR, "Empty macroblock in an INTRA picture!\n");
-                    return -1;
+                    return AVERROR_INVALIDDATA;
                }
                mb->type = 1; /* empty macroblocks are always INTER */
                mb->cbp  = 0; /* all blocks are empty */
@@ -622,7 +628,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
    result = ff_ivi_init_planes(ctx->planes, &ctx->pic_conf);
    if (result) {
        av_log(avctx, AV_LOG_ERROR, "Couldn't allocate color planes!\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
    }

    ctx->buf_switch = 0;
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -822,6 +822,14 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
                }
            }
        }
+    } else {
+        if (ctx->is_scalable)
+            return AVERROR_INVALIDDATA;
+
+        for (p = 0; p < 3; p++) {
+            if (!ctx->planes[p].bands[0].buf)
+                return AVERROR_INVALIDDATA;
+        }
    }

    //STOP_TIMER("decode_planes"); }
--- a/libavcodec/j2kdec.c
+++ b/libavcodec/j2kdec.c
@@ -28,6 +28,7 @@
 #include "avcodec.h"
 #include "bytestream.h"
 #include "j2k.h"
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"

 #define JP2_SIG_TYPE    0x6A502020
@@ -289,6 +290,10 @@ static int get_cox(J2kDecoderContext *s, J2kCodingStyle *c)
     c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width
    c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height

+    if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
+        return AVERROR_PATCHWELCOME;
+    }
+
    c->cblk_style = bytestream_get_byte(&s->buf);
    if (c->cblk_style != 0){ // cblk style
        av_log(s->avctx, AV_LOG_WARNING, "extra cblk styles %X\n", c->cblk_style);
@@ -705,6 +710,9 @@ static int decode_cblk(J2kDecoderContext *s, J2kCodingStyle *codsty, J2kT1Contex
    int bpass_csty_symbol = J2K_CBLK_BYPASS & codsty->cblk_style;
    int vert_causal_ctx_csty_symbol = J2K_CBLK_VSC & codsty->cblk_style;

+    av_assert0(width  <= J2K_MAX_CBLKW);
+    av_assert0(height <= J2K_MAX_CBLKH);
+
    for (y = 0; y < height+2; y++)
        memset(t1->flags[y], 0, (width+2)*sizeof(int));

--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -255,6 +255,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
    if (nb_components <= 0 ||
        nb_components > MAX_COMPONENTS)
        return -1;
+    if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) {
+        if (nb_components != s->nb_components) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "nb_components changing in interlaced picture\n");
+            return AVERROR_INVALIDDATA;
+        }
+    }
    if (s->ls && !(s->bits <= 8 || nb_components == 1)) {
        av_log(s->avctx, AV_LOG_ERROR,
               "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n");
@@ -712,6 +719,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
    int resync_mb_y = 0;
    int resync_mb_x = 0;

+    if (s->nb_components != 3 && s->nb_components != 4)
+        return AVERROR_INVALIDDATA;
+    if (s->v_max != 1 || s->h_max != 1 || !s->lossless)
+        return AVERROR_INVALIDDATA;
+
+
    s->restart_count = s->restart_interval;

    av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size,
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -369,9 +369,10 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
    uint8_t checksum;
    uint8_t lossless_check;
    int start_count = get_bits_count(gbp);
-    const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP
-                                 ? MAX_MATRIX_CHANNEL_MLP
-                                 : MAX_MATRIX_CHANNEL_TRUEHD;
+    int min_channel, max_channel, max_matrix_channel;
+    const int std_max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP
+                                     ? MAX_MATRIX_CHANNEL_MLP
+                                     : MAX_MATRIX_CHANNEL_TRUEHD;

    sync_word = get_bits(gbp, 13);

@@ -390,18 +391,18 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,

    skip_bits(gbp, 16); /* Output timestamp */

-    s->min_channel        = get_bits(gbp, 4);
-    s->max_channel        = get_bits(gbp, 4);
-    s->max_matrix_channel = get_bits(gbp, 4);
+    min_channel        = get_bits(gbp, 4);
+    max_channel        = get_bits(gbp, 4);
+    max_matrix_channel = get_bits(gbp, 4);

