indeo4: check that num_mbs matches

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d3db8988d5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Changelog

@@ -1,8 +1,11 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
-version next:
+version 0.9:
 
+- Indeo 4 decoder
+- SMJPEG demuxer
+- y41p Brooktree Uncompressed 4:1:1 12-bit encoder and decoder
 - openal input device added
 - boxblur filter added
 - BWF muxer
@@ -134,7 +137,7 @@ easier to use. The changes are:
 - new option: -report
 - Dxtory capture format decoder
 - cellauto source
-
+- v410 Quicktime Uncompressed 4:4:4 10-bit encoder and decoder
 
 version 0.8:
 

Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 0.9.2
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
 # base path where the generated documentation will be put.

MAINTAINERS

@@ -218,6 +218,7 @@ Codecs:
   tta.c                                 Alex Beregszaszi, Jaikrishnan Menon
   txd.c                                 Ivo van Poorten
   ulti*                                 Kostya Shishkov
+  v410*.c                               Derek Buitenhuis
   vb.c                                  Kostya Shishkov
   vble.c                                Derek Buitenhuis
   vc1*                                  Kostya Shishkov
@@ -388,6 +389,7 @@ Releases
 0.6                                     *Deprecated/Unmaintained*
 0.7                                     Michael Niedermayer
 0.8                                     Michael Niedermayer
+0.9                                     Michael Niedermayer
 
 
 

Makefile

@@ -47,7 +47,7 @@ include $(SRC_PATH)/common.mak
 FF_EXTRALIBS := $(FFEXTRALIBS)
 FF_DEP_LIBS  := $(DEP_LIBS)
 
-all: $(filter-out avconv, $(PROGS))
+all: $(PROGS)
 
 $(PROGS): %$(EXESUF): %$(PROGSSUF)_g$(EXESUF)
 	$(CP) $< $@$(PROGSSUF)

RELEASE

@@ -1 +1 @@
-0.8.7.git
+0.9.2

VERSION

@@ -0,0 +1 @@
+0.9.2

avconv.c

@@ -4361,7 +4361,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     /* parse options */
     parse_options(&o, argc, argv, options, opt_output_file);

cmdutils.c

@@ -53,7 +53,7 @@
 struct SwsContext *sws_opts;
 AVDictionary *format_opts, *codec_opts;
 
-static const int this_year = 2011;
+static const int this_year = 2012;
 
 static FILE *report_file;
 
@@ -582,8 +582,12 @@ static void print_all_libs_info(int flags, int level)
     PRINT_LIB_INFO(postproc, POSTPROC, flags, level);
 }
 
-void show_banner(void)
+void show_banner(int argc, char **argv, const OptionDef *options)
 {
+    int idx = locate_option(argc, argv, options, "version");
+    if (idx)
+        return;
+
     av_log(NULL, AV_LOG_INFO, "%s version " FFMPEG_VERSION ", Copyright (c) %d-%d the FFmpeg developers\n",
            program_name, program_birth_year, this_year);
     av_log(NULL, AV_LOG_INFO, "  built on %s %s with %s %s\n",

cmdutils.h

@@ -245,7 +245,7 @@ void print_error(const char *filename, int err);
  * current version of the repository and of the libav* libraries used by
  * the program.
  */
-void show_banner(void);
+void show_banner(int argc, char **argv, const OptionDef *options);
 
 /**
  * Print the version of the program to stdout. The version message

configure

@@ -81,7 +81,7 @@ Configuration options:
                            and binaries will be unredistributable [no]
   --disable-doc            do not build documentation
   --disable-ffmpeg         disable ffmpeg build
-  --disable-avconv         disable avconv build
+  --enable-avconv          enable  avconv build
   --disable-ffplay         disable ffplay build
   --disable-ffprobe        disable ffprobe build
   --disable-ffserver       disable ffserver build
@@ -116,6 +116,9 @@ Configuration options:
   --disable-vda            disable VDA code
   --enable-runtime-cpudetect detect cpu capabilities at runtime (bigger binary)
   --enable-hardcoded-tables use hardcoded tables instead of runtime generation
+  --disable-safe-bitstream-reader
+                           disable buffer boundary checking in bitreaders
+                           (faster, but may crash)
   --enable-memalign-hack   emulate memalign, interferes with memory debuggers
   --disable-everything     disable all components listed below
   --disable-encoder=NAME   disable encoder NAME
@@ -1055,6 +1058,7 @@ CONFIG_LIST="
     rdft
     rtpdec
     runtime_cpudetect
+    safe_bitstream_reader
     shared
     sinewin
     small
@@ -1137,6 +1141,7 @@ HAVE_LIST="
     altivec_h
     arpa_inet_h
     asm_mod_y
+    asm_types_h
     attribute_may_alias
     attribute_packed
     bswap
@@ -1799,7 +1804,6 @@ enable debug
 enable doc
 enable fastdiv
 enable ffmpeg
-enable avconv
 enable ffplay
 enable ffprobe
 enable ffserver
@@ -1807,6 +1811,7 @@ enable network
 enable optimizations
 enable postproc
 enable protocols
+enable safe_bitstream_reader
 enable static
 enable stripping
 enable swresample
@@ -2294,7 +2299,7 @@ fi
 
