h263: disable loop filter with lowres

Fixes ticket1212

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc229d4e83)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

.gitignore

@@ -0,0 +1,45 @@
+.config
+.version
+*.o
+*.d
+*.exe
+*.ho
+*-example
+*-test
+*_g
+config.*
+doc/*.1
+doc/*.html
+doc/*.pod
+doxy
+ffmpeg
+ffplay
+ffprobe
+ffserver
+libavcodec/libavcodec*
+libavcore/libavcore*
+libavdevice/libavdevice*
+libavfilter/libavfilter*
+libavformat/libavformat*
+libavutil/avconfig.h
+libavutil/libavutil*
+libpostproc/libpostproc*
+libswscale/libswscale*
+tests/audiogen
+tests/base64
+tests/data
+tests/rotozoom
+tests/seek_test
+tests/tiny_psnr
+tests/videogen
+tests/vsynth1
+tests/vsynth2
+tools/cws2fws
+tools/graph2dot
+tools/lavfi-showfiltfmts
+tools/pktdumper
+tools/probetest
+tools/qt-faststart
+tools/trasher
+tools/trasher*.d
+version.h

Changelog

@@ -1,14 +1,158 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 0.6.6:
+- id3v2: fix skipping extended header in id3v2.4
+- nsvdec: Fix use of uninitialized streams
+- nsvdec: Be more careful with av_malloc()
+- nsvdec: Propagate errors
+- dv: check stype
+- dv: Fix null pointer dereference due to ach=0
+- dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
+- atrac3: Fix crash in tonal component decoding
+- mjpegbdec: Fix overflow in SOS
+- kgv1dec: Increase offsets array size so it is large enough
+- motionpixels: decode only the 111 complete frames for fate
+- motionpixels: Clip YUV values after applying a gradient
+- celp filters: Do not read earlier than the start of the 'out' vector
+- vqavideo: return error if image size is not a multiple of block size (CVE-2012-0947)
+- dpcm: ignore extra unpaired bytes in stereo streams (CVE-2011-3951)
+- aacsbr: prevent out of bounds memcpy() (CVE-2012-0850)
+- h264: Add check for invalid chroma_format_idc (CVE-2012-0851)
+- adpcm: ADPCM Electronic Arts has always two channels (CVE-2012-0852)
+- shorten: remove VLA and check for buffer overflow
+- shorten: Prevent block size from increasing
+- shorten: Fix out of bound writes in fix_bitshift()
+- shorten: check for realloc failure (CVE-2012-0858)
+- shorten: Use separate pointers for the allocated memory for decoded samples (CVE-2012-0858)
+- kmvc: Check palsize (CVE-2011-3952)
+- qdm2: clip array indices returned by qdm2_get_vlc()
+- configure: properly check for mingw-w64 through installed headers
+- mingw32: properly check if vfw capture is supported by the system headers
+- mingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one
+- dxva2: define required feature selection macros
+- png: check bit depth for PAL8/Y400A pixel formats
+- ea: check chunk_size for validity
+- tqi: Pass errors from the MB decoder
 
-version <next>:
+
+version 0.6.5:
+- vorbis: An additional defense in the Vorbis codec. (CVE-2011-3895)
+- vorbisdec: Fix decoding bug with channel handling.
+- matroskadec: Fix a bug where a pointer was cached to an array that might
+  later move due to a realloc(). (CVE-2011-3893)
+- vorbis: Avoid some out-of-bounds reads. (CVE-2011-3893)
+- vp3: fix oob read for negative tokens and memleaks on error, (CVE-2011-3892)
+- vp3: fix streams with non-zero last coefficient.
+
+
+version 0.6.4:
+- 4xm: Add a check in decode_i_frame to prevent buffer overreads
+- wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
+- swscale: #include "libavutil/mathematics.h"
+- vp3dec: Check coefficient index in vp3_dequant() (CVE-2011-4352)
+- svq1dec: call avcodec_set_dimensions() after dimensions changed. (CVE-2011-4579)
+- commits related to CVE-2011-4353:
+  - vp6: Fix illegal read.
+  - vp6: Reset the internal state when aborting key frames header parsing
+  - vp6: Check for huffman tree build errors
+  - vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
+- commits related to CVE-2011-4351:
+  - qdm2: check output buffer size before decoding
+  - Fix qdm2 decoder packet handling to match the api
+  - Fix out of bound reads in the QDM2 decoder.
+  - Check for out of bound writes in the QDM2 decoder.
+- vmd: fix segfaults on corruped streams (CVE-2011-4364)
+- rv34: Check for invalid slice offsets
+- rv34: Fix potential overreads
+- rv34: Avoid NULL dereference on corrupted bitstream
+- rv10: Reject slices that does not have the same type as the first one
+- oggdec: fix out of bound write in the ogg demuxer
+- smacker: fix a few off by 1 errors
+- Check for invalid VLC value in smacker decoder.
+- Check and propagate errors when VLC trees cannot be built in smacker decoder.
+- Fixed off by one packet size allocation in the smacker demuxer.
+- Check for invalid packet size in the smacker demuxer.
+- ape demuxer: fix segfault on memory allocation failure.
+- Fixed size given to init_get_bits() in xan decoder.
+- smacker demuxer: handle possible av_realloc() failure.
+- Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
+- indeo2: fail if input buffer too small
+- indeo2: init_get_bits size in bits instead of bytes
+- wavpack: Check error codes rather than working around error conditions.
+- Fixed invalid writes and reads in wavpack decoder on corrupted bitstreams.
+- cpu detection: avoid a signed overflow
+- h264: correct implicit weight table computation for long ref pics
+- h264: correct the check for invalid long term frame index in MMCO decode
+- rv10/20: tell decoder to use edge emulation
+- flvenc: use int64_t to store offsets
+- VC-1: fix reading of custom PAR.
+- h264: notice memory allocation failure
+- libx264: do not set pic quality if no frame is output
+- mxfdec: Include FF_INPUT_BUFFER_PADDING_SIZE when allocating extradata.
+- rv30: return AVERROR(EINVAL) instead of EINVAL
+- Do not decode RV30 files if the extradata is too small
+- aacps: skip some memcpy() if src and dst would be equal
+- mpegts: fix Continuity Counter error detection
+- alsa: fallback to buffer_size/4 for period_size.
+- mxfenc: fix ignored drop flag in binary timecode representation.
+- dca: set AVCodecContext frame_size for DTS audio
+- H.264: fix overreads of qscale_table
+- postprocess.c: filter name needs to be double 0 terminated
+- Replace strncpy() with av_strlcpy() in libpostproc.
+- jpegdec: actually search for and parse RSTn
+- riff: Add mpgv MPEG-2 fourcc
+- Added M701 codec_tag for mpeg2video
+
+
+version 0.6.3:
+
+- fix compilation with --enable-hardcoded-tables
+- mjpeg: Detect overreads in mjpeg_decode_scan() and error out.
+- aac: add headers needed for log2f()
+- lavf: inspect more frames for fps when container time base is coarse
+- AMV: disable DR1 and don't override EMU_EDGE
+  (addresses http://seclists.org/bugtraq/2011/Apr/257)
+- Fix memory (re)allocation in matroskadec.c (MSVR11-011/CVE-2011-3504)
+- Fix some crashes with invalid bitstreams in the CAVS decoder
+  (CVE-2011-3362, CVE-2011-3973, CVE-2011-3974)
+- Compilation fixes for gcc-4.6, testsuite now passes again
+- Fix a heap corruption issue in the OGG decoder
+- Backported the Android VisualOn AAC encoder wrapper from 0.7.2
+
+
+version 0.6.3:
+
+- AMV: Fix possibly exploitable crash.
+- Fix apparently exploitable race condition.
+  (addresses http://seclists.org/bugtraq/2011/Apr/257)
+
+version 0.6.2:
+
+- fix compilation with --enable-hardcoded-tables
+- Fix invalid reads in VC-1 decoding (related to CVE-2011-0723)
+- Do not attempt to decode APE file with no frames
+  (adresses http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt)
+
+
+version 0.6.1:
+
+- fix autodetection of E-AC-3 substream samples
+- performance fix for seekable HTTP
+- backport AAC-HE v2 from trunk
+- add missing VP80 fourcc code for the VP8 codec
+- small documentation fixes
+- fix several potentially exploitable issues in the FLIC decoder
+  (addresses CVE-2010-3429)
+
+
+version 0.6:
 
 - PB-frame decoding for H.263
 - deprecated vhook subsystem removed
 - deprecated old scaler removed
 - VQF demuxer
-- Alpha channel scaler
+- alpha channel scaler
 - PCX encoder
 - RTP packetization of H.263
 - RTP packetization of AMR
@@ -70,6 +214,17 @@ version <next>:
 - Psygnosis YOP demuxer and video decoder
 - spectral extension support in the E-AC-3 decoder
 - unsharp video filter
+- RTP hinting in the mov/3gp/mp4 muxer
+- Dirac in Ogg demuxing
+- seek to keyframes in Ogg
+- 4:2:2 and 4:4:4 Theora decoding
+- 35% faster VP3/Theora decoding
+- faster AAC decoding
+- faster H.264 decoding
+- WebM support in Matroska de/muxer
+- low overhead Ogg muxing
+- VP8 de/encoding via libvpx
+- CODEC_CAP_EXPERIMENTAL added
 
 
 

RELEASE

@@ -0,0 +1,212 @@
+Release Notes
+=============
+
+* 0.6 "Works with HTML5" June, 2010
+
+General notes
+-------------
+
+This release focuses on improvements for the new multimedia elements in HTML5.
+The H.264 and Theora decoders are now significantly faster, the Vorbis decoder
+has seen important updates and this release supports Google's newly released
+libvpx library for the VP8 codec and WebM container.
+
+Other important changes are additions of decoders including, but not limited to,
+Intel Indeo 5, WMA Pro, WMA Voice and HE-AAC.
+
+See the Changelog file for a list of significant changes.
+
+Please note that our policy on bug reports has not changed. We still only accept
+bug reports against HEAD of the FFmpeg trunk repository. If you are experiencing
+any issues with any formally released version of FFmpeg, please try a current
+version of the development code to check if the issue still exists. If it does,
+make your report against the development code following the usual bug reporting
+guidelines.
+
+
+API and other notable Changes
+-----------------------------
+
+Please see the file doc/APIchanges for programmer-centric information.
+
+Notable changes:
+- deprecated vhook subsystem removed
+- deprecated old scaler removed
+- nonfree libamr support for AMR-NB/WB decoding/encoding removed
+- RTMP support in libavformat
+- -formats option split into -formats, -codecs, -bsfs, and -protocols
+- ffprobe tool
+- RTMP/RTMPT/RTMPS/RTMPE/RTMPTE protocol support via librtmp
+- CODEC_CAP_EXPERIMENTAL added
+
+
+Added Codecs:
+-------------
+
+- VQF demuxer
+- PCX encoder
+- CorePNG decoding support
+- 8088flex TMV demuxer and decoder
+- enable symbol versioning by default for linkers that support it
+- V210 decoder and encoder
+- QCP demuxer
+- SoX native format muxer and demuxer
+- AMR-NB decoding/encoding, AMR-WB decoding via OpenCORE libraries
+- DPX image decoder
+- Electronic Arts Madcow decoder
+- DivX (XSUB) subtitle encoder
+- experimental AAC encoder
+- Wave64 demuxer
+- IEC-61937 compatible Muxer
+- TwinVQ decoder
+- Bluray (PGS) subtitle decoder
+- LPCM support in MPEG-TS (HDMV RID as found on Blu-ray disks)
+- WMA Pro decoder
+- Core Audio Format demuxer
+- Atrac1 decoder
+- MD STUDIO audio demuxer
+- RF64 support in WAV demuxer
+- MPEG-4 Audio Lossless Coding (ALS) decoder
+- IV8 demuxer
+- CDG demuxer and decoder
+- R210 decoder
+- Auravision Aura 1 and 2 decoders
+- Deluxe Paint Animation playback system
+- SIPR decoder
+- Adobe Filmstrip muxer and demuxer
+- RTP packetization and depacketization of H.263 and AMR
+- Bink demuxer and audio/video decoders
+- IFF PBM/ILBM bitmap decoder
+- Indeo 5 decoder
+- WMA Voice decoder
+- AMR-NB decoder
+- RTSP muxer
+- HE-AAC v1 decoder
+- Kega Game Video (KGV1) decoder
+- Psygnosis YOP demuxer and video decoder
+- RTP hinting in the mov/3gp/mp4 muxer
+- VP8 decoding via libvpx
+
+
+Notable license related changes
+-------------------------------
+
+- remaining GPL parts in AC-3 decoder converted to LGPL
+- libswscale can now be compiled in LGPL mode
+
+
+
+* 0.6.1
+
+General notes
+-------------
+
+This point release includes some updates to make the 0.6 release series usable
+for users that need to retain the existing behavior as closely as possible.
+The changes follow below:
+
+Bugfixes
+--------
+
+- fix autodetection of E-AC-3 substream samples
+- performance fix for seekable HTTP
+- add missing VP80 fourcc code for the VP8 codec
+- small documentation fixes
+- fix several potentially exploitable issues in the FLIC decoder
+  (addresses CVE-2010-3429)
+
+
+HE-AAC v2 backport
+------------------
+
+This release includes a backport of the AAC decoder from trunk, which
+enables proper playback of HE-AAC v2 media.
+
+
+* 0.6.2
+
+General notes
+-------------
+
+This is a maintenance-only release that addresses a small number of security
+and portability issues. Distributors and system integrators are encouraged
+to update and share their patches against this branch.
+
+Security fixes
+--------------
+
+Programming errors in container and codec implementations may lead to
+denial of service or the execution of arbitrary code if the user is
+tricked into opening a malformed media file or stream.
+
+Affected and updated have been the implementations of the following
+codecs and container formats:
+
+ - VC1 decoder (Change related to CVE-2011-0723)
+ - APE decoder (cf. http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt)
+
+
+* 0.6.3
+
+General notes
+-------------
+
+This is a mostly maintenance-only release that addresses a small number
+of bugs such as security and compilation issues. Moreover, this release
+has been updated to work with gcc-4.6 and the VisualOn AAC encoder has
+been backported from the Libav 0.7.2 release. Distributors and system
+integrators are encouraged to update and share their patches against
+this branch.
+For a full list of changes please see the Changelog file.
+
+
+* 0.6.4
+
+General notes
+-------------
+
+This mostly maintenance-only release that addresses a number a number of
+bugs such as security and compilation issues that have been brought to
+our attention. Among other (rather minor) fixes, this release features
+fixes for the QDM2 decoder (CVE-2011-4351), vp3 decoder (CVE-2011-4352),
+DoS in the VP5/VP6 decoders (CVE-2011-4353), a buffer overflow in the
+Sierra VMD decoder CVE-2011-4364, and a safety fix in the svq1 decoder
+(CVE-2011-4579).
+
+Distributors and system integrators are encouraged
+to update and share their patches against this branch.  For a full list
+of changes please see the Changelog file.
+
+
+* 0.6.5
+
+General notes
+-------------
+
+This mostly maintenance-only release that addresses a number a number of
+bugs such as security and compilation issues that have been brought to
+our attention. Among other (rather minor) fixes, this release features
+fixes for the VP3 decoder (CVE-2011-3892), vorbis decoder, and matroska
+demuxer (CVE-2011-3893 and CVE-2011-3895).
+
+Distributors and system integrators are encouraged
+to update and share their patches against this branch.  For a full list
+of changes please see the Changelog file.
+
+
+* 0.6.6
+
+General notes
+-------------
+
+This mostly maintenance-only release that addresses a number a number of
+bugs such as security and compilation issues that have been brought to
+our attention. Among other fixes, this release features includes
+security updates for the, DV decoder (CVE-2011-3929 and CVE-2011-3936),
+VQA Video Decoder (CVE-2012-0947), DPCM codecs (CVE-2011-3951), AAC SBR
+(CVE-2012-0850), H.264 (CVE-2012-0851), ADPCM (CVE-2012-0852), Shorten
+(CVE-2012-0858), and the KMVC decoder (CVE-2011-3952).
+
+Distributors and system integrators are encouraged
+to update and share their patches against this branch.  For a full list
+of changes please see the Changelog file or the git commit history.

VERSION

@@ -0,0 +1 @@
+0.6.6

cmdutils.c

@@ -292,17 +292,11 @@ void set_context_opts(void *ctx, void *opts_ctx, int flags)
 void print_error(const char *filename, int err)
 {
     char errbuf[128];
+    const char *errbuf_ptr = errbuf;
 
-    switch(err) {
-#if CONFIG_NETWORK
-    case FF_NETERROR(EPROTONOSUPPORT):
-        fprintf(stderr, "%s: Unsupported network protocol\n", filename);
-        break;
-#endif
-    default:
-        av_strerror(err, errbuf, sizeof(errbuf));
-        fprintf(stderr, "%s: %s\n", filename, errbuf);
-    }
+    if (av_strerror(err, errbuf, sizeof(errbuf)) < 0)
+        errbuf_ptr = strerror(AVUNERROR(err));
+    fprintf(stderr, "%s: %s\n", filename, errbuf_ptr);
 }
 
 #define PRINT_LIB_VERSION(outstream,libname,LIBNAME,indent)             \
@@ -615,6 +609,11 @@ void show_pix_fmts(void)
         "FLAGS NAME            NB_COMPONENTS BITS_PER_PIXEL\n"
         "-----\n");
 
+#if !CONFIG_SWSCALE
+#   define sws_isSupportedInput(x)  0
+#   define sws_isSupportedOutput(x) 0
+#endif
+
     for (pix_fmt = 0; pix_fmt < PIX_FMT_NB; pix_fmt++) {
         const AVPixFmtDescriptor *pix_desc = &av_pix_fmt_descriptors[pix_fmt];
         printf("%c%c%c%c%c %-16s       %d            %2d\n",
@@ -642,7 +641,7 @@ int read_yesno(void)
 
 int read_file(const char *filename, char **bufptr, size_t *size)
 {
-    FILE *f = fopen(filename, "r");
+    FILE *f = fopen(filename, "rb");
 
     if (!f) {
         fprintf(stderr, "Cannot read file '%s': %s\n", filename, strerror(errno));

cmdutils.h

@@ -134,6 +134,15 @@ void parse_options(int argc, char **argv, const OptionDef *options,
 
 void set_context_opts(void *ctx, void *opts_ctx, int flags);
 
+/**
+ * Prints an error message to stderr, indicating filename and a human
+ * readable description of the error code err.
+ *
+ * If strerror_r() is not available the use of this function in a
+ * multithreaded application may be unsafe.
+ *
+ * @see av_strerror()
+ */
 void print_error(const char *filename, int err);
 
 void list_fmts(void (*get_fmt_string)(char *buf, int buf_size, int fmt), int nb_fmts);

configure

@@ -181,8 +181,10 @@ External library support:
   --enable-libschroedinger enable Dirac support via libschroedinger [no]
   --enable-libspeex        enable Speex decoding via libspeex [no]
   --enable-libtheora       enable Theora encoding via libtheora [no]
+  --enable-libvo-aacenc    enable AAC encoding via libvo-aacenc [no]
   --enable-libvorbis       enable Vorbis encoding via libvorbis,
                            native implementation exists [no]
+  --enable-libvpx          enable VP8 support via libvpx [no]
   --enable-libx264         enable H.264 encoding via x264 [no]
   --enable-libxvid         enable Xvid encoding via xvidcore,
                            native MPEG-4/Xvid encoder exists [no]
@@ -252,6 +254,8 @@ EOF
   exit 0
 }
 
+quotes='""'
+
 log(){
     echo "$@" >> $logfile
 }
@@ -926,7 +930,9 @@ CONFIG_LIST="
     libschroedinger
     libspeex
     libtheora
+    libvo_aacenc
     libvorbis
+    libvpx
     libx264
     libxvid
     lpc
@@ -1084,6 +1090,9 @@ HAVE_LIST="
     struct_sockaddr_in6
     struct_sockaddr_sa_len
     struct_sockaddr_storage
+    symver
+    symver_gnu_asm
+    symver_asm_label
     sys_mman_h
     sys_resource_h
     sys_select_h
@@ -1198,6 +1207,8 @@ fast_unaligned_if_any="armv6 ppc x86"
 need_memalign="altivec neon sse"
 inline_asm_deps="!tms470"
 
+symver_if_any="symver_asm_label symver_gnu_asm"
+
 # subsystems
 mdct_select="fft"
 rdft_select="fft"
@@ -1334,7 +1345,7 @@ libdirac_decoder_deps="libdirac !libschroedinger"
 libdirac_encoder_deps="libdirac"
 libfaac_encoder_deps="libfaac"
 libfaad_decoder_deps="libfaad"
-libfaadbin_decoder_extralibs='$ldl'
+libfaadbin_extralibs='$ldl'
 libgsm_decoder_deps="libgsm"
 libgsm_encoder_deps="libgsm"
 libgsm_ms_decoder_deps="libgsm"
@@ -1348,7 +1359,10 @@ libschroedinger_decoder_deps="libschroedinger"
 libschroedinger_encoder_deps="libschroedinger"
 libspeex_decoder_deps="libspeex"
 libtheora_encoder_deps="libtheora"
+libvo_aacenc_encoder_deps="libvo_aacenc"
 libvorbis_encoder_deps="libvorbis"
+libvpx_decoder_deps="libvpx"
+libvpx_encoder_deps="libvpx"
 libx264_encoder_deps="libx264"
 libxvid_encoder_deps="libxvid"
 
@@ -1398,7 +1412,7 @@ oss_indev_deps_any="soundcard_h sys_soundcard_h"
 oss_outdev_deps_any="soundcard_h sys_soundcard_h"
 v4l_indev_deps="linux_videodev_h"
 v4l2_indev_deps_any="linux_videodev2_h sys_videoio_h"
-vfwcap_indev_deps="capCreateCaptureWindow"
+vfwcap_indev_deps="capCreateCaptureWindow vfwcap_defines"
 vfwcap_indev_extralibs="-lavicap32"
 x11_grab_device_indev_deps="x11grab XShmCreateImage"
 x11_grab_device_indev_extralibs="-lX11 -lXext -lXfixes"
@@ -2195,7 +2209,7 @@ case $target_os in
         LIBTARGET=i386
         if enabled x86_64; then
             enable malloc_aligned
-            LIBTARGET=x64
+            LIBTARGET="i386:x86-64"
         elif enabled arm; then
             LIBTARGET=arm
         fi
@@ -2205,7 +2219,7 @@ case $target_os in
         SLIBSUF=".dll"
         SLIBNAME_WITH_VERSION='$(SLIBPREF)$(FULLNAME)-$(LIBVERSION)$(SLIBSUF)'
         SLIBNAME_WITH_MAJOR='$(SLIBPREF)$(FULLNAME)-$(LIBMAJOR)$(SLIBSUF)'
-        SLIB_EXTRA_CMD='-lib.exe /machine:$(LIBTARGET) /def:$$(@:$(SLIBSUF)=.def) /out:$(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib)'
+        SLIB_EXTRA_CMD=-'$(DLLTOOL) -m $(LIBTARGET) -d $$(@:$(SLIBSUF)=.def) -l $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) -D $(SLIBNAME_WITH_MAJOR)'
         SLIB_INSTALL_EXTRA_CMD='-install -m 644 $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) "$(SHLIBDIR)/$(SLIBNAME:$(SLIBSUF)=.lib)"; \
             install -m 644 $(SUBDIR)$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib) "$(SHLIBDIR)/$(SLIBNAME_WITH_MAJOR:$(SLIBSUF)=.lib)"; \
             install -d "$(LIBDIR)"; \
@@ -2213,15 +2227,12 @@ case $target_os in
         SLIB_UNINSTALL_EXTRA_CMD='rm -f "$(SHLIBDIR)/$(SLIBNAME:$(SLIBSUF)=.lib)"'
         SHFLAGS='-shared -Wl,--output-def,$$(@:$(SLIBSUF)=.def) -Wl,--out-implib,$(SUBDIR)lib$(SLIBNAME:$(SLIBSUF)=.dll.a) -Wl,--enable-runtime-pseudo-reloc -Wl,--enable-auto-image-base'
         objformat="win32"
+        dlltool="${cross_prefix}dlltool"
         enable dos_paths
         check_cflags -fno-common
-        if ! enabled x86_64; then
-            check_cpp_condition _mingw.h "(__MINGW32_MAJOR_VERSION > 3) || (__MINGW32_MAJOR_VERSION == 3 && __MINGW32_MINOR_VERSION >= 15)" ||
+        check_cpp_condition _mingw.h "defined (__MINGW64_VERSION_MAJOR) || (__MINGW32_MAJOR_VERSION > 3) \
+                                      || (__MINGW32_MAJOR_VERSION == 3 && __MINGW32_MINOR_VERSION >= 15)" ||
                 die "ERROR: MinGW runtime version must be >= 3.15."
-            enabled_any avisynth vfwcap_indev &&
-                { check_cpp_condition w32api.h "(__W32API_MAJOR_VERSION > 3) || (__W32API_MAJOR_VERSION == 3 && __W32API_MINOR_VERSION >= 13)" ||
-                  die "ERROR: avisynth and vfwcap_indev require w32api version 3.13 or later."; }
-        fi
         ;;
     cygwin*)
         target_os=cygwin
@@ -2335,6 +2346,7 @@ die_license_disabled nonfree libfaac
 
 die_license_disabled version3 libopencore_amrnb
 die_license_disabled version3 libopencore_amrwb
+die_license_disabled version3 libvo_aacenc
 
 enabled version3 && { enabled gpl && enable gplv3 || enable lgplv3; }
 
@@ -2406,11 +2418,6 @@ EOF
 
     enabled_all armv6t2 shared !pic && enable_pic
 
-elif enabled ia64; then
-
-    # HACK: currently fails to build if .bss is > 4MB and shared libs are built
-    enabled shared && enable_weak hardcoded_tables
-
 elif enabled mips; then
 
     check_asm loongson '"dmult.g $1, $2, $3"'
@@ -2611,12 +2618,15 @@ enabled libnut     && require  libnut libnut.h nut_demuxer_init -lnut
 enabled libopencore_amrnb  && require libopencore_amrnb opencore-amrnb/interf_dec.h Decoder_Interface_init -lopencore-amrnb -lm
 enabled libopencore_amrwb  && require libopencore_amrwb opencore-amrwb/dec_if.h D_IF_init -lopencore-amrwb -lm
 enabled libopenjpeg && require libopenjpeg openjpeg.h opj_version -lopenjpeg
-enabled librtmp    && require  librtmp librtmp/rtmp.h RTMP_Init -lrtmp
+enabled librtmp    && require  librtmp librtmp/rtmp.h RTMP_Init $(pkg-config --libs librtmp)
 enabled libschroedinger && add_cflags $(pkg-config --cflags schroedinger-1.0) &&
                            require libschroedinger schroedinger/schro.h schro_init $(pkg-config --libs schroedinger-1.0)
 enabled libspeex   && require  libspeex speex/speex.h speex_decoder_init -lspeex
 enabled libtheora  && require  libtheora theora/theoraenc.h th_info_init -ltheoraenc -ltheoradec -logg
+enabled libvo_aacenc && require libvo_aacenc vo-aacenc/voAAC.h voGetAACEncAPI -lvo-aacenc
 enabled libvorbis  && require  libvorbis vorbis/vorbisenc.h vorbis_info_init -lvorbisenc -lvorbis -logg
+enabled libvpx     && require2 libvpx "vpx/vpx_decoder.h vpx/vp8dx.h" "vpx_codec_dec_init_ver" -lvpx &&
+                      require2 libvpx "vpx/vpx_encoder.h vpx/vp8cx.h" "vpx_codec_enc_init_ver" -lvpx
 enabled libx264    && require  libx264 x264.h x264_encoder_encode -lx264 -lm &&
                       { check_cpp_condition x264.h "X264_BUILD >= 83" ||
                         die "ERROR: libx264 version must be >= 0.83."; }
@@ -2675,6 +2685,9 @@ check_header linux/videodev2.h
 check_header sys/videoio.h
 
 check_func_headers "windows.h vfw.h" capCreateCaptureWindow "$vfwcap_indev_extralibs"
+# check that WM_CAP_DRIVER_CONNECT is defined to the proper value
+# w32api 3.12 had it defined wrong
+check_cpp_condition vfw.h "WM_CAP_DRIVER_CONNECT > WM_USER" && enable vfwcap_defines
 
 # check for ioctl_meteor.h, ioctl_bt848.h and alternatives
 { check_header dev/bktr/ioctl_meteor.h &&
@@ -2731,8 +2744,17 @@ check_ldflags '-Wl,-rpath-link,\$(BUILD_ROOT)/libpostproc -Wl,-rpath-link,\$(BUI
 check_ldflags -Wl,-Bsymbolic
 
 echo "X{};" > $TMPV
-test_ldflags -Wl,--version-script,$TMPV &&
+if test_ldflags -Wl,--version-script,$TMPV; then
     append SHFLAGS '-Wl,--version-script,\$(SUBDIR)lib\$(NAME).ver'
+    check_cc <<EOF && enable symver_asm_label
+void ff_foo(void) __asm__ ("av_foo@VERSION");
+void ff_foo(void) { ${inline_asm+__asm__($quotes);} }
+EOF
+    check_cc <<EOF && enable symver_gnu_asm
+__asm__(".symver ff_foo,av_foo@VERSION");
+void ff_foo(void) {}
+EOF
+fi
 
 if enabled small; then
     add_cflags $size_cflags
@@ -2885,7 +2907,9 @@ echo "librtmp enabled           ${librtmp-no}"
 echo "libschroedinger enabled   ${libschroedinger-no}"
 echo "libspeex enabled          ${libspeex-no}"
 echo "libtheora enabled         ${libtheora-no}"
+echo "libvo-aacenc support      ${libvo_aacenc-no}"
 echo "libvorbis enabled         ${libvorbis-no}"
+echo "libvpx enabled            ${libvpx-no}"
 echo "libx264 enabled           ${libx264-no}"
 echo "libxvid enabled           ${libxvid-no}"
 echo "zlib enabled              ${zlib-no}"
@@ -2984,6 +3008,7 @@ CPPFLAGS=$CPPFLAGS
 CFLAGS=$CFLAGS
 ASFLAGS=$ASFLAGS
 CC_O=$CC_O
+DLLTOOL=$dlltool
 LDFLAGS=$LDFLAGS
 FFSERVERLDFLAGS=$FFSERVERLDFLAGS
 SHFLAGS=$SHFLAGS

doc/APIchanges

@@ -12,6 +12,15 @@ libavutil:   2009-03-08
 
 API changes, most recent first:
 
+2010-06-01 - r31301 - lsws 0.11.0 - convertPalette API
+  Add sws_convertPalette8ToPacked32 and sws_convertPalette8ToPacked24
+
+2010-05-26 - r23334 - lavc 52.72.0 - CODEC_CAP_EXPERIMENTAL
+  Add CODEC_CAP_EXPERIMENTAL flag.
+
+2010-05-18 - r23161 - lavf 52.63.0 - AVFMT_FLAG_RTP_HINT
+  Add AVFMT_FLAG_RTP_HINT as possible value for AVFormatContext.flags
+
 2010-05-01 - r23002 - lavf 52.62.0 - probe function
   Add av_probe_input_format2 to API, it allows ignoring probe
   results below given score and returns the actual probe score.

doc/general.texi

@@ -234,6 +234,7 @@ library:
 @item VC-1 test bitstream       @tab X @tab X
 @item WAV                       @tab X @tab X
 @item WavPack                   @tab   @tab X
+@item WebM                      @tab X @tab X
 @item Wing Commander III movie  @tab   @tab X
     @tab Multimedia format used in Origin's Wing Commander III computer game.
 @item Westwood Studios audio    @tab   @tab X
@@ -436,6 +437,8 @@ following image formats are supported:
     @tab fourcc: VP50
 @item On2 VP6                @tab     @tab  X
     @tab fourcc: VP60,VP61,VP62
+@item VP8                    @tab  X  @tab  X
+    @tab fourcc: VP80, de/encoding supported through external library libvpx
 @item planar RGB             @tab     @tab  X
     @tab fourcc: 8BPS
 @item Q-team QPEG            @tab     @tab  X
@@ -508,7 +511,7 @@ following image formats are supported:
 @item Name @tab Encoding @tab Decoding @tab Comments
 @item 8SVX audio             @tab     @tab  X
 @item AAC                    @tab  E  @tab  X
-    @tab encoding supported through external library libfaac
+    @tab encoding supported through external library libfaac and libvo-aacenc
 @item AC-3                   @tab IX  @tab  X
 @item ADPCM 4X Movie         @tab     @tab  X
 @item ADPCM CDROM XA         @tab     @tab  X

ffmpeg.c

@@ -2093,7 +2093,7 @@ static int av_transcode(AVFormatContext **output_files,
                          pass_logfilename_prefix ? pass_logfilename_prefix : DEFAULT_PASS_LOGFILENAME_PREFIX,
                          i);
                 if (codec->flags & CODEC_FLAG_PASS1) {
-                    f = fopen(logfilename, "w");
+                    f = fopen(logfilename, "wb");
                     if (!f) {
                         fprintf(stderr, "Cannot write log file '%s' for pass-1 encoding: %s\n", logfilename, strerror(errno));
                         av_exit(1);
@@ -2912,7 +2912,7 @@ static int opt_input_ts_offset(const char *opt, const char *arg)
     return 0;
 }
 
-static enum CodecID find_codec_or_die(const char *name, int type, int encoder)
+static enum CodecID find_codec_or_die(const char *name, int type, int encoder, int strict)
 {
     const char *codec_string = encoder ? "encoder" : "decoder";
     AVCodec *codec;
@@ -2930,6 +2930,19 @@ static enum CodecID find_codec_or_die(const char *name, int type, int encoder)
         fprintf(stderr, "Invalid %s type '%s'\n", codec_string, name);
         av_exit(1);
     }
+    if(codec->capabilities & CODEC_CAP_EXPERIMENTAL &&
+       strict > FF_COMPLIANCE_EXPERIMENTAL) {
+        fprintf(stderr, "%s '%s' is experimental and might produce bad "
+                "results.\nAdd '-strict experimental' if you want to use it.\n",
+                codec_string, codec->name);
+        codec = encoder ?
+            avcodec_find_encoder(codec->id) :
+            avcodec_find_decoder(codec->id);
+        if (!(codec->capabilities & CODEC_CAP_EXPERIMENTAL))
+            fprintf(stderr, "Or use the non experimental %s '%s'.\n",
+                    codec_string, codec->name);
+        av_exit(1);
+    }
     return codec->id;
 }
 