-    if (s->max_matrix_channel > max_matrix_channel) {
+    if (max_matrix_channel > std_max_matrix_channel) {
        av_log(m->avctx, AV_LOG_ERROR,
               "Max matrix channel cannot be greater than %d.\n",
               max_matrix_channel);
        return AVERROR_INVALIDDATA;
    }

-    if (s->max_channel != s->max_matrix_channel) {
+    if (max_channel != max_matrix_channel) {
        av_log(m->avctx, AV_LOG_ERROR,
               "Max channel must be equal max matrix channel.\n");
        return AVERROR_INVALIDDATA;
@@ -416,15 +417,20 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
        return AVERROR_INVALIDDATA;
    }

-    if (s->min_channel > s->max_channel) {
+    if (min_channel > max_channel) {
        av_log(m->avctx, AV_LOG_ERROR,
               "Substream min channel cannot be greater than max channel.\n");
        return AVERROR_INVALIDDATA;
    }

-    if (m->avctx->request_channels > 0
-        && s->max_channel + 1 >= m->avctx->request_channels
-        && substr < m->max_decoded_substream) {
+
+    s->min_channel        = min_channel;
+    s->max_channel        = max_channel;
+    s->max_matrix_channel = max_matrix_channel;
+
+    if (m->avctx->request_channels > 0 &&
+        m->avctx->request_channels <= s->max_channel + 1 &&
+        m->max_decoded_substream > substr) {
        av_log(m->avctx, AV_LOG_DEBUG,
               "Extracting %d channel downmix from substream %d. "
               "Further substreams will be skipped.\n",
--- a/libavcodec/mpegvideo_common.h
+++ b/libavcodec/mpegvideo_common.h
@@ -244,7 +244,8 @@ void mpeg_motion_internal(MpegEncContext *s,
 {
    uint8_t *ptr_y, *ptr_cb, *ptr_cr;
    int dxy, uvdxy, mx, my, src_x, src_y,
-        uvsrc_x, uvsrc_y, v_edge_pos, uvlinesize, linesize;
+        uvsrc_x, uvsrc_y, v_edge_pos;
+    emuedge_linesize_type uvlinesize, linesize;

 #if 0
 if(s->quarter_sample)
--- a/libavcodec/parser.c
+++ b/libavcodec/parser.c
@@ -241,8 +241,10 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
    if(next == END_NOT_FOUND){
        void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);

-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->index = 0;
            return AVERROR(ENOMEM);
+        }
        pc->buffer = new_buffer;
        memcpy(&pc->buffer[pc->index], *buf, *buf_size);
        pc->index += *buf_size;
@@ -255,9 +257,11 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s
    /* append to buffer */
    if(pc->index){
        void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE);
-
-        if(!new_buffer)
+        if(!new_buffer) {
+            pc->overread_index =
+            pc->index = 0;
            return AVERROR(ENOMEM);
+        }
        pc->buffer = new_buffer;
        if (next > -FF_INPUT_BUFFER_PADDING_SIZE)
            memcpy(&pc->buffer[pc->index], *buf,
--- a/libavcodec/pcm.c
+++ b/libavcodec/pcm.c
@@ -268,7 +268,7 @@ static int pcm_decode_frame(AVCodecContext *avctx, void *data,

    /* av_get_bits_per_sample returns 0 for CODEC_ID_PCM_DVD */
    samples_per_block = 1;
-    if (CODEC_ID_PCM_DVD == avctx->codec_id) {
+    if (avctx->codec->id == CODEC_ID_PCM_DVD) {
        if (avctx->bits_per_coded_sample != 20 &&
            avctx->bits_per_coded_sample != 24) {
            av_log(avctx, AV_LOG_ERROR,
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -43,16 +43,19 @@ static av_cold int pcx_init(AVCodecContext *avctx) {
 /**
 * @return advanced src pointer
 */
-static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
-                            unsigned int bytes_per_scanline, int compressed) {
+static const uint8_t *pcx_rle_decode(const uint8_t *src,
+                                     const uint8_t *end,
+                                     uint8_t *dst,
+                                     unsigned int bytes_per_scanline,
+                                     int compressed) {
    unsigned int i = 0;
    unsigned char run, value;