 # Deal with common $arch aliases
 case "$arch" in
-    arm*)
+    arm*|iPad*)
         arch="arm"
     ;;
     mips|mipsel|IP*)
@@ -2997,6 +3002,7 @@ check_header termios.h
 check_header vdpau/vdpau.h
 check_header vdpau/vdpau_x11.h
 check_header X11/extensions/XvMClib.h
+check_header asm/types.h
 
 disabled  zlib || check_lib   zlib.h      zlibVersion -lz   || disable  zlib
 disabled bzlib || check_lib2 bzlib.h BZ2_bzlibVersion -lbz2 || disable bzlib
@@ -3394,6 +3400,7 @@ echo "postprocessing support    ${postproc-no}"
 echo "new filter support        ${avfilter-no}"
 echo "network support           ${network-no}"
 echo "threading support         ${thread_type-no}"
+echo "safe bitstream reader     ${safe_bitstream_reader-no}"
 echo "SDL support               ${sdl-no}"
 echo "Sun medialib support      ${mlib-no}"
 echo "libdxva2 enabled          ${dxva2-no}"

doc/APIchanges

@@ -31,6 +31,10 @@ API changes, most recent first:
 2011-10-20 - b35e9e1 - lavu 51.22.0
   Add av_strtok() to avstring.h.
 
+2011-xx-xx - xxxxxxx - lavf 53.17.0
+  Add avformat_open_input().
+  Deprecate av_close_input_file() and av_close_input_stream().
+
 2011-xx-xx - xxxxxxx - lavc 53.25.0
   Add nb_samples and extended_data fields to AVFrame.
   Deprecate AVCODEC_MAX_AUDIO_FRAME_SIZE.

doc/RELEASE_NOTES

@@ -1,65 +1,17 @@
 Release Notes
 =============
 
-* 0.8 "Love"  June, 2011
-* 0.7 "Peace" June, 2011 (identical to 0.8 but using 0.6 ABI/API)
+* 0.9 "Harmony"  December, 2011
 
 
 General notes
 -------------
 
-This release enables frame-based multithreaded decoding for a number of codecs,
-including theora, huffyuv, VP8, H.263, mpeg4 and H.264. Additionally, there has
-been a major cleanup of
-both internal and external APIs. For this reason, the major versions of all
-libraries except libpostproc have been bumped. This means that 0.8 can be installed
-side-by-side with previous releases, on the other hand applications need to be
-recompiled to use 0.8.
-
-Other important changes are more than 200 bugfixes, known regressions were fixed
-w.r.t 0.5 and 0.6, additions of decoders including, but not limited to,
-AMR-WB, single stream LATM/LOAS, G.722 ADPCM, a native VP8 decoder
-and HE-AACv2. Additionally, many new de/muxers such as WebM in Matroska, Apple
-HTTP Live Streaming, SAP, IEC 61937 (S/PDIF) have been added.
-
-See the Changelog file for a list of significant changes.
+See the Changelog file for a list of significant changes. Note, there
+are many more new features and bugfixes than whats listed there.
 
 Bugreports against FFmpeg git master or the most recent FFmpeg release are
 accepted. If you are experiencing issues with any formally released version of
 FFmpeg, please try git master to check if the issue still exists. If it does,
 make your report against the development code following the usual bug reporting
 guidelines.
-
-Note, if you have difficulty building for mingw, try --disable-outdev=sdl
-
-
-API changes
------------
-
-Please see git log of the public headers or the file doc/APIchanges for
-programmer-centric information. Note that some long-time deprecated APIs have
-been removed. Also, a number of additional APIs have been deprecated and might
-be removed in the next release.
-
-
-Other notable changes
----------------------
-
-- high quality dithering in swscale to fix banding issues
-- ffmpeg is now interactive and various information can be turned on/off while its running
-- resolution changing support in ffmpeg
-- sdl output device
-- optimizations in libavfilter that make it much faster
-- split, buffer, select, lut, negate filters amongth others
-- more than 50 new video filters from mplayers libmpcodecs
-- many ARM NEON optimizations
-- nonfree libfaad support for AAC decoding removed
-- 4:4:4 H.264 decoding
-- 9/10bit H.264 decoding
-- Win64 Assembler support
-- native MMSH/MMST support
-- Windows TV demuxing
-- native AMR-WB decoding
-- native GSM-MS decoding
-- SMPTE 302M decoding
-- AVS encoding