@@ -2977,9 +2990,15 @@ static void opt_input_file(const char *filename)
 
     set_context_opts(ic, avformat_opts, AV_OPT_FLAG_DECODING_PARAM);
 
-    ic->video_codec_id   = find_codec_or_die(video_codec_name   , AVMEDIA_TYPE_VIDEO   , 0);
-    ic->audio_codec_id   = find_codec_or_die(audio_codec_name   , AVMEDIA_TYPE_AUDIO   , 0);
-    ic->subtitle_codec_id= find_codec_or_die(subtitle_codec_name, AVMEDIA_TYPE_SUBTITLE, 0);
+    ic->video_codec_id   =
+        find_codec_or_die(video_codec_name   , AVMEDIA_TYPE_VIDEO   , 0,
+                          avcodec_opts[AVMEDIA_TYPE_VIDEO   ]->strict_std_compliance);
+    ic->audio_codec_id   =
+        find_codec_or_die(audio_codec_name   , AVMEDIA_TYPE_AUDIO   , 0,
+                          avcodec_opts[AVMEDIA_TYPE_AUDIO   ]->strict_std_compliance);
+    ic->subtitle_codec_id=
+        find_codec_or_die(subtitle_codec_name, AVMEDIA_TYPE_SUBTITLE, 0,
+                          avcodec_opts[AVMEDIA_TYPE_SUBTITLE]->strict_std_compliance);
     ic->flags |= AVFMT_FLAG_NONBLOCK;
 
     if(pgmyuv_compatibility_hack)
@@ -3208,7 +3227,8 @@ static void new_video_stream(AVFormatContext *oc)
         AVRational fps= frame_rate.num ? frame_rate : (AVRational){25,1};
 
         if (video_codec_name) {
-            codec_id = find_codec_or_die(video_codec_name, AVMEDIA_TYPE_VIDEO, 1);
+            codec_id = find_codec_or_die(video_codec_name, AVMEDIA_TYPE_VIDEO, 1,
+                                         video_enc->strict_std_compliance);
             codec = avcodec_find_encoder_by_name(video_codec_name);
             output_codecs[nb_ocodecs] = codec;
         } else {
@@ -3339,7 +3359,8 @@ static void new_audio_stream(AVFormatContext *oc)
         set_context_opts(audio_enc, avcodec_opts[AVMEDIA_TYPE_AUDIO], AV_OPT_FLAG_AUDIO_PARAM | AV_OPT_FLAG_ENCODING_PARAM);
 
         if (audio_codec_name) {
-            codec_id = find_codec_or_die(audio_codec_name, AVMEDIA_TYPE_AUDIO, 1);
+            codec_id = find_codec_or_die(audio_codec_name, AVMEDIA_TYPE_AUDIO, 1,
+                                         audio_enc->strict_std_compliance);
             codec = avcodec_find_encoder_by_name(audio_codec_name);
             output_codecs[nb_ocodecs] = codec;
         } else {
@@ -3399,7 +3420,8 @@ static void new_subtitle_stream(AVFormatContext *oc)
         st->stream_copy = 1;
     } else {
         set_context_opts(avcodec_opts[AVMEDIA_TYPE_SUBTITLE], subtitle_enc, AV_OPT_FLAG_SUBTITLE_PARAM | AV_OPT_FLAG_ENCODING_PARAM);
-        subtitle_enc->codec_id = find_codec_or_die(subtitle_codec_name, AVMEDIA_TYPE_SUBTITLE, 1);
+        subtitle_enc->codec_id = find_codec_or_die(subtitle_codec_name, AVMEDIA_TYPE_SUBTITLE, 1,
+                                                   subtitle_enc->strict_std_compliance);
         output_codecs[nb_ocodecs] = avcodec_find_encoder_by_name(subtitle_codec_name);
     }
     nb_ocodecs++;

ffplay.c

@@ -1593,7 +1593,9 @@ static int input_get_buffer(AVCodecContext *codec, AVFrame *pic)
         unsigned hshift = i == 0 ? 0 : av_pix_fmt_descriptors[ref->pic->format].log2_chroma_w;
         unsigned vshift = i == 0 ? 0 : av_pix_fmt_descriptors[ref->pic->format].log2_chroma_h;
 
-        ref->data[i]    += (edge >> hshift) + ((edge * ref->linesize[i]) >> vshift);
+        if (ref->data[i]) {
+            ref->data[i]    += (edge >> hshift) + ((edge * ref->linesize[i]) >> vshift);
+        }
         pic->data[i]     = ref->data[i];
         pic->linesize[i] = ref->linesize[i];
     }

ffserver.c

@@ -847,6 +847,8 @@ static void close_connection(HTTPContext *c)
         ctx = c->rtp_ctx[i];
         if (ctx) {
             av_write_trailer(ctx);
+            av_metadata_free(&ctx->metadata);
+            av_free(ctx->streams[0]);
             av_free(ctx);
         }
         h = c->rtp_handles[i];
@@ -2280,6 +2282,7 @@ static int http_prepare_data(HTTPContext *c)
             http_log("Error writing output header\n");
             return -1;
         }
+        av_metadata_free(&c->fmt_ctx.metadata);
 
         len = url_close_dyn_buf(c->fmt_ctx.pb, &c->pb_buffer);
         c->buffer_ptr = c->pb_buffer;
@@ -2343,7 +2346,7 @@ static int http_prepare_data(HTTPContext *c)
                         }
                     }
                     for(i=0;i<c->stream->nb_streams;i++) {
-                        if (c->feed_streams[i] == pkt.stream_index) {
+                        if (c->stream->feed_streams[i] == pkt.stream_index) {
                             AVStream *st = c->fmt_in->streams[source_index];
                             pkt.stream_index = i;
                             if (pkt.flags & AV_PKT_FLAG_KEY &&
@@ -2879,7 +2882,7 @@ static int rtsp_parse_request(HTTPContext *c)
     if (*p == '\n')
         p++;
     while (*p != '\0') {
-        p1 = strchr(p, '\n');
+        p1 = memchr(p, '\n', (char *)c->buffer_ptr - p);
         if (!p1)
             break;
         p2 = p1;
@@ -2946,6 +2949,8 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,
         snprintf(avc->filename, 1024, "rtp://%s:%d?multicast=1?ttl=%d",
                  inet_ntoa(stream->multicast_ip),
                  stream->multicast_port, stream->multicast_ttl);
+    } else {
+        snprintf(avc->filename, 1024, "rtp://0.0.0.0");
     }
 
     for(i = 0; i < stream->nb_streams; i++) {
@@ -2954,6 +2959,7 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer,
     }
     *pbuffer = av_mallocz(2048);
     avf_sdp_create(&avc, 1, *pbuffer, 2048);
+    av_metadata_free(&avc->metadata);
     av_free(avc);
 
     return strlen(*pbuffer);
@@ -3006,10 +3012,12 @@ static void rtsp_cmd_describe(HTTPContext *c, const char *url)
         return;
     }
     rtsp_reply_header(c, RTSP_STATUS_OK);
+    url_fprintf(c->pb, "Content-Base: %s/\r\n", url);
     url_fprintf(c->pb, "Content-Type: application/sdp\r\n");
     url_fprintf(c->pb, "Content-Length: %d\r\n", content_length);
     url_fprintf(c->pb, "\r\n");
     put_buffer(c->pb, content, content_length);
+    av_free(content);
 }
 
 static HTTPContext *find_rtp_session(const char *session_id)
@@ -3376,7 +3384,6 @@ static int rtp_new_av_stream(HTTPContext *c,
     st = av_mallocz(sizeof(AVStream));
     if (!st)
         goto fail;
-    st->codec= avcodec_alloc_context();
     ctx->nb_streams = 1;
     ctx->streams[0] = st;
 
@@ -3452,16 +3459,28 @@ static int rtp_new_av_stream(HTTPContext *c,
 /********************************************************************/
 /* ffserver initialization */
 
-static AVStream *add_av_stream1(FFStream *stream, AVCodecContext *codec)
+static AVStream *add_av_stream1(FFStream *stream, AVCodecContext *codec, int copy)
 {
     AVStream *fst;
 
     fst = av_mallocz(sizeof(AVStream));
     if (!fst)
         return NULL;
-    fst->codec= avcodec_alloc_context();
+    if (copy) {
+        fst->codec= avcodec_alloc_context();
+        memcpy(fst->codec, codec, sizeof(AVCodecContext));
+        if (codec->extradata_size) {
+            fst->codec->extradata = av_malloc(codec->extradata_size);
+            memcpy(fst->codec->extradata, codec->extradata,
+                codec->extradata_size);
+        }
+    } else {
+        /* live streams must use the actual feed's codec since it may be
+         * updated later to carry extradata needed by the streams.
+         */
+        fst->codec = codec;
+    }
     fst->priv_data = av_mallocz(sizeof(FeedData));
-    memcpy(fst->codec, codec, sizeof(AVCodecContext));
     fst->index = stream->nb_streams;
     av_set_pts_info(fst, 33, 1, 90000);
     stream->streams[stream->nb_streams++] = fst;
@@ -3503,7 +3522,7 @@ static int add_av_stream(FFStream *feed, AVStream *st)
         }
     }
 
-    fst = add_av_stream1(feed, av);
+    fst = add_av_stream1(feed, av, 0);
     if (!fst)
         return -1;
     return feed->nb_streams - 1;
@@ -3614,7 +3633,7 @@ static void build_file_streams(void)
                 extract_mpeg4_header(infile);
 
                 for(i=0;i<infile->nb_streams;i++)
-                    add_av_stream1(stream, infile->streams[i]->codec);
+                    add_av_stream1(stream, infile->streams[i]->codec, 1);
 
                 av_close_input_file(infile);
             }
@@ -3681,7 +3700,7 @@ static void build_feed_streams(void)
                             ccs = ss->codec;
 #define CHECK_CODEC(x)  (ccf->x != ccs->x)
 
-                            if (CHECK_CODEC(codec) || CHECK_CODEC(codec_type)) {
+                            if (CHECK_CODEC(codec_id) || CHECK_CODEC(codec_type)) {
                                 http_log("Codecs do not match for stream %d\n", i);
                                 matches = 0;
                             } else if (CHECK_CODEC(bit_rate) || CHECK_CODEC(flags)) {

libavcodec/4xm.c

@@ -641,9 +641,18 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
     uint16_t *dst= (uint16_t*)f->current_picture.data[0];
     const int stride= f->current_picture.linesize[0]>>1;
     const unsigned int bitstream_size= AV_RL32(buf);
-    const int token_count av_unused = AV_RL32(buf + bitstream_size + 8);
-    unsigned int prestream_size= 4*AV_RL32(buf + bitstream_size + 4);
-    const uint8_t *prestream= buf + bitstream_size + 12;
+    int token_count av_unused;
+    unsigned int prestream_size;
+    const uint8_t *prestream;
+
+    if (length < bitstream_size + 12) {
+        av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    token_count    = AV_RL32(buf + bitstream_size + 8);
+    prestream_size = 4 * AV_RL32(buf + bitstream_size + 4);
+    prestream      = buf + bitstream_size + 12;
 
     if(prestream_size + bitstream_size + 12 != length
        || bitstream_size > (1<<26)

libavcodec/Makefile

@@ -43,7 +43,7 @@ OBJS-$(CONFIG_VAAPI)                   += vaapi.o
 OBJS-$(CONFIG_VDPAU)                   += vdpau.o
 
 # decoders/encoders/hardware accelerators
-OBJS-$(CONFIG_AAC_DECODER)             += aac.o aactab.o aacsbr.o
+OBJS-$(CONFIG_AAC_DECODER)             += aacdec.o aactab.o aacsbr.o aacps.o
 OBJS-$(CONFIG_AAC_ENCODER)             += aacenc.o aaccoder.o    \
                                           aacpsy.o aactab.o      \
                                           psymodel.o iirfilter.o \
@@ -501,6 +501,8 @@ OBJS-$(CONFIG_OGG_DEMUXER)             += flacdec.o flacdata.o flac.o \
                                           dirac.o mpeg12data.o
 OBJS-$(CONFIG_OGG_MUXER)               += xiph.o flacdec.o flacdata.o flac.o
 OBJS-$(CONFIG_RTP_MUXER)               += mpegvideo.o
+OBJS-$(CONFIG_WEBM_MUXER)              += xiph.o mpeg4audio.o \
+                                          flacdec.o flacdata.o flac.o
 
 # external codec libraries
 OBJS-$(CONFIG_LIBDIRAC_DECODER)           += libdiracdec.o
@@ -525,6 +527,9 @@ OBJS-$(CONFIG_LIBSCHROEDINGER_ENCODER)    += libschroedingerenc.o \
 OBJS-$(CONFIG_LIBSPEEX_DECODER)           += libspeexdec.o
 OBJS-$(CONFIG_LIBTHEORA_ENCODER)          += libtheoraenc.o
 OBJS-$(CONFIG_LIBVORBIS_ENCODER)          += libvorbis.o
+OBJS-$(CONFIG_LIBVO_AACENC_ENCODER)       += libvo-aacenc.o mpeg4audio.o
+OBJS-$(CONFIG_LIBVPX_DECODER)             += libvpxdec.o
+OBJS-$(CONFIG_LIBVPX_ENCODER)             += libvpxenc.o
 OBJS-$(CONFIG_LIBX264_ENCODER)            += libx264.o
 OBJS-$(CONFIG_LIBXVID_ENCODER)            += libxvidff.o libxvid_rc.o
 
@@ -641,7 +646,9 @@ $(SUBDIR)%_tables.h: $(SUBDIR)%_tablegen$(HOSTEXESUF)
 	$(M)./$< > $@
 
 ifdef CONFIG_HARDCODED_TABLES
-$(SUBDIR)aac.o: $(SUBDIR)cbrt_tables.h
+$(SUBDIR)aacdec.o: $(SUBDIR)cbrt_tables.h
+$(SUBDIR)aacps.o: $(SUBDIR)aacps_tables.h
+$(SUBDIR)aactab.o: $(SUBDIR)aac_tables.h
 $(SUBDIR)dv.o: $(SUBDIR)dv_tables.h
 $(SUBDIR)mdct.o: $(SUBDIR)mdct_tables.h
 $(SUBDIR)mpegaudiodec.o: $(SUBDIR)mpegaudio_tables.h

libavcodec/aac.h

@@ -38,12 +38,6 @@
 
 #include <stdint.h>
 
-#define AAC_INIT_VLC_STATIC(num, size) \
-    INIT_VLC_STATIC(&vlc_spectral[num], 8, ff_aac_spectral_sizes[num], \
-         ff_aac_spectral_bits[num], sizeof( ff_aac_spectral_bits[num][0]), sizeof( ff_aac_spectral_bits[num][0]), \
-        ff_aac_spectral_codes[num], sizeof(ff_aac_spectral_codes[num][0]), sizeof(ff_aac_spectral_codes[num][0]), \
-        size);
-
 #define MAX_CHANNELS 64
 #define MAX_ELEM_ID 16
 
@@ -241,7 +235,7 @@ typedef struct {
  * main AAC context
  */
 typedef struct {
-    AVCodecContext * avccontext;
+    AVCodecContext *avctx;
 
     MPEG4AudioConfig m4ac;
 
@@ -255,8 +249,9 @@ typedef struct {
     enum ChannelPosition che_pos[4][MAX_ELEM_ID]; /**< channel element channel mapping with the
                                                    *   first index as the first 4 raw data block types
                                                    */
-    ChannelElement * che[4][MAX_ELEM_ID];
-    ChannelElement * tag_che_map[4][MAX_ELEM_ID];
+    ChannelElement          *che[4][MAX_ELEM_ID];
+    ChannelElement  *tag_che_map[4][MAX_ELEM_ID];
+    uint8_t tags_seen_this_frame[4][MAX_ELEM_ID];
     int tags_mapped;
     /** @} */
 

libavcodec/aac_tablegen.c

@@ -0,0 +1,39 @@
+/*
+ * Generate a header file for hardcoded AAC tables
+ *
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <stdlib.h>
+#define CONFIG_HARDCODED_TABLES 0
+#include "aac_tablegen.h"
+#include "tableprint.h"
+
+int main(void)
+{
+    ff_aac_tableinit();
+
+    write_fileheader();
+
+    printf("const float ff_aac_pow2sf_tab[428] = {\n");
+    write_float_array(ff_aac_pow2sf_tab, 428);
+    printf("};\n");
+
+    return 0;
+}

libavcodec/aac_tablegen.h

@@ -0,0 +1,42 @@
+/*
+ * Header file for hardcoded AAC tables
+ *
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AAC_TABLEGEN_H
+#define AAC_TABLEGEN_H
+
+#include "aac_tablegen_decl.h"
+
+#if CONFIG_HARDCODED_TABLES
+#include "libavcodec/aac_tables.h"
+#else
+#include "../libavutil/mathematics.h"
+float ff_aac_pow2sf_tab[428];
+
+void ff_aac_tableinit(void)
+{
+    int i;
+    for (i = 0; i < 428; i++)
+        ff_aac_pow2sf_tab[i] = pow(2, (i - 200) / 4.);
+}
+#endif /* CONFIG_HARDCODED_TABLES */
+
+#endif /* AAC_TABLEGEN_H */

libavcodec/aac_tablegen_decl.h

@@ -0,0 +1,34 @@
+/*
+ * Header file for hardcoded AAC tables
+ *
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AAC_TABLEGEN_INIT_H
+#define AAC_TABLEGEN_INIT_H
+
+#if CONFIG_HARDCODED_TABLES
+#define ff_aac_tableinit()
+extern const float ff_aac_pow2sf_tab[428];
+#else
+void ff_aac_tableinit(void);
+extern       float ff_aac_pow2sf_tab[428];
+#endif /* CONFIG_HARDCODED_TABLES */
+
+#endif /* AAC_TABLEGEN_INIT_H */

libavcodec/aaccoder.c

@@ -35,6 +35,7 @@
 #include "aac.h"
 #include "aacenc.h"
 #include "aactab.h"
+#include "libavutil/libm.h"
 
 /** bits needed to code codebook run value for long windows */
 static const uint8_t run_value_bits_long[64] = {
@@ -763,7 +764,7 @@ static void search_for_quantizers_faac(AVCodecContext *avctx, AACEncContext *s,
             const float *scaled = s->scoefs   + start;
             const int size      = sce->ics.swb_sizes[g];
             int scf, prev_scf, step;
-            int min_scf = 0, max_scf = 255;
+            int min_scf = -1, max_scf = 256;
             float curdiff;
             if (maxq[w*16+g] < 21.544) {
                 sce->zeroes[w*16+g] = 1;
@@ -797,21 +798,23 @@ static void search_for_quantizers_faac(AVCodecContext *avctx, AACEncContext *s,
                 }
                 prev_scf = scf;
                 curdiff = fabsf(dist - uplim[w*16+g]);
-                if (curdiff == 0.0f)
+                if (curdiff <= 1.0f)
                     step = 0;
                 else
-                    step = fabsf(log2(curdiff));
+                    step = log2(curdiff);
                 if (dist > uplim[w*16+g])
                     step = -step;
+                scf += step;
+                scf = av_clip_uint8(scf);
+                step = scf - prev_scf;
                 if (FFABS(step) <= 1 || (step > 0 && scf >= max_scf) || (step < 0 && scf <= min_scf)) {
-                    sce->sf_idx[w*16+g] = scf;
+                    sce->sf_idx[w*16+g] = av_clip(scf, min_scf, max_scf);
                     break;
                 }
-                scf += step;
                 if (step > 0)
-                    min_scf = scf;
+                    min_scf = prev_scf;
                 else
-                    max_scf = scf;
+                    max_scf = prev_scf;
             }
             start += size;
         }

libavcodec/aacdec.c

@@ -67,7 +67,7 @@
  * Y (not in this code) Layer-2
  * Y (not in this code) Layer-3
  * N                    SinuSoidal Coding (Transient, Sinusoid, Noise)
- * N (planned)          Parametric Stereo
+ * Y                    Parametric Stereo
  * N                    Direct Stream Transfer
  *
  * Note: - HE AAC v1 comprises LC AAC with Spectral Band Replication.
@@ -113,6 +113,22 @@ static const char overread_err[] = "Input buffer exhausted before END element fo
 
 static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
 {
+    /* Some buggy encoders appear to set all elem_ids to zero and rely on
+    channels always occurring in the same order. This is expressly forbidden
+    by the spec but we will try to work around it.
+    */
+    int err_printed = 0;
+    while (ac->tags_seen_this_frame[type][elem_id] && elem_id < MAX_ELEM_ID) {
+        if (ac->output_configured < OC_LOCKED && !err_printed) {
+            av_log(ac->avctx, AV_LOG_WARNING, "Duplicate channel tag found, attempting to remap.\n");
+            err_printed = 1;
+        }
+        elem_id++;
+    }
+    if (elem_id == MAX_ELEM_ID)
+        return NULL;
+    ac->tags_seen_this_frame[type][elem_id] = 1;
+
     if (ac->tag_che_map[type][elem_id]) {
         return ac->tag_che_map[type][elem_id];
     }
@@ -127,8 +143,8 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
         }
     case 6:
         /* Some streams incorrectly code 5.1 audio as SCE[0] CPE[0] CPE[1] SCE[1]
-           instead of SCE[0] CPE[0] CPE[0] LFE[0]. If we seem to have
-           encountered such a stream, transfer the LFE[0] element to SCE[1] */
+           instead of SCE[0] CPE[0] CPE[1] LFE[0]. If we seem to have
+           encountered such a stream, transfer the LFE[0] element to the SCE[1]'s mapping */
         if (ac->tags_mapped == tags_per_config[ac->m4ac.chan_config] - 1 && (type == TYPE_LFE || type == TYPE_SCE)) {
             ac->tags_mapped++;
             return ac->tag_che_map[type][elem_id] = ac->che[TYPE_LFE][0];
@@ -184,7 +200,8 @@ static av_cold int che_configure(AACContext *ac,
         ff_aac_sbr_ctx_init(&ac->che[type][id]->sbr);
         if (type != TYPE_CCE) {
             ac->output_data[(*channels)++] = ac->che[type][id]->ch[0].ret;
-            if (type == TYPE_CPE) {
+            if (type == TYPE_CPE ||
+                (type == TYPE_SCE && ac->m4ac.ps == 1)) {
                 ac->output_data[(*channels)++] = ac->che[type][id]->ch[1].ret;
             }
         }
@@ -209,9 +226,10 @@ static av_cold int output_configure(AACContext *ac,
                             enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
                             int channel_config, enum OCStatus oc_type)
 {
-    AVCodecContext *avctx = ac->avccontext;
+    AVCodecContext *avctx = ac->avctx;
     int i, type, channels = 0, ret;
 
+    if (new_che_pos != che_pos)
     memcpy(che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
 
     if (channel_config) {
@@ -292,7 +310,7 @@ static int decode_pce(AACContext *ac, enum ChannelPosition new_che_pos[4][MAX_EL
 
     sampling_index = get_bits(gb, 4);
     if (ac->m4ac.sampling_index != sampling_index)
-        av_log(ac->avccontext, AV_LOG_WARNING, "Sample rate index in program config element does not match the sample rate index configured by the container.\n");
+        av_log(ac->avctx, AV_LOG_WARNING, "Sample rate index in program config element does not match the sample rate index configured by the container.\n");
 
     num_front       = get_bits(gb, 4);
     num_side        = get_bits(gb, 4);
@@ -323,7 +341,7 @@ static int decode_pce(AACContext *ac, enum ChannelPosition new_che_pos[4][MAX_EL
     /* comment field, first byte is length */
     comment_len = get_bits(gb, 8) * 8;
     if (get_bits_left(gb) < comment_len) {
-        av_log(ac->avccontext, AV_LOG_ERROR, overread_err);
+        av_log(ac->avctx, AV_LOG_ERROR, overread_err);
         return -1;
     }
     skip_bits_long(gb, comment_len);
@@ -343,7 +361,7 @@ static av_cold int set_default_channel_config(AACContext *ac,
                                       int channel_config)
 {
     if (channel_config < 1 || channel_config > 7) {
-        av_log(ac->avccontext, AV_LOG_ERROR, "invalid default channel configuration (%d)\n",
+        av_log(ac->avctx, AV_LOG_ERROR, "invalid default channel configuration (%d)\n",
                channel_config);
         return -1;
     }
@@ -388,7 +406,7 @@ static int decode_ga_specific_config(AACContext *ac, GetBitContext *gb,
     int extension_flag, ret;
 
     if (get_bits1(gb)) { // frameLengthFlag
-        av_log_missing_feature(ac->avccontext, "960/120 MDCT window is", 1);
+        av_log_missing_feature(ac->avctx, "960/120 MDCT window is", 1);
         return -1;
     }
 
@@ -452,9 +470,11 @@ static int decode_audio_specific_config(AACContext *ac, void *data,
     if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)
         return -1;
     if (ac->m4ac.sampling_index > 12) {
-        av_log(ac->avccontext, AV_LOG_ERROR, "invalid sampling rate index %d\n", ac->m4ac.sampling_index);
+        av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\n", ac->m4ac.sampling_index);
         return -1;
     }
+    if (ac->m4ac.sbr == 1 && ac->m4ac.ps == -1)
+        ac->m4ac.ps = 1;
 
     skip_bits_long(&gb, i);
 
@@ -465,7 +485,7 @@ static int decode_audio_specific_config(AACContext *ac, void *data,
             return -1;
         break;
     default:
-        av_log(ac->avccontext, AV_LOG_ERROR, "Audio object type %s%d is not supported.\n",
+        av_log(ac->avctx, AV_LOG_ERROR, "Audio object type %s%d is not supported.\n",
                ac->m4ac.sbr == 1? "SBR+" : "", ac->m4ac.object_type);
         return -1;
     }
@@ -508,20 +528,25 @@ static void reset_predictor_group(PredictorState *ps, int group_num)
         reset_predict_state(&ps[i]);
 }
 
-static av_cold int aac_decode_init(AVCodecContext *avccontext)
+#define AAC_INIT_VLC_STATIC(num, size) \
+    INIT_VLC_STATIC(&vlc_spectral[num], 8, ff_aac_spectral_sizes[num], \
+         ff_aac_spectral_bits[num], sizeof( ff_aac_spectral_bits[num][0]), sizeof( ff_aac_spectral_bits[num][0]), \
+        ff_aac_spectral_codes[num], sizeof(ff_aac_spectral_codes[num][0]), sizeof(ff_aac_spectral_codes[num][0]), \
+        size);
+
+static av_cold int aac_decode_init(AVCodecContext *avctx)
 {
-    AACContext *ac = avccontext->priv_data;
-    int i;
+    AACContext *ac = avctx->priv_data;
 
-    ac->avccontext = avccontext;
-    ac->m4ac.sample_rate = avccontext->sample_rate;
+    ac->avctx = avctx;
+    ac->m4ac.sample_rate = avctx->sample_rate;
 
-    if (avccontext->extradata_size > 0) {
-        if (decode_audio_specific_config(ac, avccontext->extradata, avccontext->extradata_size))
+    if (avctx->extradata_size > 0) {
+        if (decode_audio_specific_config(ac, avctx->extradata, avctx->extradata_size))
             return -1;
     }
 
-    avccontext->sample_fmt = SAMPLE_FMT_S16;
+    avctx->sample_fmt = SAMPLE_FMT_S16;
 
     AAC_INIT_VLC_STATIC( 0, 304);
     AAC_INIT_VLC_STATIC( 1, 270);
@@ -537,7 +562,7 @@ static av_cold int aac_decode_init(AVCodecContext *avccontext)
 
     ff_aac_sbr_init();
 
-    dsputil_init(&ac->dsp, avccontext);
+    dsputil_init(&ac->dsp, avctx);
 
     ac->random_state = 0x1f2e3d4c;
 
@@ -555,10 +580,7 @@ static av_cold int aac_decode_init(AVCodecContext *avccontext)
         ac->sf_offset = 60;
     }
 
-#if !CONFIG_HARDCODED_TABLES
-    for (i = 0; i < 428; i++)
-        ff_aac_pow2sf_tab[i] = pow(2, (i - 200) / 4.);
-#endif /* CONFIG_HARDCODED_TABLES */
+    ff_aac_tableinit();
 
     INIT_VLC_STATIC(&vlc_scalefactors,7,FF_ARRAY_ELEMS(ff_aac_scalefactor_code),
                     ff_aac_scalefactor_bits, sizeof(ff_aac_scalefactor_bits[0]), sizeof(ff_aac_scalefactor_bits[0]),
@@ -591,7 +613,7 @@ static int skip_data_stream_element(AACContext *ac, GetBitContext *gb)
         align_get_bits(gb);
 
     if (get_bits_left(gb) < 8 * count) {
-        av_log(ac->avccontext, AV_LOG_ERROR, overread_err);
+        av_log(ac->avctx, AV_LOG_ERROR, overread_err);
         return -1;
     }
     skip_bits_long(gb, 8 * count);
@@ -605,7 +627,7 @@ static int decode_prediction(AACContext *ac, IndividualChannelStream *ics,
     if (get_bits1(gb)) {
         ics->predictor_reset_group = get_bits(gb, 5);
         if (ics->predictor_reset_group == 0 || ics->predictor_reset_group > 30) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "Invalid Predictor Reset Group.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "Invalid Predictor Reset Group.\n");
             return -1;
         }
     }
@@ -624,7 +646,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
                            GetBitContext *gb, int common_window)
 {
     if (get_bits1(gb)) {
-        av_log(ac->avccontext, AV_LOG_ERROR, "Reserved bit set.\n");
+        av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n");
         memset(ics, 0, sizeof(IndividualChannelStream));
         return -1;
     }
@@ -665,11 +687,11 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
                     return -1;
                 }
             } else if (ac->m4ac.object_type == AOT_AAC_LC) {
-                av_log(ac->avccontext, AV_LOG_ERROR, "Prediction is not allowed in AAC-LC.\n");
+                av_log(ac->avctx, AV_LOG_ERROR, "Prediction is not allowed in AAC-LC.\n");
                 memset(ics, 0, sizeof(IndividualChannelStream));
                 return -1;
             } else {
-                av_log_missing_feature(ac->avccontext, "Predictor bit set but LTP is", 1);
+                av_log_missing_feature(ac->avctx, "Predictor bit set but LTP is", 1);
                 memset(ics, 0, sizeof(IndividualChannelStream));
                 return -1;
             }
@@ -677,7 +699,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
     }
 
     if (ics->max_sfb > ics->num_swb) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Number of scalefactor bands in group (%d) exceeds limit (%d).\n",
                ics->max_sfb, ics->num_swb);
         memset(ics, 0, sizeof(IndividualChannelStream));
@@ -708,18 +730,18 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120],
             int sect_len_incr;
             int sect_band_type = get_bits(gb, 4);
             if (sect_band_type == 12) {
-                av_log(ac->avccontext, AV_LOG_ERROR, "invalid band type\n");
+                av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n");
                 return -1;
             }
             while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
                 sect_end += sect_len_incr;
             sect_end += sect_len_incr;
             if (get_bits_left(gb) < 0) {
-                av_log(ac->avccontext, AV_LOG_ERROR, overread_err);
+                av_log(ac->avctx, AV_LOG_ERROR, overread_err);
                 return -1;
             }
             if (sect_end > ics->max_sfb) {
-                av_log(ac->avccontext, AV_LOG_ERROR,
+                av_log(ac->avctx, AV_LOG_ERROR,
                        "Number of bands (%d) exceeds limit (%d).\n",
                        sect_end, ics->max_sfb);
                 return -1;
@@ -764,7 +786,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                 for (; i < run_end; i++, idx++) {
                     offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                     if (offset[2] > 255U) {
-                        av_log(ac->avccontext, AV_LOG_ERROR,
+                        av_log(ac->avctx, AV_LOG_ERROR,
                                "%s (%d) out of range.\n", sf_str[2], offset[2]);
                         return -1;
                     }
@@ -777,7 +799,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                     else
                         offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                     if (offset[1] > 255U) {
-                        av_log(ac->avccontext, AV_LOG_ERROR,
+                        av_log(ac->avctx, AV_LOG_ERROR,
                                "%s (%d) out of range.\n", sf_str[1], offset[1]);
                         return -1;
                     }
@@ -787,7 +809,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                 for (; i < run_end; i++, idx++) {
                     offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                     if (offset[0] > 255U) {
-                        av_log(ac->avccontext, AV_LOG_ERROR,
+                        av_log(ac->avctx, AV_LOG_ERROR,
                                "%s (%d) out of range.\n", sf_str[0], offset[0]);
                         return -1;
                     }
@@ -844,7 +866,7 @@ static int decode_tns(AACContext *ac, TemporalNoiseShaping *tns,
                 tns->length[w][filt] = get_bits(gb, 6 - 2 * is8);
 
                 if ((tns->order[w][filt] = get_bits(gb, 5 - 2 * is8)) > tns_max_order) {
-                    av_log(ac->avccontext, AV_LOG_ERROR, "TNS filter order %d is greater than maximum %d.\n",
+                    av_log(ac->avctx, AV_LOG_ERROR, "TNS filter order %d is greater than maximum %d.\n",
                            tns->order[w][filt], tns_max_order);
                     tns->order[w][filt] = 0;
                     return -1;
@@ -1163,7 +1185,7 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024],
                                     b = 31 - av_log2(~b);
 
                                     if (b > 8) {
-                                        av_log(ac->avccontext, AV_LOG_ERROR, "error in spectral data, ESC overflow\n");
+                                        av_log(ac->avctx, AV_LOG_ERROR, "error in spectral data, ESC overflow\n");
                                         return -1;
                                     }
 