    if (compressed) {
-        while (i<bytes_per_scanline) {
+        while (i < bytes_per_scanline && src < end) {
            run = 1;
            value = *src++;
-            if (value >= 0xc0) {
+            if (value >= 0xc0 && src < end) {
                run = value & 0x3f;
                value = *src++;
            }
@@ -87,6 +90,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
    unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x,
                 bytes_per_scanline;
    uint8_t *ptr;
+    const uint8_t *buf_end = buf + buf_size;
    uint8_t const *bufstart = buf;
    uint8_t *scanline;
    int ret = -1;
@@ -115,7 +119,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
    nplanes            = buf[65];
    bytes_per_scanline = nplanes * bytes_per_line;

-    if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) {
+    if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 ||
+        (!compressed && bytes_per_scanline > buf_size / h)) {
        av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
        return -1;
    }
@@ -163,7 +168,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,

    if (nplanes == 3 && bits_per_pixel == 8) {
        for (y=0; y<h; y++) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);

            for (x=0; x<w; x++) {
                ptr[3*x  ] = scanline[x                    ];
@@ -178,7 +184,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
        const uint8_t *palstart = bufstart + buf_size - 769;

        for (y=0; y<h; y++, ptr+=stride) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);
            memcpy(ptr, scanline, w);
        }

@@ -197,7 +204,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
        for (y=0; y<h; y++) {
            init_get_bits(&s, scanline, bytes_per_scanline<<3);

-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);

            for (x=0; x<w; x++)
                ptr[x] = get_bits(&s, bits_per_pixel);
@@ -208,7 +216,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
        int i;

        for (y=0; y<h; y++) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);

            for (x=0; x<w; x++) {
                int m = 0x80 >> (x&7), v = 0;
--- a/libavcodec/pictordec.c
+++ b/libavcodec/pictordec.c
@@ -235,6 +235,8 @@ static int decode_frame(AVCodecContext *avctx,

                if (bits_per_plane == 8) {
                    picmemset_8bpp(s, val, run, &x, &y);
+                    if (y < 0)
+                        goto finish;
                } else {
                    picmemset(s, val, run, &x, &y, &plane, bits_per_plane);
                }
@@ -247,6 +249,7 @@ static int decode_frame(AVCodecContext *avctx,
            y--;
        }
    }
+finish:

    *data_size = sizeof(AVFrame);
    *(AVFrame*)data = s->frame;
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -121,7 +121,7 @@ static void png_put_interlaced_row(uint8_t *dst, int width,
 static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w)
 {
    long i;
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
        long a = *(long*)(src1+i);
        long b = *(long*)(src2+i);
        *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -498,7 +498,8 @@ static void build_sb_samples_from_noise (QDM2Context *q, int sb)
 * @param channels         number of channels
 * @param coding_method    q->coding_method[0][0][0]
 */
-static void fix_coding_method_array (int sb, int channels, sb_int8_array coding_method)
+static int fix_coding_method_array(int sb, int channels,
+                                   sb_int8_array coding_method)
 {
    int j,k;
    int ch;
@@ -507,8 +508,10 @@ static void fix_coding_method_array (int sb, int channels, sb_int8_array coding_

    for (ch = 0; ch < channels; ch++) {
        for (j = 0; j < 64; ) {
-            if((coding_method[ch][sb][j] - 8) > 22) {
-                run = 1;
+            if (coding_method[ch][sb][j] < 8)
+                return -1;
+            if ((coding_method[ch][sb][j] - 8) > 22) {
+                run      = 1;
                case_val = 8;
            } else {
                switch (switchtable[coding_method[ch][sb][j]-8]) {
@@ -533,6 +536,7 @@ static void fix_coding_method_array (int sb, int channels, sb_int8_array coding_
            j += run;
        }
    }
+    return 0;
 }