doc/errno.txt

@@ -0,0 +1,174 @@
+The following table lists most error codes found in various operating
+systems supported by FFmpeg.
+
+                             OS
+Code             Std    F  LBMWwb Text (YMMV)
+
+E2BIG            POSIX     ++++++  Argument list too long
+EACCES           POSIX     ++++++  Permission denied
+EADDRINUSE       POSIX     +++..+  Address in use
+EADDRNOTAVAIL    POSIX     +++..+  Cannot assign requested address
+EADV                       +.....  Advertise error
+EAFNOSUPPORT     POSIX     +++..+  Address family not supported
+EAGAIN           POSIX  +  ++++++  Resource temporarily unavailable
+EALREADY         POSIX     +++..+  Operation already in progress
+EAUTH                      .++...  Authentication error
+EBADARCH                   ..+...  Bad CPU type in executable
+EBADE                      +.....  Invalid exchange
+EBADEXEC                   ..+...  Bad executable
+EBADF            POSIX     ++++++  Bad file descriptor
+EBADFD                     +.....  File descriptor in bad state
+EBADMACHO                  ..+...  Malformed Macho file
+EBADMSG          POSIX     ++4...  Bad message
+EBADR                      +.....  Invalid request descriptor
+EBADRPC                    .++...  RPC struct is bad
+EBADRQC                    +.....  Invalid request code
+EBADSLT                    +.....  Invalid slot
+EBFONT                     +.....  Bad font file format
+EBUSY            POSIX  -  ++++++  Device or resource busy
+ECANCELED        POSIX     +++...  Operation canceled
+ECHILD           POSIX     ++++++  No child processes
+ECHRNG                     +.....  Channel number out of range
+ECOMM                      +.....  Communication error on send
+ECONNABORTED     POSIX     +++..+  Software caused connection abort
+ECONNREFUSED     POSIX  -  +++ss+  Connection refused
+ECONNRESET       POSIX     +++..+  Connection reset
+EDEADLK          POSIX     ++++++  Resource deadlock avoided
+EDEADLOCK                  +..++.  File locking deadlock error
+EDESTADDRREQ     POSIX     +++...  Destination address required
+EDEVERR                    ..+...  Device error
+EDOM             C89    -  ++++++  Numerical argument out of domain
+EDOOFUS                    .F....  Programming error
+EDOTDOT                    +.....  RFS specific error
+EDQUOT           POSIX     +++...  Disc quota exceeded
+EEXIST           POSIX     ++++++  File exists
+EFAULT           POSIX  -  ++++++  Bad address
+EFBIG            POSIX  -  ++++++  File too large
+EFTYPE                     .++...  Inappropriate file type or format
+EHOSTDOWN                  +++...  Host is down
+EHOSTUNREACH     POSIX     +++..+  No route to host
+EHWPOISON                  +.....  Memory page has hardware error
+EIDRM            POSIX     +++...  Identifier removed
+EILSEQ           C99       ++++++  Illegal byte sequence
+EINPROGRESS      POSIX  -  +++ss+  Operation in progress
+EINTR            POSIX  -  ++++++  Interrupted system call
+EINVAL           POSIX  +  ++++++  Invalid argument
+EIO              POSIX  +  ++++++  I/O error
+EISCONN          POSIX     +++..+  Socket is already connected
+EISDIR           POSIX     ++++++  Is a directory
+EISNAM                     +.....  Is a named type file
+EKEYEXPIRED                +.....  Key has expired
+EKEYREJECTED               +.....  Key was rejected by service
+EKEYREVOKED                +.....  Key has been revoked
+EL2HLT                     +.....  Level 2 halted
+EL2NSYNC                   +.....  Level 2 not synchronized
+EL3HLT                     +.....  Level 3 halted
+EL3RST                     +.....  Level 3 reset
+ELIBACC                    +.....  Can not access a needed shared library
+ELIBBAD                    +.....  Accessing a corrupted shared library
+ELIBEXEC                   +.....  Cannot exec a shared library directly
+ELIBMAX                    +.....  Too many shared libraries
+ELIBSCN                    +.....  .lib section in a.out corrupted
+ELNRNG                     +.....  Link number out of range
+ELOOP            POSIX     +++..+  Too many levels of symbolic links
+EMEDIUMTYPE                +.....  Wrong medium type
+EMFILE           POSIX     ++++++  Too many open files
+EMLINK           POSIX     ++++++  Too many links
+EMSGSIZE         POSIX     +++..+  Message too long
+EMULTIHOP        POSIX     ++4...  Multihop attempted
+ENAMETOOLONG     POSIX  -  ++++++  Filen ame too long
+ENAVAIL                    +.....  No XENIX semaphores available
+ENEEDAUTH                  .++...  Need authenticator
+ENETDOWN         POSIX     +++..+  Network is down
+ENETRESET        SUSv3     +++..+  Network dropped connection on reset
+ENETUNREACH      POSIX     +++..+  Network unreachable