@@ -1216,7 +1238,7 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024],
     return 0;
 
 err_cb_overflow:
-    av_log(ac->avccontext, AV_LOG_ERROR,
+    av_log(ac->avctx, AV_LOG_ERROR,
            "Read beyond end of ff_aac_codebook_vectors[%d][]. index %d >= %d\n",
            band_type[idx], err_idx, ff_aac_spectral_sizes[band_type[idx]]);
     return -1;
@@ -1337,18 +1359,18 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce,
     if (!scale_flag) {
         if ((pulse_present = get_bits1(gb))) {
             if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
-                av_log(ac->avccontext, AV_LOG_ERROR, "Pulse tool not allowed in eight short sequence.\n");
+                av_log(ac->avctx, AV_LOG_ERROR, "Pulse tool not allowed in eight short sequence.\n");
                 return -1;
             }
             if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {
-                av_log(ac->avccontext, AV_LOG_ERROR, "Pulse data corrupt or invalid.\n");
+                av_log(ac->avctx, AV_LOG_ERROR, "Pulse data corrupt or invalid.\n");
                 return -1;
             }
         }
         if ((tns->present = get_bits1(gb)) && decode_tns(ac, tns, gb, ics))
             return -1;
         if (get_bits1(gb)) {
-            av_log_missing_feature(ac->avccontext, "SSR", 1);
+            av_log_missing_feature(ac->avctx, "SSR", 1);
             return -1;
         }
     }
@@ -1448,7 +1470,7 @@ static int decode_cpe(AACContext *ac, GetBitContext *gb, ChannelElement *cpe)
         cpe->ch[1].ics.use_kb_window[1] = i;
         ms_present = get_bits(gb, 2);
         if (ms_present == 3) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "ms_present = 3 is reserved.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "ms_present = 3 is reserved.\n");
             return -1;
         } else if (ms_present)
             decode_mid_side_stereo(cpe, gb, ms_present);
@@ -1635,16 +1657,20 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
         crc_flag++;
     case EXT_SBR_DATA:
         if (!che) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "SBR was found before the first channel element.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "SBR was found before the first channel element.\n");
             return res;
         } else if (!ac->m4ac.sbr) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "SBR signaled to be not-present but was found in the bitstream.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "SBR signaled to be not-present but was found in the bitstream.\n");
             skip_bits_long(gb, 8 * cnt - 4);
             return res;
         } else if (ac->m4ac.sbr == -1 && ac->output_configured == OC_LOCKED) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "Implicit SBR was found with a first occurrence after the first frame.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "Implicit SBR was found with a first occurrence after the first frame.\n");
             skip_bits_long(gb, 8 * cnt - 4);
             return res;
+        } else if (ac->m4ac.ps == -1 && ac->output_configured < OC_LOCKED && ac->avctx->channels == 1) {
+            ac->m4ac.sbr = 1;
+            ac->m4ac.ps = 1;
+            output_configure(ac, ac->che_pos, ac->che_pos, ac->m4ac.chan_config, ac->output_configured);
         } else {
             ac->m4ac.sbr = 1;
         }
@@ -1728,7 +1754,7 @@ static void imdct_and_windowing(AACContext *ac, SingleChannelElement *sce, float
     // imdct
     if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
         if (ics->window_sequence[1] == ONLY_LONG_SEQUENCE || ics->window_sequence[1] == LONG_STOP_SEQUENCE)
-            av_log(ac->avccontext, AV_LOG_WARNING,
+            av_log(ac->avctx, AV_LOG_WARNING,
                    "Transition from an ONLY_LONG or LONG_STOP to an EIGHT_SHORT sequence detected. "
                    "If you heard an audible artifact, please submit the sample to the FFmpeg developers.\n");
         for (i = 0; i < 1024; i += 128)
@@ -1794,7 +1820,7 @@ static void apply_dependent_coupling(AACContext *ac,
     const float *src = cce->ch[0].coeffs;
     int g, i, group, k, idx = 0;
     if (ac->m4ac.object_type == AOT_AAC_LTP) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Dependent coupling is not supported together with LTP\n");
         return;
     }
@@ -1924,57 +1950,65 @@ static int parse_adts_frame_header(AACContext *ac, GetBitContext *gb)
         } else if (ac->output_configured != OC_LOCKED) {
             ac->output_configured = OC_NONE;
         }
-        if (ac->output_configured != OC_LOCKED)
+        if (ac->output_configured != OC_LOCKED) {
             ac->m4ac.sbr = -1;
+            ac->m4ac.ps  = -1;
+        }
         ac->m4ac.sample_rate     = hdr_info.sample_rate;
         ac->m4ac.sampling_index  = hdr_info.sampling_index;
         ac->m4ac.object_type     = hdr_info.object_type;
-        if (!ac->avccontext->sample_rate)
-            ac->avccontext->sample_rate = hdr_info.sample_rate;
+        if (!ac->avctx->sample_rate)
+            ac->avctx->sample_rate = hdr_info.sample_rate;
         if (hdr_info.num_aac_frames == 1) {
             if (!hdr_info.crc_absent)
                 skip_bits(gb, 16);
         } else {
-            av_log_missing_feature(ac->avccontext, "More than one AAC RDB per ADTS frame is", 0);
+            av_log_missing_feature(ac->avctx, "More than one AAC RDB per ADTS frame is", 0);
             return -1;
         }
     }
     return size;
 }
 
-static int aac_decode_frame(AVCodecContext *avccontext, void *data,
+static int aac_decode_frame(AVCodecContext *avctx, void *data,
                             int *data_size, AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
-    AACContext *ac = avccontext->priv_data;
+    AACContext *ac = avctx->priv_data;
     ChannelElement *che = NULL, *che_prev = NULL;
     GetBitContext gb;
     enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;
     int err, elem_id, data_size_tmp;
     int buf_consumed;
-    int samples = 1024, multiplier;
+    int samples = 0, multiplier;
+    int buf_offset;
 
     init_get_bits(&gb, buf, buf_size * 8);
 
     if (show_bits(&gb, 12) == 0xfff) {
         if (parse_adts_frame_header(ac, &gb) < 0) {
-            av_log(avccontext, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
+            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
             return -1;
         }
         if (ac->m4ac.sampling_index > 12) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "invalid sampling rate index %d\n", ac->m4ac.sampling_index);
+            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\n", ac->m4ac.sampling_index);
             return -1;
         }
     }
 
+    memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));
     // parse
     while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {
         elem_id = get_bits(&gb, 4);
 
-        if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "channel element %d.%d is not allocated\n", elem_type, elem_id);
-            return -1;
+        if (elem_type < TYPE_DSE) {
+            if (!(che=get_che(ac, elem_type, elem_id))) {
+                av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\n",
+                       elem_type, elem_id);
+                return -1;
+            }
+            samples = 1024;
         }
 
         switch (elem_type) {
@@ -2005,7 +2039,7 @@ static int aac_decode_frame(AVCodecContext *avccontext, void *data,
             if ((err = decode_pce(ac, new_che_pos, &gb)))
                 break;
             if (ac->output_configured > OC_TRIAL_PCE)
-                av_log(avccontext, AV_LOG_ERROR,
+                av_log(avctx, AV_LOG_ERROR,
                        "Not evaluating a further program_config_element as this construct is dubious at best.\n");
             else
                 err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);
@@ -2016,7 +2050,7 @@ static int aac_decode_frame(AVCodecContext *avccontext, void *data,
             if (elem_id == 15)
                 elem_id += get_bits(&gb, 8) - 1;
             if (get_bits_left(&gb) < 8 * elem_id) {
-                    av_log(avccontext, AV_LOG_ERROR, overread_err);
+                    av_log(avctx, AV_LOG_ERROR, overread_err);
                     return -1;
             }
             while (elem_id > 0)
@@ -2036,7 +2070,7 @@ static int aac_decode_frame(AVCodecContext *avccontext, void *data,
             return err;
 
         if (get_bits_left(&gb) < 3) {
-            av_log(avccontext, AV_LOG_ERROR, overread_err);
+            av_log(avctx, AV_LOG_ERROR, overread_err);
             return -1;
         }
     }
@@ -2046,31 +2080,36 @@ static int aac_decode_frame(AVCodecContext *avccontext, void *data,
     multiplier = (ac->m4ac.sbr == 1) ? ac->m4ac.ext_sample_rate > ac->m4ac.sample_rate : 0;
     samples <<= multiplier;
     if (ac->output_configured < OC_LOCKED) {
-        avccontext->sample_rate = ac->m4ac.sample_rate << multiplier;
-        avccontext->frame_size = samples;
+        avctx->sample_rate = ac->m4ac.sample_rate << multiplier;
+        avctx->frame_size = samples;
     }
 
-    data_size_tmp = samples * avccontext->channels * sizeof(int16_t);
+    data_size_tmp = samples * avctx->channels * sizeof(int16_t);
     if (*data_size < data_size_tmp) {
-        av_log(avccontext, AV_LOG_ERROR,
+        av_log(avctx, AV_LOG_ERROR,
                "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\n",
                *data_size, data_size_tmp);
         return -1;
     }
     *data_size = data_size_tmp;
 
-    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, samples, avccontext->channels);
+    if (samples)
+        ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, samples, avctx->channels);
 
     if (ac->output_configured)
         ac->output_configured = OC_LOCKED;
 
     buf_consumed = (get_bits_count(&gb) + 7) >> 3;
-    return buf_size > buf_consumed ? buf_consumed : buf_size;
+    for (buf_offset = buf_consumed; buf_offset < buf_size; buf_offset++)
+        if (buf[buf_offset])
+            break;
+
+    return buf_size > buf_offset ? buf_consumed : buf_size;
 }
 
-static av_cold int aac_decode_close(AVCodecContext *avccontext)
+static av_cold int aac_decode_close(AVCodecContext *avctx)
 {
-    AACContext *ac = avccontext->priv_data;
+    AACContext *ac = avctx->priv_data;
     int i, type;
 
     for (i = 0; i < MAX_ELEM_ID; i++) {

libavcodec/aacenc.c

@@ -174,6 +174,10 @@ static av_cold int aac_encode_init(AVCodecContext *avctx)
         av_log(avctx, AV_LOG_ERROR, "Unsupported profile %d\n", avctx->profile);
         return -1;
     }
+    if (1024.0 * avctx->bit_rate / avctx->sample_rate > 6144 * avctx->channels) {
+        av_log(avctx, AV_LOG_ERROR, "Too many bits per frame requested\n");
+        return -1;
+    }
     s->samplerate_index = i;
 
     dsputil_init(&s->dsp, avctx);
@@ -197,13 +201,11 @@ static av_cold int aac_encode_init(AVCodecContext *avctx)
     lengths[1] = ff_aac_num_swb_128[i];
     ff_psy_init(&s->psy, avctx, 2, sizes, lengths);
     s->psypp = ff_psy_preprocess_init(avctx);
-    s->coder = &ff_aac_coders[0];
+    s->coder = &ff_aac_coders[2];
 
     s->lambda = avctx->global_quality ? avctx->global_quality : 120;
-#if !CONFIG_HARDCODED_TABLES
-    for (i = 0; i < 428; i++)
-        ff_aac_pow2sf_tab[i] = pow(2, (i - 200)/4.);
-#endif /* CONFIG_HARDCODED_TABLES */
+
+    ff_aac_tableinit();
 
     if (avctx->channels > 5)
         av_log(avctx, AV_LOG_ERROR, "This encoder does not yet enforce the restrictions on LFEs. "
@@ -230,25 +232,21 @@ static void apply_window_and_mdct(AVCodecContext *avctx, AACEncContext *s,
                 s->output[i] = sce->saved[i];
         }
         if (sce->ics.window_sequence[0] != LONG_START_SEQUENCE) {
-            j = channel;
-            for (i = 0; i < 1024; i++, j += avctx->channels) {
+            for (i = 0, j = channel; i < 1024; i++, j += avctx->channels) {
                 s->output[i+1024]         = audio[j] * lwindow[1024 - i - 1];
                 sce->saved[i] = audio[j] * lwindow[i];
             }
         } else {
-            j = channel;
-            for (i = 0; i < 448; i++, j += avctx->channels)
+            for (i = 0, j = channel; i < 448; i++, j += avctx->channels)
                 s->output[i+1024]         = audio[j];
-            for (i = 448; i < 576; i++, j += avctx->channels)
+            for (; i < 576; i++, j += avctx->channels)
                 s->output[i+1024]         = audio[j] * swindow[576 - i - 1];
             memset(s->output+1024+576, 0, sizeof(s->output[0]) * 448);
-            j = channel;
-            for (i = 0; i < 1024; i++, j += avctx->channels)
+            for (i = 0, j = channel; i < 1024; i++, j += avctx->channels)
                 sce->saved[i] = audio[j];
         }
         ff_mdct_calc(&s->mdct1024, sce->coeffs, s->output);
     } else {
-        j = channel;
         for (k = 0; k < 1024; k += 128) {
             for (i = 448 + k; i < 448 + k + 256; i++)
                 s->output[i - 448 - k] = (i < 1024)
@@ -258,8 +256,7 @@ static void apply_window_and_mdct(AVCodecContext *avctx, AACEncContext *s,
             s->dsp.vector_fmul_reverse(s->output+128, s->output+128, swindow, 128);
             ff_mdct_calc(&s->mdct128, sce->coeffs + k, s->output);
         }
-        j = channel;
-        for (i = 0; i < 1024; i++, j += avctx->channels)
+        for (i = 0, j = channel; i < 1024; i++, j += avctx->channels)
             sce->saved[i] = audio[j];
     }
 }
@@ -557,6 +554,8 @@ static int aac_encode_frame(AVCodecContext *avctx,
             chans    = tag == TYPE_CPE ? 2 : 1;
             cpe      = &s->cpe[i];
             for (j = 0; j < chans; j++) {
+                s->cur_channel = start_ch + j;
+                ff_psy_set_band_info(&s->psy, s->cur_channel, cpe->ch[j].coeffs, &wi[j]);
                 s->coder->search_for_quantizers(avctx, s, &cpe->ch[j], s->lambda);
             }
             cpe->common_window = 0;
@@ -572,6 +571,7 @@ static int aac_encode_frame(AVCodecContext *avctx,
                     }
                 }
             }
+            s->cur_channel = start_ch;
             if (cpe->common_window && s->coder->search_for_ms)
                 s->coder->search_for_ms(s, cpe, s->lambda);
             adjust_frame_information(s, cpe, chans);
@@ -586,7 +586,6 @@ static int aac_encode_frame(AVCodecContext *avctx,
             }
             for (j = 0; j < chans; j++) {
                 s->cur_channel = start_ch + j;
-                ff_psy_set_band_info(&s->psy, s->cur_channel, cpe->ch[j].coeffs, &wi[j]);
                 encode_individual_channel(avctx, s, &cpe->ch[j], cpe->common_window);
             }
             start_ch += chans;
@@ -639,7 +638,7 @@ AVCodec aac_encoder = {
     aac_encode_init,
     aac_encode_frame,
     aac_encode_end,
-    .capabilities = CODEC_CAP_SMALL_LAST_FRAME | CODEC_CAP_DELAY,
+    .capabilities = CODEC_CAP_SMALL_LAST_FRAME | CODEC_CAP_DELAY | CODEC_CAP_EXPERIMENTAL,
     .sample_fmts = (const enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("Advanced Audio Coding"),
 };

libavcodec/aacenc.h

@@ -64,7 +64,7 @@ typedef struct AACEncContext {
     int cur_channel;
     int last_frame;
     float lambda;
-    DECLARE_ALIGNED(16, int,   qcoefs)[96][2];   ///< quantized coefficients
+    DECLARE_ALIGNED(16, int,   qcoefs)[96];      ///< quantized coefficients
     DECLARE_ALIGNED(16, float, scoefs)[1024];    ///< scaled coefficients
 } AACEncContext;
 

libavcodec/aacps.h

@@ -0,0 +1,82 @@
+/*
+ * MPEG-4 Parametric Stereo definitions and declarations
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AVCODEC_PS_H
+#define AVCODEC_PS_H
+
+#include <stdint.h>
+
+#include "avcodec.h"
+#include "get_bits.h"
+
+#define PS_MAX_NUM_ENV 5
+#define PS_MAX_NR_IIDICC 34
+#define PS_MAX_NR_IPDOPD 17
+#define PS_MAX_SSB 91
+#define PS_MAX_AP_BANDS 50
+#define PS_QMF_TIME_SLOTS 32
+#define PS_MAX_DELAY 14
+#define PS_AP_LINKS 3
+#define PS_MAX_AP_DELAY 5
+
+typedef struct {
+    int    start;
+    int    enable_iid;
+    int    iid_quant;
+    int    nr_iid_par;
+    int    nr_ipdopd_par;
+    int    enable_icc;
+    int    icc_mode;
+    int    nr_icc_par;
+    int    enable_ext;
+    int    frame_class;
+    int    num_env_old;
+    int    num_env;
+    int    enable_ipdopd;
+    int    border_position[PS_MAX_NUM_ENV+1];
+    int8_t iid_par[PS_MAX_NUM_ENV][PS_MAX_NR_IIDICC]; //<Inter-channel Intensity Difference Parameters
+    int8_t icc_par[PS_MAX_NUM_ENV][PS_MAX_NR_IIDICC]; //<Inter-Channel Coherence Parameters
+    /* ipd/opd is iid/icc sized so that the same functions can handle both */
+    int8_t ipd_par[PS_MAX_NUM_ENV][PS_MAX_NR_IIDICC]; //<Inter-channel Phase Difference Parameters
+    int8_t opd_par[PS_MAX_NUM_ENV][PS_MAX_NR_IIDICC]; //<Overall Phase Difference Parameters
+    int    is34bands;
+    int    is34bands_old;
+
+    float  in_buf[5][44][2];
+    float  delay[PS_MAX_SSB][PS_QMF_TIME_SLOTS + PS_MAX_DELAY][2];
+    float  ap_delay[PS_MAX_AP_BANDS][PS_AP_LINKS][PS_QMF_TIME_SLOTS + PS_MAX_AP_DELAY][2];
+    float  peak_decay_nrg[34];
+    float  power_smooth[34];
+    float  peak_decay_diff_smooth[34];
+    float  H11[2][PS_MAX_NUM_ENV+1][PS_MAX_NR_IIDICC];
+    float  H12[2][PS_MAX_NUM_ENV+1][PS_MAX_NR_IIDICC];
+    float  H21[2][PS_MAX_NUM_ENV+1][PS_MAX_NR_IIDICC];
+    float  H22[2][PS_MAX_NUM_ENV+1][PS_MAX_NR_IIDICC];
+    int8_t opd_hist[PS_MAX_NR_IIDICC];
+    int8_t ipd_hist[PS_MAX_NR_IIDICC];
+} PSContext;
+
+void ff_ps_init(void);
+void ff_ps_ctx_init(PSContext *ps);
+int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb, PSContext *ps, int bits_left);
+int ff_ps_apply(AVCodecContext *avctx, PSContext *ps, float L[2][38][64], float R[2][38][64], int top);
+
+#endif /* AVCODEC_PS_H */

libavcodec/aacps_tablegen.c

@@ -0,0 +1,93 @@
+/*
+ * Generate a header file for hardcoded Parametric Stereo tables
+ *
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <stdlib.h>
+#define CONFIG_HARDCODED_TABLES 0
+#include "aacps_tablegen.h"
+#include "tableprint.h"
+
+void write_float_3d_array (const void *p, int b, int c, int d)
+{
+    int i;
+    const float *f = p;
+    for (i = 0; i < b; i++) {
+        printf("{\n");
+        write_float_2d_array(f, c, d);
+        printf("},\n");
+        f += c * d;
+    }
+}
+
+void write_float_4d_array (const void *p, int a, int b, int c, int d)
+{
+    int i;
+    const float *f = p;
+    for (i = 0; i < a; i++) {
+        printf("{\n");
+        write_float_3d_array(f, b, c, d);
+        printf("},\n");
+        f += b * c * d;
+    }
+}
+
+int main(void)
+{
+    ps_tableinit();
+
+    write_fileheader();
+
+    printf("static const float pd_re_smooth[8*8*8] = {\n");
+    write_float_array(pd_re_smooth, 8*8*8);
+    printf("};\n");
+    printf("static const float pd_im_smooth[8*8*8] = {\n");
+    write_float_array(pd_im_smooth, 8*8*8);
+    printf("};\n");
+
+    printf("static const float HA[46][8][4] = {\n");
+    write_float_3d_array(HA, 46, 8, 4);
+    printf("};\n");
+    printf("static const float HB[46][8][4] = {\n");
+    write_float_3d_array(HB, 46, 8, 4);
+    printf("};\n");
+
+    printf("static const float f20_0_8[8][7][2] = {\n");
+    write_float_3d_array(f20_0_8, 8, 7, 2);
+    printf("};\n");
+    printf("static const float f34_0_12[12][7][2] = {\n");
+    write_float_3d_array(f34_0_12, 12, 7, 2);
+    printf("};\n");
+    printf("static const float f34_1_8[8][7][2] = {\n");
+    write_float_3d_array(f34_1_8, 8, 7, 2);
+    printf("};\n");
+    printf("static const float f34_2_4[4][7][2] = {\n");
+    write_float_3d_array(f34_2_4, 4, 7, 2);
+    printf("};\n");
+
+    printf("static const float Q_fract_allpass[2][50][3][2] = {\n");
+    write_float_4d_array(Q_fract_allpass, 2, 50, 3, 2);
+    printf("};\n");
+    printf("static const float phi_fract[2][50][2] = {\n");
+    write_float_3d_array(phi_fract, 2, 50, 2);
+    printf("};\n");
+
+    return 0;
+}

libavcodec/aacps_tablegen.h

@@ -0,0 +1,212 @@
+/*
+ * Header file for hardcoded Parametric Stereo tables
+ *
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef AACPS_TABLEGEN_H
+#define AACPS_TABLEGEN_H
+
+#include <stdint.h>
+
+#if CONFIG_HARDCODED_TABLES
+#define ps_tableinit()
+#include "libavcodec/aacps_tables.h"
+#else
+#include "../libavutil/common.h"
+#include "../libavutil/mathematics.h"
+#define NR_ALLPASS_BANDS20 30
+#define NR_ALLPASS_BANDS34 50
+#define PS_AP_LINKS 3
+static float pd_re_smooth[8*8*8];
+static float pd_im_smooth[8*8*8];
+static float HA[46][8][4];
+static float HB[46][8][4];
+static float f20_0_8 [ 8][7][2];
+static float f34_0_12[12][7][2];
+static float f34_1_8 [ 8][7][2];
+static float f34_2_4 [ 4][7][2];
+static float Q_fract_allpass[2][50][3][2];
+static float phi_fract[2][50][2];
+
+static const float g0_Q8[] = {
+    0.00746082949812f, 0.02270420949825f, 0.04546865930473f, 0.07266113929591f,
+    0.09885108575264f, 0.11793710567217f, 0.125f
+};
+
+static const float g0_Q12[] = {
+    0.04081179924692f, 0.03812810994926f, 0.05144908135699f, 0.06399831151592f,
+    0.07428313801106f, 0.08100347892914f, 0.08333333333333f
+};
+
+static const float g1_Q8[] = {
+    0.01565675600122f, 0.03752716391991f, 0.05417891378782f, 0.08417044116767f,
+    0.10307344158036f, 0.12222452249753f, 0.125f
+};
+
+static const float g2_Q4[] = {
+    -0.05908211155639f, -0.04871498374946f, 0.0f,   0.07778723915851f,
+     0.16486303567403f,  0.23279856662996f, 0.25f
+};
+
+static void make_filters_from_proto(float (*filter)[7][2], const float *proto, int bands)
+{
+    int q, n;
+    for (q = 0; q < bands; q++) {
+        for (n = 0; n < 7; n++) {
+            double theta = 2 * M_PI * (q + 0.5) * (n - 6) / bands;
+            filter[q][n][0] = proto[n] *  cos(theta);
+            filter[q][n][1] = proto[n] * -sin(theta);
+        }
+    }
+}
+
+static void ps_tableinit(void)
+{
+    static const float ipdopd_sin[] = { 0, M_SQRT1_2, 1,  M_SQRT1_2,  0, -M_SQRT1_2, -1, -M_SQRT1_2 };
+    static const float ipdopd_cos[] = { 1, M_SQRT1_2, 0, -M_SQRT1_2, -1, -M_SQRT1_2,  0,  M_SQRT1_2 };
+    int pd0, pd1, pd2;
+
+    static const float iid_par_dequant[] = {
+        //iid_par_dequant_default
+        0.05623413251903, 0.12589254117942, 0.19952623149689, 0.31622776601684,
+        0.44668359215096, 0.63095734448019, 0.79432823472428, 1,
+        1.25892541179417, 1.58489319246111, 2.23872113856834, 3.16227766016838,
+        5.01187233627272, 7.94328234724282, 17.7827941003892,
+        //iid_par_dequant_fine
+        0.00316227766017, 0.00562341325190, 0.01,             0.01778279410039,
+        0.03162277660168, 0.05623413251903, 0.07943282347243, 0.11220184543020,
+        0.15848931924611, 0.22387211385683, 0.31622776601684, 0.39810717055350,
+        0.50118723362727, 0.63095734448019, 0.79432823472428, 1,
+        1.25892541179417, 1.58489319246111, 1.99526231496888, 2.51188643150958,
+        3.16227766016838, 4.46683592150963, 6.30957344480193, 8.91250938133745,
+        12.5892541179417, 17.7827941003892, 31.6227766016838, 56.2341325190349,
+        100,              177.827941003892, 316.227766016837,
+    };
+    static const float icc_invq[] = {
+        1, 0.937,      0.84118,    0.60092,    0.36764,   0,      -0.589,    -1
+    };
+    static const float acos_icc_invq[] = {
+        0, 0.35685527, 0.57133466, 0.92614472, 1.1943263, M_PI/2, 2.2006171, M_PI
+    };
+    int iid, icc;
+
+    int k, m;
+    static const int8_t f_center_20[] = {
+        -3, -1, 1, 3, 5, 7, 10, 14, 18, 22,
+    };
+    static const int8_t f_center_34[] = {
+         2,  6, 10, 14, 18, 22, 26, 30,
+        34,-10, -6, -2, 51, 57, 15, 21,
+        27, 33, 39, 45, 54, 66, 78, 42,
+       102, 66, 78, 90,102,114,126, 90,
+    };
+    static const float fractional_delay_links[] = { 0.43f, 0.75f, 0.347f };
+    const float fractional_delay_gain = 0.39f;
+
+    for (pd0 = 0; pd0 < 8; pd0++) {
+        float pd0_re = ipdopd_cos[pd0];
+        float pd0_im = ipdopd_sin[pd0];
+        for (pd1 = 0; pd1 < 8; pd1++) {
+            float pd1_re = ipdopd_cos[pd1];
+            float pd1_im = ipdopd_sin[pd1];
+            for (pd2 = 0; pd2 < 8; pd2++) {
+                float pd2_re = ipdopd_cos[pd2];
+                float pd2_im = ipdopd_sin[pd2];
+                float re_smooth = 0.25f * pd0_re + 0.5f * pd1_re + pd2_re;
+                float im_smooth = 0.25f * pd0_im + 0.5f * pd1_im + pd2_im;
+                float pd_mag = 1 / sqrt(im_smooth * im_smooth + re_smooth * re_smooth);
+                pd_re_smooth[pd0*64+pd1*8+pd2] = re_smooth * pd_mag;
+                pd_im_smooth[pd0*64+pd1*8+pd2] = im_smooth * pd_mag;
+            }
+        }
+    }
+
+    for (iid = 0; iid < 46; iid++) {
+        float c = iid_par_dequant[iid]; //<Linear Inter-channel Intensity Difference
+        float c1 = (float)M_SQRT2 / sqrtf(1.0f + c*c);
+        float c2 = c * c1;
+        for (icc = 0; icc < 8; icc++) {
+            /*if (PS_BASELINE || ps->icc_mode < 3)*/ {
+                float alpha = 0.5f * acos_icc_invq[icc];
+                float beta  = alpha * (c1 - c2) * (float)M_SQRT1_2;
+                HA[iid][icc][0] = c2 * cosf(beta + alpha);
+                HA[iid][icc][1] = c1 * cosf(beta - alpha);
+                HA[iid][icc][2] = c2 * sinf(beta + alpha);
+                HA[iid][icc][3] = c1 * sinf(beta - alpha);
+            } /* else */ {
+                float alpha, gamma, mu, rho;
+                float alpha_c, alpha_s, gamma_c, gamma_s;
+                rho = FFMAX(icc_invq[icc], 0.05f);
+                alpha = 0.5f * atan2f(2.0f * c * rho, c*c - 1.0f);
+                mu = c + 1.0f / c;
+                mu = sqrtf(1 + (4 * rho * rho - 4)/(mu * mu));
+                gamma = atanf(sqrtf((1.0f - mu)/(1.0f + mu)));
+                if (alpha < 0) alpha += M_PI/2;
+                alpha_c = cosf(alpha);
+                alpha_s = sinf(alpha);
+                gamma_c = cosf(gamma);
+                gamma_s = sinf(gamma);
+                HB[iid][icc][0] =  M_SQRT2 * alpha_c * gamma_c;
+                HB[iid][icc][1] =  M_SQRT2 * alpha_s * gamma_c;
+                HB[iid][icc][2] = -M_SQRT2 * alpha_s * gamma_s;
+                HB[iid][icc][3] =  M_SQRT2 * alpha_c * gamma_s;
+            }
+        }
+    }
+
+    for (k = 0; k < NR_ALLPASS_BANDS20; k++) {
+        double f_center, theta;
+        if (k < FF_ARRAY_ELEMS(f_center_20))
+            f_center = f_center_20[k] * 0.125;
+        else
+            f_center = k - 6.5f;
+        for (m = 0; m < PS_AP_LINKS; m++) {
+            theta = -M_PI * fractional_delay_links[m] * f_center;
+            Q_fract_allpass[0][k][m][0] = cos(theta);
+            Q_fract_allpass[0][k][m][1] = sin(theta);
+        }
+        theta = -M_PI*fractional_delay_gain*f_center;
+        phi_fract[0][k][0] = cos(theta);
+        phi_fract[0][k][1] = sin(theta);
+    }
+    for (k = 0; k < NR_ALLPASS_BANDS34; k++) {
+        double f_center, theta;
+        if (k < FF_ARRAY_ELEMS(f_center_34))
+            f_center = f_center_34[k] / 24.;
+        else
+            f_center = k - 26.5f;
+        for (m = 0; m < PS_AP_LINKS; m++) {
+            theta = -M_PI * fractional_delay_links[m] * f_center;
+            Q_fract_allpass[1][k][m][0] = cos(theta);
+            Q_fract_allpass[1][k][m][1] = sin(theta);
+        }
+        theta = -M_PI*fractional_delay_gain*f_center;
+        phi_fract[1][k][0] = cos(theta);
+        phi_fract[1][k][1] = sin(theta);
+    }
+
+    make_filters_from_proto(f20_0_8,  g0_Q8,   8);
+    make_filters_from_proto(f34_0_12, g0_Q12, 12);
+    make_filters_from_proto(f34_1_8,  g1_Q8,   8);
+    make_filters_from_proto(f34_2_4,  g2_Q4,   4);
+}
+#endif /* CONFIG_HARDCODED_TABLES */
+
+#endif /* AACPS_TABLEGEN_H */