@@ -769,7 +773,7 @@ static void fill_coding_method_array (sb_int8_array tone_level_idx, sb_int8_arra
 static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int length, int sb_min, int sb_max)
 {
    int sb, j, k, n, ch, run, channels;
-    int joined_stereo, zero_encoding, chs;
+    int joined_stereo, zero_encoding;
    int type34_first;
    float type34_div = 0;
    float type34_predictor;
@@ -784,8 +788,6 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
    }

    for (sb = sb_min; sb < sb_max; sb++) {
-        FIX_NOISE_IDX(q->noise_idx);
-
        channels = q->nb_channels;

        if (q->nb_channels <= 1 || sb < 12)
@@ -804,11 +806,16 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
                if (q->coding_method[1][sb][j] > q->coding_method[0][sb][j])
                    q->coding_method[0][sb][j] = q->coding_method[1][sb][j];

-            fix_coding_method_array(sb, q->nb_channels, q->coding_method);
+            if (fix_coding_method_array(sb, q->nb_channels,
+                                            q->coding_method)) {
+                build_sb_samples_from_noise(q, sb);
+                continue;
+            }
            channels = 1;
        }

        for (ch = 0; ch < channels; ch++) {
+            FIX_NOISE_IDX(q->noise_idx);
            zero_encoding = (BITS_LEFT(length,gb) >= 1) ? get_bits1(gb) : 0;
            type34_predictor = 0.0;
            type34_first = 1;
@@ -924,16 +931,18 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
                }

                if (joined_stereo) {
-                    float tmp[10][MPA_MAX_CHANNELS];
-
-                    for (k = 0; k < run; k++) {
-                        tmp[k][0] = samples[k];
-                        tmp[k][1] = (sign_bits[(j + k) / 8]) ? -samples[k] : samples[k];
+                    for (k = 0; k < run && j + k < 128; k++) {
+                        q->sb_samples[0][j + k][sb] =
+                            q->tone_level[0][sb][(j + k) / 2] * samples[k];
+                        if (q->nb_channels == 2) {
+                            if (sign_bits[(j + k) / 8])
+                                q->sb_samples[1][j + k][sb] =
+                                    q->tone_level[1][sb][(j + k) / 2] * -samples[k];
+                            else
+                                q->sb_samples[1][j + k][sb] =
+                                    q->tone_level[1][sb][(j + k) / 2] * samples[k];
+                        }
                    }
-                    for (chs = 0; chs < q->nb_channels; chs++)
-                        for (k = 0; k < run; k++)
-                            if ((j + k) < 128)
-                                q->sb_samples[chs][j + k][sb] = q->tone_level[chs][sb][((j + k)/2)] * tmp[k][chs];
                } else {
                    for (k = 0; k < run; k++)
                        if ((j + k) < 128)
--- a/libavcodec/rpza.c
+++ b/libavcodec/rpza.c
@@ -83,7 +83,7 @@ static void rpza_decode_stream(RpzaContext *s)
    unsigned short *pixels = (unsigned short *)s->frame.data[0];

    int row_ptr = 0;
-    int pixel_ptr = 0;
+    int pixel_ptr = -4;
    int block_ptr;
    int pixel_x, pixel_y;
    int total_blocks;
@@ -139,6 +139,7 @@ static void rpza_decode_stream(RpzaContext *s)
            colorA = AV_RB16 (&s->buf[stream_ptr]);
            stream_ptr += 2;
            while (n_blocks--) {
+                ADVANCE_BLOCK()
                block_ptr = row_ptr + pixel_ptr;
                for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                    for (pixel_x = 0; pixel_x < 4; pixel_x++){
@@ -147,7 +148,6 @@ static void rpza_decode_stream(RpzaContext *s)
                    }
                    block_ptr += row_inc;
                }
-                ADVANCE_BLOCK();
            }
            break;

@@ -186,6 +186,7 @@ static void rpza_decode_stream(RpzaContext *s)
            if (s->size - stream_ptr < n_blocks * 4)
                return;
            while (n_blocks--) {
+                ADVANCE_BLOCK();
                block_ptr = row_ptr + pixel_ptr;
                for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                    index = s->buf[stream_ptr++];
@@ -196,7 +197,6 @@ static void rpza_decode_stream(RpzaContext *s)
                    }
                    block_ptr += row_inc;
                }
-                ADVANCE_BLOCK();
            }
            break;