+ENFILE           POSIX     ++++++  Too many open files in system
+ENOANO                     +.....  No anode
+ENOATTR                    .++...  Attribute not found
+ENOBUFS          POSIX  -  +++..+  No buffer space available
+ENOCSI                     +.....  No CSI structure available
+ENODATA          XSR       +N4...  No message available
+ENODEV           POSIX  -  ++++++  No such device
+ENOENT           POSIX  -  ++++++  No such file or directory
+ENOEXEC          POSIX     ++++++  Exec format error
+ENOFILE                    ...++.  No such file or directory
+ENOKEY                     +.....  Required key not available
+ENOLCK           POSIX     ++++++  No locks available
+ENOLINK          POSIX     ++4...  Link has been severed
+ENOMEDIUM                  +.....  No medium found
+ENOMEM           POSIX     ++++++  Not enough space
+ENOMSG           POSIX     +++..+  No message of desired type
+ENONET                     +.....  Machine is not on the network
+ENOPKG                     +.....  Package not installed
+ENOPROTOOPT      POSIX     +++..+  Protocol not available
+ENOSPC           POSIX     ++++++  No space left on device
+ENOSR            XSR       +N4...  No STREAM resources
+ENOSTR           XSR       +N4...  Not a STREAM
+ENOSYS           POSIX  +  ++++++  Function not implemented
+ENOTBLK                    +++...  Block device required
+ENOTCONN         POSIX     +++..+  Socket is not connected
+ENOTDIR          POSIX     ++++++  Not a directory
+ENOTEMPTY        POSIX     ++++++  Directory not empty
+ENOTNAM                    +.....  Not a XENIX named type file
+ENOTRECOVERABLE  SUSv4  -  +.....  State not recoverable
+ENOTSOCK         POSIX     +++..+  Socket operation on non-socket
+ENOTSUP          POSIX     +++...  Operation not supported
+ENOTTY           POSIX     ++++++  Inappropriate I/O control operation
+ENOTUNIQ                   +.....  Name not unique on network
+ENXIO            POSIX     ++++++  No such device or address
+EOPNOTSUPP       POSIX     +++..+  Operation not supported (on socket)
+EOVERFLOW        POSIX     +++..+  Value too large to be stored in data type
+EOWNERDEAD       SUSv4     +.....  Owner died
+EPERM            POSIX  -  ++++++  Operation not permitted
+EPFNOSUPPORT               +++..+  Protocol family not supported
+EPIPE            POSIX  -  ++++++  Broken pipe
+EPROCLIM                   .++...  Too many processes
+EPROCUNAVAIL               .++...  Bad procedure for program
+EPROGMISMATCH              .++...  Program version wrong
+EPROGUNAVAIL               .++...  RPC prog. not avail
+EPROTO           POSIX     ++4...  Protocol error
+EPROTONOSUPPORT  POSIX  -  +++ss+  Protocol not supported
+EPROTOTYPE       POSIX     +++..+  Protocol wrong type for socket
+EPWROFF                    ..+...  Device power is off
+ERANGE           C89    -  ++++++  Result too large
+EREMCHG                    +.....  Remote address changed
+EREMOTE                    +++...  Object is remote
+EREMOTEIO                  +.....  Remote I/O error
+ERESTART                   +.....  Interrupted system call should be restarted
+ERFKILL                    +.....  Operation not possible due to RF-kill
+EROFS            POSIX     ++++++  Read-only file system
+ERPCMISMATCH               .++...  RPC version wrong
+ESHLIBVERS                 ..+...  Shared library version mismatch
+ESHUTDOWN                  +++..+  Cannot send after socket shutdown
+ESOCKTNOSUPPORT            +++...  Socket type not supported
+ESPIPE           POSIX     ++++++  Illegal seek
+ESRCH            POSIX     ++++++  No such process
+ESRMNT                     +.....  Srmount error
+ESTALE           POSIX     +++..+  Stale NFS file handle
+ESTRPIPE                   +.....  Streams pipe error
+ETIME            XSR       +N4...  Stream ioctl timeout
+ETIMEDOUT        POSIX  -  +++ss+  Connection timed out
+ETOOMANYREFS               +++...  Too many references: cannot splice
+ETXTBSY          POSIX     +++...  Text file busy
+EUCLEAN                    +.....  Structure needs cleaning
+EUNATCH                    +.....  Protocol driver not attached
+EUSERS                     +++...  Too many users
+EWOULDBLOCK      POSIX     +++..+  Operation would block
+EXDEV            POSIX     ++++++  Cross-device link
+EXFULL                     +.....  Exchange full
+
+Notations:
+
+F: used in FFmpeg (-: a few times, +: a lot)
+
+SUSv3: Single Unix Specification, version 3
+SUSv4: Single Unix Specification, version 4
+XSR: XSI STREAMS (obsolete)
+
+OS: availability on some supported operating systems
+L: GNU/Linux
+B: BSD (F: FreeBSD, N: NetBSD)
+M: MacOS X
+W: Microsoft Windows (s: emulated with winsock, see libavformat/network.h)
+w: Mingw32 (3.17) and Mingw64 (2.0.1)
+b: BeOS