libavcodec/aacpsdata.c

@@ -0,0 +1,163 @@
+/*
+ * MPEG-4 Parametric Stereo data tables
+ * Copyright (c) 2010 Alex Converse <alex.converse@gmail.com>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+static const uint8_t huff_iid_df1_bits[] = {
+    18, 18, 18, 18, 18, 18, 18, 18, 18, 17, 18, 17, 17, 16, 16, 15, 14, 14,
+    13, 12, 12, 11, 10, 10,  8,  7,  6,  5,  4,  3,  1,  3,  4,  5,  6,  7,
+     8,  9, 10, 11, 11, 12, 13, 14, 14, 15, 16, 16, 17, 17, 18, 17, 18, 18,
+    18, 18, 18, 18, 18, 18, 18,
+};
+
+static const uint32_t huff_iid_df1_codes[] = {
+    0x01FEB4, 0x01FEB5, 0x01FD76, 0x01FD77, 0x01FD74, 0x01FD75, 0x01FE8A,
+    0x01FE8B, 0x01FE88, 0x00FE80, 0x01FEB6, 0x00FE82, 0x00FEB8, 0x007F42,
+    0x007FAE, 0x003FAF, 0x001FD1, 0x001FE9, 0x000FE9, 0x0007EA, 0x0007FB,
+    0x0003FB, 0x0001FB, 0x0001FF, 0x00007C, 0x00003C, 0x00001C, 0x00000C,
+    0x000000, 0x000001, 0x000001, 0x000002, 0x000001, 0x00000D, 0x00001D,
+    0x00003D, 0x00007D, 0x0000FC, 0x0001FC, 0x0003FC, 0x0003F4, 0x0007EB,
+    0x000FEA, 0x001FEA, 0x001FD6, 0x003FD0, 0x007FAF, 0x007F43, 0x00FEB9,
+    0x00FE83, 0x01FEB7, 0x00FE81, 0x01FE89, 0x01FE8E, 0x01FE8F, 0x01FE8C,
+    0x01FE8D, 0x01FEB2, 0x01FEB3, 0x01FEB0, 0x01FEB1,
+};
+
+static const uint8_t huff_iid_dt1_bits[] = {
+    16, 16, 16, 16, 16, 16, 16, 16, 16, 15, 15, 15, 15, 15, 15, 14, 14, 13,
+    13, 13, 12, 12, 11, 10,  9,  9,  7,  6,  5,  3,  1,  2,  5,  6,  7,  8,
+     9, 10, 11, 11, 12, 12, 13, 13, 14, 14, 15, 15, 15, 15, 16, 16, 16, 16,
+    16, 16, 16, 16, 16, 16, 16,
+};
+
+static const uint16_t huff_iid_dt1_codes[] = {
+    0x004ED4, 0x004ED5, 0x004ECE, 0x004ECF, 0x004ECC, 0x004ED6, 0x004ED8,
+    0x004F46, 0x004F60, 0x002718, 0x002719, 0x002764, 0x002765, 0x00276D,
+    0x0027B1, 0x0013B7, 0x0013D6, 0x0009C7, 0x0009E9, 0x0009ED, 0x0004EE,
+    0x0004F7, 0x000278, 0x000139, 0x00009A, 0x00009F, 0x000020, 0x000011,
+    0x00000A, 0x000003, 0x000001, 0x000000, 0x00000B, 0x000012, 0x000021,
+    0x00004C, 0x00009B, 0x00013A, 0x000279, 0x000270, 0x0004EF, 0x0004E2,
+    0x0009EA, 0x0009D8, 0x0013D7, 0x0013D0, 0x0027B2, 0x0027A2, 0x00271A,
+    0x00271B, 0x004F66, 0x004F67, 0x004F61, 0x004F47, 0x004ED9, 0x004ED7,
+    0x004ECD, 0x004ED2, 0x004ED3, 0x004ED0, 0x004ED1,
+};
+
+static const uint8_t huff_iid_df0_bits[] = {
+    17, 17, 17, 17, 16, 15, 13, 10,  9,  7,  6,  5,  4,  3,  1,  3,  4,  5,
+     6,  6,  8, 11, 13, 14, 14, 15, 17, 18, 18,
+};
+
+static const uint32_t huff_iid_df0_codes[] = {
+    0x01FFFB, 0x01FFFC, 0x01FFFD, 0x01FFFA, 0x00FFFC, 0x007FFC, 0x001FFD,
+    0x0003FE, 0x0001FE, 0x00007E, 0x00003C, 0x00001D, 0x00000D, 0x000005,
+    0x000000, 0x000004, 0x00000C, 0x00001C, 0x00003D, 0x00003E, 0x0000FE,
+    0x0007FE, 0x001FFC, 0x003FFC, 0x003FFD, 0x007FFD, 0x01FFFE, 0x03FFFE,
+    0x03FFFF,
+};
+
+static const uint8_t huff_iid_dt0_bits[] = {
+    19, 19, 19, 20, 20, 20, 17, 15, 12, 10,  8,  6,  4,  2,  1,  3,  5,  7,
+     9, 11, 13, 14, 17, 19, 20, 20, 20, 20, 20,
+};
+
+static const uint32_t huff_iid_dt0_codes[] = {
+    0x07FFF9, 0x07FFFA, 0x07FFFB, 0x0FFFF8, 0x0FFFF9, 0x0FFFFA, 0x01FFFD,
+    0x007FFE, 0x000FFE, 0x0003FE, 0x0000FE, 0x00003E, 0x00000E, 0x000002,
+    0x000000, 0x000006, 0x00001E, 0x00007E, 0x0001FE, 0x0007FE, 0x001FFE,
+    0x003FFE, 0x01FFFC, 0x07FFF8, 0x0FFFFB, 0x0FFFFC, 0x0FFFFD, 0x0FFFFE,
+    0x0FFFFF,
+};
+
+static const uint8_t huff_icc_df_bits[] = {
+    14, 14, 12, 10, 7, 5, 3, 1, 2, 4, 6, 8, 9, 11, 13,
+};
+
+static const uint16_t huff_icc_df_codes[] = {
+    0x3FFF, 0x3FFE, 0x0FFE, 0x03FE, 0x007E, 0x001E, 0x0006, 0x0000,
+    0x0002, 0x000E, 0x003E, 0x00FE, 0x01FE, 0x07FE, 0x1FFE,
+};
+
+static const uint8_t huff_icc_dt_bits[] = {
+    14, 13, 11, 9, 7, 5, 3, 1, 2, 4, 6, 8, 10, 12, 14,
+};
+
+static const uint16_t huff_icc_dt_codes[] = {
+    0x3FFE, 0x1FFE, 0x07FE, 0x01FE, 0x007E, 0x001E, 0x0006, 0x0000,
+    0x0002, 0x000E, 0x003E, 0x00FE, 0x03FE, 0x0FFE, 0x3FFF,
+};
+
+static const uint8_t huff_ipd_df_bits[] = {
+    1, 3, 4, 4, 4, 4, 4, 4,
+};
+
+static const uint8_t huff_ipd_df_codes[] = {
+    0x01, 0x00, 0x06, 0x04, 0x02, 0x03, 0x05, 0x07,
+};
+
+static const uint8_t huff_ipd_dt_bits[] = {
+    1, 3, 4, 5, 5, 4, 4, 3,
+};
+
+static const uint8_t huff_ipd_dt_codes[] = {
+    0x01, 0x02, 0x02, 0x03, 0x02, 0x00, 0x03, 0x03,
+};
+
+static const uint8_t huff_opd_df_bits[] = {
+    1, 3, 4, 4, 5, 5, 4, 3,
+};
+
+static const uint8_t huff_opd_df_codes[] = {
+    0x01, 0x01, 0x06, 0x04, 0x0F, 0x0E, 0x05, 0x00,
+};
+
+static const uint8_t huff_opd_dt_bits[] = {
+    1, 3, 4, 5, 5, 4, 4, 3,
+};
+
+static const uint8_t huff_opd_dt_codes[] = {
+    0x01, 0x02, 0x01, 0x07, 0x06, 0x00, 0x02, 0x03,
+};
+
+static const int8_t huff_offset[] = {
+    30, 30,
+    14, 14,
+    7, 7,
+    0, 0,
+    0, 0,
+};
+
+///Table 8.48
+static const int8_t k_to_i_20[] = {
+     1,  0,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 14, 15,
+    15, 15, 16, 16, 16, 16, 17, 17, 17, 17, 17, 18, 18, 18, 18, 18, 18, 18, 18,
+    18, 18, 18, 18, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19,
+    19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19
+};
+///Table 8.49
+static const int8_t k_to_i_34[] = {
+     0,  1,  2,  3,  4,  5,  6,  6,  7,  2,  1,  0, 10, 10,  4,  5,  6,  7,  8,
+     9, 10, 11, 12,  9, 14, 11, 12, 13, 14, 15, 16, 13, 16, 17, 18, 19, 20, 21,
+    22, 22, 23, 23, 24, 24, 25, 25, 26, 26, 27, 27, 27, 28, 28, 28, 29, 29, 29,
+    30, 30, 30, 31, 31, 31, 31, 32, 32, 32, 32, 33, 33, 33, 33, 33, 33, 33, 33,
+    33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33
+};
+
+static const float g1_Q2[] = {
+    0.0f,  0.01899487526049f, 0.0f, -0.07293139167538f,
+    0.0f,  0.30596630545168f, 0.5f
+};

libavcodec/aacsbr.c

@@ -31,6 +31,8 @@
 #include "aacsbr.h"
 #include "aacsbrdata.h"
 #include "fft.h"
+#include "aacps.h"
+#include "libavutil/libm.h"
 
 #include <stdint.h>
 #include <float.h>
@@ -71,9 +73,6 @@ enum {
 static VLC vlc_sbr[10];
 static const int8_t vlc_sbr_lav[10] =
     { 60, 60, 24, 24, 31, 31, 12, 12, 31, 12 };
-static DECLARE_ALIGNED(16, float, analysis_cos_pre)[64];
-static DECLARE_ALIGNED(16, float, analysis_sin_pre)[64];
-static DECLARE_ALIGNED(16, float, analysis_cossin_post)[32][2];
 static const DECLARE_ALIGNED(16, float, zero64)[64];
 
 #define SBR_INIT_VLC_STATIC(num, size) \
@@ -87,7 +86,7 @@ static const DECLARE_ALIGNED(16, float, zero64)[64];
 
 av_cold void ff_aac_sbr_init(void)
 {
-    int n, k;
+    int n;
     static const struct {
         const void *sbr_codes, *sbr_bits;
         const unsigned int table_size, elem_size;
@@ -116,16 +115,6 @@ av_cold void ff_aac_sbr_init(void)
     SBR_INIT_VLC_STATIC(8, 592);
     SBR_INIT_VLC_STATIC(9, 512);
 
-    for (n = 0; n < 64; n++) {
-        float pre = M_PI * n / 64;
-        analysis_cos_pre[n] = cosf(pre);
-        analysis_sin_pre[n] = sinf(pre);
-    }
-    for (k = 0; k < 32; k++) {
-        float post = M_PI * (k + 0.5) / 128;
-        analysis_cossin_post[k][0] =  4.0 * cosf(post);
-        analysis_cossin_post[k][1] = -4.0 * sinf(post);
-    }
     for (n = 1; n < 320; n++)
         sbr_qmf_window_us[320 + n] = sbr_qmf_window_us[320 - n];
     sbr_qmf_window_us[384] = -sbr_qmf_window_us[384];
@@ -133,6 +122,8 @@ av_cold void ff_aac_sbr_init(void)
 
     for (n = 0; n < 320; n++)
         sbr_qmf_window_ds[n] = sbr_qmf_window_us[2*n];
+
+    ff_ps_init();
 }
 
 av_cold void ff_aac_sbr_ctx_init(SpectralBandReplication *sbr)
@@ -142,13 +133,14 @@ av_cold void ff_aac_sbr_ctx_init(SpectralBandReplication *sbr)
     sbr->data[0].synthesis_filterbank_samples_offset = SBR_SYNTHESIS_BUF_SIZE - (1280 - 128);
     sbr->data[1].synthesis_filterbank_samples_offset = SBR_SYNTHESIS_BUF_SIZE - (1280 - 128);
     ff_mdct_init(&sbr->mdct, 7, 1, 1.0/64);
-    ff_rdft_init(&sbr->rdft, 6, IDFT_R2C);
+    ff_mdct_init(&sbr->mdct_ana, 7, 1, -2.0);
+    ff_ps_ctx_init(&sbr->ps);
 }
 
 av_cold void ff_aac_sbr_ctx_close(SpectralBandReplication *sbr)
 {
     ff_mdct_end(&sbr->mdct);
-    ff_rdft_end(&sbr->rdft);
+    ff_mdct_end(&sbr->mdct_ana);
 }
 
 static int qsort_comparison_function_int16(const void *a, const void *b)
@@ -293,15 +285,15 @@ static void make_bands(int16_t* bands, int start, int stop, int num_bands)
     bands[num_bands-1] = stop - previous;
 }
 
-static int check_n_master(AVCodecContext *avccontext, int n_master, int bs_xover_band)
+static int check_n_master(AVCodecContext *avctx, int n_master, int bs_xover_band)
 {
     // Requirements (14496-3 sp04 p205)
     if (n_master <= 0) {
-        av_log(avccontext, AV_LOG_ERROR, "Invalid n_master: %d\n", n_master);
+        av_log(avctx, AV_LOG_ERROR, "Invalid n_master: %d\n", n_master);
         return -1;
     }
     if (bs_xover_band >= n_master) {
-        av_log(avccontext, AV_LOG_ERROR,
+        av_log(avctx, AV_LOG_ERROR,
                "Invalid bitstream, crossover band index beyond array bounds: %d\n",
                bs_xover_band);
         return -1;
@@ -349,7 +341,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
         sbr_offset_ptr = sbr_offset[5];
         break;
     default:
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Unsupported sample rate for SBR: %d\n", sbr->sample_rate);
         return -1;
     }
@@ -367,7 +359,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     } else if (spectrum->bs_stop_freq == 15) {
         sbr->k[2] = 3*sbr->k[0];
     } else {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Invalid bs_stop_freq: %d\n", spectrum->bs_stop_freq);
         return -1;
     }
@@ -382,18 +374,17 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
         max_qmf_subbands = 32;
 
     if (sbr->k[2] - sbr->k[0] > max_qmf_subbands) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Invalid bitstream, too many QMF subbands: %d\n", sbr->k[2] - sbr->k[0]);
         return -1;
     }
 
     if (!spectrum->bs_freq_scale) {
-        unsigned int dk;
-        int k2diff;
+        int dk, k2diff;
 
         dk = spectrum->bs_alter_scale + 1;
         sbr->n_master = ((sbr->k[2] - sbr->k[0] + (dk&2)) >> dk) << 1;
-        if (check_n_master(ac->avccontext, sbr->n_master, sbr->spectrum_params.bs_xover_band))
+        if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
             return -1;
 
         for (k = 1; k <= sbr->n_master; k++)
@@ -402,7 +393,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
         if (k2diff < 0) {
             sbr->f_master[1]--;
-            sbr->f_master[2]-= (k2diff < 1);
+            sbr->f_master[2]-= (k2diff < -1);
         } else if (k2diff) {
             sbr->f_master[sbr->n_master]++;
         }
@@ -428,7 +419,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
         num_bands_0 = lrintf(half_bands * log2f(sbr->k[1] / (float)sbr->k[0])) * 2;
 
         if (num_bands_0 <= 0) { // Requirements (14496-3 sp04 p205)
-            av_log(ac->avccontext, AV_LOG_ERROR, "Invalid num_bands_0: %d\n", num_bands_0);
+            av_log(ac->avctx, AV_LOG_ERROR, "Invalid num_bands_0: %d\n", num_bands_0);
             return -1;
         }
 
@@ -442,7 +433,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
         vk0[0] = sbr->k[0];
         for (k = 1; k <= num_bands_0; k++) {
             if (vk0[k] <= 0) { // Requirements (14496-3 sp04 p205)
-                av_log(ac->avccontext, AV_LOG_ERROR, "Invalid vDk0[%d]: %d\n", k, vk0[k]);
+                av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk0[%d]: %d\n", k, vk0[k]);
                 return -1;
             }
             vk0[k] += vk0[k-1];
@@ -472,14 +463,14 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             vk1[0] = sbr->k[1];
             for (k = 1; k <= num_bands_1; k++) {
                 if (vk1[k] <= 0) { // Requirements (14496-3 sp04 p205)
-                    av_log(ac->avccontext, AV_LOG_ERROR, "Invalid vDk1[%d]: %d\n", k, vk1[k]);
+                    av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk1[%d]: %d\n", k, vk1[k]);
                     return -1;
                 }
                 vk1[k] += vk1[k-1];
             }
 
             sbr->n_master = num_bands_0 + num_bands_1;
-            if (check_n_master(ac->avccontext, sbr->n_master, sbr->spectrum_params.bs_xover_band))
+            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
                 return -1;
             memcpy(&sbr->f_master[0],               vk0,
                    (num_bands_0 + 1) * sizeof(sbr->f_master[0]));
@@ -488,7 +479,7 @@ static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
 
         } else {
             sbr->n_master = num_bands_0;
-            if (check_n_master(ac->avccontext, sbr->n_master, sbr->spectrum_params.bs_xover_band))
+            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
                 return -1;
             memcpy(sbr->f_master, vk0, (num_bands_0 + 1) * sizeof(sbr->f_master[0]));
         }
@@ -524,7 +515,7 @@ static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
         // illegal however the Coding Technologies decoder check stream has a final
         // count of 6 patches
         if (sbr->num_patches > 5) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "Too many patches: %d\n", sbr->num_patches);
+            av_log(ac->avctx, AV_LOG_ERROR, "Too many patches: %d\n", sbr->num_patches);
             return -1;
         }
 
@@ -563,12 +554,12 @@ static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)
 
     // Requirements (14496-3 sp04 p205)
     if (sbr->kx[1] + sbr->m[1] > 64) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Stop frequency border too high: %d\n", sbr->kx[1] + sbr->m[1]);
         return -1;
     }
     if (sbr->kx[1] > 32) {
-        av_log(ac->avccontext, AV_LOG_ERROR, "Start frequency border too high: %d\n", sbr->kx[1]);
+        av_log(ac->avctx, AV_LOG_ERROR, "Start frequency border too high: %d\n", sbr->kx[1]);
         return -1;
     }
 
@@ -580,7 +571,7 @@ static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)
     sbr->n_q = FFMAX(1, lrintf(sbr->spectrum_params.bs_noise_bands *
                                log2f(sbr->k[2] / (float)sbr->kx[1]))); // 0 <= bs_noise_bands <= 3
     if (sbr->n_q > 5) {
-        av_log(ac->avccontext, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q);
+        av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q);
         return -1;
     }
 
@@ -638,7 +629,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
             ch_data->bs_amp_res = 0;
 
         if (ch_data->bs_num_env > 4) {
-            av_log(ac->avccontext, AV_LOG_ERROR,
+            av_log(ac->avctx, AV_LOG_ERROR,
                    "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
                    ch_data->bs_num_env);
             return -1;
@@ -693,7 +684,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
         ch_data->bs_num_env                 = num_rel_lead + num_rel_trail + 1;
 
         if (ch_data->bs_num_env > 5) {
-            av_log(ac->avccontext, AV_LOG_ERROR,
+            av_log(ac->avctx, AV_LOG_ERROR,
                    "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
                    ch_data->bs_num_env);
             return -1;
@@ -714,7 +705,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     }
 
     if (bs_pointer > ch_data->bs_num_env + 1) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Invalid bitstream, bs_pointer points to a middle noise border outside the time borders table: %d\n",
                bs_pointer);
         return -1;
@@ -722,7 +713,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
 
     for (i = 1; i <= ch_data->bs_num_env; i++) {
         if (ch_data->t_env[i-1] > ch_data->t_env[i]) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "Non monotone time borders\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "Non monotone time borders\n");
             return -1;
         }
     }
@@ -903,25 +894,24 @@ static void read_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
                                GetBitContext *gb,
                                int bs_extension_id, int *num_bits_left)
 {
-//TODO - implement ps_data for parametric stereo parsing
     switch (bs_extension_id) {
     case EXTENSION_ID_PS:
         if (!ac->m4ac.ps) {
-            av_log(ac->avccontext, AV_LOG_ERROR, "Parametric Stereo signaled to be not-present but was found in the bitstream.\n");
+            av_log(ac->avctx, AV_LOG_ERROR, "Parametric Stereo signaled to be not-present but was found in the bitstream.\n");
             skip_bits_long(gb, *num_bits_left); // bs_fill_bits
             *num_bits_left = 0;
         } else {
-#if 0
-            *num_bits_left -= ff_ps_data(gb, ps);
+#if 1
+            *num_bits_left -= ff_ps_read_data(ac->avctx, gb, &sbr->ps, *num_bits_left);
 #else
-            av_log_missing_feature(ac->avccontext, "Parametric Stereo is", 0);
+            av_log_missing_feature(ac->avctx, "Parametric Stereo is", 0);
             skip_bits_long(gb, *num_bits_left); // bs_fill_bits
             *num_bits_left = 0;
 #endif
         }
         break;
     default:
-        av_log_missing_feature(ac->avccontext, "Reserved SBR extensions are", 1);
+        av_log_missing_feature(ac->avctx, "Reserved SBR extensions are", 1);
         skip_bits_long(gb, *num_bits_left); // bs_fill_bits
         *num_bits_left = 0;
         break;
@@ -1006,7 +996,7 @@ static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,
             return get_bits_count(gb) - cnt;
         }
     } else {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
             "Invalid bitstream - cannot apply SBR to element type %d\n", id_aac);
         sbr->start = 0;
         return get_bits_count(gb) - cnt;
@@ -1021,6 +1011,11 @@ static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,
             num_bits_left -= 2;
             read_sbr_extension(ac, sbr, gb, get_bits(gb, 2), &num_bits_left); // bs_extension_id
         }
+        if (num_bits_left < 0) {
+            av_log(ac->avctx, AV_LOG_ERROR, "SBR Extension over read.\n");
+        }
+        if (num_bits_left > 0)
+            skip_bits(gb, num_bits_left);
     }
 
     return get_bits_count(gb) - cnt;
@@ -1033,7 +1028,7 @@ static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
     if (err >= 0)
         err = sbr_make_f_derived(ac, sbr);
     if (err < 0) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "SBR reset failed. Switching SBR to pure upsampling mode.\n");
         sbr->start = 0;
     }
@@ -1085,7 +1080,7 @@ int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
     bytes_read = ((num_sbr_bits + num_align_bits + 4) >> 3);
 
     if (bytes_read > cnt) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
+        av_log(ac->avctx, AV_LOG_ERROR,
                "Expected to read %d SBR bytes actually read %d.\n", cnt, bytes_read);
     }
     return cnt;
@@ -1139,7 +1134,7 @@ static void sbr_dequant(SpectralBandReplication *sbr, int id_aac)
  * @param   x       pointer to the beginning of the first sample window
  * @param   W       array of complex-valued samples split into subbands
  */
-static void sbr_qmf_analysis(DSPContext *dsp, RDFTContext *rdft, const float *in, float *x,
+static void sbr_qmf_analysis(DSPContext *dsp, FFTContext *mdct, const float *in, float *x,
                              float z[320], float W[2][32][32][2],
                              float scale)
 {
@@ -1152,23 +1147,23 @@ static void sbr_qmf_analysis(DSPContext *dsp, RDFTContext *rdft, const float *in
         memcpy(x+288, in, 1024*sizeof(*x));
     for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames
                                // are not supported
-        float re, im;
         dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);
         for (k = 0; k < 64; k++) {
             float f = z[k] + z[k + 64] + z[k + 128] + z[k + 192] + z[k + 256];
-            z[k] = f * analysis_cos_pre[k];
-            z[k+64] = f;
+            z[k] = f;
         }
-        ff_rdft_calc(rdft, z);
-        re = z[0] * 0.5f;
-        im = 0.5f * dsp->scalarproduct_float(z+64, analysis_sin_pre, 64);
-        W[1][i][0][0] = re * analysis_cossin_post[0][0] - im * analysis_cossin_post[0][1];
-        W[1][i][0][1] = re * analysis_cossin_post[0][1] + im * analysis_cossin_post[0][0];
+        //Shuffle to IMDCT
+        z[64] = z[0];
         for (k = 1; k < 32; k++) {
-            re = z[2*k  ] - re;
-            im = z[2*k+1] - im;
-            W[1][i][k][0] = re * analysis_cossin_post[k][0] - im * analysis_cossin_post[k][1];
-            W[1][i][k][1] = re * analysis_cossin_post[k][1] + im * analysis_cossin_post[k][0];
+            z[64+2*k-1] =  z[   k];
+            z[64+2*k  ] = -z[64-k];
+        }
+        z[64+63] = z[32];
+
+        ff_imdct_half(mdct, z, z+64);
+        for (k = 0; k < 32; k++) {
+            W[1][i][k][0] = -z[63-k];
+            W[1][i][k][1] = z[k];
         }
         x += 32;
     }
@@ -1179,7 +1174,7 @@ static void sbr_qmf_analysis(DSPContext *dsp, RDFTContext *rdft, const float *in
  * (14496-3 sp04 p206)
  */
 static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct,
-                              float *out, float X[2][32][64],
+                              float *out, float X[2][38][64],
                               float mdct_buf[2][64],
                               float *v0, int *v_off, const unsigned int div,
                               float bias, float scale)
@@ -1187,31 +1182,33 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct,
     int i, n;
     const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us;
     int scale_and_bias = scale != 1.0f || bias != 0.0f;
+    const int step = 128 >> div;
     float *v;
     for (i = 0; i < 32; i++) {
-        if (*v_off == 0) {
+        if (*v_off < step) {
             int saved_samples = (1280 - 128) >> div;
             memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float));
-            *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div);
+            *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - step;
         } else {
-            *v_off -= 128 >> div;
+            *v_off -= step;
         }
         v = v0 + *v_off;
-        for (n = 1; n < 64 >> div; n+=2) {
-            X[1][i][n] = -X[1][i][n];
-        }
-        if (div) {
-            memset(X[0][i]+32, 0, 32*sizeof(float));
-            memset(X[1][i]+32, 0, 32*sizeof(float));
-        }
-        ff_imdct_half(mdct, mdct_buf[0], X[0][i]);
-        ff_imdct_half(mdct, mdct_buf[1], X[1][i]);
         if (div) {
             for (n = 0; n < 32; n++) {
-                v[      n] = -mdct_buf[0][63 - 2*n] + mdct_buf[1][2*n    ];
-                v[ 63 - n] =  mdct_buf[0][62 - 2*n] + mdct_buf[1][2*n + 1];
+                X[0][i][   n] = -X[0][i][n];
+                X[0][i][32+n] =  X[1][i][31-n];
+            }
+            ff_imdct_half(mdct, mdct_buf[0], X[0][i]);
+            for (n = 0; n < 32; n++) {
+                v[     n] =  mdct_buf[0][63 - 2*n];
+                v[63 - n] = -mdct_buf[0][62 - 2*n];
             }
         } else {
+            for (n = 1; n < 64; n+=2) {
+                X[1][i][n] = -X[1][i][n];
+            }
+            ff_imdct_half(mdct, mdct_buf[0], X[0][i]);
+            ff_imdct_half(mdct, mdct_buf[1], X[1][i]);
             for (n = 0; n < 64; n++) {
                 v[      n] = -mdct_buf[0][63 -   n] + mdct_buf[1][  n    ];
                 v[127 - n] =  mdct_buf[0][63 -   n] + mdct_buf[1][  n    ];
@@ -1380,7 +1377,7 @@ static int sbr_hf_gen(AACContext *ac, SpectralBandReplication *sbr,
             g--;
 
             if (g < 0) {
-                av_log(ac->avccontext, AV_LOG_ERROR,
+                av_log(ac->avctx, AV_LOG_ERROR,
                        "ERROR : no subband found for frequency %d\n", k);
                 return -1;
             }
@@ -1414,7 +1411,7 @@ static int sbr_hf_gen(AACContext *ac, SpectralBandReplication *sbr,
 }
 
 /// Generate the subband filtered lowband
-static int sbr_x_gen(SpectralBandReplication *sbr, float X[2][32][64],
+static int sbr_x_gen(SpectralBandReplication *sbr, float X[2][38][64],
                      const float X_low[32][40][2], const float Y[2][38][64][2],
                      int ch)
 {
@@ -1436,7 +1433,7 @@ static int sbr_x_gen(SpectralBandReplication *sbr, float X[2][32][64],
     }
 
     for (k = 0; k < sbr->kx[1]; k++) {
-        for (i = i_Temp; i < i_f; i++) {
+        for (i = i_Temp; i < 38; i++) {
             X[0][i][k] = X_low[k][i + ENVELOPE_ADJUSTMENT_OFFSET][0];
             X[1][i][k] = X_low[k][i + ENVELOPE_ADJUSTMENT_OFFSET][1];
         }
@@ -1730,7 +1727,7 @@ void ff_sbr_apply(AACContext *ac, SpectralBandReplication *sbr, int id_aac,
     }
     for (ch = 0; ch < nch; ch++) {
         /* decode channel */
-        sbr_qmf_analysis(&ac->dsp, &sbr->rdft, ch ? R : L, sbr->data[ch].analysis_filterbank_samples,
+        sbr_qmf_analysis(&ac->dsp, &sbr->mdct_ana, ch ? R : L, sbr->data[ch].analysis_filterbank_samples,
                          (float*)sbr->qmf_filter_scratch,
                          sbr->data[ch].W, 1/(-1024 * ac->sf_scale));
         sbr_lf_gen(ac, sbr, sbr->X_low, sbr->data[ch].W);
@@ -1752,6 +1749,16 @@ void ff_sbr_apply(AACContext *ac, SpectralBandReplication *sbr, int id_aac,
         /* synthesis */
         sbr_x_gen(sbr, sbr->X[ch], sbr->X_low, sbr->data[ch].Y, ch);
     }
+
+    if (ac->m4ac.ps == 1) {
+        if (sbr->ps.start) {
+            ff_ps_apply(ac->avctx, &sbr->ps, sbr->X[0], sbr->X[1], sbr->kx[1] + sbr->m[1]);
+        } else {
+            memcpy(sbr->X[1], sbr->X[0], sizeof(sbr->X[0]));
+        }
+        nch = 2;
+    }
+
     sbr_qmf_synthesis(&ac->dsp, &sbr->mdct, L, sbr->X[0], sbr->qmf_filter_scratch,
                       sbr->data[0].synthesis_filterbank_samples,
                       &sbr->data[0].synthesis_filterbank_samples_offset,

libavcodec/aactab.c

@@ -29,6 +29,7 @@
 
 #include "libavutil/mem.h"
 #include "aac.h"
+#include "aac_tablegen.h"
 
 #include <stdint.h>
 
@@ -1204,129 +1205,3 @@ const uint8_t ff_tns_max_bands_128[] = {
     9, 9, 10, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14
 };
 // @}
-
-
-#if CONFIG_HARDCODED_TABLES
-
-/**
- * Table of pow(2, (i - 200)/4.) used for different purposes depending on the
- * range of indices to the table:
- * [ 0, 255] scale factor decoding when using C dsp.float_to_int16
- * [60, 315] scale factor decoding when using SIMD dsp.float_to_int16
- * [45, 300] intensity stereo position decoding mapped in reverse order i.e. 0->300, 1->299, ..., 254->46, 255->45
- */
-const float ff_aac_pow2sf_tab[428] = {
-    8.88178420e-16, 1.05622810e-15, 1.25607397e-15, 1.49373210e-15,
-    1.77635684e-15, 2.11245619e-15, 2.51214793e-15, 2.98746420e-15,
-    3.55271368e-15, 4.22491238e-15, 5.02429587e-15, 5.97492839e-15,
-    7.10542736e-15, 8.44982477e-15, 1.00485917e-14, 1.19498568e-14,
-    1.42108547e-14, 1.68996495e-14, 2.00971835e-14, 2.38997136e-14,
-    2.84217094e-14, 3.37992991e-14, 4.01943669e-14, 4.77994272e-14,
-    5.68434189e-14, 6.75985982e-14, 8.03887339e-14, 9.55988543e-14,
-    1.13686838e-13, 1.35197196e-13, 1.60777468e-13, 1.91197709e-13,
-    2.27373675e-13, 2.70394393e-13, 3.21554936e-13, 3.82395417e-13,
-    4.54747351e-13, 5.40788785e-13, 6.43109871e-13, 7.64790834e-13,
-    9.09494702e-13, 1.08157757e-12, 1.28621974e-12, 1.52958167e-12,
-    1.81898940e-12, 2.16315514e-12, 2.57243948e-12, 3.05916334e-12,
-    3.63797881e-12, 4.32631028e-12, 5.14487897e-12, 6.11832668e-12,
-    7.27595761e-12, 8.65262056e-12, 1.02897579e-11, 1.22366534e-11,
-    1.45519152e-11, 1.73052411e-11, 2.05795159e-11, 2.44733067e-11,
-    2.91038305e-11, 3.46104823e-11, 4.11590317e-11, 4.89466134e-11,
-    5.82076609e-11, 6.92209645e-11, 8.23180635e-11, 9.78932268e-11,
-    1.16415322e-10, 1.38441929e-10, 1.64636127e-10, 1.95786454e-10,
-    2.32830644e-10, 2.76883858e-10, 3.29272254e-10, 3.91572907e-10,
-    4.65661287e-10, 5.53767716e-10, 6.58544508e-10, 7.83145814e-10,
-    9.31322575e-10, 1.10753543e-09, 1.31708902e-09, 1.56629163e-09,
-    1.86264515e-09, 2.21507086e-09, 2.63417803e-09, 3.13258326e-09,
-    3.72529030e-09, 4.43014173e-09, 5.26835606e-09, 6.26516652e-09,
-    7.45058060e-09, 8.86028346e-09, 1.05367121e-08, 1.25303330e-08,
-    1.49011612e-08, 1.77205669e-08, 2.10734243e-08, 2.50606661e-08,
-    2.98023224e-08, 3.54411338e-08, 4.21468485e-08, 5.01213321e-08,
-    5.96046448e-08, 7.08822677e-08, 8.42936970e-08, 1.00242664e-07,
-    1.19209290e-07, 1.41764535e-07, 1.68587394e-07, 2.00485328e-07,
-    2.38418579e-07, 2.83529071e-07, 3.37174788e-07, 4.00970657e-07,
-    4.76837158e-07, 5.67058141e-07, 6.74349576e-07, 8.01941314e-07,
-    9.53674316e-07, 1.13411628e-06, 1.34869915e-06, 1.60388263e-06,
-    1.90734863e-06, 2.26823256e-06, 2.69739830e-06, 3.20776526e-06,
-    3.81469727e-06, 4.53646513e-06, 5.39479661e-06, 6.41553051e-06,
-    7.62939453e-06, 9.07293026e-06, 1.07895932e-05, 1.28310610e-05,
-    1.52587891e-05, 1.81458605e-05, 2.15791864e-05, 2.56621220e-05,
-    3.05175781e-05, 3.62917210e-05, 4.31583729e-05, 5.13242441e-05,
-    6.10351562e-05, 7.25834421e-05, 8.63167458e-05, 1.02648488e-04,
-    1.22070312e-04, 1.45166884e-04, 1.72633492e-04, 2.05296976e-04,
-    2.44140625e-04, 2.90333768e-04, 3.45266983e-04, 4.10593953e-04,
-    4.88281250e-04, 5.80667537e-04, 6.90533966e-04, 8.21187906e-04,
-    9.76562500e-04, 1.16133507e-03, 1.38106793e-03, 1.64237581e-03,
-    1.95312500e-03, 2.32267015e-03, 2.76213586e-03, 3.28475162e-03,
-    3.90625000e-03, 4.64534029e-03, 5.52427173e-03, 6.56950324e-03,
-    7.81250000e-03, 9.29068059e-03, 1.10485435e-02, 1.31390065e-02,
-    1.56250000e-02, 1.85813612e-02, 2.20970869e-02, 2.62780130e-02,
-    3.12500000e-02, 3.71627223e-02, 4.41941738e-02, 5.25560260e-02,
-    6.25000000e-02, 7.43254447e-02, 8.83883476e-02, 1.05112052e-01,
-    1.25000000e-01, 1.48650889e-01, 1.76776695e-01, 2.10224104e-01,
-    2.50000000e-01, 2.97301779e-01, 3.53553391e-01, 4.20448208e-01,
-    5.00000000e-01, 5.94603558e-01, 7.07106781e-01, 8.40896415e-01,
-    1.00000000e+00, 1.18920712e+00, 1.41421356e+00, 1.68179283e+00,
-    2.00000000e+00, 2.37841423e+00, 2.82842712e+00, 3.36358566e+00,
-    4.00000000e+00, 4.75682846e+00, 5.65685425e+00, 6.72717132e+00,
-    8.00000000e+00, 9.51365692e+00, 1.13137085e+01, 1.34543426e+01,
-    1.60000000e+01, 1.90273138e+01, 2.26274170e+01, 2.69086853e+01,
-    3.20000000e+01, 3.80546277e+01, 4.52548340e+01, 5.38173706e+01,
-    6.40000000e+01, 7.61092554e+01, 9.05096680e+01, 1.07634741e+02,
-    1.28000000e+02, 1.52218511e+02, 1.81019336e+02, 2.15269482e+02,
-    2.56000000e+02, 3.04437021e+02, 3.62038672e+02, 4.30538965e+02,
-    5.12000000e+02, 6.08874043e+02, 7.24077344e+02, 8.61077929e+02,
-    1.02400000e+03, 1.21774809e+03, 1.44815469e+03, 1.72215586e+03,
-    2.04800000e+03, 2.43549617e+03, 2.89630938e+03, 3.44431172e+03,
-    4.09600000e+03, 4.87099234e+03, 5.79261875e+03, 6.88862343e+03,
-    8.19200000e+03, 9.74198469e+03, 1.15852375e+04, 1.37772469e+04,
-    1.63840000e+04, 1.94839694e+04, 2.31704750e+04, 2.75544937e+04,
-    3.27680000e+04, 3.89679387e+04, 4.63409500e+04, 5.51089875e+04,
-    6.55360000e+04, 7.79358775e+04, 9.26819000e+04, 1.10217975e+05,
-    1.31072000e+05, 1.55871755e+05, 1.85363800e+05, 2.20435950e+05,
-    2.62144000e+05, 3.11743510e+05, 3.70727600e+05, 4.40871900e+05,
-    5.24288000e+05, 6.23487020e+05, 7.41455200e+05, 8.81743800e+05,
-    1.04857600e+06, 1.24697404e+06, 1.48291040e+06, 1.76348760e+06,
-    2.09715200e+06, 2.49394808e+06, 2.96582080e+06, 3.52697520e+06,
-    4.19430400e+06, 4.98789616e+06, 5.93164160e+06, 7.05395040e+06,
-    8.38860800e+06, 9.97579232e+06, 1.18632832e+07, 1.41079008e+07,
-    1.67772160e+07, 1.99515846e+07, 2.37265664e+07, 2.82158016e+07,
-    3.35544320e+07, 3.99031693e+07, 4.74531328e+07, 5.64316032e+07,
-    6.71088640e+07, 7.98063385e+07, 9.49062656e+07, 1.12863206e+08,
-    1.34217728e+08, 1.59612677e+08, 1.89812531e+08, 2.25726413e+08,
-    2.68435456e+08, 3.19225354e+08, 3.79625062e+08, 4.51452825e+08,
-    5.36870912e+08, 6.38450708e+08, 7.59250125e+08, 9.02905651e+08,
-    1.07374182e+09, 1.27690142e+09, 1.51850025e+09, 1.80581130e+09,
-    2.14748365e+09, 2.55380283e+09, 3.03700050e+09, 3.61162260e+09,
-    4.29496730e+09, 5.10760567e+09, 6.07400100e+09, 7.22324521e+09,
-    8.58993459e+09, 1.02152113e+10, 1.21480020e+10, 1.44464904e+10,
-    1.71798692e+10, 2.04304227e+10, 2.42960040e+10, 2.88929808e+10,
-    3.43597384e+10, 4.08608453e+10, 4.85920080e+10, 5.77859616e+10,
-    6.87194767e+10, 8.17216907e+10, 9.71840160e+10, 1.15571923e+11,
-    1.37438953e+11, 1.63443381e+11, 1.94368032e+11, 2.31143847e+11,
-    2.74877907e+11, 3.26886763e+11, 3.88736064e+11, 4.62287693e+11,
-    5.49755814e+11, 6.53773525e+11, 7.77472128e+11, 9.24575386e+11,
-    1.09951163e+12, 1.30754705e+12, 1.55494426e+12, 1.84915077e+12,
-    2.19902326e+12, 2.61509410e+12, 3.10988851e+12, 3.69830155e+12,
-    4.39804651e+12, 5.23018820e+12, 6.21977702e+12, 7.39660309e+12,
-    8.79609302e+12, 1.04603764e+13, 1.24395540e+13, 1.47932062e+13,
-    1.75921860e+13, 2.09207528e+13, 2.48791081e+13, 2.95864124e+13,
-    3.51843721e+13, 4.18415056e+13, 4.97582162e+13, 5.91728247e+13,
-    7.03687442e+13, 8.36830112e+13, 9.95164324e+13, 1.18345649e+14,
-    1.40737488e+14, 1.67366022e+14, 1.99032865e+14, 2.36691299e+14,
-    2.81474977e+14, 3.34732045e+14, 3.98065730e+14, 4.73382598e+14,
-    5.62949953e+14, 6.69464090e+14, 7.96131459e+14, 9.46765196e+14,
-    1.12589991e+15, 1.33892818e+15, 1.59226292e+15, 1.89353039e+15,
-    2.25179981e+15, 2.67785636e+15, 3.18452584e+15, 3.78706078e+15,
-    4.50359963e+15, 5.35571272e+15, 6.36905167e+15, 7.57412156e+15,
-    9.00719925e+15, 1.07114254e+16, 1.27381033e+16, 1.51482431e+16,
-    1.80143985e+16, 2.14228509e+16, 2.54762067e+16, 3.02964863e+16,
-    3.60287970e+16, 4.28457018e+16, 5.09524134e+16, 6.05929725e+16,
-    7.20575940e+16, 8.56914035e+16, 1.01904827e+17, 1.21185945e+17,
-};
-
-#else
-
-float ff_aac_pow2sf_tab[428];
-
-#endif /* CONFIG_HARDCODED_TABLES */