@@ -204,6 +204,7 @@ static void rpza_decode_stream(RpzaContext *s)
        case 0x00:
            if (s->size - stream_ptr < 16)
                return;
+            ADVANCE_BLOCK();
            block_ptr = row_ptr + pixel_ptr;
            for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                for (pixel_x = 0; pixel_x < 4; pixel_x++){
@@ -217,7 +218,6 @@ static void rpza_decode_stream(RpzaContext *s)
                }
                block_ptr += row_inc;
            }
-            ADVANCE_BLOCK();
            break;

        /* Unknown opcode */
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -903,14 +903,14 @@ static av_cold int decode_init(AVCodecContext *avctx){
    if (!l->Y1_base || !l->Y2_base || !l->U1_base ||
        !l->V1_base || !l->U2_base || !l->V2_base ||
        !l->last    || !l->clast) {
-        av_freep(l->Y1_base);
-        av_freep(l->Y2_base);
-        av_freep(l->U1_base);
-        av_freep(l->U2_base);
-        av_freep(l->V1_base);
-        av_freep(l->V2_base);
-        av_freep(l->last);
-        av_freep(l->clast);
+        av_freep(&l->Y1_base);
+        av_freep(&l->Y2_base);
+        av_freep(&l->U1_base);
+        av_freep(&l->U2_base);
+        av_freep(&l->V1_base);
+        av_freep(&l->V2_base);
+        av_freep(&l->last);
+        av_freep(&l->clast);
        return AVERROR(ENOMEM);
    }
    l->Y1 = l->Y1_base + l->y_stride  * 4 + 4;
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -395,6 +395,11 @@ static void vc1_mc_1mv(VC1Context *v, int dir)
        }
    }

+    if (!srcY || !srcU) {
+        av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n");
+        return;
+    }
+
    src_x   = s->mb_x * 16 + (mx   >> 2);
    src_y   = s->mb_y * 16 + (my   >> 2);
    uvsrc_x = s->mb_x *  8 + (uvmx >> 2);
@@ -570,6 +575,11 @@ static void vc1_mc_4mv_luma(VC1Context *v, int n, int dir)
    } else
        srcY = s->next_picture.f.data[0];

+    if (!srcY) {
+        av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n");
+        return;
+    }
+
    if (v->field_mode) {
        if (v->cur_field_type != v->ref_field_type[dir])
            my = my - 2 + 4 * v->cur_field_type;
@@ -856,6 +866,11 @@ static void vc1_mc_4mv_chroma(VC1Context *v, int dir)
        srcV = s->next_picture.f.data[2] + uvsrc_y * s->uvlinesize + uvsrc_x;
    }

+    if (!srcU) {
+        av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n");
+        return;
+    }
+
    if (v->field_mode) {
        if (chroma_ref_type) {
            srcU += s->current_picture_ptr->f.linesize[1];
@@ -3949,7 +3964,7 @@ static int vc1_decode_p_mb_intfi(VC1Context *v)
        s->current_picture.f.mb_type[mb_pos + v->mb_off] = MB_TYPE_16x16;
        for (i = 0; i < 6; i++) v->mb_type[0][s->block_index[i]] = 0;
        if (idx_mbmode <= 5) { // 1-MV
-            dmv_x = dmv_y = 0;
+            dmv_x = dmv_y = pred_flag = 0;
            if (idx_mbmode & 1) {
                get_mvdata_interlaced(v, &dmv_x, &dmv_y, &pred_flag);
            }
@@ -5569,6 +5584,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
            v->mv_f[1] = tmp[1];
        }
        mb_height = s->mb_height >> v->field_mode;
+
+        if (!mb_height) {
+            av_log(v->s.avctx, AV_LOG_ERROR, "Invalid mb_height.\n");
+            goto err;
+        }
+
        for (i = 0; i <= n_slices; i++) {
            if (i > 0 &&  slices[i - 1].mby_start >= mb_height) {
                if (v->field_mode <= 0) {
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -134,9 +134,16 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)