doc/examples/decoding_encoding.c

@@ -180,6 +180,8 @@ static void audio_decode_example(const char *outfilename, const char *filename)
         }
         avpkt.size -= len;
         avpkt.data += len;
+        avpkt.dts =
+        avpkt.pts = AV_NOPTS_VALUE;
         if (avpkt.size < AUDIO_REFILL_THRESH) {
             /* Refill the input buffer, to avoid trying to decode
              * incomplete frames. Instead of this, one could also use

doc/ffplay.texi

@@ -168,6 +168,9 @@ Seek backward/forward 10 seconds.
 @item down/up
 Seek backward/forward 1 minute.
 
+@item page down/page up
+Seek backward/forward 10 minutes.
+
 @item mouse click
 Seek to percentage in file corresponding to fraction of width.
 

doc/general.texi

@@ -316,6 +316,7 @@ library:
     @tab Used in Sierra CD-ROM games.
 @item Smacker                   @tab   @tab X
     @tab Multimedia format used by many games.
+@item SMJPEG                    @tab   @tab X
 @item Sony OpenMG (OMA)         @tab   @tab X
     @tab Audio format used in Sony Sonic Stage and Sony Vegas.
 @item Sony PlayStation STR      @tab   @tab X
@@ -442,6 +443,7 @@ following image formats are supported:
     @tab Used in some games from Bethesda Softworks.
 @item Bink Video             @tab     @tab  X
 @item Bitmap Brothers JV video  @tab   @tab X
+@item y41p Brooktree uncompressed 4:1:1 12-bit     @tab  X  @tab  X
 @item Brute Force & Ignorance   @tab   @tab X
     @tab Used in the game Flash Traffic: City of Angels.
 @item C93 video              @tab     @tab  X
@@ -511,6 +513,7 @@ following image formats are supported:
 @item Intel H.263            @tab     @tab  X
 @item Intel Indeo 2          @tab     @tab  X
 @item Intel Indeo 3          @tab     @tab  X
+@item Intel Indeo 4          @tab     @tab  X
 @item Intel Indeo 5          @tab     @tab  X
 @item Interplay C93          @tab     @tab  X
     @tab Used in the game Cyberia from Interplay.
@@ -602,6 +605,7 @@ following image formats are supported:
     @tab Codec used in DOS CD-ROM FlashBack game.
 @item Ut Video               @tab     @tab  X
 @item V210 Quicktime Uncompressed 4:2:2 10-bit     @tab  X  @tab  X
+@item v410 Quicktime Uncompressed 4:4:4 10-bit     @tab  X  @tab  X
 @item VBLE Lossless Codec    @tab     @tab  X
 @item VMware Screen Codec / VMware Video  @tab     @tab  X
     @tab Codec used in videos captured by VMware.

ffmpeg.c

@@ -549,6 +549,8 @@ static void sigterm_handler(int sig)
     received_sigterm = sig;
     received_nb_signals++;
     term_exit();
+    if(received_nb_signals > 3)
+        exit(123);
 }
 
 static void term_init(void)
@@ -1902,7 +1904,10 @@ static int transcode_video(InputStream *ist, AVPacket *pkt, int *got_output, int
                 *frame_sample_aspect = ist->st->sample_aspect_ratio;
             decoded_frame->pts = ist->pts;
 
-            av_vsrc_buffer_add_frame(ost->input_video_filter, decoded_frame, AV_VSRC_BUF_FLAG_OVERWRITE);
+            if((av_vsrc_buffer_add_frame(ost->input_video_filter, decoded_frame, AV_VSRC_BUF_FLAG_OVERWRITE)) < 0){
+                av_log(0, AV_LOG_FATAL, "Failed to inject frame into filter network\n");
+                exit_program(1);
+            }
         }
     }
 #endif
@@ -2047,6 +2052,10 @@ static int output_packet(InputStream *ist,
 
         if (ret < 0)
             return ret;
+
+        avpkt.dts=
+        avpkt.pts= AV_NOPTS_VALUE;
+
         // touch data and size only if not EOF
         if (pkt) {
             if(ist->st->codec->codec_type != AVMEDIA_TYPE_AUDIO)
@@ -3293,6 +3302,7 @@ static void assert_file_overwrite(const char *filename)
                 fprintf(stderr,"File '%s' already exists. Overwrite ? [y/N] ", filename);
                 fflush(stderr);
                 term_exit();
+                signal(SIGINT, SIG_DFL);
                 if (!read_yesno()) {
                     av_log(0, AV_LOG_FATAL, "Not overwriting - exiting\n");
                     exit_program(1);
@@ -3962,6 +3972,7 @@ static int read_ffserver_streams(OptionsContext *o, AVFormatContext *s, const ch
         ost   = new_output_stream(o, s, codec->type);
         st    = ost->st;
         avctx = st->codec;
+        ost->enc = codec;
 
         // FIXME: a more elegant solution is needed
         memcpy(st, ic->streams[i], sizeof(AVStream));
@@ -4826,7 +4837,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     term_init();
 

ffplay.c

@@ -922,7 +922,7 @@ static void do_exit(VideoState *is)
     exit(0);
 }
 
-static int video_open(VideoState *is){
+static int video_open(VideoState *is, int force_set_video_mode){
     int flags = SDL_HWSURFACE|SDL_ASYNCBLIT|SDL_HWACCEL;
     int w,h;
 