libavcodec/aactab.h

@@ -32,6 +32,7 @@
 
 #include "libavutil/mem.h"
 #include "aac.h"
+#include "aac_tablegen_decl.h"
 
 #include <stdint.h>
 
@@ -73,10 +74,4 @@ extern const uint16_t * const ff_swb_offset_128 [13];
 extern const uint8_t ff_tns_max_bands_1024[13];
 extern const uint8_t ff_tns_max_bands_128 [13];
 
-#if CONFIG_HARDCODED_TABLES
-extern const float ff_aac_pow2sf_tab[428];
-#else
-extern       float ff_aac_pow2sf_tab[428];
-#endif /* CONFIG_HARDCODED_TABLES */
-
 #endif /* AVCODEC_AACTAB_H */

libavcodec/ac3_parser.c

@@ -181,7 +181,7 @@ static int ac3_sync(uint64_t state, AACAC3ParseContext *hdr_info,
     hdr_info->samples = hdr.num_blocks * 256;
     if(hdr.bitstream_id>10)
         hdr_info->codec_id = CODEC_ID_EAC3;
-    else
+    else if (hdr_info->codec_id == CODEC_ID_NONE)
         hdr_info->codec_id = CODEC_ID_AC3;
 
     *need_next_header = (hdr.frame_type != EAC3_FRAME_TYPE_AC3_CONVERT);

libavcodec/ac3dec.c

@@ -1268,7 +1268,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
     }
 
     /* apply spectral extension to high frequency bins */
-    if (s->spx_in_use) {
+    if (s->spx_in_use && CONFIG_EAC3_DECODER) {
         ff_eac3_apply_spectral_extension(s);
     }
 

libavcodec/adpcm.c

@@ -678,17 +678,23 @@ static int adpcm_encode_frame(AVCodecContext *avctx,
 static av_cold int adpcm_decode_init(AVCodecContext * avctx)
 {
     ADPCMContext *c = avctx->priv_data;
+    unsigned int min_channels = 1;
     unsigned int max_channels = 2;
 
     switch(avctx->codec->id) {
+    case CODEC_ID_ADPCM_EA:
+        min_channels = 2;
+        break;
     case CODEC_ID_ADPCM_EA_R1:
     case CODEC_ID_ADPCM_EA_R2:
     case CODEC_ID_ADPCM_EA_R3:
         max_channels = 6;
         break;
     }
-    if(avctx->channels > max_channels){
-        return -1;
+
+    if (avctx->channels < min_channels || avctx->channels > max_channels) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
+        return AVERROR(EINVAL);
     }
 
     switch(avctx->codec->id) {

libavcodec/allcodecs.c

@@ -253,7 +253,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (TTA, tta);
     REGISTER_DECODER (TWINVQ, twinvq);
     REGISTER_DECODER (VMDAUDIO, vmdaudio);
-    REGISTER_ENCDEC  (VORBIS, vorbis);
+    REGISTER_DECODER  (VORBIS, vorbis);
     REGISTER_DECODER (WAVPACK, wavpack);
     REGISTER_DECODER (WMAPRO, wmapro);
     REGISTER_ENCDEC  (WMAV1, wmav1);
@@ -343,7 +343,9 @@ void avcodec_register_all(void)
     REGISTER_ENCDEC  (LIBSCHROEDINGER, libschroedinger);
     REGISTER_DECODER (LIBSPEEX, libspeex);
     REGISTER_ENCODER (LIBTHEORA, libtheora);
+    REGISTER_ENCODER (LIBVO_AACENC, libvo_aacenc);
     REGISTER_ENCODER (LIBVORBIS, libvorbis);
+    REGISTER_ENCDEC  (LIBVPX, libvpx);
     REGISTER_ENCODER (LIBX264, libx264);
     REGISTER_ENCODER (LIBXVID, libxvid);
 

libavcodec/api-example.c

@@ -39,6 +39,8 @@
 #include "libavutil/mathematics.h"
 
 #define INBUF_SIZE 4096
+#define AUDIO_INBUF_SIZE 20480
+#define AUDIO_REFILL_THRESH 4096
 
 /*
  * Audio encoding example
@@ -118,7 +120,7 @@ static void audio_decode_example(const char *outfilename, const char *filename)
     int out_size, len;
     FILE *f, *outfile;
     uint8_t *outbuf;
-    uint8_t inbuf[INBUF_SIZE + FF_INPUT_BUFFER_PADDING_SIZE];
+    uint8_t inbuf[AUDIO_INBUF_SIZE + FF_INPUT_BUFFER_PADDING_SIZE];
     AVPacket avpkt;
 
     av_init_packet(&avpkt);
@@ -155,25 +157,32 @@ static void audio_decode_example(const char *outfilename, const char *filename)
 
     /* decode until eof */
     avpkt.data = inbuf;
-    for(;;) {
-        avpkt.size = fread(inbuf, 1, INBUF_SIZE, f);
-        if (avpkt.size == 0)
-            break;
+    avpkt.size = fread(inbuf, 1, AUDIO_INBUF_SIZE, f);
 
-        avpkt.data = inbuf;
-        while (avpkt.size > 0) {
-            out_size = AVCODEC_MAX_AUDIO_FRAME_SIZE;
-            len = avcodec_decode_audio3(c, (short *)outbuf, &out_size, &avpkt);
-            if (len < 0) {
-                fprintf(stderr, "Error while decoding\n");
-                exit(1);
-            }
-            if (out_size > 0) {
-                /* if a frame has been decoded, output it */
-                fwrite(outbuf, 1, out_size, outfile);
-            }
-            avpkt.size -= len;
-            avpkt.data += len;
+    while (avpkt.size > 0) {
+        out_size = AVCODEC_MAX_AUDIO_FRAME_SIZE;
+        len = avcodec_decode_audio3(c, (short *)outbuf, &out_size, &avpkt);
+        if (len < 0) {
+            fprintf(stderr, "Error while decoding\n");
+            exit(1);
+        }
+        if (out_size > 0) {
+            /* if a frame has been decoded, output it */
+            fwrite(outbuf, 1, out_size, outfile);
+        }
+        avpkt.size -= len;
+        avpkt.data += len;
+        if (avpkt.size < AUDIO_REFILL_THRESH) {
+            /* Refill the input buffer, to avoid trying to decode
+             * incomplete frames. Instead of this, one could also use
+             * a parser, or use a proper container format through
+             * libavformat. */
+            memmove(inbuf, avpkt.data, avpkt.size);
+            avpkt.data = inbuf;
+            len = fread(avpkt.data + avpkt.size, 1,
+                        AUDIO_INBUF_SIZE - avpkt.size, f);
+            if (len > 0)
+                avpkt.size += len;
         }
     }
 

libavcodec/atrac3.c

@@ -393,6 +393,8 @@ static int decodeTonalComponents (GetBitContext *gb, tonal_component *pComponent
 
             for (k=0; k<coded_components; k++) {
                 sfIndx = get_bits(gb,6);
+                if (component_count >= 64)
+                    return AVERROR_INVALIDDATA;
                 pComponent[component_count].pos = j * 64 + (get_bits(gb,6));
                 max_coded_values = 1024 - pComponent[component_count].pos;
                 coded_values = coded_values_per_component + 1;

libavcodec/audioconvert.h

@@ -103,9 +103,9 @@ void av_audio_convert_free(AVAudioConvert *ctx);
 /**
  * Convert between audio sample formats
  * @param[in] out array of output buffers for each channel. set to NULL to ignore processing of the given channel.
- * @param[in] out_stride distance between consecutive input samples (measured in bytes)
+ * @param[in] out_stride distance between consecutive output samples (measured in bytes)
  * @param[in] in array of input buffers for each channel
- * @param[in] in_stride distance between consecutive output samples (measured in bytes)
+ * @param[in] in_stride distance between consecutive input samples (measured in bytes)
  * @param len length of audio frame size (measured in samples)
  */
 int av_audio_convert(AVAudioConvert *ctx,

libavcodec/avcodec.h

@@ -30,8 +30,8 @@
 #include "libavutil/avutil.h"
 
 #define LIBAVCODEC_VERSION_MAJOR 52
-#define LIBAVCODEC_VERSION_MINOR 66
-#define LIBAVCODEC_VERSION_MICRO  0
+#define LIBAVCODEC_VERSION_MINOR 72
+#define LIBAVCODEC_VERSION_MICRO  2
 
 #define LIBAVCODEC_VERSION_INT  AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \
                                                LIBAVCODEC_VERSION_MINOR, \
@@ -210,6 +210,7 @@ enum CodecID {
     CODEC_ID_IFF_BYTERUN1,
     CODEC_ID_KGV1,
     CODEC_ID_YOP,
+    CODEC_ID_VP8,
 
     /* various PCM "codecs" */
     CODEC_ID_PCM_S16LE= 0x10000,
@@ -643,6 +644,11 @@ typedef struct RcOverride{
  * as a last resort.
  */
 #define CODEC_CAP_SUBFRAMES        0x0100
+/**
+ * Codec is experimental and is thus avoided in favor of non experimental
+ * encoders
+ */
+#define CODEC_CAP_EXPERIMENTAL     0x0200
 
 //The following defines may change, don't expect compatibility if you use them.
 #define MB_TYPE_INTRA4x4   0x0001
@@ -3303,12 +3309,20 @@ unsigned avcodec_get_edge_width(void);
  * Modifies width and height values so that they will result in a memory
  * buffer that is acceptable for the codec if you do not use any horizontal
  * padding.
+ *
+ * May only be used if a codec with CODEC_CAP_DR1 has been opened.
+ * If CODEC_FLAG_EMU_EDGE is not set, the dimensions must have been increased
+ * according to avcodec_get_edge_width() before.
  */
 void avcodec_align_dimensions(AVCodecContext *s, int *width, int *height);
 /**
  * Modifies width and height values so that they will result in a memory
  * buffer that is acceptable for the codec if you also ensure that all
  * line sizes are a multiple of the respective linesize_align[i].
+ *
+ * May only be used if a codec with CODEC_CAP_DR1 has been opened.
+ * If CODEC_FLAG_EMU_EDGE is not set, the dimensions must have been increased
+ * according to avcodec_get_edge_width() before.
  */
 void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
                                int linesize_align[4]);
@@ -3464,8 +3478,8 @@ attribute_deprecated int avcodec_decode_video(AVCodecContext *avctx, AVFrame *pi
  *
  * @param avctx the codec context
  * @param[out] picture The AVFrame in which the decoded video frame will be stored.
- *             Use avcodec_alloc_frame to get an AVFrame, the codec will call
- *             get_buffer to get memory for the actual image data.
+ *             Use avcodec_alloc_frame to get an AVFrame, the codec will
+ *             allocate memory for the actual bitmap.
  * @param[in] avpkt The input AVpacket containing the input buffer.
  *            You can create such packet with av_init_packet() and by then setting
  *            data and size, some decoders might in addition need other fields like

libavcodec/cavsdec.c

@@ -130,12 +130,14 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
                 r++;
             mask = -(level_code & 1);
             level = (level^mask) - mask;
-        } else {
+        } else if (level_code >= 0) {
             level = r->rltab[level_code][0];
             if(!level) //end of block signal
                 break;
             run   = r->rltab[level_code][1];
             r += r->rltab[level_code][2];
+        } else {
+            break;
         }
         level_buf[i] = level;
         run_buf[i] = run;
@@ -189,7 +191,8 @@ static inline int decode_residual_inter(AVSContext *h) {
 
 static int decode_mb_i(AVSContext *h, int cbp_code) {
     GetBitContext *gb = &h->s.gb;
-    int block, pred_mode_uv;
+    unsigned pred_mode_uv;
+    int block;
     uint8_t top[18];
     uint8_t *left = NULL;
     uint8_t *d;
@@ -445,6 +448,8 @@ static inline int check_for_slice(AVSContext *h) {
     if((show_bits_long(gb,24+align) & 0xFFFFFF) == 0x000001) {
         skip_bits_long(gb,24+align);
         h->stc = get_bits(gb,8);
+        if (h->stc >= h->mb_height)
+            return 0;
         decode_slice_header(h,gb);
         return 1;
     }
@@ -659,7 +664,7 @@ static int cavs_decode_frame(AVCodecContext * avctx,void *data, int *data_size,
     buf_end = buf + buf_size;
     for(;;) {
         buf_ptr = ff_find_start_code(buf_ptr,buf_end, &stc);
-        if(stc & 0xFFFFFE00)
+        if((stc & 0xFFFFFE00) || buf_ptr == buf_end)
             return FFMAX(0, buf_ptr - buf - s->parse_context.last_index);
         input_size = (buf_end - buf_ptr)*8;
         switch(stc) {

libavcodec/cdgraphics.c

@@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx,
         av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n");
         return AVERROR(EINVAL);
     }
+    if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) {
+        av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n");
+        return AVERROR(EINVAL);
+    }
 
     ret = avctx->reget_buffer(avctx, &cc->frame);
     if (ret) {

libavcodec/celp_filters.c

@@ -133,9 +133,8 @@ void ff_celp_lp_synthesis_filterf(float *out, const float *filter_coeffs,
         out2 -= val * old_out2;
         out3 -= val * old_out3;
 
-        old_out3 = out[-5];
-
         for (i = 5; i <= filter_length; i += 2) {
+            old_out3 = out[-i];
             val = filter_coeffs[i-1];
 
             out0 -= val * old_out3;
@@ -154,7 +153,6 @@ void ff_celp_lp_synthesis_filterf(float *out, const float *filter_coeffs,
 
             FFSWAP(float, old_out0, old_out2);
             old_out1 = old_out3;
-            old_out3 = out[-i-2];
         }
 
         tmp0 = out0;

libavcodec/dca.c

@@ -1224,6 +1224,7 @@ static int dca_decode_frame(AVCodecContext * avctx,
     //set AVCodec values with parsed data
     avctx->sample_rate = s->sample_rate;
     avctx->bit_rate = s->bit_rate;
+    avctx->frame_size = s->sample_blocks * 32;
 
     channels = s->prim_channels + !!s->lfe;
 

libavcodec/dpcm.c

@@ -169,6 +169,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
     int in, out = 0;
     int predictor[2];
     int channel_number = 0;
+    int stereo = s->channels - 1;
     short *output_samples = data;
     int shift[2];
     unsigned char byte;
@@ -177,6 +178,9 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
     if (!buf_size)
         return 0;
 
+    if (stereo && (buf_size & 1))
+        buf_size--;
+
     // almost every DPCM variant expands one byte of data into two
     if(*data_size/2 < buf_size)
         return -1;
@@ -295,7 +299,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
     }
 
     *data_size = out * sizeof(short);
-    return buf_size;
+    return avpkt->size;
 }
 
 #define DPCM_DECODER(id, name, long_name_)      \

libavcodec/dxva2_internal.h

@@ -23,6 +23,8 @@
 #ifndef AVCODEC_DXVA_INTERNAL_H
 #define AVCODEC_DXVA_INTERNAL_H
 
+#define _WIN32_WINNT 0x0600
+#define COBJMACROS
 #include "dxva2.h"
 #include "avcodec.h"
 #include "mpegvideo.h"

libavcodec/eatqi.c

@@ -59,12 +59,15 @@ static av_cold int tqi_decode_init(AVCodecContext *avctx)
     return 0;
 }
 
-static void tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
+static int tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
 {
     int n;
     s->dsp.clear_blocks(block[0]);
     for (n=0; n<6; n++)
-        ff_mpeg1_decode_block_intra(s, block[n], n);
+        if (ff_mpeg1_decode_block_intra(s, block[n], n) < 0)
+            return -1;
+
+    return 0;
 }
 
 static inline void tqi_idct_put(TqiContext *t, DCTELEM (*block)[64])
@@ -136,7 +139,8 @@ static int tqi_decode_frame(AVCodecContext *avctx,
     for (s->mb_y=0; s->mb_y<(avctx->height+15)/16; s->mb_y++)
     for (s->mb_x=0; s->mb_x<(avctx->width+15)/16; s->mb_x++)
     {
-        tqi_decode_mb(s, t->block);
+        if (tqi_decode_mb(s, t->block) < 0)
+            break;
         tqi_idct_put(t, t->block);
     }
 

libavcodec/flicvideo.c

@@ -159,7 +159,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
     int pixel_skip;
     int pixel_countdown;
     unsigned char *pixels;
-    int pixel_limit;
+    unsigned int pixel_limit;
 
     s->frame.reference = 1;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
@@ -253,10 +253,13 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                     av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets);
                 } else if ((line_packets & 0xC000) == 0x8000) {
                     // "last byte" opcode
-                    pixels[y_ptr + s->frame.linesize[0] - 1] = line_packets & 0xff;
+                    pixel_ptr= y_ptr + s->frame.linesize[0] - 1;
+                    CHECK_PIXEL_PTR(0);
+                    pixels[pixel_ptr] = line_packets & 0xff;
                 } else {
                     compressed_lines--;
                     pixel_ptr = y_ptr;
+                    CHECK_PIXEL_PTR(0);
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
@@ -268,7 +271,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                             byte_run = -byte_run;
                             palette_idx1 = buf[stream_ptr++];
                             palette_idx2 = buf[stream_ptr++];
-                            CHECK_PIXEL_PTR(byte_run);
+                            CHECK_PIXEL_PTR(byte_run * 2);
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                 pixels[pixel_ptr++] = palette_idx1;
                                 pixels[pixel_ptr++] = palette_idx2;
@@ -298,6 +301,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
             stream_ptr += 2;
             while (compressed_lines > 0) {
                 pixel_ptr = y_ptr;
+                CHECK_PIXEL_PTR(0);
                 pixel_countdown = s->avctx->width;
                 line_packets = buf[stream_ptr++];
                 if (line_packets > 0) {
@@ -453,7 +457,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     int pixel_countdown;
     unsigned char *pixels;
     int pixel;
-    int pixel_limit;
+    unsigned int pixel_limit;
 
     s->frame.reference = 1;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
@@ -503,6 +507,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 } else {
                     compressed_lines--;
                     pixel_ptr = y_ptr;
+                    CHECK_PIXEL_PTR(0);
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
@@ -514,13 +519,13 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                             byte_run = -byte_run;
                             pixel    = AV_RL16(&buf[stream_ptr]);
                             stream_ptr += 2;
-                            CHECK_PIXEL_PTR(byte_run);
+                            CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                 *((signed short*)(&pixels[pixel_ptr])) = pixel;
                                 pixel_ptr += 2;
                             }
                         } else {
-                            CHECK_PIXEL_PTR(byte_run);
+                            CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                 *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
                                 stream_ptr += 2;
@@ -611,7 +616,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                     if (byte_run > 0) {
                         pixel    = AV_RL16(&buf[stream_ptr]);
                         stream_ptr += 2;
-                        CHECK_PIXEL_PTR(byte_run);
+                        CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
                             *((signed short*)(&pixels[pixel_ptr])) = pixel;
                             pixel_ptr += 2;
@@ -622,7 +627,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy pixels if byte_run < 0 */
                         byte_run = -byte_run;
-                        CHECK_PIXEL_PTR(byte_run);
+                        CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
                             *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
                             stream_ptr += 2;

libavcodec/h263dec.c

@@ -428,7 +428,9 @@ retry:
     if(s->xvid_build==-1 && s->divx_version==-1 && s->lavc_build==-1){
         if(s->stream_codec_tag == AV_RL32("XVID") ||
            s->codec_tag == AV_RL32("XVID") || s->codec_tag == AV_RL32("XVIX") ||
-           s->codec_tag == AV_RL32("RMP4"))
+           s->codec_tag == AV_RL32("RMP4") ||
+           s->codec_tag == AV_RL32("SIPP")
+           )
             s->xvid_build= 0;
 #if 0
         if(s->codec_tag == AV_RL32("DIVX") && s->vo_type==0 && s->vol_control_parameters==1

libavcodec/h264.c

@@ -1448,15 +1448,17 @@ static void implicit_weight_table(H264Context *h, int field){
     for(ref0=ref_start; ref0 < ref_count0; ref0++){
         int poc0 = h->ref_list[0][ref0].poc;
         for(ref1=ref_start; ref1 < ref_count1; ref1++){
-            int poc1 = h->ref_list[1][ref1].poc;
-            int td = av_clip(poc1 - poc0, -128, 127);
-            int w= 32;
-            if(td){
-                int tb = av_clip(cur_poc - poc0, -128, 127);
-                int tx = (16384 + (FFABS(td) >> 1)) / td;
-                int dist_scale_factor = (tb*tx + 32) >> 8;
-                if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
-                    w = 64 - dist_scale_factor;
+            int w = 32;
+            if (!h->ref_list[0][ref0].long_ref && !h->ref_list[1][ref1].long_ref) {
+                int poc1 = h->ref_list[1][ref1].poc;
+                int td = av_clip(poc1 - poc0, -128, 127);
+                if(td){
+                    int tb = av_clip(cur_poc - poc0, -128, 127);
+                    int tx = (16384 + (FFABS(td) >> 1)) / td;
+                    int dist_scale_factor = (tb*tx + 32) >> 8;
+                    if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
+                        w = 64 - dist_scale_factor;
+                }
             }
             if(field<0){
                 h->implicit_weight[ref0][ref1][0]=
@@ -1840,7 +1842,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
         h->prev_interlaced_frame = 1;
 
         init_scan_tables(h);
-        ff_h264_alloc_tables(h);
+        if (ff_h264_alloc_tables(h) < 0) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "Could not allocate memory for h264\n");
+            return AVERROR(ENOMEM);
+        }
 
         for(i = 1; i < s->avctx->thread_count; i++) {
             H264Context *c;

libavcodec/h264.h

@@ -1048,7 +1048,7 @@ static void fill_decode_caches(H264Context *h, int mb_type){
                 AV_ZERO32(h->mv_cache [list][scan8[0] + 4 - 1*8]);
                 h->ref_cache[list][scan8[0] + 4 - 1*8]= topright_type ? LIST_NOT_USED : PART_NOT_AVAILABLE;
             }
-            if(h->ref_cache[list][scan8[0] + 4 - 1*8] < 0){
+            if(h->ref_cache[list][scan8[0] + 2 - 1*8] < 0 || h->ref_cache[list][scan8[0] + 4 - 1*8] < 0){
                 if(USES_LIST(topleft_type, list)){
                     const int b_xy = h->mb2b_xy [topleft_xy] + 3 + h->b_stride + (h->topleft_partition & 2*h->b_stride);
                     const int b8_xy= 4*topleft_xy + 1 + (h->topleft_partition & 2);

libavcodec/h264_mp4toannexb_bsf.c

@@ -55,7 +55,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
                                    int keyframe) {
     H264BSFContext *ctx = bsfc->priv_data;
     uint8_t unit_type;
-    uint32_t nal_size, cumul_size = 0;
+    int32_t nal_size;
+    uint32_t cumul_size = 0;
+    const uint8_t *buf_end = buf + buf_size;
 
     /* nothing to filter */
     if (!avctx->extradata || avctx->extradata_size < 6) {
@@ -109,6 +111,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
     *poutbuf_size = 0;
     *poutbuf = NULL;
     do {
+        if (buf + ctx->length_size > buf_end)
+            goto fail;
+
         if (ctx->length_size == 1)
             nal_size = buf[0];
         else if (ctx->length_size == 2)
@@ -119,6 +124,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
         buf += ctx->length_size;
         unit_type = *buf & 0x1f;
 
+        if (buf + nal_size > buf_end || nal_size < 0)
+            goto fail;
+
         /* prepend only to the first type 5 NAL unit of an IDR picture */
         if (ctx->first_idr && unit_type == 5) {
             alloc_and_copy(poutbuf, poutbuf_size,
@@ -139,6 +147,11 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
     } while (cumul_size < buf_size);
 
     return 1;
+
+fail:
+    av_freep(poutbuf);
+    *poutbuf_size = 0;
+    return AVERROR(EINVAL);
 }
 
 static void h264_mp4toannexb_close(AVBitStreamFilterContext *bsfc)

libavcodec/h264_ps.c

@@ -205,6 +205,12 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
         sps->num_reorder_frames= get_ue_golomb(&s->gb);
         get_ue_golomb(&s->gb); /*max_dec_frame_buffering*/
 
+        if(s->gb.size_in_bits < get_bits_count(&s->gb)){
+            av_log(h->s.avctx, AV_LOG_ERROR, "Overread VUI by %d bits\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+            sps->num_reorder_frames=0;
+            sps->bitstream_restriction_flag= 0;
+        }
+
         if(sps->num_reorder_frames > 16U /*max_dec_frame_buffering || max_dec_frame_buffering > 16*/){
             av_log(h->s.avctx, AV_LOG_ERROR, "illegal num_reorder_frames %d\n", sps->num_reorder_frames);
             return -1;
@@ -291,8 +297,12 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
 
     if(sps->profile_idc >= 100){ //high profile
         sps->chroma_format_idc= get_ue_golomb_31(&s->gb);
-        if(sps->chroma_format_idc == 3)
+        if (sps->chroma_format_idc > 3U) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc);
+            goto fail;
+        } else if(sps->chroma_format_idc == 3) {
             sps->residual_color_transform_flag = get_bits1(&s->gb);
+        }
         sps->bit_depth_luma   = get_ue_golomb(&s->gb) + 8;
         sps->bit_depth_chroma = get_ue_golomb(&s->gb) + 8;
         sps->transform_bypass = get_bits1(&s->gb);

libavcodec/h264_refs.c

@@ -657,7 +657,7 @@ int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){
                 }
                 if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){
                     unsigned int long_arg= get_ue_golomb_31(gb);
-                    if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
+                    if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG && long_arg == 16) && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
                         av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode);
                         return -1;
                     }

libavcodec/indeo2.c

@@ -156,6 +156,13 @@ static int ir2_decode_frame(AVCodecContext *avctx,
         return -1;
     }
 
+    start = 48; /* hardcoded for now */
+
+    if (start >= buf_size) {
+        av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size);
+        return AVERROR_INVALIDDATA;
+    }
+
     s->decode_delta = buf[18];
 
     /* decide whether frame uses deltas or not */
@@ -163,9 +170,8 @@ static int ir2_decode_frame(AVCodecContext *avctx,
     for (i = 0; i < buf_size; i++)
         buf[i] = av_reverse[buf[i]];
 #endif
-    start = 48; /* hardcoded for now */
 
-    init_get_bits(&s->gb, buf + start, buf_size - start);
+    init_get_bits(&s->gb, buf + start, (buf_size - start) * 8);
 
     if (s->decode_delta) { /* intraframe */
         ir2_decode_plane(s, avctx->width, avctx->height,

libavcodec/intelh263dec.c

@@ -72,7 +72,7 @@ int ff_intel_h263_decode_picture_header(MpegEncContext *s)
         }
         if(get_bits(&s->gb, 2))
             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
-        s->loop_filter = get_bits1(&s->gb);
+        s->loop_filter = get_bits1(&s->gb) * !s->avctx->lowres;
         if(get_bits1(&s->gb))
             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
         if(get_bits1(&s->gb))

libavcodec/ituh263dec.c

@@ -961,6 +961,8 @@ int h263_decode_picture_header(MpegEncContext *s)
             s->h263_aic = get_bits1(&s->gb); /* Advanced Intra Coding (AIC) */
             s->loop_filter= get_bits1(&s->gb);
             s->unrestricted_mv = s->umvplus || s->obmc || s->loop_filter;
+            if(s->avctx->lowres)
+                s->loop_filter = 0;
 
             s->h263_slice_structured= get_bits1(&s->gb);
             if (get_bits1(&s->gb) != 0) {

libavcodec/ivi_common.h

@@ -89,7 +89,7 @@ typedef struct {
     uint32_t    buf_offs; ///< address in the output buffer for this mb
     uint8_t     type;     ///< macroblock type: 0 - INTRA, 1 - INTER
     uint8_t     cbp;      ///< coded block pattern
-    uint8_t     q_delta;  ///< quant delta
+    int8_t      q_delta;  ///< quant delta
     int8_t      mv_x;     ///< motion vector (x component)
     int8_t      mv_y;     ///< motion vector (y component)
 } IVIMbInfo;

libavcodec/kgv1dec.c

@@ -38,7 +38,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
     const uint8_t *buf = avpkt->data;
     const uint8_t *buf_end = buf + avpkt->size;
     KgvContext * const c = avctx->priv_data;
-    int offsets[7];
+    int offsets[8];
     uint16_t *out, *prev;
     int outcnt = 0, maxcnt;
     int w, h, i;
@@ -68,7 +68,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
         return -1;
     c->prev = prev;
 
-    for (i = 0; i < 7; i++)
+    for (i = 0; i < 8; i++)
         offsets[i] = -1;
 
     while (outcnt < maxcnt && buf_end - 2 > buf) {

libavcodec/kmvc.c

@@ -33,6 +33,7 @@
 #define KMVC_KEYFRAME 0x80
 #define KMVC_PALETTE  0x40
 #define KMVC_METHOD   0x0F
+#define MAX_PALSIZE   256
 