    /* load up the VQA parameters from the header */
    s->vqa_version = s->avctx->extradata[0];
-    if (s->vqa_version < 1 || s->vqa_version > 3) {
-        av_log(s->avctx, AV_LOG_ERROR, "  VQA video: unsupported version %d\n", s->vqa_version);
-        return -1;
+    switch (s->vqa_version) {
+    case 1:
+    case 2:
+        break;
+    case 3:
+        av_log_missing_feature(avctx, "VQA Version 3", 0);
+        return AVERROR_PATCHWELCOME;
+    default:
+        av_log_missing_feature(avctx, "VQA Version", 1);
+        return AVERROR_PATCHWELCOME;
    }
    s->width = AV_RL16(&s->avctx->extradata[6]);
    s->height = AV_RL16(&s->avctx->extradata[8]);
--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -534,6 +534,10 @@ static int wma_decode_block(WMACodecContext *s)
       coef escape coding */
    total_gain = 1;
    for(;;) {
+        if (get_bits_left(&s->gb) < 7) {
+            av_log(s->avctx, AV_LOG_ERROR, "total_gain overread\n");
+            return AVERROR_INVALIDDATA;
+        }
        a = get_bits(&s->gb, 7);
        total_gain += a;
        if (a != 127)
--- a/libavcodec/wmavoice.c
+++ b/libavcodec/wmavoice.c
@@ -1046,9 +1046,10 @@ static void aw_parse_coords(WMAVoiceContext *s, GetBitContext *gb,
 * @param gb bit I/O context
 * @param block_idx block index in frame [0, 1]
 * @param fcb structure containing fixed codebook vector info
+ * @return -1 on error, 0 otherwise
 */
-static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb,
-                          int block_idx, AMRFixed *fcb)
+static int aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb,
+                         int block_idx, AMRFixed *fcb)
 {
    uint16_t use_mask_mem[9]; // only 5 are used, rest is padding
    uint16_t *use_mask = use_mask_mem + 2;
@@ -1110,7 +1111,7 @@ static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb,
            else if (use_mask[2]) idx = 0x2F;
            else if (use_mask[3]) idx = 0x3F;
            else if (use_mask[4]) idx = 0x4F;
-            else                  return;
+            else return -1;
            idx -= av_log2_16bit(use_mask[idx >> 4]);
        }
        if (use_mask[idx >> 4] & (0x8000 >> (idx & 15))) {
@@ -1127,6 +1128,7 @@ static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb,
    /* set offset for next block, relative to start of that block */
    n = (MAX_FRAMESIZE / 2 - start_off) % fcb->pitch_lag;
    s->aw_next_pulse_off_cache = n ? fcb->pitch_lag - n : 0;
+    return 0;
 }

 /**
@@ -1289,7 +1291,18 @@ static void synth_block_fcb_acb(WMAVoiceContext *s, GetBitContext *gb,
     * (fixed) codebook pulses of the speech signal. */
    if (frame_desc->fcb_type == FCB_TYPE_AW_PULSES) {
        aw_pulse_set1(s, gb, block_idx, &fcb);
-        aw_pulse_set2(s, gb, block_idx, &fcb);
+        if (aw_pulse_set2(s, gb, block_idx, &fcb)) {
+            /* Conceal the block with silence and return.
+             * Skip the correct amount of bits to read the next
+             * block from the correct offset. */
+            int r_idx = pRNG(s->frame_cntr, block_idx, size);
+
+            for (n = 0; n < size; n++)
+                excitation[n] =
+                    wmavoice_std_codebook[r_idx + n] * s->silence_gain;
+            skip_bits(gb, 7 + 1);
+            return;
+        }
    } else /* FCB_TYPE_EXC_PULSES */ {
        int offset_nbits = 5 - frame_desc->log_n_blocks;

--- a/libavcodec/xl.c
+++ b/libavcodec/xl.c
@@ -69,6 +69,11 @@ static int decode_frame(AVCodecContext *avctx,

    stride = avctx->width - 4;