@@ -949,7 +949,7 @@ static int video_open(VideoState *is){
         h = 480;
     }
     if(screen && is->width == screen->w && screen->w == w
-       && is->height== screen->h && screen->h == h)
+       && is->height== screen->h && screen->h == h && !force_set_video_mode)
         return 0;
     screen = SDL_SetVideoMode(w, h, 0, flags);
     if (!screen) {
@@ -970,7 +970,7 @@ static int video_open(VideoState *is){
 static void video_display(VideoState *is)
 {
     if(!screen)
-        video_open(is);
+        video_open(is, 0);
     if (is->audio_st && is->show_mode != SHOW_MODE_VIDEO)
         video_audio_display(is);
     else if (is->video_st)
@@ -2043,7 +2043,8 @@ static int audio_decode_frame(VideoState *is, double *pts_ptr)
     AVPacket *pkt = &is->audio_pkt;
     AVCodecContext *dec= is->audio_st->codec;
     int len1, len2, data_size, resampled_data_size;
-    int64_t dec_channel_layout, got_frame;
+    int64_t dec_channel_layout;
+    int got_frame;
     double pts;
     int new_packet = 0;
     int flush_complete = 0;
@@ -2144,6 +2145,7 @@ static int audio_decode_frame(VideoState *is, double *pts_ptr)
         /* free the current packet */
         if (pkt->data)
             av_free_packet(pkt);
+        memset(pkt_temp, 0, sizeof(*pkt_temp));
 
         if (is->paused || is->audioq.abort_request) {
             return -1;
@@ -2776,14 +2778,15 @@ static void stream_cycle_channel(VideoState *is, int codec_type)
 
 static void toggle_full_screen(VideoState *is)
 {
+    int i;
     is_full_screen = !is_full_screen;
 #if defined(__APPLE__) && SDL_VERSION_ATLEAST(1, 2, 14)
     /* OS X needs to reallocate the SDL overlays */
-    for (int i = 0; i < VIDEO_PICTURE_QUEUE_SIZE; i++) {
+    for (i = 0; i < VIDEO_PICTURE_QUEUE_SIZE; i++) {
         is->pictq[i].reallocate = 1;
     }
 #endif
-    video_open(is);
+    video_open(is, 1);
 }
 
 static void toggle_pause(VideoState *is)
@@ -2852,6 +2855,12 @@ static void event_loop(VideoState *cur_stream)
             case SDLK_w:
                 toggle_audio_display(cur_stream);
                 break;
+            case SDLK_PAGEUP:
+                incr = 600.0;
+                goto do_seek;
+            case SDLK_PAGEDOWN:
+                incr = -600.0;
+                goto do_seek;
             case SDLK_LEFT:
                 incr = -10.0;
                 goto do_seek;
@@ -2935,7 +2944,7 @@ static void event_loop(VideoState *cur_stream)
             do_exit(cur_stream);
             break;
         case FF_ALLOC_EVENT:
-            video_open(event.user.data1);
+            video_open(event.user.data1, 0);
             alloc_picture(event.user.data1);
             break;
         case FF_REFRESH_EVENT:
@@ -3121,6 +3130,7 @@ static int opt_help(const char *opt, const char *arg)
            "s                   activate frame-step mode\n"
            "left/right          seek backward/forward 10 seconds\n"
            "down/up             seek backward/forward 1 minute\n"
+           "page down/page up   seek backward/forward 10 minutes\n"
            "mouse click         seek to percentage in file corresponding to fraction of width\n"
            );
     return 0;
@@ -3167,7 +3177,7 @@ int main(int argc, char **argv)
 
     init_opts();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     parse_options(NULL, argc, argv, options, opt_input_file);
 

ffprobe.c

@@ -1252,7 +1252,7 @@ int main(int argc, char **argv)
     avdevice_register_all();
 #endif
 
-    show_banner();
+    show_banner(argc, argv, options);
     parse_options(NULL, argc, argv, options, opt_input_file);
 
     if (!input_filename) {

ffserver.c

@@ -4674,7 +4674,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     my_program_name = argv[0];
     my_program_dir = getcwd(0, 0);

libavcodec/4xm.c

@@ -459,6 +459,11 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
 static int decode_i_block(FourXContext *f, DCTELEM *block){
     int code, i, j, level, val;
 