 /*
  * Decoder context
@@ -43,7 +44,7 @@ typedef struct KmvcContext {
 
     int setpal;
     int palsize;
-    uint32_t pal[256];
+    uint32_t pal[MAX_PALSIZE];
     uint8_t *cur, *prev;
     uint8_t *frm0, *frm1;
 } KmvcContext;
@@ -365,6 +366,10 @@ static av_cold int decode_init(AVCodecContext * avctx)
         c->palsize = 127;
     } else {
         c->palsize = AV_RL16(avctx->extradata + 10);
+        if (c->palsize >= MAX_PALSIZE) {
+            av_log(avctx, AV_LOG_ERROR, "KMVC palette too large\n");
+            return AVERROR_INVALIDDATA;
+        }
     }
 
     if (avctx->extradata_size == 1036) {        // palette in extradata

libavcodec/libvo-aacenc.c

@@ -0,0 +1,130 @@
+/*
+ * AAC encoder wrapper
+ * Copyright (c) 2010 Martin Storsjo
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <vo-aacenc/voAAC.h>
+#include <vo-aacenc/cmnMemory.h>
+
+#include "avcodec.h"
+#include "mpeg4audio.h"
+
+typedef struct AACContext {
+    VO_AUDIO_CODECAPI codec_api;
+    VO_HANDLE handle;
+    VO_MEM_OPERATOR mem_operator;
+    VO_CODEC_INIT_USERDATA user_data;
+} AACContext;
+
+static av_cold int aac_encode_init(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+    AACENC_PARAM params = { 0 };
+    int index;
+
+    avctx->coded_frame = avcodec_alloc_frame();
+    avctx->frame_size = 1024;
+
+    voGetAACEncAPI(&s->codec_api);
+
+    s->mem_operator.Alloc = cmnMemAlloc;
+    s->mem_operator.Copy = cmnMemCopy;
+    s->mem_operator.Free = cmnMemFree;
+    s->mem_operator.Set = cmnMemSet;
+    s->mem_operator.Check = cmnMemCheck;
+    s->user_data.memflag = VO_IMF_USERMEMOPERATOR;
+    s->user_data.memData = &s->mem_operator;
+    s->codec_api.Init(&s->handle, VO_AUDIO_CodingAAC, &s->user_data);
+
+    params.sampleRate = avctx->sample_rate;
+    params.bitRate    = avctx->bit_rate;
+    params.nChannels  = avctx->channels;
+    params.adtsUsed   = !(avctx->flags & CODEC_FLAG_GLOBAL_HEADER);
+    if (s->codec_api.SetParam(s->handle, VO_PID_AAC_ENCPARAM, &params)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to set encoding parameters\n");
+        return AVERROR(EINVAL);
+    }
+
+    for (index = 0; index < 16; index++)
+        if (avctx->sample_rate == ff_mpeg4audio_sample_rates[index])
+            break;
+    if (index == 16) {
+        av_log(avctx, AV_LOG_ERROR, "Unsupported sample rate %d\n",
+                                    avctx->sample_rate);
+        return AVERROR(ENOSYS);
+    }
+    if (avctx->flags & CODEC_FLAG_GLOBAL_HEADER) {
+        avctx->extradata_size = 2;
+        avctx->extradata      = av_mallocz(avctx->extradata_size +
+                                           FF_INPUT_BUFFER_PADDING_SIZE);
+        if (!avctx->extradata)
+            return AVERROR(ENOMEM);
+
+        avctx->extradata[0] = 0x02 << 3 | index >> 1;
+        avctx->extradata[1] = (index & 0x01) << 7 | avctx->channels << 3;
+    }
+    return 0;
+}
+
+static int aac_encode_close(AVCodecContext *avctx)
+{
+    AACContext *s = avctx->priv_data;
+
+    s->codec_api.Uninit(s->handle);
+    av_freep(&avctx->coded_frame);
+
+    return 0;
+}
+
+static int aac_encode_frame(AVCodecContext *avctx,
+                            unsigned char *frame/*out*/,
+                            int buf_size, void *data/*in*/)
+{
+    AACContext *s = avctx->priv_data;
+    VO_CODECBUFFER input = { 0 }, output = { 0 };
+    VO_AUDIO_OUTPUTINFO output_info = { { 0 } };
+
+    input.Buffer = data;
+    input.Length = 2 * avctx->channels * avctx->frame_size;
+    output.Buffer = frame;
+    output.Length = buf_size;
+
+    s->codec_api.SetInputData(s->handle, &input);
+    if (s->codec_api.GetOutputData(s->handle, &output, &output_info)
+        != VO_ERR_NONE) {
+        av_log(avctx, AV_LOG_ERROR, "Unable to encode frame\n");
+        return AVERROR(EINVAL);
+    }
+    return output.Length;
+}
+
+AVCodec libvo_aacenc_encoder = {
+    "libvo_aacenc",
+    CODEC_TYPE_AUDIO,
+    CODEC_ID_AAC,
+    sizeof(AACContext),
+    aac_encode_init,
+    aac_encode_frame,
+    aac_encode_close,
+    NULL,
+    .sample_fmts = (const enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
+    .long_name = NULL_IF_CONFIG_SMALL("Android VisualOn AAC"),
+};
+

libavcodec/libvpxdec.c

@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2010, Google, Inc.
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * VP8 decoder support via libvpx
+ */
+
+#define VPX_CODEC_DISABLE_COMPAT 1
+#include <vpx/vpx_decoder.h>
+#include <vpx/vp8dx.h>
+
+#include "avcodec.h"
+
+typedef struct VP8DecoderContext {
+    struct vpx_codec_ctx decoder;
+} VP8Context;
+
+static av_cold int vp8_init(AVCodecContext *avctx)
+{
+    VP8Context *ctx = avctx->priv_data;
+    const struct vpx_codec_iface *iface = &vpx_codec_vp8_dx_algo;
+    struct vpx_codec_dec_cfg deccfg = {
+        /* token partitions+1 would be a decent choice */
+        .threads = FFMIN(avctx->thread_count, 16)
+    };
+
+    av_log(avctx, AV_LOG_INFO, "%s\n", vpx_codec_version_str());
+    av_log(avctx, AV_LOG_VERBOSE, "%s\n", vpx_codec_build_config());
+
+    if (vpx_codec_dec_init(&ctx->decoder, iface, &deccfg, 0) != VPX_CODEC_OK) {
+        const char *error = vpx_codec_error(&ctx->decoder);
+        av_log(avctx, AV_LOG_ERROR, "Failed to initialize decoder: %s\n",
+               error);
+        return AVERROR(EINVAL);
+    }
+
+    avctx->pix_fmt = PIX_FMT_YUV420P;
+    return 0;
+}
+
+static int vp8_decode(AVCodecContext *avctx,
+                      void *data, int *data_size, AVPacket *avpkt)
+{
+    VP8Context *ctx = avctx->priv_data;
+    AVFrame *picture = data;
+    const void *iter = NULL;
+    struct vpx_image *img;
+
+    if (vpx_codec_decode(&ctx->decoder, avpkt->data, avpkt->size, NULL, 0) !=
+        VPX_CODEC_OK) {
+        const char *error  = vpx_codec_error(&ctx->decoder);
+        const char *detail = vpx_codec_error_detail(&ctx->decoder);
+
+        av_log(avctx, AV_LOG_ERROR, "Failed to decode frame: %s\n", error);
+        if (detail)
+            av_log(avctx, AV_LOG_ERROR, "  Additional information: %s\n",
+                   detail);
+        return AVERROR_INVALIDDATA;
+    }
+
+    if ((img = vpx_codec_get_frame(&ctx->decoder, &iter))) {
+        if (img->fmt != VPX_IMG_FMT_I420) {
+            av_log(avctx, AV_LOG_ERROR, "Unsupported output colorspace (%d)\n",
+                   img->fmt);
+            return AVERROR_INVALIDDATA;
+        }
+
+        if ((int) img->d_w != avctx->width || (int) img->d_h != avctx->height) {
+            av_log(avctx, AV_LOG_INFO, "dimension change! %dx%d -> %dx%d\n",
+                   avctx->width, avctx->height, img->d_w, img->d_h);
+            if (avcodec_check_dimensions(avctx, img->d_w, img->d_h))
+                return AVERROR_INVALIDDATA;
+            avcodec_set_dimensions(avctx, img->d_w, img->d_h);
+        }
+        picture->data[0]     = img->planes[0];
+        picture->data[1]     = img->planes[1];
+        picture->data[2]     = img->planes[2];
+        picture->data[3]     = NULL;
+        picture->linesize[0] = img->stride[0];
+        picture->linesize[1] = img->stride[1];
+        picture->linesize[2] = img->stride[2];
+        picture->linesize[3] = 0;
+        *data_size           = sizeof(AVPicture);
+    }
+    return avpkt->size;
+}
+
+static av_cold int vp8_free(AVCodecContext *avctx)
+{
+    VP8Context *ctx = avctx->priv_data;
+    vpx_codec_destroy(&ctx->decoder);
+    return 0;
+}
+
+AVCodec libvpx_decoder = {
+    "libvpx",
+    AVMEDIA_TYPE_VIDEO,
+    CODEC_ID_VP8,
+    sizeof(VP8Context),
+    vp8_init,
+    NULL, /* encode */
+    vp8_free,
+    vp8_decode,
+    0, /* capabilities */
+    .long_name = NULL_IF_CONFIG_SMALL("libvpx VP8"),
+};

libavcodec/libvpxenc.c

@@ -0,0 +1,489 @@
+/*
+ * Copyright (c) 2010, Google, Inc.
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * VP8 encoder support via libvpx
+ */
+
+#define VPX_DISABLE_CTRL_TYPECHECKS 1
+#define VPX_CODEC_DISABLE_COMPAT    1
+#include <vpx/vpx_encoder.h>
+#include <vpx/vp8cx.h>
+
+#include "avcodec.h"
+#include "libavutil/base64.h"
+
+/**
+ * Portion of struct vpx_codec_cx_pkt from vpx_encoder.h.
+ * One encoded frame returned from the library.
+ */
+struct FrameListData {
+    void *buf;                       /**≤ compressed data buffer */
+    size_t sz;                       /**≤ length of compressed data */
+    int64_t pts;                     /**≤ time stamp to show frame
+                                          (in timebase units) */
+    unsigned long duration;          /**≤ duration to show frame
+                                          (in timebase units) */
+    uint32_t flags;                  /**≤ flags for this frame */
+    struct FrameListData *next;
+};
+
+typedef struct VP8EncoderContext {
+    struct vpx_codec_ctx encoder;
+    struct vpx_image rawimg;
+    struct vpx_fixed_buf twopass_stats;
+    unsigned long deadline; //i.e., RT/GOOD/BEST
+    struct FrameListData *coded_frame_list;
+} VP8Context;
+
+/** String mappings for enum vp8e_enc_control_id */
+static const char *ctlidstr[] = {
+    [VP8E_UPD_ENTROPY]           = "VP8E_UPD_ENTROPY",
+    [VP8E_UPD_REFERENCE]         = "VP8E_UPD_REFERENCE",
+    [VP8E_USE_REFERENCE]         = "VP8E_USE_REFERENCE",
+    [VP8E_SET_ROI_MAP]           = "VP8E_SET_ROI_MAP",
+    [VP8E_SET_ACTIVEMAP]         = "VP8E_SET_ACTIVEMAP",
+    [VP8E_SET_SCALEMODE]         = "VP8E_SET_SCALEMODE",
+    [VP8E_SET_CPUUSED]           = "VP8E_SET_CPUUSED",
+    [VP8E_SET_ENABLEAUTOALTREF]  = "VP8E_SET_ENABLEAUTOALTREF",
+    [VP8E_SET_NOISE_SENSITIVITY] = "VP8E_SET_NOISE_SENSITIVITY",
+    [VP8E_SET_SHARPNESS]         = "VP8E_SET_SHARPNESS",
+    [VP8E_SET_STATIC_THRESHOLD]  = "VP8E_SET_STATIC_THRESHOLD",
+    [VP8E_SET_TOKEN_PARTITIONS]  = "VP8E_SET_TOKEN_PARTITIONS",
+    [VP8E_GET_LAST_QUANTIZER]    = "VP8E_GET_LAST_QUANTIZER",
+    [VP8E_SET_ARNR_MAXFRAMES]    = "VP8E_SET_ARNR_MAXFRAMES",
+    [VP8E_SET_ARNR_STRENGTH]     = "VP8E_SET_ARNR_STRENGTH",
+    [VP8E_SET_ARNR_TYPE]         = "VP8E_SET_ARNR_TYPE",
+};
+
+static av_cold void log_encoder_error(AVCodecContext *avctx, const char *desc)
+{
+    VP8Context *ctx = avctx->priv_data;
+    const char *error  = vpx_codec_error(&ctx->encoder);
+    const char *detail = vpx_codec_error_detail(&ctx->encoder);
+
+    av_log(avctx, AV_LOG_ERROR, "%s: %s\n", desc, error);
+    if (detail)
+        av_log(avctx, AV_LOG_ERROR, "  Additional information: %s\n", detail);
+}
+
+static av_cold void dump_enc_cfg(AVCodecContext *avctx,
+                                 const struct vpx_codec_enc_cfg *cfg)
+{
+    int width = -30;
+    int level = AV_LOG_DEBUG;
+
+    av_log(avctx, level, "vpx_codec_enc_cfg\n");
+    av_log(avctx, level, "generic settings\n"
+           "  %*s%u\n  %*s%u\n  %*s%u\n  %*s%u\n  %*s%u\n"
+           "  %*s{%u/%u}\n  %*s%u\n  %*s%d\n  %*s%u\n",
+           width, "g_usage:",           cfg->g_usage,
+           width, "g_threads:",         cfg->g_threads,
+           width, "g_profile:",         cfg->g_profile,
+           width, "g_w:",               cfg->g_w,
+           width, "g_h:",               cfg->g_h,
+           width, "g_timebase:",        cfg->g_timebase.num, cfg->g_timebase.den,
+           width, "g_error_resilient:", cfg->g_error_resilient,
+           width, "g_pass:",            cfg->g_pass,
+           width, "g_lag_in_frames:",   cfg->g_lag_in_frames);
+    av_log(avctx, level, "rate control settings\n"
+           "  %*s%u\n  %*s%u\n  %*s%u\n  %*s%u\n"
+           "  %*s%d\n  %*s%p(%zu)\n  %*s%u\n",
+           width, "rc_dropframe_thresh:",   cfg->rc_dropframe_thresh,
+           width, "rc_resize_allowed:",     cfg->rc_resize_allowed,
+           width, "rc_resize_up_thresh:",   cfg->rc_resize_up_thresh,
+           width, "rc_resize_down_thresh:", cfg->rc_resize_down_thresh,
+           width, "rc_end_usage:",          cfg->rc_end_usage,
+           width, "rc_twopass_stats_in:",   cfg->rc_twopass_stats_in.buf, cfg->rc_twopass_stats_in.sz,
+           width, "rc_target_bitrate:",     cfg->rc_target_bitrate);
+    av_log(avctx, level, "quantizer settings\n"
+           "  %*s%u\n  %*s%u\n",
+           width, "rc_min_quantizer:", cfg->rc_min_quantizer,
+           width, "rc_max_quantizer:", cfg->rc_max_quantizer);
+    av_log(avctx, level, "bitrate tolerance\n"
+           "  %*s%u\n  %*s%u\n",
+           width, "rc_undershoot_pct:", cfg->rc_undershoot_pct,
+           width, "rc_overshoot_pct:",  cfg->rc_overshoot_pct);
+    av_log(avctx, level, "decoder buffer model\n"
+            "  %*s%u\n  %*s%u\n  %*s%u\n",
+            width, "rc_buf_sz:",         cfg->rc_buf_sz,
+            width, "rc_buf_initial_sz:", cfg->rc_buf_initial_sz,
+            width, "rc_buf_optimal_sz:", cfg->rc_buf_optimal_sz);
+    av_log(avctx, level, "2 pass rate control settings\n"
+           "  %*s%u\n  %*s%u\n  %*s%u\n",
+           width, "rc_2pass_vbr_bias_pct:",       cfg->rc_2pass_vbr_bias_pct,
+           width, "rc_2pass_vbr_minsection_pct:", cfg->rc_2pass_vbr_minsection_pct,
+           width, "rc_2pass_vbr_maxsection_pct:", cfg->rc_2pass_vbr_maxsection_pct);
+    av_log(avctx, level, "keyframing settings\n"
+           "  %*s%d\n  %*s%u\n  %*s%u\n",
+           width, "kf_mode:",     cfg->kf_mode,
+           width, "kf_min_dist:", cfg->kf_min_dist,
+           width, "kf_max_dist:", cfg->kf_max_dist);
+    av_log(avctx, level, "\n");
+}
+
+static void coded_frame_add(void *list, struct FrameListData *cx_frame)
+{
+    struct FrameListData **p = list;
+
+    while (*p != NULL)
+        p = &(*p)->next;
+    *p = cx_frame;
+    cx_frame->next = NULL;
+}
+
+static av_cold void free_coded_frame(struct FrameListData *cx_frame)
+{
+    av_freep(&cx_frame->buf);
+    av_freep(&cx_frame);
+}
+
+static av_cold void free_frame_list(struct FrameListData *list)
+{
+    struct FrameListData *p = list;
+
+    while (p) {
+        list = list->next;
+        free_coded_frame(p);
+        p = list;
+    }
+}
+
+static av_cold int codecctl_int(AVCodecContext *avctx,
+                                enum vp8e_enc_control_id id, int val)
+{
+    VP8Context *ctx = avctx->priv_data;
+    char buf[80];
+    int width = -30;
+    int res;
+
+    snprintf(buf, sizeof(buf), "%s:", ctlidstr[id]);
+    av_log(avctx, AV_LOG_DEBUG, "  %*s%d\n", width, buf, val);
+
+    res = vpx_codec_control(&ctx->encoder, id, val);
+    if (res != VPX_CODEC_OK) {
+        snprintf(buf, sizeof(buf), "Failed to set %s codec control",
+                 ctlidstr[id]);
+        log_encoder_error(avctx, buf);
+    }
+
+    return res == VPX_CODEC_OK ? 0 : AVERROR(EINVAL);
+}
+
+static av_cold int vp8_free(AVCodecContext *avctx)
+{
+    VP8Context *ctx = avctx->priv_data;
+
+    vpx_codec_destroy(&ctx->encoder);
+    av_freep(&ctx->twopass_stats.buf);
+    av_freep(&avctx->coded_frame);
+    av_freep(&avctx->stats_out);
+    free_frame_list(ctx->coded_frame_list);
+    return 0;
+}
+
+static av_cold int vp8_init(AVCodecContext *avctx)
+{
+    VP8Context *ctx = avctx->priv_data;
+    const struct vpx_codec_iface *iface = &vpx_codec_vp8_cx_algo;
+    int cpuused = 3;
+    struct vpx_codec_enc_cfg enccfg;
+    int res;
+
+    av_log(avctx, AV_LOG_INFO, "%s\n", vpx_codec_version_str());
+    av_log(avctx, AV_LOG_VERBOSE, "%s\n", vpx_codec_build_config());
+
+    if ((res = vpx_codec_enc_config_default(iface, &enccfg, 0)) != VPX_CODEC_OK) {
+        av_log(avctx, AV_LOG_ERROR, "Failed to get config: %s\n",
+               vpx_codec_err_to_string(res));
+        return AVERROR(EINVAL);
+    }
+    dump_enc_cfg(avctx, &enccfg);
+
+    enccfg.g_w            = avctx->width;
+    enccfg.g_h            = avctx->height;
+    enccfg.g_timebase.num = avctx->time_base.num;
+    enccfg.g_timebase.den = avctx->time_base.den;
+    enccfg.g_threads      = avctx->thread_count;
+
+    if (avctx->flags & CODEC_FLAG_PASS1)
+        enccfg.g_pass = VPX_RC_FIRST_PASS;
+    else if (avctx->flags & CODEC_FLAG_PASS2)
+        enccfg.g_pass = VPX_RC_LAST_PASS;
+    else
+        enccfg.g_pass = VPX_RC_ONE_PASS;
+
+    if (avctx->rc_min_rate == avctx->rc_max_rate &&
+        avctx->rc_min_rate == avctx->bit_rate)
+        enccfg.rc_end_usage = VPX_CBR;
+    enccfg.rc_target_bitrate = av_rescale_rnd(avctx->bit_rate, 1, 1000,
+                                              AV_ROUND_NEAR_INF);
+
+    //convert [1,51] -> [0,63]
+    enccfg.rc_min_quantizer = ((avctx->qmin * 5 + 1) >> 2) - 1;
+    enccfg.rc_max_quantizer = ((avctx->qmax * 5 + 1) >> 2) - 1;
+
+    if (avctx->keyint_min == avctx->gop_size)
+        enccfg.kf_mode = VPX_KF_FIXED;
+    //_enc_init() will balk if kf_min_dist is set in this case
+    if (enccfg.kf_mode != VPX_KF_AUTO)
+        enccfg.kf_min_dist = avctx->keyint_min;
+    enccfg.kf_max_dist     = avctx->gop_size;
+
+    if (enccfg.g_pass == VPX_RC_FIRST_PASS)
+        enccfg.g_lag_in_frames = 0;
+    else if (enccfg.g_pass == VPX_RC_LAST_PASS) {
+        int decode_size;
+
+        if (!avctx->stats_in) {
+            av_log(avctx, AV_LOG_ERROR, "No stats file for second pass\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        ctx->twopass_stats.sz  = strlen(avctx->stats_in) * 3 / 4;
+        ctx->twopass_stats.buf = av_malloc(ctx->twopass_stats.sz);
+        if (!ctx->twopass_stats.buf) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Stat buffer alloc (%zu bytes) failed\n",
+                   ctx->twopass_stats.sz);
+            return AVERROR(ENOMEM);
+        }
+        decode_size = av_base64_decode(ctx->twopass_stats.buf, avctx->stats_in,
+                                       ctx->twopass_stats.sz);
+        if (decode_size < 0) {
+            av_log(avctx, AV_LOG_ERROR, "Stat buffer decode failed\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        ctx->twopass_stats.sz      = decode_size;
+        enccfg.rc_twopass_stats_in = ctx->twopass_stats;
+    }
+
+    ctx->deadline = VPX_DL_GOOD_QUALITY;
+
+    dump_enc_cfg(avctx, &enccfg);
+    /* Construct Encoder Context */
+    res = vpx_codec_enc_init(&ctx->encoder, iface, &enccfg, 0);
+    if (res != VPX_CODEC_OK) {
+        log_encoder_error(avctx, "Failed to initialize encoder");
+        return AVERROR(EINVAL);
+    }
+
+    //codec control failures are currently treated only as warnings
+    av_log(avctx, AV_LOG_DEBUG, "vpx_codec_control\n");
+    codecctl_int(avctx, VP8E_SET_CPUUSED,           cpuused);
+    codecctl_int(avctx, VP8E_SET_NOISE_SENSITIVITY, avctx->noise_reduction);
+
+    //provide dummy value to initialize wrapper, values will be updated each _encode()
+    vpx_img_wrap(&ctx->rawimg, VPX_IMG_FMT_I420, avctx->width, avctx->height, 1,
+                 (unsigned char*)1);
+
+    avctx->coded_frame = avcodec_alloc_frame();
+    if (!avctx->coded_frame) {
+        av_log(avctx, AV_LOG_ERROR, "Error allocating coded frame\n");
+        vp8_free(avctx);
+        return AVERROR(ENOMEM);
+    }
+    return 0;
+}
+
+static inline void cx_pktcpy(struct FrameListData *dst,
+                             const struct vpx_codec_cx_pkt *src)
+{
+    dst->pts      = src->data.frame.pts;
+    dst->duration = src->data.frame.duration;
+    dst->flags    = src->data.frame.flags;
+    dst->sz       = src->data.frame.sz;
+    dst->buf      = src->data.frame.buf;
+}
+
+/**
+ * Store coded frame information in format suitable for return from encode().
+ *
+ * Write buffer information from @a cx_frame to @a buf & @a buf_size.
+ * Timing/frame details to @a coded_frame.
+ * @return Frame size written to @a buf on success
+ * @return AVERROR(EINVAL) on error
+ */
+static int storeframe(AVCodecContext *avctx, struct FrameListData *cx_frame,
+                      uint8_t *buf, int buf_size, AVFrame *coded_frame)
+{
+    if ((int) cx_frame->sz <= buf_size) {
+        buf_size = cx_frame->sz;
+        memcpy(buf, cx_frame->buf, buf_size);
+        coded_frame->pts       = cx_frame->pts;
+        coded_frame->key_frame = !!(cx_frame->flags & VPX_FRAME_IS_KEY);
+
+        if (coded_frame->key_frame)
+            coded_frame->pict_type = FF_I_TYPE;
+        else
+            coded_frame->pict_type = FF_P_TYPE;
+    } else {
+        av_log(avctx, AV_LOG_ERROR,
+               "Compressed frame larger than storage provided! (%zu/%d)\n",
+               cx_frame->sz, buf_size);
+        return AVERROR(EINVAL);
+    }
+    return buf_size;
+}
+
+/**
+ * Queue multiple output frames from the encoder, returning the front-most.
+ * In cases where vpx_codec_get_cx_data() returns more than 1 frame append
+ * the frame queue. Return the head frame if available.
+ * @return Stored frame size
+ * @return AVERROR(EINVAL) on output size error
+ * @return AVERROR(ENOMEM) on coded frame queue data allocation error
+ */
+static int queue_frames(AVCodecContext *avctx, uint8_t *buf, int buf_size,
+                        AVFrame *coded_frame)
+{
+    VP8Context *ctx = avctx->priv_data;
+    const struct vpx_codec_cx_pkt *pkt;
+    const void *iter = NULL;
+    int size = 0;
+
+    if (ctx->coded_frame_list) {
+        struct FrameListData *cx_frame = ctx->coded_frame_list;
+        /* return the leading frame if we've already begun queueing */
+        size = storeframe(avctx, cx_frame, buf, buf_size, coded_frame);
+        if (size < 0)
+            return AVERROR(EINVAL);
+        ctx->coded_frame_list = cx_frame->next;
+        free_coded_frame(cx_frame);
+    }
+
+    /* consume all available output from the encoder before returning. buffers
+       are only good through the next vpx_codec call */
+    while ((pkt = vpx_codec_get_cx_data(&ctx->encoder, &iter))) {
+        switch (pkt->kind) {
+        case VPX_CODEC_CX_FRAME_PKT:
+            if (!size) {
+                struct FrameListData cx_frame;
+
+                /* avoid storing the frame when the list is empty and we haven't yet
+                   provided a frame for output */
+                assert(!ctx->coded_frame_list);
+                cx_pktcpy(&cx_frame, pkt);
+                size = storeframe(avctx, &cx_frame, buf, buf_size, coded_frame);
+                if (size < 0)
+                    return AVERROR(EINVAL);
+            } else {
+                struct FrameListData *cx_frame =
+                    av_malloc(sizeof(struct FrameListData));
+
+                if (!cx_frame) {
+                    av_log(avctx, AV_LOG_ERROR,
+                           "Frame queue element alloc failed\n");
+                    return AVERROR(ENOMEM);
+                }
+                cx_pktcpy(cx_frame, pkt);
+                cx_frame->buf = av_malloc(cx_frame->sz);
+
+                if (!cx_frame->buf) {
+                    av_log(avctx, AV_LOG_ERROR,
+                           "Data buffer alloc (%zu bytes) failed\n",
+                           cx_frame->sz);
+                    return AVERROR(ENOMEM);
+                }
+                memcpy(cx_frame->buf, pkt->data.frame.buf, pkt->data.frame.sz);
+                coded_frame_add(&ctx->coded_frame_list, cx_frame);
+            }
+            break;
+        case VPX_CODEC_STATS_PKT: {
+            struct vpx_fixed_buf *stats = &ctx->twopass_stats;
+            stats->buf = av_realloc(stats->buf,
+                                    stats->sz + pkt->data.twopass_stats.sz);
+            if (!stats->buf) {
+                av_log(avctx, AV_LOG_ERROR, "Stat buffer realloc failed\n");
+                return AVERROR(ENOMEM);
+            }
+            memcpy((uint8_t*)stats->buf + stats->sz,
+                   pkt->data.twopass_stats.buf, pkt->data.twopass_stats.sz);
+            stats->sz += pkt->data.twopass_stats.sz;
+            break;
+        }
+        case VPX_CODEC_PSNR_PKT: //FIXME add support for CODEC_FLAG_PSNR
+        case VPX_CODEC_CUSTOM_PKT:
+            //ignore unsupported/unrecognized packet types
+            break;
+        }
+    }
+
+    return size;
+}
+
+static int vp8_encode(AVCodecContext *avctx, uint8_t *buf, int buf_size,
+                      void *data)
+{
+    VP8Context *ctx = avctx->priv_data;
+    AVFrame *frame = data;
+    struct vpx_image *rawimg = NULL;
+    int64_t timestamp = 0;
+    int res, coded_size;
+
+    if (frame) {
+        rawimg                      = &ctx->rawimg;
+        rawimg->planes[VPX_PLANE_Y] = frame->data[0];
+        rawimg->planes[VPX_PLANE_U] = frame->data[1];
+        rawimg->planes[VPX_PLANE_V] = frame->data[2];
+        rawimg->stride[VPX_PLANE_Y] = frame->linesize[0];
+        rawimg->stride[VPX_PLANE_U] = frame->linesize[1];
+        rawimg->stride[VPX_PLANE_V] = frame->linesize[2];
+        timestamp                   = frame->pts;
+    }
+
+    res = vpx_codec_encode(&ctx->encoder, rawimg, timestamp,
+                           avctx->ticks_per_frame, 0, ctx->deadline);
+    if (res != VPX_CODEC_OK) {
+        log_encoder_error(avctx, "Error encoding frame");
+        return AVERROR_INVALIDDATA;
+    }
+    coded_size = queue_frames(avctx, buf, buf_size, avctx->coded_frame);
+
+    if (!frame && avctx->flags & CODEC_FLAG_PASS1) {
+        unsigned int b64_size = ((ctx->twopass_stats.sz + 2) / 3) * 4 + 1;
+
+        avctx->stats_out = av_malloc(b64_size);
+        if (!avctx->stats_out) {
+            av_log(avctx, AV_LOG_ERROR, "Stat buffer alloc (%d bytes) failed\n",
+                   b64_size);
+            return AVERROR(ENOMEM);
+        }
+        av_base64_encode(avctx->stats_out, b64_size, ctx->twopass_stats.buf,
+                         ctx->twopass_stats.sz);
+    }
+    return coded_size;
+}
+
+AVCodec libvpx_encoder = {
+    "libvpx",
+    AVMEDIA_TYPE_VIDEO,
+    CODEC_ID_VP8,
+    sizeof(VP8Context),
+    vp8_init,
+    vp8_encode,
+    vp8_free,
+    NULL,
+    CODEC_CAP_DELAY,
+    .pix_fmts = (const enum PixelFormat[]){PIX_FMT_YUV420P, PIX_FMT_NONE},
+    .long_name = NULL_IF_CONFIG_SMALL("libvpx VP8"),
+};

libavcodec/libx264.c

@@ -127,7 +127,8 @@ static int X264_frame(AVCodecContext *ctx, uint8_t *buf,
     }
 
     x4->out_pic.key_frame = pic_out.b_keyframe;
-    x4->out_pic.quality   = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;
+    if (bufsize)
+        x4->out_pic.quality = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;
 
     return bufsize;
 }

libavcodec/mjpegbdec.c

@@ -59,6 +59,9 @@ read_header:
     s->restart_count = 0;
     s->mjpb_skiptosod = 0;
 
+    if (buf_end - buf_ptr >= 1 << 28)
+        return AVERROR_INVALIDDATA;
+
     init_get_bits(&hgb, buf_ptr, /*buf_size*/(buf_end - buf_ptr)*8);
 
     skip_bits(&hgb, 32); /* reserved zeros */
@@ -109,8 +112,8 @@ read_header:
     av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
     if (sos_offs)
     {
-//        init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8);
-        init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8);
+        init_get_bits(&s->gb, buf_ptr + sos_offs,
+                      8 * FFMIN(field_size, buf_end - buf_ptr - sos_offs));
         s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
         s->start_code = SOS;
         ff_mjpeg_decode_sos(s);

libavcodec/mjpegdec.c

@@ -792,6 +792,10 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
             if (s->restart_interval && !s->restart_count)
                 s->restart_count = s->restart_interval;
 
+            if(get_bits_count(&s->gb)>s->gb.size_in_bits){
+                av_log(s->avctx, AV_LOG_ERROR, "overread %d\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+                return -1;
+            }
             for(i=0;i<nb_components;i++) {
                 uint8_t *ptr;
                 int n, h, v, x, y, c, j;
@@ -835,9 +839,12 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
                 }
             }
 
-            if (s->restart_interval && !--s->restart_count) {
+            if (s->restart_interval && show_bits(&s->gb, 8) == 0xFF){ /* skip RSTn */
+                --s->restart_count;
                 align_get_bits(&s->gb);
-                skip_bits(&s->gb, 16); /* skip RSTn */
+                while(show_bits(&s->gb, 8) == 0xFF)
+                    skip_bits(&s->gb, 8);
+                skip_bits(&s->gb, 8);
                 for (i=0; i<nb_components; i++) /* reset dc */
                     s->last_dc[i] = 1024;
             }

libavcodec/mlpdec.c

@@ -62,6 +62,9 @@ typedef struct SubStream {
     //! For each channel output by the matrix, the output channel to map it to
     uint8_t     ch_assign[MAX_CHANNELS];
 
+    //! Channel coding parameters for channels in the substream
+    ChannelParams channel_params[MAX_CHANNELS];
+
     //! The left shift applied to random noise in 0x31ea substreams.
     uint8_t     noise_shift;
     //! The current seed value for the pseudorandom noise generator(s).
@@ -137,8 +140,6 @@ typedef struct MLPDecodeContext {
 
     SubStream   substream[MAX_SUBSTREAMS];
 