+    if (avctx->width % 4) {
+        av_log(avctx, AV_LOG_ERROR, "Width not a multiple of 4.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
    if (buf_size < avctx->width * avctx->height) {
        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
        return AVERROR_INVALIDDATA;
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -276,7 +276,9 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
        ape->seektable = av_malloc(ape->seektablelength);
        if (!ape->seektable)
            return AVERROR(ENOMEM);
-        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
+        for (i = 0;
+             i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached;
+             i++)
            ape->seektable[i] = avio_rl32(pb);
    }else{
        av_log(s, AV_LOG_ERROR, "Missing seektable\n");
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -980,9 +980,12 @@ start_sync:
            }


-            if(   (st->discard >= AVDISCARD_DEFAULT && size==0)
-               /*|| (st->discard >= AVDISCARD_NONKEY && !(pkt->flags & AV_PKT_FLAG_KEY))*/ //FIXME needs a little reordering
-               || st->discard >= AVDISCARD_ALL){
+            if (!avi->dv_demux &&
+                ((st->discard >= AVDISCARD_DEFAULT && size==0) /* ||
+                //FIXME needs a little reordering
+                (st->discard >= AVDISCARD_NONKEY &&
+                 !(pkt->flags & AV_PKT_FLAG_KEY)) */
+                || st->discard >= AVDISCARD_ALL)) {
                if (!exit_early) {
                    ast->frame_offset += get_duration(ast, size);
                    avio_skip(pb, size);
@@ -1280,7 +1283,7 @@ static int avi_read_idx1(AVFormatContext *s, int size)
        st = s->streams[index];
        ast = st->priv_data;

-        if(first_packet && first_packet_pos && len) {
+        if (first_packet && first_packet_pos) {
            data_offset = first_packet_pos - pos;
            first_packet = 0;
        }
--- a/libavformat/avio.c
+++ b/libavformat/avio.c
@@ -359,7 +359,7 @@ static inline int retry_transfer_wrapper(URLContext *h, unsigned char *buf, int
            else
                usleep(1000);
        } else if (ret < 1)
-            return ret < 0 ? ret : len;
+            return (ret < 0 && ret != AVERROR_EOF) ? ret : len;
        if (ret)
           fast_retries = FFMAX(fast_retries, 2);
        len += ret;
--- a/libavformat/dv.c
+++ b/libavformat/dv.c
@@ -106,7 +106,7 @@ static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)
 * 3. Audio is always returned as 16bit linear samples: 12bit nonlinear samples
 *    are converted into 16bit linear ones.
 */
-static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
+static int dv_extract_audio(uint8_t *frame, uint8_t **ppcm,
                            const DVprofile *sys)
 {
    int size, chan, i, j, d, of, smpls, freq, quant, half_ch;
@@ -374,7 +374,7 @@ int avpriv_dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,
                      uint8_t* buf, int buf_size, int64_t pos)
 {
    int size, i;
-    uint8_t *ppcm[4] = {0};
+    uint8_t *ppcm[5] = { 0 };

    if (buf_size < DV_PROFILE_BYTES ||
        !(c->sys = avpriv_dv_frame_profile(c->sys, buf, buf_size)) ||
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1114,7 +1114,8 @@ static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
    int i;

    for (i=0; i < list->nb_elem; i++) {
-        const char *lang = strcmp(tags[i].lang, "und") ? tags[i].lang : NULL;
+        const char *lang = tags[i].lang && strcmp(tags[i].lang, "und") ?
+                           tags[i].lang : NULL;

        if (!tags[i].name) {
            av_log(s, AV_LOG_WARNING, "Skipping invalid tag with no TagName.\n");
@@ -2074,10 +2075,11 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
        if (tracks[i].type == MATROSKA_TRACK_TYPE_SUBTITLE
            && !tracks[i].stream->discard != AVDISCARD_ALL) {
            index_sub = av_index_search_timestamp(tracks[i].stream, st->index_entries[index].timestamp, AVSEEK_FLAG_BACKWARD);
-            if (index_sub >= 0
-                && st->index_entries[index_sub].pos < st->index_entries[index_min].pos
-                && st->index_entries[index].timestamp - st->index_entries[index_sub].timestamp < 30000000000/matroska->time_scale)
-                index_min = index_sub;
+            while(index_sub >= 0
+                  && index_min >= 0
+                  && tracks[i].stream->index_entries[index_sub].pos < st->index_entries[index_min].pos
+                  && st->index_entries[index].timestamp - tracks[i].stream->index_entries[index_sub].timestamp < 30000000000/matroska->time_scale)
+                index_min--;
        }
    }