+    if(get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
+        return -1;
+    }
+
     /* DC coef */
     val = get_vlc2(&f->pre_gb, f->pre_vlc.table, ACDC_VLC_BITS, 3);
     if (val>>4){

libavcodec/Makefile

@@ -207,6 +207,7 @@ OBJS-$(CONFIG_IFF_ILBM_DECODER)        += iff.o
 OBJS-$(CONFIG_IMC_DECODER)             += imc.o
 OBJS-$(CONFIG_INDEO2_DECODER)          += indeo2.o
 OBJS-$(CONFIG_INDEO3_DECODER)          += indeo3.o
+OBJS-$(CONFIG_INDEO4_DECODER)          += indeo4.o ivi_common.o ivi_dsp.o
 OBJS-$(CONFIG_INDEO5_DECODER)          += indeo5.o ivi_common.o ivi_dsp.o
 OBJS-$(CONFIG_INTERPLAY_DPCM_DECODER)  += dpcm.o
 OBJS-$(CONFIG_INTERPLAY_VIDEO_DECODER) += interplayvideo.o
@@ -413,6 +414,8 @@ OBJS-$(CONFIG_ULTI_DECODER)            += ulti.o
 OBJS-$(CONFIG_UTVIDEO_DECODER)         += utvideo.o
 OBJS-$(CONFIG_V210_DECODER)            += v210dec.o
 OBJS-$(CONFIG_V210_ENCODER)            += v210enc.o
+OBJS-$(CONFIG_V410_DECODER)            += v410dec.o
+OBJS-$(CONFIG_V410_ENCODER)            += v410enc.o
 OBJS-$(CONFIG_V210X_DECODER)           += v210x.o
 OBJS-$(CONFIG_VB_DECODER)              += vb.o
 OBJS-$(CONFIG_VBLE_DECODER)            += vble.o
@@ -463,6 +466,8 @@ OBJS-$(CONFIG_XBIN_DECODER)            += bintext.o cga_data.o
 OBJS-$(CONFIG_XL_DECODER)              += xl.o
 OBJS-$(CONFIG_XSUB_DECODER)            += xsubdec.o
 OBJS-$(CONFIG_XSUB_ENCODER)            += xsubenc.o
+OBJS-$(CONFIG_Y41P_DECODER)            += y41pdec.o
+OBJS-$(CONFIG_Y41P_ENCODER)            += y41penc.o
 OBJS-$(CONFIG_YOP_DECODER)             += yop.o
 OBJS-$(CONFIG_ZLIB_DECODER)            += lcldec.o
 OBJS-$(CONFIG_ZLIB_ENCODER)            += lclenc.o

libavcodec/aac.h

@@ -300,6 +300,7 @@ typedef struct {
     DECLARE_ALIGNED(32, float, temp)[128];
 
     enum OCStatus output_configured;
+    int warned_num_aac_frames;
 } AACContext;
 
 #endif /* AVCODEC_AAC_H */

libavcodec/aacdec.c

@@ -819,10 +819,10 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120],
                 av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n");
                 return -1;
             }
-            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
+            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1 && get_bits_left(gb) >= bits)
                 sect_end += sect_len_incr;
             sect_end += sect_len_incr;
-            if (get_bits_left(gb) < 0) {
+            if (get_bits_left(gb) < 0 || sect_len_incr == (1 << bits) - 1) {
                 av_log(ac->avctx, AV_LOG_ERROR, overread_err);
                 return -1;
             }
@@ -2125,13 +2125,14 @@ static int parse_adts_frame_header(AACContext *ac, GetBitContext *gb)
         }
         if (!ac->avctx->sample_rate)
             ac->avctx->sample_rate = hdr_info.sample_rate;
-        if (hdr_info.num_aac_frames == 1) {
-            if (!hdr_info.crc_absent)
-                skip_bits(gb, 16);
-        } else {
+        if (!ac->warned_num_aac_frames && hdr_info.num_aac_frames != 1) {
+            // This is 2 for "VLB " audio in NSV files.
+            // See samples/nsv/vlb_audio.
             av_log_missing_feature(ac->avctx, "More than one AAC RDB per ADTS frame is", 0);
-            return -1;
+            ac->warned_num_aac_frames = 1;
         }
+        if (!hdr_info.crc_absent)
+            skip_bits(gb, 16);
     }
     return size;
 }

libavcodec/aacsbr.c

@@ -1187,7 +1187,7 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct,
     const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us;
     float *v;
     for (i = 0; i < 32; i++) {
-        if (*v_off == 0) {
+        if (*v_off < 128 >> div) {
             int saved_samples = (1280 - 128) >> div;
             memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float));
             *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div);

libavcodec/aasc.c

@@ -79,8 +79,13 @@ static int aasc_decode_frame(AVCodecContext *avctx,
     case 0:
         stride = (avctx->width * 3 + 3) & ~3;
         for(i = avctx->height - 1; i >= 0; i--){
+            if(avctx->width*3 > buf_size){
+                av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n");
+                break;
+            }
             memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3);
             buf += stride;
+            buf_size -= stride;
         }
         break;
     case 1:

libavcodec/ac3dec.c

@@ -1371,7 +1371,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
         if (s->frame_size > buf_size) {
             av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
             err = AAC_AC3_PARSE_ERROR_FRAME_SIZE;
-        } else if (avctx->err_recognition & AV_EF_CRCCHECK) {
+        } else if (avctx->err_recognition & (AV_EF_CRCCHECK|AV_EF_CAREFUL)) {
             /* check for crc mismatch */
             if (av_crc(av_crc_get_table(AV_CRC_16_ANSI), 0, &buf[2],
                        s->frame_size - 2)) {

libavcodec/acelp_vectors.c

@@ -237,6 +237,7 @@ void ff_set_fixed_vector(float *out, const AMRFixed *in, float scale, int size)
         int x   = in->x[i], repeats = !((in->no_repeat_mask >> i) & 1);
         float y = in->y[i] * scale;
 