-    ChannelParams channel_params[MAX_CHANNELS];
-
     int         matrix_changed;
     int         filter_changed[MAX_CHANNELS][NUM_FILTERS];
 
@@ -173,8 +174,8 @@ static av_cold void init_static(void)
 static inline int32_t calculate_sign_huff(MLPDecodeContext *m,
                                           unsigned int substr, unsigned int ch)
 {
-    ChannelParams *cp = &m->channel_params[ch];
     SubStream *s = &m->substream[substr];
+    ChannelParams *cp = &s->channel_params[ch];
     int lsb_bits = cp->huff_lsbs - s->quant_step_size[ch];
     int sign_shift = lsb_bits + (cp->codebook ? 2 - cp->codebook : -1);
     int32_t sign_huff_offset = cp->huff_offset;
@@ -202,7 +203,7 @@ static inline int read_huff_channels(MLPDecodeContext *m, GetBitContext *gbp,
             m->bypassed_lsbs[pos + s->blockpos][mat] = get_bits1(gbp);
 
     for (channel = s->min_channel; channel <= s->max_channel; channel++) {
-        ChannelParams *cp = &m->channel_params[channel];
+        ChannelParams *cp = &s->channel_params[channel];
         int codebook = cp->codebook;
         int quant_step_size = s->quant_step_size[channel];
         int lsb_bits = cp->huff_lsbs - quant_step_size;
@@ -450,7 +451,7 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     memset(s->quant_step_size, 0, sizeof(s->quant_step_size));
 
     for (ch = s->min_channel; ch <= s->max_channel; ch++) {
-        ChannelParams *cp = &m->channel_params[ch];
+        ChannelParams *cp = &s->channel_params[ch];
         cp->filter_params[FIR].order = 0;
         cp->filter_params[IIR].order = 0;
         cp->filter_params[FIR].shift = 0;
@@ -472,9 +473,11 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
 /** Read parameters for one of the prediction filters. */
 
 static int read_filter_params(MLPDecodeContext *m, GetBitContext *gbp,
-                              unsigned int channel, unsigned int filter)
+                              unsigned int substr, unsigned int channel,
+                              unsigned int filter)
 {
-    FilterParams *fp = &m->channel_params[channel].filter_params[filter];
+    SubStream *s = &m->substream[substr];
+    FilterParams *fp = &s->channel_params[channel].filter_params[filter];
     const int max_order = filter ? MAX_IIR_ORDER : MAX_FIR_ORDER;
     const char fchar = filter ? 'I' : 'F';
     int i, order;
@@ -497,7 +500,7 @@ static int read_filter_params(MLPDecodeContext *m, GetBitContext *gbp,
     fp->order = order;
 
     if (order > 0) {
-        int32_t *fcoeff = m->channel_params[channel].coeff[filter];
+        int32_t *fcoeff = s->channel_params[channel].coeff[filter];
         int coeff_bits, coeff_shift;
 
         fp->shift = get_bits(gbp, 4);
@@ -610,19 +613,19 @@ static int read_matrix_params(MLPDecodeContext *m, unsigned int substr, GetBitCo
 static int read_channel_params(MLPDecodeContext *m, unsigned int substr,
                                GetBitContext *gbp, unsigned int ch)
 {
-    ChannelParams *cp = &m->channel_params[ch];
+    SubStream *s = &m->substream[substr];
+    ChannelParams *cp = &s->channel_params[ch];
     FilterParams *fir = &cp->filter_params[FIR];
     FilterParams *iir = &cp->filter_params[IIR];
-    SubStream *s = &m->substream[substr];
 
     if (s->param_presence_flags & PARAM_FIR)
         if (get_bits1(gbp))
-            if (read_filter_params(m, gbp, ch, FIR) < 0)
+            if (read_filter_params(m, gbp, substr, ch, FIR) < 0)
                 return -1;
 
     if (s->param_presence_flags & PARAM_IIR)
         if (get_bits1(gbp))
-            if (read_filter_params(m, gbp, ch, IIR) < 0)
+            if (read_filter_params(m, gbp, substr, ch, IIR) < 0)
                 return -1;
 
     if (fir->order + iir->order > 8) {
@@ -697,7 +700,7 @@ static int read_decoding_params(MLPDecodeContext *m, GetBitContext *gbp,
     if (s->param_presence_flags & PARAM_QUANTSTEP)
         if (get_bits1(gbp))
             for (ch = 0; ch <= s->max_channel; ch++) {
-                ChannelParams *cp = &m->channel_params[ch];
+                ChannelParams *cp = &s->channel_params[ch];
 
                 s->quant_step_size[ch] = get_bits(gbp, 4);
 
@@ -721,12 +724,12 @@ static void filter_channel(MLPDecodeContext *m, unsigned int substr,
                            unsigned int channel)
 {
     SubStream *s = &m->substream[substr];
-    const int32_t *fircoeff = m->channel_params[channel].coeff[FIR];
+    const int32_t *fircoeff = s->channel_params[channel].coeff[FIR];
     int32_t state_buffer[NUM_FILTERS][MAX_BLOCKSIZE + MAX_FIR_ORDER];
     int32_t *firbuf = state_buffer[FIR] + MAX_BLOCKSIZE;
     int32_t *iirbuf = state_buffer[IIR] + MAX_BLOCKSIZE;
-    FilterParams *fir = &m->channel_params[channel].filter_params[FIR];
-    FilterParams *iir = &m->channel_params[channel].filter_params[IIR];
+    FilterParams *fir = &s->channel_params[channel].filter_params[FIR];
+    FilterParams *iir = &s->channel_params[channel].filter_params[IIR];
     unsigned int filter_shift = fir->shift;
     int32_t mask = MSB_MASK(s->quant_step_size[channel]);
 

libavcodec/motionpixels.c

@@ -53,6 +53,11 @@ static av_cold int mp_decode_init(AVCodecContext *avctx)
 {
     MotionPixelsContext *mp = avctx->priv_data;
 
+    if(avctx->extradata_size < 2){
+        av_log(avctx, AV_LOG_ERROR, "extradata too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     motionpixels_tableinit();
     mp->avctx = avctx;
     dsputil_init(&mp->dsp, avctx);
@@ -188,10 +193,13 @@ static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y)
             p = mp_get_yuv_from_rgb(mp, x - 1, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((x & 3) == 0) {
                 if ((y & 3) == 0) {
                     p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                    p.v = av_clip(p.v, -32, 31);
                     p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                    p.u = av_clip(p.u, -32, 31);
                     mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p;
                 } else {
                     p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v;
@@ -215,9 +223,12 @@ static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb)
             p = mp_get_yuv_from_rgb(mp, 0, y);
         } else {
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+            p.y = av_clip(p.y, 0, 31);
             if ((y & 3) == 0) {
                 p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+                p.v = av_clip(p.v, -32, 31);
                 p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+                p.u = av_clip(p.u, -32, 31);
             }
             mp->vpt[y] = p;
             mp_set_rgb_from_yuv(mp, 0, y, &p);

libavcodec/mpegaudiodec.c

@@ -1315,23 +1315,32 @@ static int mp_decode_layer2(MPADecodeContext *s)
     return 3 * 12;
 }
 
-static inline void lsf_sf_expand(int *slen,
+#define SPLIT(dst,sf,n)\
+    if(n==3){\
+        int m= (sf*171)>>9;\
+        dst= sf - 3*m;\
+        sf=m;\
+    }else if(n==4){\
+        dst= sf&3;\
+        sf>>=2;\
+    }else if(n==5){\
+        int m= (sf*205)>>10;\
+        dst= sf - 5*m;\
+        sf=m;\
+    }else if(n==6){\
+        int m= (sf*171)>>10;\
+        dst= sf - 6*m;\
+        sf=m;\
+    }else{\
+        dst=0;\
+    }
+
+static av_always_inline void lsf_sf_expand(int *slen,
                                  int sf, int n1, int n2, int n3)
 {
-    if (n3) {
-        slen[3] = sf % n3;
-        sf /= n3;
-    } else {
-        slen[3] = 0;
-    }
-    if (n2) {
-        slen[2] = sf % n2;
-        sf /= n2;
-    } else {
-        slen[2] = 0;
-    }
-    slen[1] = sf % n1;
-    sf /= n1;
+    SPLIT(slen[3], sf, n3)
+    SPLIT(slen[2], sf, n2)
+    SPLIT(slen[1], sf, n1)
     slen[0] = sf;
 }
 

libavcodec/mpegvideo.c

@@ -282,9 +282,10 @@ int ff_alloc_picture(MpegEncContext *s, Picture *pic, int shared){
         }
 
         FF_ALLOCZ_OR_GOTO(s->avctx, pic->mbskip_table , mb_array_size * sizeof(uint8_t)+2, fail) //the +2 is for the slice end check
-        FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table , mb_array_size * sizeof(uint8_t)  , fail)
+        FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table_base , (big_mb_num + s->mb_stride) * sizeof(uint8_t)  , fail)
         FF_ALLOCZ_OR_GOTO(s->avctx, pic->mb_type_base , (big_mb_num + s->mb_stride) * sizeof(uint32_t), fail)
         pic->mb_type= pic->mb_type_base + 2*s->mb_stride+1;
+        pic->qscale_table = pic->qscale_table_base + 2*s->mb_stride + 1;
         if(s->out_format == FMT_H264){
             for(i=0; i<2; i++){
                 FF_ALLOCZ_OR_GOTO(s->avctx, pic->motion_val_base[i], 2 * (b4_array_size+4)  * sizeof(int16_t), fail)
@@ -335,7 +336,7 @@ static void free_picture(MpegEncContext *s, Picture *pic){
     av_freep(&pic->mc_mb_var);
     av_freep(&pic->mb_mean);
     av_freep(&pic->mbskip_table);
-    av_freep(&pic->qscale_table);
+    av_freep(&pic->qscale_table_base);
     av_freep(&pic->mb_type_base);
     av_freep(&pic->dct_coeff);
     av_freep(&pic->pan_scan);

libavcodec/mpegvideo.h

@@ -86,6 +86,7 @@ typedef struct Picture{
      * halfpel luma planes.
      */
     uint8_t *interpolated[3];
+    int8_t *qscale_table_base;
     int16_t (*motion_val_base[2])[2];
     uint32_t *mb_type_base;
 #define MB_TYPE_INTRA MB_TYPE_INTRA4x4 //default mb_type if there is just one type

libavcodec/options.c

@@ -488,9 +488,6 @@ int avcodec_copy_context(AVCodecContext *dest, const AVCodecContext *src)
     dest->slice_offset    = NULL;
     dest->internal_buffer = NULL;
     dest->hwaccel         = NULL;
-    dest->execute         = NULL;
-    dest->execute2        = NULL;
-    dest->reget_buffer    = NULL;
     dest->thread_opaque   = NULL;
 
     /* reallocate values that should be allocated separately */

libavcodec/pngdec.c

@@ -487,9 +487,11 @@ static int decode_frame(AVCodecContext *avctx,
                 } else if (s->bit_depth == 1 &&
                            s->color_type == PNG_COLOR_TYPE_GRAY) {
                     avctx->pix_fmt = PIX_FMT_MONOBLACK;
-                } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
+                } else if (s->bit_depth == 8 &&
+                           s->color_type == PNG_COLOR_TYPE_PALETTE) {
                     avctx->pix_fmt = PIX_FMT_PAL8;
-                } else if (s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
+                } else if (s->bit_depth == 8 &&
+                           s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
                     avctx->pix_fmt = PIX_FMT_Y400A;
                 } else {
                     goto fail;

libavcodec/qdm2.c

@@ -75,6 +75,7 @@ do { \
 #define SAMPLES_NEEDED_2(why) \
      av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why);
 
+#define QDM2_MAX_FRAME_SIZE 512
 
 typedef int8_t sb_int8_array[2][30][64];
 
@@ -167,7 +168,7 @@ typedef struct {
     /// I/O data
     const uint8_t *compressed_data;
     int compressed_size;
-    float output_buffer[1024];
+    float output_buffer[QDM2_MAX_FRAME_SIZE * 2];
 
     /// Synthesis filter
     DECLARE_ALIGNED(16, MPA_INT, synth_buf)[MPA_MAX_CHANNELS][512*2];
@@ -882,9 +883,13 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
                         break;
 
                     case 30:
-                        if (BITS_LEFT(length,gb) >= 4)
-                            samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)];
-                        else
+                        if (BITS_LEFT(length,gb) >= 4) {
+                            unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);
+                            if (index < FF_ARRAY_ELEMS(type30_dequant)) {
+                                samples[0] = type30_dequant[index];
+                            } else
+                                samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
+                        } else
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
 
                         run = 1;
@@ -898,8 +903,12 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
                                 type34_predictor = samples[0];
                                 type34_first = 0;
                             } else {
-                                samples[0] = type34_delta[qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1)] / type34_div + type34_predictor;
-                                type34_predictor = samples[0];
+                                unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1);
+                                if (index < FF_ARRAY_ELEMS(type34_delta)) {
+                                    samples[0] = type34_delta[index] / type34_div + type34_predictor;
+                                    type34_predictor = samples[0];
+                                } else
+                                    samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
                             }
                         } else {
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
@@ -1355,6 +1364,8 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext *
             return;
 
         local_int_14 = (offset >> local_int_8);
+        if (local_int_14 >= FF_ARRAY_ELEMS(fft_level_index_table))
+            return;
 
         if (q->nb_channels > 1) {
             channel = get_bits1(gb);
@@ -1799,6 +1810,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
 
     avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
     extradata += 4;
+    if (s->channels > MPA_MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
 
     avctx->sample_rate = AV_RB32(extradata);
     extradata += 4;
@@ -1820,6 +1833,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
     // something like max decodable tones
     s->group_order = av_log2(s->group_size) + 1;
     s->frame_size = s->group_size / 16; // 16 iterations per super block
+    if (s->frame_size > QDM2_MAX_FRAME_SIZE)
+        return AVERROR_INVALIDDATA;
 
     s->sub_sampling = s->fft_order - 7;
     s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
@@ -1883,7 +1898,7 @@ static av_cold int qdm2_decode_close(AVCodecContext *avctx)
 }
 
 
-static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
+static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
 {
     int ch, i;
     const int frame_size = (q->frame_size * q->channels);
@@ -1919,7 +1934,7 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
 
         if (!q->has_errors && q->sub_packet_list_C[0].packet != NULL) {
             SAMPLES_NEEDED_2("has errors, and C list is not empty")
-            return;
+            return -1;
         }
     }
 
@@ -1940,6 +1955,8 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
 
         out[i] = value;
     }
+
+    return 0;
 }
 
 
@@ -1950,25 +1967,33 @@ static int qdm2_decode_frame(AVCodecContext *avctx,
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     QDM2Context *s = avctx->priv_data;
+    int16_t *out = data;
+    int i, out_size;
 
     if(!buf)
         return 0;
     if(buf_size < s->checksum_size)
         return -1;
 
-    *data_size = s->channels * s->frame_size * sizeof(int16_t);
+    out_size = 16 * s->channels * s->frame_size *
+               av_get_bits_per_sample_format(avctx->sample_fmt)/8;
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
 
     av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\n",
        buf_size, buf, s->checksum_size, data, *data_size);
 
-    qdm2_decode(s, buf, data);
-
-    // reading only when next superblock found
-    if (s->sub_packet == 0) {
-        return s->checksum_size;
+    for (i = 0; i < 16; i++) {
+        if (qdm2_decode(s, buf, out) < 0)
+            return -1;
+        out += s->channels * s->frame_size;
     }
 
-    return 0;
+    *data_size = out_size;
+
+    return buf_size;
 }
 
 AVCodec qdm2_decoder =

libavcodec/rv10.c

@@ -454,6 +454,7 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
     s->avctx= avctx;
     s->out_format = FMT_H263;
     s->codec_id= avctx->codec_id;
+    avctx->flags |= CODEC_FLAG_EMU_EDGE;
 
     s->orig_width = s->width  = avctx->coded_width;
     s->orig_height= s->height = avctx->coded_height;
@@ -558,6 +559,11 @@ static int rv10_decode_packet(AVCodecContext *avctx,
         if(MPV_frame_start(s, avctx) < 0)
             return -1;
         ff_er_frame_start(s);
+    } else {
+        if (s->current_picture_ptr->pict_type != s->pict_type) {
+            av_log(s->avctx, AV_LOG_ERROR, "Slice type mismatch\n");
+            return -1;
+        }
     }
 
     dprintf(avctx, "qscale=%d\n", s->qscale);

libavcodec/rv30.c

@@ -256,6 +256,7 @@ static av_cold int rv30_decode_init(AVCodecContext *avctx)
     if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){
         av_log(avctx, AV_LOG_ERROR, "Insufficient extradata - need at least %d bytes, got %d\n",
                6 + r->rpr * 2, avctx->extradata_size);
+        return AVERROR(EINVAL);
     }
     r->parse_slice_header = rv30_parse_slice_header;
     r->decode_intra_types = rv30_decode_intra_types;

libavcodec/rv34.c

@@ -1439,12 +1439,14 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         slice_count = (*buf++) + 1;
         slices_hdr = buf + 4;
         buf += 8 * slice_count;
+        buf_size -= 1 + 8 * slice_count;
     }else
         slice_count = avctx->slice_count;
 
     //parse first slice header to check whether this frame can be decoded
-    if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
-        av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+    if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
+       get_slice_offset(avctx, slices_hdr, 0) > buf_size){
+        av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
         return -1;
     }
     init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0));
@@ -1459,7 +1461,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
     if(   (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE)
        || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=FF_I_TYPE)
        ||  avctx->skip_frame >= AVDISCARD_ALL)
-        return buf_size;
+        return avpkt->size;
     /* skip everything if we are in a hurry>=5 */
     if(avctx->hurry_up>=5)
         return buf_size;
@@ -1472,8 +1474,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         else
             size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
 
-        if(offset > buf_size){
-            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+        if(offset < 0 || offset > buf_size || size < 0){
+            av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
             break;
         }
 
@@ -1494,7 +1496,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
             break;
     }
 
-    if(last){
+    if(last && s->current_picture_ptr){
         if(r->loop_filter)
             r->loop_filter(r, s->mb_height - 1);
         ff_er_frame_end(s);
@@ -1511,7 +1513,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         }
         s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
     }
-    return buf_size;
+    return avpkt->size;
 }
 
 av_cold int ff_rv34_decode_end(AVCodecContext *avctx)

libavcodec/sbr.h

@@ -31,6 +31,7 @@
 
 #include <stdint.h>
 #include "fft.h"
+#include "aacps.h"
 
 /**
  * Spectral Band Replication header - spectrum parameters that invoke a reset if they differ from the previous header.
@@ -133,6 +134,7 @@ typedef struct {
     ///The number of frequency bands in f_master
     unsigned           n_master;
     SBRData            data[2];
+    PSContext          ps;
     ///N_Low and N_High respectively, the number of frequency bands for low and high resolution
     unsigned           n[2];
     ///Number of noise floor bands
@@ -157,7 +159,7 @@ typedef struct {
     ///QMF output of the HF generator
     float              X_high[64][40][2];
     ///QMF values of the reconstructed signal
-    DECLARE_ALIGNED(16, float, X)[2][2][32][64];
+    DECLARE_ALIGNED(16, float, X)[2][2][38][64];
     ///Zeroth coefficient used to filter the subband signals
     float              alpha0[64][2];
     ///First coefficient used to filter the subband signals
@@ -176,7 +178,7 @@ typedef struct {
     float              s_m[7][48];
     float              gain[7][48];
     DECLARE_ALIGNED(16, float, qmf_filter_scratch)[5][64];
-    RDFTContext        rdft;
+    FFTContext         mdct_ana;
     FFTContext         mdct;
 } SpectralBandReplication;
 

libavcodec/shorten.c

@@ -82,7 +82,9 @@ typedef struct ShortenContext {
     int channels;
 
     int32_t *decoded[MAX_CHANNELS];
+    int32_t *decoded_base[MAX_CHANNELS];
     int32_t *offset[MAX_CHANNELS];
+    int *coeffs;
     uint8_t *bitstream;
     int bitstream_size;
     int bitstream_index;
@@ -112,6 +114,9 @@ static av_cold int shorten_decode_init(AVCodecContext * avctx)
 static int allocate_buffers(ShortenContext *s)
 {
     int i, chan;
+    int *coeffs;
+    void *tmp_ptr;
+
     for (chan=0; chan<s->channels; chan++) {
         if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){
             av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n");
@@ -122,13 +127,26 @@ static int allocate_buffers(ShortenContext *s)
             return -1;
         }
 
-        s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
+        tmp_ptr = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
+        if (!tmp_ptr)
+            return AVERROR(ENOMEM);
+        s->offset[chan] = tmp_ptr;
 
-        s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
+        tmp_ptr = av_realloc(s->decoded_base[chan], (s->blocksize + s->nwrap) *
+                             sizeof(s->decoded_base[0][0]));
+        if (!tmp_ptr)
+            return AVERROR(ENOMEM);
+        s->decoded_base[chan] = tmp_ptr;
         for (i=0; i<s->nwrap; i++)
-            s->decoded[chan][i] = 0;
-        s->decoded[chan] += s->nwrap;
+            s->decoded_base[chan][i] = 0;
+        s->decoded[chan] = s->decoded_base[chan] + s->nwrap;
     }
+
+    coeffs = av_realloc(s->coeffs, s->nwrap * sizeof(*s->coeffs));
+    if (!coeffs)
+        return AVERROR(ENOMEM);
+    s->coeffs = coeffs;
+
     return 0;
 }
 
@@ -147,7 +165,7 @@ static void fix_bitshift(ShortenContext *s, int32_t *buffer)
 
     if (s->bitshift != 0)
         for (i = 0; i < s->blocksize; i++)
-            buffer[s->nwrap + i] <<= s->bitshift;
+            buffer[i] <<= s->bitshift;
 }
 
 
@@ -253,7 +271,7 @@ static int16_t * interleave_buffer(int16_t *samples, int nchan, int blocksize, i
 static void decode_subframe_lpc(ShortenContext *s, int channel, int residual_size, int pred_order)
 {
     int sum, i, j;
-    int coeffs[pred_order];
+    int *coeffs = s->coeffs;
 
     for (i=0; i<pred_order; i++)
         coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);
@@ -277,8 +295,15 @@ static int shorten_decode_frame(AVCodecContext *avctx,
     int i, input_buf_size = 0;
     int16_t *samples = data;
     if(s->max_framesize == 0){
+        void *tmp_ptr;
         s->max_framesize= 1024; // should hopefully be enough for the first header
-        s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);
+        tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,
+                                  s->max_framesize);
+        if (!tmp_ptr) {
+            av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\n");
+            return AVERROR(ENOMEM);
+        }
+        s->bitstream = tmp_ptr;
     }
 
     if(1 && s->max_framesize){//FIXME truncated
@@ -427,6 +452,12 @@ static int shorten_decode_frame(AVCodecContext *avctx,
                         case FN_QLPC:
                             {
                                 int pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);
+                                if (pred_order > s->nwrap) {
+                                    av_log(avctx, AV_LOG_ERROR,
+                                           "invalid pred_order %d\n",
+                                           pred_order);
+                                    return -1;
+                                }
                                 for (i=0; i<pred_order; i++)
                                     s->decoded[channel][i - pred_order] -= coffset;
                                 decode_subframe_lpc(s, channel, residual_size, pred_order);
@@ -471,9 +502,15 @@ static int shorten_decode_frame(AVCodecContext *avctx,
             case FN_BITSHIFT:
                 s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
                 break;
-            case FN_BLOCKSIZE:
-                s->blocksize = get_uint(s, av_log2(s->blocksize));
+            case FN_BLOCKSIZE: {
+                int blocksize = get_uint(s, av_log2(s->blocksize));
+                if (blocksize > s->blocksize) {
+                    av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\n");
+                    return AVERROR_PATCHWELCOME;
+                }
+                s->blocksize = blocksize;
                 break;
+            }
             case FN_QUIT:
                 *data_size = 0;
                 return buf_size;
@@ -510,11 +547,12 @@ static av_cold int shorten_decode_close(AVCodecContext *avctx)
     int i;
 
     for (i = 0; i < s->channels; i++) {
-        s->decoded[i] -= s->nwrap;
-        av_freep(&s->decoded[i]);
+        s->decoded[i] = NULL;
+        av_freep(&s->decoded_base[i]);
         av_freep(&s->offset[i]);
     }
     av_freep(&s->bitstream);
+    av_freep(&s->coeffs);
     return 0;
 }
 

libavcodec/smacker.c

@@ -133,11 +133,13 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx
             return -1;
         }
         b1 = get_bits_count(gb);
-        i1 = get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3);
+        i1 = ctx->v1->table ? get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3) : 0;
         b1 = get_bits_count(gb) - b1;
         b2 = get_bits_count(gb);
-        i2 = get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3);
+        i2 = ctx->v2->table ? get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3) : 0;
         b2 = get_bits_count(gb) - b2;
+        if (i1 < 0 || i2 < 0)
+            return -1;
         val = ctx->recode1[i1] | (ctx->recode2[i2] << 8);
         if(val == ctx->escapes[0]) {
             ctx->last[0] = hc->current;
@@ -289,7 +291,8 @@ static int decode_header_trees(SmackVContext *smk) {
         smk->mmap_tbl[0] = 0;
         smk->mmap_last[0] = smk->mmap_last[1] = smk->mmap_last[2] = 1;
     } else {
-        smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size))
+            return -1;
     }
     if(!get_bits1(&gb)) {
         av_log(smk->avctx, AV_LOG_INFO, "Skipping MCLR tree\n");
@@ -297,7 +300,8 @@ static int decode_header_trees(SmackVContext *smk) {
         smk->mclr_tbl[0] = 0;
         smk->mclr_last[0] = smk->mclr_last[1] = smk->mclr_last[2] = 1;
     } else {
-        smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size))
+            return -1;
     }
     if(!get_bits1(&gb)) {
         av_log(smk->avctx, AV_LOG_INFO, "Skipping FULL tree\n");
@@ -305,7 +309,8 @@ static int decode_header_trees(SmackVContext *smk) {
         smk->full_tbl[0] = 0;
         smk->full_last[0] = smk->full_last[1] = smk->full_last[2] = 1;
     } else {
-        smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size))
+            return -1;
     }
     if(!get_bits1(&gb)) {
         av_log(smk->avctx, AV_LOG_INFO, "Skipping TYPE tree\n");
@@ -313,7 +318,8 @@ static int decode_header_trees(SmackVContext *smk) {
         smk->type_tbl[0] = 0;
         smk->type_last[0] = smk->type_last[1] = smk->type_last[2] = 1;
     } else {
-        smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size);
+        if (smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size))
+            return -1;
     }
 
     return 0;
@@ -523,8 +529,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
         return -1;
     }
 
-    decode_header_trees(c);
-
+    if (decode_header_trees(c))
+        return -1;
 
     return 0;
 }
@@ -619,9 +625,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     if(bits) { //decode 16-bit data
         for(i = stereo; i >= 0; i--)
             pred[i] = bswap_16(get_bits(&gb, 16));
-        for(i = 0; i < stereo; i++)
+        for(i = 0; i <= stereo; i++)
             *samples++ = pred[i];
-        for(i = 0; i < unp_size / 2; i++) {
+        for(; i < unp_size / 2; i++) {
             if(i & stereo) {
                 if(vlc[2].table)
                     res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@@ -653,9 +659,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     } else { //8-bit data
         for(i = stereo; i >= 0; i--)
             pred[i] = get_bits(&gb, 8);
-        for(i = 0; i < stereo; i++)
+        for(i = 0; i <= stereo; i++)
             *samples8++ = pred[i];
-        for(i = 0; i < unp_size; i++) {
+        for(; i < unp_size; i++) {
             if(i & stereo){
                 if(vlc[1].table)
                     res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);

libavcodec/sp5xdec.c

@@ -90,7 +90,6 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
     recoded[j++] = 0xFF;
     recoded[j++] = 0xD9;
 
-    avctx->flags &= ~CODEC_FLAG_EMU_EDGE;
     av_init_packet(&avpkt_recoded);
     avpkt_recoded.data = recoded;
     avpkt_recoded.size = j;
@@ -216,6 +215,6 @@ AVCodec amv_decoder = {
     NULL,
     ff_mjpeg_decode_end,
     sp5x_decode_frame,
-    CODEC_CAP_DR1,
+    0,
     .long_name = NULL_IF_CONFIG_SMALL("AMV Video"),
 };

libavcodec/svq1dec.c

@@ -678,6 +678,7 @@ static int svq1_decode_frame(AVCodecContext *avctx,
 #endif
     return result;
   }
+  avcodec_set_dimensions(avctx, s->width, s->height);
 
   //FIXME this avoids some confusion for "B frames" without 2 references
   //this should be removed after libavcodec can handle more flexible picture types & ordering

libavcodec/tableprint.c

@@ -33,6 +33,7 @@ WRITE_1D_FUNC(float,  float,    "%.18e", 3)
 WRITE_2D_FUNC(int8,   int8_t)
 WRITE_2D_FUNC(uint8,  uint8_t)
 WRITE_2D_FUNC(uint32, uint32_t)
+WRITE_2D_FUNC(float,  float)
 
 void write_fileheader(void) {
     printf("/* This file was generated by libavcodec/tableprint */\n");

libavcodec/tableprint.h

@@ -66,6 +66,7 @@ void write_float_array    (const float    *, int);
 void write_int8_2d_array  (const void *, int, int);
 void write_uint8_2d_array (const void *, int, int);
 void write_uint32_2d_array(const void *, int, int);
+void write_float_2d_array (const void *, int, int);
 /** \} */ // end of printfuncs group
 
 /** Write a standard file header */

libavcodec/truemotion1.c

@@ -518,6 +518,10 @@ hres,vres,i,i%vres (0 < i < 4)
 }
 
 #define APPLY_C_PREDICTOR() \
+    if(index > 1023){\
+        av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \
+        return; \
+    }\
     predictor_pair = s->c_predictor_table[index]; \
     horiz_pred += (predictor_pair >> 1); \
     if (predictor_pair & 1) { \
@@ -535,6 +539,10 @@ hres,vres,i,i%vres (0 < i < 4)
         index++;
 
 #define APPLY_C_PREDICTOR_24() \
+    if(index > 1023){\
+        av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \
+        return; \
+    }\
     predictor_pair = s->c_predictor_table[index]; \
     horiz_pred += (predictor_pair >> 1); \
     if (predictor_pair & 1) { \
@@ -553,6 +561,10 @@ hres,vres,i,i%vres (0 < i < 4)
 
 
 #define APPLY_Y_PREDICTOR() \
+    if(index > 1023){\
+        av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \
+        return; \
+    }\
     predictor_pair = s->y_predictor_table[index]; \
     horiz_pred += (predictor_pair >> 1); \
     if (predictor_pair & 1) { \
@@ -570,6 +582,10 @@ hres,vres,i,i%vres (0 < i < 4)
         index++;
 
 #define APPLY_Y_PREDICTOR_24() \
+    if(index > 1023){\
+        av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \
+        return; \
+    }\
     predictor_pair = s->y_predictor_table[index]; \
     horiz_pred += (predictor_pair >> 1); \
     if (predictor_pair & 1) { \

libavcodec/utils.c

@@ -724,14 +724,18 @@ av_cold int avcodec_close(AVCodecContext *avctx)
 
 AVCodec *avcodec_find_encoder(enum CodecID id)
 {
-    AVCodec *p;
+    AVCodec *p, *experimental=NULL;
     p = first_avcodec;
     while (p) {
-        if (p->encode != NULL && p->id == id)
-            return p;
+        if (p->encode != NULL && p->id == id) {
+            if (p->capabilities & CODEC_CAP_EXPERIMENTAL && !experimental) {
+                experimental = p;
+            } else
+                return p;
+        }
         p = p->next;
     }
-    return NULL;
+    return experimental;
 }
 
 AVCodec *avcodec_find_encoder_by_name(const char *name)

libavcodec/vc1.c

@@ -467,8 +467,8 @@ static int decode_sequence_header_adv(VC1Context *v, GetBitContext *gb)
         if(ar && ar < 14){
             v->s.avctx->sample_aspect_ratio = ff_vc1_pixel_aspect[ar];
         }else if(ar == 15){
-            w = get_bits(gb, 8);
-            h = get_bits(gb, 8);
+            w = get_bits(gb, 8) + 1;
+            h = get_bits(gb, 8) + 1;
             v->s.avctx->sample_aspect_ratio = (AVRational){w, h};
         }
         av_log(v->s.avctx, AV_LOG_DEBUG, "Aspect: %i:%i\n", v->s.avctx->sample_aspect_ratio.num, v->s.avctx->sample_aspect_ratio.den);

libavcodec/vc1dec.c

@@ -1365,7 +1365,7 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, int *value,
     if (index != vc1_ac_sizes[codingset] - 1) {
         run = vc1_index_decode_table[codingset][index][0];
         level = vc1_index_decode_table[codingset][index][1];
-        lst = index >= vc1_last_decode_table[codingset];
+        lst = index >= vc1_last_decode_table[codingset] || get_bits_left(gb) < 0;
         if(get_bits1(gb))
             level = -level;
     } else {

libavcodec/vmdav.c

@@ -72,9 +72,11 @@ typedef struct VmdVideoContext {
 #define QUEUE_SIZE 0x1000
 #define QUEUE_MASK 0x0FFF
 
-static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_len)
+static void lz_unpack(const unsigned char *src, int src_len,
+                      unsigned char *dest, int dest_len)
 {
     const unsigned char *s;
+    unsigned int s_len;
     unsigned char *d;
     unsigned char *d_end;
     unsigned char queue[QUEUE_SIZE];
@@ -87,13 +89,16 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
     unsigned int i, j;
 
     s = src;
+    s_len = src_len;
     d = dest;
     d_end = d + dest_len;
     dataleft = AV_RL32(s);
-    s += 4;
+    s += 4; s_len -= 4;
     memset(queue, 0x20, QUEUE_SIZE);
+    if (s_len < 4)
+        return;
     if (AV_RL32(s) == 0x56781234) {
-        s += 4;
+        s += 4; s_len -= 4;
         qpos = 0x111;
         speclen = 0xF + 3;
     } else {
@@ -101,32 +106,41 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
         speclen = 100;  /* no speclen */
     }
 