--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -754,6 +754,11 @@ static int mov_read_mdhd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
    st = c->fc->streams[c->fc->nb_streams-1];
    sc = st->priv_data;

+    if (sc->time_scale) {
+        av_log(c->fc, AV_LOG_ERROR, "Multiple mdhd?\n");
+        return AVERROR_INVALIDDATA;
+    }
+
    version = avio_r8(pb);
    if (version > 1) {
        av_log_ask_for_sample(c, "unsupported version %d\n", version);
--- a/libavformat/oggparsevorbis.c
+++ b/libavformat/oggparsevorbis.c
@@ -208,15 +208,15 @@ vorbis_header (AVFormatContext * s, int idx)
    struct oggvorbis_private *priv;
    int pkt_type = os->buf[os->pstart];

-    if (!(pkt_type & 1))
-        return 0;
-
    if (!os->private) {
        os->private = av_mallocz(sizeof(struct oggvorbis_private));
        if (!os->private)
            return 0;
    }

+    if (!(pkt_type & 1))
+        return 0;
+
    if (os->psize < 1 || pkt_type > 5)
        return -1;

--- a/libavformat/segafilm.c
+++ b/libavformat/segafilm.c
@@ -211,6 +211,8 @@ static int film_read_header(AVFormatContext *s,
        film->sample_table[i].sample_offset =
            data_offset + AV_RB32(&scratch[0]);
        film->sample_table[i].sample_size = AV_RB32(&scratch[4]);
+        if (film->sample_table[i].sample_size > INT_MAX / 4)
+            return AVERROR_INVALIDDATA;
        if (AV_RB32(&scratch[8]) == 0xFFFFFFFF) {
            film->sample_table[i].stream = film->audio_stream_index;
            film->sample_table[i].pts = audio_frame_counter;
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2057,8 +2057,13 @@ static void estimate_timings_from_bit_rate(AVFormatContext *ic)
        bit_rate = 0;
        for(i=0;i<ic->nb_streams;i++) {
            st = ic->streams[i];
-            if (st->codec->bit_rate > 0)
-            bit_rate += st->codec->bit_rate;
+            if (st->codec->bit_rate > 0) {
+                if (INT_MAX - st->codec->bit_rate < bit_rate) {
+                    bit_rate = 0;
+                    break;
+                }
+                bit_rate += st->codec->bit_rate;
+            }
        }
        ic->bit_rate = bit_rate;
    }
--- a/libavformat/westwood_vqa.c
+++ b/libavformat/westwood_vqa.c
@@ -104,7 +104,6 @@ static int wsvqa_read_header(AVFormatContext *s,
    header = (unsigned char *)st->codec->extradata;
    if (avio_read(pb, st->codec->extradata, VQA_HEADER_SIZE) !=
        VQA_HEADER_SIZE) {
-        av_free(st->codec->extradata);
        return AVERROR(EIO);
    }
    st->codec->width = AV_RL16(&header[6]);
--- a/libavformat/wtvdec.c
+++ b/libavformat/wtvdec.c
@@ -423,6 +423,7 @@ static void get_attachment(AVFormatContext *s, AVIOContext *pb, int length)
    st->codec->codec_id   = CODEC_ID_MJPEG;
    st->codec->codec_type = AVMEDIA_TYPE_ATTACHMENT;
    st->codec->extradata  = av_mallocz(filesize);
+    st->id = -1;
    if (!st->codec->extradata)
        goto done;
    st->codec->extradata_size = filesize;
@@ -1 +1 @@
 .10.8
 .10.9