-    while (dataleft > 0) {
-        tag = *s++;
+    while (dataleft > 0 && s_len > 0) {
+        tag = *s++; s_len--;
         if ((tag == 0xFF) && (dataleft > 8)) {
-            if (d + 8 > d_end)
+            if (d + 8 > d_end || s_len < 8)
                 return;
             for (i = 0; i < 8; i++) {
                 queue[qpos++] = *d++ = *s++;
                 qpos &= QUEUE_MASK;
             }
+            s_len -= 8;
             dataleft -= 8;
         } else {
             for (i = 0; i < 8; i++) {
                 if (dataleft == 0)
                     break;
                 if (tag & 0x01) {
-                    if (d + 1 > d_end)
+                    if (d + 1 > d_end || s_len < 1)
                         return;
                     queue[qpos++] = *d++ = *s++;
                     qpos &= QUEUE_MASK;
                     dataleft--;
+                    s_len--;
                 } else {
+                    if (s_len < 2)
+                        return;
                     chainofs = *s++;
                     chainofs |= ((*s & 0xF0) << 4);
                     chainlen = (*s++ & 0x0F) + 3;
-                    if (chainlen == speclen)
+                    s_len -= 2;
+                    if (chainlen == speclen) {
+                        if (s_len < 1)
+                            return;
                         chainlen = *s++ + 0xF + 3;
+                        s_len--;
+                    }
                     if (d + chainlen > d_end)
                         return;
                     for (j = 0; j < chainlen; j++) {
@@ -143,7 +157,7 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
 }
 
 static int rle_unpack(const unsigned char *src, unsigned char *dest,
-    int src_len, int dest_len)
+    int src_count, int src_size, int dest_len)
 {
     const unsigned char *ps;
     unsigned char *pd;
@@ -152,31 +166,40 @@ static int rle_unpack(const unsigned char *src, unsigned char *dest,
 
     ps = src;
     pd = dest;
-    if (src_len & 1)
+    if (src_count & 1) {
+        if (src_size < 1)
+            return 0;
         *pd++ = *ps++;
+        src_size--;
+    }
 
-    src_len >>= 1;
+    src_count >>= 1;
     i = 0;
     do {
+        if (src_size < 1)
+            break;
         l = *ps++;
+        src_size--;
         if (l & 0x80) {
             l = (l & 0x7F) * 2;
-            if (pd + l > dest_end)
+            if (pd + l > dest_end || src_size < l)
                 return ps - src;
             memcpy(pd, ps, l);
             ps += l;
+            src_size -= l;
             pd += l;
         } else {
-            if (pd + i > dest_end)
+            if (pd + i > dest_end || src_size < 2)
                 return ps - src;
             for (i = 0; i < l; i++) {
                 *pd++ = ps[0];
                 *pd++ = ps[1];
             }
             ps += 2;
+            src_size -= 2;
         }
         i += l;
-    } while (i < src_len);
+    } while (i < src_count);
 
     return ps - src;
 }
@@ -191,6 +214,7 @@ static void vmd_decode(VmdVideoContext *s)
     const unsigned char *p = s->buf + 16;
 
     const unsigned char *pb;
+    unsigned int pb_size;
     unsigned char meth;
     unsigned char *dp;   /* pointer to current frame */
     unsigned char *pp;   /* pointer to previous frame */
@@ -205,6 +229,16 @@ static void vmd_decode(VmdVideoContext *s)
     frame_y = AV_RL16(&s->buf[8]);
     frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
     frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;
+    if (frame_x < 0 || frame_width < 0 ||
+        frame_x >= s->avctx->width ||
+        frame_width > s->avctx->width ||
+        frame_x + frame_width > s->avctx->width)
+        return;
+    if (frame_y < 0 || frame_height < 0 ||
+        frame_y >= s->avctx->height ||
+        frame_height > s->avctx->height ||
+        frame_y + frame_height > s->avctx->height)
+        return;
 
     if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
         (frame_x || frame_y)) {
@@ -217,8 +251,9 @@ static void vmd_decode(VmdVideoContext *s)
 
     /* if only a certain region will be updated, copy the entire previous
      * frame before the decode */
-    if (frame_x || frame_y || (frame_width != s->avctx->width) ||
-        (frame_height != s->avctx->height)) {
+    if (s->prev_frame.data[0] &&
+        (frame_x || frame_y || (frame_width != s->avctx->width) ||
+        (frame_height != s->avctx->height))) {
 
         memcpy(s->frame.data[0], s->prev_frame.data[0],
             s->avctx->height * s->frame.linesize[0]);
@@ -236,14 +271,19 @@ static void vmd_decode(VmdVideoContext *s)
         }
         s->size -= (256 * 3 + 2);
     }
-    if (s->size >= 0) {
+    if (s->size > 0) {
         /* originally UnpackFrame in VAG's code */
         pb = p;
-        meth = *pb++;
+        pb_size = s->buf + s->size - pb;
+        if (pb_size < 1)
+            return;
+        meth = *pb++; pb_size--;
         if (meth & 0x80) {
-            lz_unpack(pb, s->unpack_buffer, s->unpack_buffer_size);
+            lz_unpack(pb, pb_size,
+                      s->unpack_buffer, s->unpack_buffer_size);
             meth &= 0x7F;
             pb = s->unpack_buffer;
+            pb_size = s->unpack_buffer_size;
         }
 
         dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x];
@@ -254,17 +294,21 @@ static void vmd_decode(VmdVideoContext *s)
             for (i = 0; i < frame_height; i++) {
                 ofs = 0;
                 do {
+                    if (pb_size < 1)
+                        return;
                     len = *pb++;
+                    pb_size--;
                     if (len & 0x80) {
                         len = (len & 0x7F) + 1;
-                        if (ofs + len > frame_width)
+                        if (ofs + len > frame_width || pb_size < len)
                             return;
                         memcpy(&dp[ofs], pb, len);
                         pb += len;
+                        pb_size -= len;
                         ofs += len;
                     } else {
                         /* interframe pixel copy */
-                        if (ofs + len + 1 > frame_width)
+                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
                             return;
                         memcpy(&dp[ofs], &pp[ofs], len + 1);
                         ofs += len + 1;
@@ -282,8 +326,11 @@ static void vmd_decode(VmdVideoContext *s)
 
         case 2:
             for (i = 0; i < frame_height; i++) {
+                if (pb_size < frame_width)
+                    return;
                 memcpy(dp, pb, frame_width);
                 pb += frame_width;
+                pb_size -= frame_width;
                 dp += s->frame.linesize[0];
                 pp += s->prev_frame.linesize[0];
             }
@@ -293,18 +340,27 @@ static void vmd_decode(VmdVideoContext *s)
             for (i = 0; i < frame_height; i++) {
                 ofs = 0;
                 do {
+                    if (pb_size < 1)
+                        return;
                     len = *pb++;
+                    pb_size--;
                     if (len & 0x80) {
                         len = (len & 0x7F) + 1;
+                        if (pb_size < 1)
+                            return;
                         if (*pb++ == 0xFF)
-                            len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs);
-                        else
+                            len = rle_unpack(pb, &dp[ofs], len, pb_size, frame_width - ofs);
+                        else {
+                            if (pb_size < len)
+                                return;
                             memcpy(&dp[ofs], pb, len);
+                        }
                         pb += len;
+                        pb_size -= 1 + len;
                         ofs += len;
                     } else {
                         /* interframe pixel copy */
-                        if (ofs + len + 1 > frame_width)
+                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
                             return;
                         memcpy(&dp[ofs], &pp[ofs], len + 1);
                         ofs += len + 1;

libavcodec/vorbis.c

@@ -156,7 +156,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values)
     }
 }
 
-static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1,
                                         intptr_t sy, int ady, int adx,
                                         float *buf)
 {
@@ -179,7 +179,7 @@ static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
     }
 }
 
-static void render_line(int x0, int y0, int x1, int y1, float *buf)
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf)
 {
     int dy  = y1 - y0;
     int adx = x1 - x0;
@@ -189,10 +189,10 @@ static void render_line(int x0, int y0, int x1, int y1, float *buf)
     if (ady*2 <= adx) { // optimized common case
         render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
     } else {
-        int base = dy / adx;
-        int x    = x0;
-        int y    = y0;
-        int err  = -adx;
+        int base  = dy / adx;
+        int x     = x0;
+        uint8_t y = y0;
+        int err   = -adx;
         ady -= FFABS(base) * adx;
         while (++x < x1) {
             y += base;
@@ -210,7 +210,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values,
                                   uint_fast16_t *y_list, int *flag,
                                   int multiplier, float *out, int samples)
 {
-    int lx, ly, i;
+    int lx, i;
+    uint8_t ly;
     lx = 0;
     ly = y_list[0] * multiplier;
     for (i = 1; i < values; i++) {

libavcodec/vorbis_dec.c

@@ -61,8 +61,8 @@ typedef struct vorbis_floor0_s vorbis_floor0;
 typedef struct vorbis_floor1_s vorbis_floor1;
 struct vorbis_context_s;
 typedef
-uint_fast8_t (* vorbis_floor_decode_func)
-             (struct vorbis_context_s *, vorbis_floor_data *, float *);
+int (* vorbis_floor_decode_func)
+    (struct vorbis_context_s *, vorbis_floor_data *, float *);
 typedef struct {
     uint_fast8_t floor_type;
     vorbis_floor_decode_func decode;
@@ -453,11 +453,11 @@ static int vorbis_parse_setup_hdr_tdtransforms(vorbis_context *vc)
 
 // Process floors part
 
-static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec);
+static int vorbis_floor0_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec);
 static void create_map(vorbis_context *vc, uint_fast8_t floor_number);
-static uint_fast8_t vorbis_floor1_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec);
+static int vorbis_floor1_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec);
 static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
 {
     GetBitContext *gb = &vc->gb;
@@ -477,6 +477,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
         if (floor_setup->floor_type == 1) {
             uint_fast8_t  maximum_class = 0;
             uint_fast8_t  rangebits;
+            uint_fast32_t rangemax;
             uint_fast16_t floor1_values = 2;
 
             floor_setup->decode = vorbis_floor1_decode;
@@ -530,8 +531,15 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
 
 
             rangebits = get_bits(gb, 4);
+            rangemax = (1 << rangebits);
+            if (rangemax > vc->blocksize[1] / 2) {
+                av_log(vc->avccontext, AV_LOG_ERROR,
+                       "Floor value is too large for blocksize: %d (%d)\n",
+                       rangemax, vc->blocksize[1] / 2);
+                return -1;
+            }
             floor_setup->data.t1.list[0].x = 0;
-            floor_setup->data.t1.list[1].x = (1 << rangebits);
+            floor_setup->data.t1.list[1].x = rangemax;
 
             for (j = 0; j < floor_setup->data.t1.partitions; ++j) {
                 for (k = 0; k < floor_setup->data.t1.class_dimensions[floor_setup->data.t1.partition_class[j]]; ++k, ++floor1_values) {
@@ -648,7 +656,7 @@ static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
         res_setup->partition_size = get_bits(gb, 24) + 1;
         /* Validations to prevent a buffer overflow later. */
         if (res_setup->begin>res_setup->end ||
-            res_setup->end>vc->blocksize[1] / (res_setup->type == 2 ? 1 : 2) ||
+            res_setup->end > (res_setup->type == 2 ? vc->avccontext->channels : 1) * vc->blocksize[1] / 2 ||
             (res_setup->end-res_setup->begin) / res_setup->partition_size > V_MAX_PARTITIONS) {
             av_log(vc->avccontext, AV_LOG_ERROR, "partition out of bounds: type, begin, end, size, blocksize: %"PRIdFAST16", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32"\n", res_setup->type, res_setup->begin, res_setup->end, res_setup->partition_size, vc->blocksize[1] / 2);
             return -1;
@@ -1002,8 +1010,8 @@ static av_cold int vorbis_decode_init(AVCodecContext *avccontext)
 
 // Read and decode floor
 
-static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec)
+static int vorbis_floor0_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec)
 {
     vorbis_floor0 *vf = &vfu->t0;
     float *lsp = vf->lsp;
@@ -1027,6 +1035,9 @@ static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
         }
         AV_DEBUG("floor0 dec: booknumber: %u\n", book_idx);
         codebook = vc->codebooks[vf->book_list[book_idx]];
+        /* Invalid codebook! */
+        if (!codebook.codevectors)
+            return -1;
 
         while (lsp_len<vf->order) {
             int vec_off;
@@ -1112,8 +1123,8 @@ static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc,
     return 0;
 }
 
-static uint_fast8_t vorbis_floor1_decode(vorbis_context *vc,
-                                         vorbis_floor_data *vfu, float *vec)
+static int vorbis_floor1_decode(vorbis_context *vc,
+                                vorbis_floor_data *vfu, float *vec)
 {
     vorbis_floor1 *vf = &vfu->t1;
     GetBitContext *gb = &vc->gb;
@@ -1251,6 +1262,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
                                                            uint_fast8_t *do_not_decode,
                                                            float *vec,
                                                            uint_fast16_t vlen,
+                                                           unsigned ch_left,
                                                            int vr_type)
 {
     GetBitContext *gb = &vc->gb;
@@ -1262,6 +1274,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
     uint_fast8_t ch_used;
     uint_fast8_t i,j,l;
     uint_fast16_t k;
+    unsigned max_output = (ch - 1) * vlen;
 
     if (vr_type == 2) {
         for (j = 1; j < ch; ++j)
@@ -1269,8 +1282,15 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
         if (do_not_decode[0])
             return 0;
         ch_used = 1;
+        max_output += vr->end / ch;
     } else {
         ch_used = ch;
+        max_output += vr->end;
+    }
+
+    if (max_output > ch_left * vlen) {
+        av_log(vc->avccontext, AV_LOG_ERROR, "Insufficient output buffer\n");
+        return -1;
     }
 
     AV_DEBUG(" residue type 0/1/2 decode begin, ch: %d  cpc %d  \n", ch, c_p_c);
@@ -1392,14 +1412,16 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
 static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,
                                         uint_fast8_t ch,
                                         uint_fast8_t *do_not_decode,
-                                        float *vec, uint_fast16_t vlen)
+                                        float *vec, uint_fast16_t vlen,
+                                        unsigned ch_left)
+
 {
     if (vr->type == 2)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 2);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 2);
     else if (vr->type == 1)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 1);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 1);
     else if (vr->type == 0)
-        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 0);
+        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 0);
     else {
         av_log(vc->avccontext, AV_LOG_ERROR, " Invalid residue type while residue decode?! \n");
         return -1;
@@ -1462,6 +1484,8 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
     uint_fast8_t res_num = 0;
     int_fast16_t retlen  = 0;
     float fadd_bias = vc->add_bias;
+    unsigned ch_left = vc->audio_channels;
+    unsigned vlen;
 
     if (get_bits1(gb)) {
         av_log(vc->avccontext, AV_LOG_ERROR, "Not a Vorbis I audio packet.\n");
@@ -1480,24 +1504,32 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
 
     blockflag = vc->modes[mode_number].blockflag;
     blocksize = vc->blocksize[blockflag];
+    vlen = blocksize / 2;
     if (blockflag)
         skip_bits(gb, 2); // previous_window, next_window
 
-    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * blocksize / 2); //FIXME can this be removed ?
-    memset(ch_floor_ptr, 0, sizeof(float) * vc->audio_channels * blocksize / 2); //FIXME can this be removed ?
+    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * vlen); //FIXME can this be removed ?
+    memset(ch_floor_ptr, 0, sizeof(float) * vc->audio_channels * vlen); //FIXME can this be removed ?
 
 // Decode floor
 
     for (i = 0; i < vc->audio_channels; ++i) {
         vorbis_floor *floor;
+        int ret;
         if (mapping->submaps > 1) {
             floor = &vc->floors[mapping->submap_floor[mapping->mux[i]]];
         } else {
             floor = &vc->floors[mapping->submap_floor[0]];
         }
 
-        no_residue[i] = floor->decode(vc, &floor->data, ch_floor_ptr);
-        ch_floor_ptr += blocksize / 2;
+        ret = floor->decode(vc, &floor->data, ch_floor_ptr);
+
+        if (ret < 0) {
+            av_log(vc->avccontext, AV_LOG_ERROR, "Invalid codebook in vorbis_floor_decode.\n");
+            return -1;
+        }
+        no_residue[i] = ret;
+        ch_floor_ptr += vlen;
     }
 
 // Nonzero vector propagate
@@ -1514,6 +1546,7 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
     for (i = 0; i < mapping->submaps; ++i) {
         vorbis_residue *residue;
         uint_fast8_t ch = 0;
+        int ret;
 
         for (j = 0; j < vc->audio_channels; ++j) {
             if ((mapping->submaps == 1) || (i == mapping->mux[j])) {
@@ -1528,9 +1561,18 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
             }
         }
         residue = &vc->residues[mapping->submap_residue[i]];
-        vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, blocksize/2);
+        if (ch_left < ch) {
+            av_log(vc->avccontext, AV_LOG_ERROR, "Too many channels in vorbis_floor_decode.\n");
+            return -1;
+        }
+        if (ch) {
+            ret = vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, vlen, ch_left);
+            if (ret < 0)
+                return ret;
+        }
 
-        ch_res_ptr += ch * blocksize / 2;
+        ch_res_ptr += ch * vlen;
+        ch_left -= ch;
     }
 
 // Inverse coupling

libavcodec/vorbis_enc.c

@@ -1099,7 +1099,7 @@ AVCodec vorbis_encoder = {
     vorbis_encode_init,
     vorbis_encode_frame,
     vorbis_encode_close,
-    .capabilities= CODEC_CAP_DELAY,
+    .capabilities= CODEC_CAP_DELAY | CODEC_CAP_EXPERIMENTAL,
     .sample_fmts = (const enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("Vorbis"),
 };

libavcodec/vp3.c

@@ -884,7 +884,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
             /* decode a VLC into a token */
             token = get_vlc2(gb, vlc_table, 11, 3);
             /* use the token to get a zero run, a coefficient, and an eob run */
-            if (token <= 6) {
+            if ((unsigned) token <= 6U) {
                 eob_run = eob_run_base[token];
                 if (eob_run_get_bits[token])
                     eob_run += get_bits(gb, eob_run_get_bits[token]);
@@ -902,7 +902,7 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
                     coeff_i        += eob_run;
                     eob_run = 0;
                 }
-            } else {
+            } else if (token >= 0) {
                 bits_to_get = coeff_get_bits[token];
                 if (bits_to_get)
                     bits_to_get = get_bits(gb, bits_to_get);
@@ -936,6 +936,10 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
                 for (i = coeff_index+1; i <= coeff_index+zero_run; i++)
                     s->num_coded_frags[plane][i]--;
                 coeff_i++;
+            } else {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "Invalid token %d\n", token);
+                return -1;
             }
     }
 
@@ -985,6 +989,8 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
     /* unpack the Y plane DC coefficients */
     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_y_table], 0,
         0, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;
 
     /* reverse prediction of the Y-plane DC coefficients */
     reverse_dc_prediction(s, 0, s->fragment_width[0], s->fragment_height[0]);
@@ -992,8 +998,12 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
     /* unpack the C plane DC coefficients */
     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
         1, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;
     residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
         2, residual_eob_run);
+    if (residual_eob_run < 0)
+        return residual_eob_run;
 
     /* reverse prediction of the C-plane DC coefficients */
     if (!(s->avctx->flags & CODEC_FLAG_GRAY))
@@ -1030,11 +1040,17 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
     for (i = 1; i <= 63; i++) {
             residual_eob_run = unpack_vlcs(s, gb, y_tables[i], i,
                 0, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;
 
             residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
                 1, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;
             residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
                 2, residual_eob_run);
+            if (residual_eob_run < 0)
+                return residual_eob_run;
     }
 
     return 0;
@@ -1285,6 +1301,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if (i > 63) {
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return i;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;
@@ -1296,6 +1316,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
             return i;
         }
     } while (i < 64);
+    // return value is expected to be a valid level
+    i--;
 end:
     // the actual DC+prediction is in the fragment structure
     block[0] = frag->dc * s->qmat[0][inter][plane][0];

libavcodec/vp5.c

@@ -116,7 +116,7 @@ static void vp5_parse_vector_models(VP56Context *s)
                 model->vector_pdv[comp][node] = vp56_rac_gets_nn(c, 7);
 }
 
-static void vp5_parse_coeff_models(VP56Context *s)
+static int vp5_parse_coeff_models(VP56Context *s)
 {
     VP56RangeCoder *c = &s->c;
     VP56Model *model = s->modelp;
@@ -160,6 +160,7 @@ static void vp5_parse_coeff_models(VP56Context *s)
                 for (ctx=0; ctx<6; ctx++)
                     for (node=0; node<5; node++)
                         model->coeff_acct[pt][ct][cg][ctx][node] = av_clip(((model->coeff_ract[pt][ct][cg][node] * vp5_ract_lc[ct][cg][node][ctx][0] + 128) >> 8) + vp5_ract_lc[ct][cg][node][ctx][1], 1, 254);
+    return 0;
 }
 
 static void vp5_parse_coeff(VP56Context *s)

libavcodec/vp56.c

@@ -537,7 +537,8 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
             s->mb_type = VP56_MB_INTER_NOVEC_PF;
         }
 
-        s->parse_coeff_models(s);
+        if (s->parse_coeff_models(s))
+            goto next;
 
         memset(s->prev_dc, 0, sizeof(s->prev_dc));
         s->prev_dc[1][VP56_FRAME_CURRENT] = 128;
@@ -601,6 +602,7 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
             }
         }
 
+    next:
         if (p->key_frame || golden_frame) {
             if (s->framep[VP56_FRAME_GOLDEN]->data[0] &&
                 s->framep[VP56_FRAME_GOLDEN] != s->framep[VP56_FRAME_GOLDEN2])

libavcodec/vp56.h

@@ -41,7 +41,7 @@ typedef void (*VP56Filter)(VP56Context *s, uint8_t *dst, uint8_t *src,
 typedef void (*VP56ParseCoeff)(VP56Context *s);
 typedef void (*VP56DefaultModelsInit)(VP56Context *s);
 typedef void (*VP56ParseVectorModels)(VP56Context *s);
-typedef void (*VP56ParseCoeffModels)(VP56Context *s);
+typedef int  (*VP56ParseCoeffModels)(VP56Context *s);
 typedef int  (*VP56ParseHeader)(VP56Context *s, const uint8_t *buf,
                                 int buf_size, int *golden_frame);
 

libavcodec/vp6.c

@@ -136,8 +136,11 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size,
     if (coeff_offset) {
         buf      += coeff_offset;
         buf_size -= coeff_offset;
-        if (buf_size < 0)
+        if (buf_size < 0) {
+            if (s->framep[VP56_FRAME_CURRENT]->key_frame)
+                avcodec_set_dimensions(s->avctx, 0, 0);
             return 0;
+        }
         if (s->use_huffman) {
             s->parse_coeff = vp6_parse_coeff_huffman;
             init_get_bits(&s->gb, buf, buf_size<<3);
@@ -212,8 +215,8 @@ static int vp6_huff_cmp(const void *va, const void *vb)
     return (a->count - b->count)*16 + (b->sym - a->sym);
 }
 
-static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
-                                const uint8_t *map, unsigned size, VLC *vlc)
+static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
+                               const uint8_t *map, unsigned size, VLC *vlc)
 {
     Node nodes[2*size], *tmp = &nodes[size];
     int a, b, i;
@@ -228,12 +231,12 @@ static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     }
 
     free_vlc(vlc);
-    /* then build the huffman tree accodring to probabilities */
-    ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
-                       FF_HUFFMAN_FLAG_HNODE_FIRST);
+    /* then build the huffman tree according to probabilities */
+    return ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
+                              FF_HUFFMAN_FLAG_HNODE_FIRST);
 }
 
-static void vp6_parse_coeff_models(VP56Context *s)
+static int vp6_parse_coeff_models(VP56Context *s)
 {
     VP56RangeCoder *c = &s->c;
     VP56Model *model = s->modelp;
@@ -278,15 +281,18 @@ static void vp6_parse_coeff_models(VP56Context *s)
 
     if (s->use_huffman) {
         for (pt=0; pt<2; pt++) {
-            vp6_build_huff_tree(s, model->coeff_dccv[pt],
-                                vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);
-            vp6_build_huff_tree(s, model->coeff_runv[pt],
-                                vp6_huff_run_map, 9, &s->runv_vlc[pt]);
+            if (vp6_build_huff_tree(s, model->coeff_dccv[pt],
+                                    vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]))
+                return -1;
+            if (vp6_build_huff_tree(s, model->coeff_runv[pt],
+                                    vp6_huff_run_map, 9, &s->runv_vlc[pt]))
+                return -1;
             for (ct=0; ct<3; ct++)
                 for (cg = 0; cg < 6; cg++)
-                    vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
-                                        vp6_huff_coeff_map, 12,
-                                        &s->ract_vlc[pt][ct][cg]);
+                    if (vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
+                                            vp6_huff_coeff_map, 12,
+                                            &s->ract_vlc[pt][ct][cg]))
+                        return -1;
         }
         memset(s->nb_null, 0, sizeof(s->nb_null));
     } else {
@@ -296,6 +302,7 @@ static void vp6_parse_coeff_models(VP56Context *s)
             for (node=0; node<5; node++)
                 model->coeff_dcct[pt][ctx][node] = av_clip(((model->coeff_dccv[pt][node] * vp6_dccv_lc[ctx][node][0] + 128) >> 8) + vp6_dccv_lc[ctx][node][1], 1, 255);
     }
+    return 0;
 }
 
 static void vp6_parse_vector_adjustment(VP56Context *s, VP56mv *vect)
@@ -366,7 +373,7 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
         if (b > 3) pt = 1;
         vlc_coeff = &s->dccv_vlc[pt];
 
-        for (coeff_idx=0; coeff_idx<64; ) {
+        for (coeff_idx = 0;;) {
             int run = 1;
             if (coeff_idx<2 && s->nb_null[coeff_idx][pt]) {
                 s->nb_null[coeff_idx][pt]--;
@@ -403,6 +410,8 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
                 }
             }
             coeff_idx+=run;
+            if (coeff_idx >= 64)
+                break;
             cg = FFMIN(vp6_coeff_groups[coeff_idx], 3);
             vlc_coeff = &s->ract_vlc[pt][ct][cg];
         }
@@ -430,7 +439,8 @@ static void vp6_parse_coeff(VP56Context *s)
         model1 = model->coeff_dccv[pt];
         model2 = model->coeff_dcct[pt][ctx];
 
-        for (coeff_idx=0; coeff_idx<64; ) {
+        coeff_idx = 0;
+        for (;;) {
             if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) {
                 /* parse a coeff */
                 if (vp56_rac_get_prob(c, model2[2])) {
@@ -471,8 +481,10 @@ static void vp6_parse_coeff(VP56Context *s)
                             run += vp56_rac_get_prob(c, model3[i+8]) << i;
                 }
             }
-
-            cg = vp6_coeff_groups[coeff_idx+=run];
+            coeff_idx += run;
+            if (coeff_idx >= 64)
+                break;
+            cg = vp6_coeff_groups[coeff_idx];
             model1 = model2 = model->coeff_ract[pt][ct][cg];
         }
 

libavcodec/vqavideo.c

@@ -162,6 +162,12 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
         return -1;
     }
 
+    if (s->width  & (s->vector_width  - 1) ||
+        s->height & (s->vector_height - 1)) {
+        av_log(avctx, AV_LOG_ERROR, "Image size not multiple of block size\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* allocate codebooks */
     s->codebook_size = MAX_CODEBOOK_SIZE;
     s->codebook = av_malloc(s->codebook_size);

libavcodec/wavpack.c

@@ -275,7 +275,14 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
             }
         }else{
             t = get_unary_0_33(gb);
-            if(t >= 2) t = get_bits(gb, t - 1) | (1 << (t-1));
+            if(t >= 2){
+                if(get_bits_left(gb) < t-1)
+                    goto error;
+                t = get_bits(gb, t - 1) | (1 << (t-1));
+            }else{
+                if(get_bits_left(gb) < 0)
+                    goto error;
+            }
             ctx->zeroes = t;
             if(ctx->zeroes){
                 memset(ctx->ch[0].median, 0, sizeof(ctx->ch[0].median));
@@ -286,24 +293,24 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
         }
     }
 
-    if(get_bits_count(gb) >= ctx->data_size){
-        *last = 1;
-        return 0;
-    }
-
     if(ctx->zero){
         t = 0;
         ctx->zero = 0;
     }else{
         t = get_unary_0_33(gb);
-        if(get_bits_count(gb) >= ctx->data_size){
-            *last = 1;
-            return 0;
-        }
+        if(get_bits_left(gb) < 0)
+            goto error;
         if(t == 16) {
             t2 = get_unary_0_33(gb);
-            if(t2 < 2) t += t2;
-            else t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
+            if(t2 < 2){
+                if(get_bits_left(gb) < 0)
+                    goto error;
+                t += t2;
+            }else{
+                if(get_bits_left(gb) < t2 - 1)
+                    goto error;
+                t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
+            }
         }
 
         if(ctx->one){
@@ -343,9 +350,13 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
     }
     if(!c->error_limit){
         ret = base + get_tail(gb, add);
+        if (get_bits_left(gb) <= 0)
+            goto error;
     }else{
         int mid = (base*2 + add + 1) >> 1;
         while(add > c->error_limit){
+            if(get_bits_left(gb) <= 0)
+                goto error;
             if(get_bits1(gb)){
                 add -= (mid - base);
                 base = mid;
@@ -359,6 +370,10 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
     if(ctx->hybrid_bitrate)
         c->slow_level += wp_log2(ret) - LEVEL_DECAY(c->slow_level);
     return sign ? ~ret : ret;
+
+error:
+    *last = 1;
+    return 0;
 }
 
 static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
@@ -368,7 +383,7 @@ static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
     if(s->extra_bits){
         S <<= s->extra_bits;
 
-        if(s->got_extra_bits){
+        if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){
             S |= get_bits(&s->gb_extra_bits, s->extra_bits);
             *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
         }
@@ -559,7 +574,10 @@ static inline int wv_unpack_stereo(WavpackContext *s, GetBitContext *gb, void *d
         count++;
     }while(!last && count < s->max_samples);
 
-    s->samples_left -= count;
+    if (last)
+        s->samples_left = 0;
+    else
+        s->samples_left -= count;
     if(!s->samples_left){
         if(crc != s->CRC){
             av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@@ -632,7 +650,10 @@ static inline int wv_unpack_mono(WavpackContext *s, GetBitContext *gb, void *dst
         count++;
     }while(!last && count < s->samples);
 
-    s->samples_left -= count;
+    if (last)
+        s->samples_left = 0;
+    else
+        s->samples_left -= count;
     if(!s->samples_left){
         if(crc != s->CRC){
             av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@@ -755,12 +776,13 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
         }
         switch(id & WP_IDF_MASK){
         case WP_ID_DECTERMS:
-            s->terms = size;
-            if(s->terms > MAX_TERMS){
+            if(size > MAX_TERMS){
                 av_log(avctx, AV_LOG_ERROR, "Too many decorrelation terms\n");
+                s->terms = 0;
                 buf += ssize;
                 continue;
             }
+            s->terms = size;
             for(i = 0; i < s->terms; i++) {
                 s->decorr[s->terms - i - 1].value = (*buf & 0x1F) - 5;
                 s->decorr[s->terms - i - 1].delta = *buf >> 5;
@@ -976,6 +998,9 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
         else
             samplecount = wv_unpack_stereo(s, &s->gb, samples, SAMPLE_FMT_FLT);
 
+        if (samplecount < 0)
+            return -1;
+
     }else{
         if(avctx->sample_fmt == SAMPLE_FMT_S16)
             samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_S16);
@@ -984,11 +1009,14 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
         else
             samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_FLT);
 
+        if (samplecount < 0)
+            return -1;
+
         if(s->stereo && avctx->sample_fmt == SAMPLE_FMT_S16){
             int16_t *dst = (int16_t*)samples + samplecount * 2;
             int16_t *src = (int16_t*)samples + samplecount;
             int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                 *--dst = *--src;
                 *--dst = *src;
             }
@@ -997,7 +1025,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
             int32_t *dst = (int32_t*)samples + samplecount * 2;
             int32_t *src = (int32_t*)samples + samplecount;
             int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                 *--dst = *--src;
                 *--dst = *src;
             }
@@ -1006,7 +1034,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
             float *dst = (float*)samples + samplecount * 2;
             float *src = (float*)samples + samplecount;
             int cnt = samplecount;
-            while(cnt--){
+            while(cnt-- > 0){
                 *--dst = *--src;
                 *--dst = *src;
             }

libavcodec/wma.c

@@ -135,6 +135,9 @@ int ff_wma_init(AVCodecContext *avctx, int flags2)
 
     /* compute MDCT block size */
     s->frame_len_bits = ff_wma_get_frame_len_bits(s->sample_rate, s->version, 0);
+    s->next_block_len_bits = s->frame_len_bits;
+    s->prev_block_len_bits = s->frame_len_bits;
+    s->block_len_bits      = s->frame_len_bits;
 
     s->frame_len = 1 << s->frame_len_bits;
     if (s->use_variable_block_len) {

libavcodec/wnv1.c

@@ -70,6 +70,11 @@ static int decode_frame(AVCodecContext *avctx,
     int prev_y = 0, prev_u = 0, prev_v = 0;
     uint8_t *rbuf;
 
+    if(buf_size<=8) {
+        av_log(avctx, AV_LOG_ERROR, "buf_size %d is too small\n", buf_size);
+        return AVERROR_INVALIDDATA;
+    }
+
     rbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
     if(!rbuf){
         av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");

libavcodec/x86/cpuid.c

@@ -98,7 +98,7 @@ int mm_support(void)
 
     if(max_ext_level >= 0x80000001){
         cpuid(0x80000001, eax, ebx, ecx, ext_caps);
-        if (ext_caps & (1<<31))
+        if (ext_caps & (1U<<31))
             rval |= FF_MM_3DNOW;
         if (ext_caps & (1<<30))
             rval |= FF_MM_3DNOWEXT;