+        if (in->pitch_lag > 0)
         do {
             out[x] += y;
             y *= in->pitch_fac;
@@ -252,6 +253,7 @@ void ff_clear_fixed_vector(float *out, const AMRFixed *in, int size)
     for (i=0; i < in->n; i++) {
         int x  = in->x[i], repeats = !((in->no_repeat_mask >> i) & 1);
 
+        if (in->pitch_lag > 0)
         do {
             out[x] = 0.0;
             x += in->pitch_lag;

libavcodec/adpcm.c

@@ -101,8 +101,9 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
         max_channels = 6;
         break;
     }
-    if(avctx->channels > max_channels){
-        return -1;
+    if (avctx->channels <= 0 || avctx->channels > max_channels) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
+        return AVERROR(EINVAL);
     }
 
     switch(avctx->codec->id) {
@@ -817,6 +818,9 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         /* Each EA ADPCM frame has a 12-byte header followed by 30-byte pieces,
            each coding 28 stereo samples. */
 
+        if(avctx->channels != 2)
+            return AVERROR_INVALIDDATA;
+
         src += 4; // skip sample count (already read)
 
         current_left_sample   = (int16_t)bytestream_get_le16(&src);
@@ -1003,11 +1007,15 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         break;
     case CODEC_ID_ADPCM_IMA_AMV:
     case CODEC_ID_ADPCM_IMA_SMJPEG:
-        c->status[0].predictor = (int16_t)bytestream_get_le16(&src);
-        c->status[0].step_index = bytestream_get_le16(&src);
-
-        if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV)
-            src+=4;
+        if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) {
+            c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16);
+            c->status[0].step_index = bytestream_get_le16(&src);
+            src += 4;
+        } else {
+            c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16);
+            c->status[0].step_index = bytestream_get_byte(&src);
+            src += 1;
+        }
 
         for (n = nb_samples >> (1 - st); n > 0; n--, src++) {
             char hi, lo;

libavcodec/adx_parser.c

@@ -22,7 +22,7 @@
  * @file
  * ADX audio parser
  *
- * Reads header to extradata and splits packets into individual blocks.
+ * Splits packets into individual blocks.
  */
 
 #include "libavutil/intreadwrite.h"
@@ -33,11 +33,9 @@ typedef struct ADXParseContext {
     ParseContext pc;
     int header_size;
     int block_size;
-    int buf_pos;
+    int remaining;
 } ADXParseContext;
 
-#define MIN_HEADER_SIZE 24
-
 static int adx_parse(AVCodecParserContext *s1,
                            AVCodecContext *avctx,
                            const uint8_t **poutbuf, int *poutbuf_size,
@@ -46,45 +44,32 @@ static int adx_parse(AVCodecParserContext *s1,
     ADXParseContext *s = s1->priv_data;
     ParseContext *pc = &s->pc;
     int next = END_NOT_FOUND;
+    int i;
+    uint64_t state= pc->state64;
 
-    if (!avctx->extradata_size) {
-        int ret;
-
-        ff_combine_frame(pc, END_NOT_FOUND, &buf, &buf_size);
-
-        if (!s->header_size && pc->index >= MIN_HEADER_SIZE) {
-            if (ret = avpriv_adx_decode_header(avctx, pc->buffer, pc->index,
-                                               &s->header_size, NULL))
-                return AVERROR_INVALIDDATA;
-            s->block_size = BLOCK_SIZE * avctx->channels;
+    if(!s->header_size){
+        for(i=0; i<buf_size; i++){
+            state= (state<<8) | buf[i];
+            if((state&0xFFFF0000FFFFFF00) == 0x8000000003120400ULL && (state&0xFF) && ((state>>32)&0xFFFF)>=4){
+                s->header_size= ((state>>32)&0xFFFF) + 4;
+                s->block_size = BLOCK_SIZE * (state&0xFF);
+                s->remaining  = i - 7 + s->header_size + s->block_size;
+                break;
+            }
         }
-        if (s->header_size && s->header_size <= pc->index) {
-            avctx->extradata = av_mallocz(s->header_size + FF_INPUT_BUFFER_PADDING_SIZE);
-            if (!avctx->extradata)
-                return AVERROR(ENOMEM);
-            avctx->extradata_size = s->header_size;
-            memcpy(avctx->extradata, pc->buffer, s->header_size);
-            memmove(pc->buffer, pc->buffer + s->header_size, s->header_size);
-            pc->index -= s->header_size;
-        }
-        *poutbuf      = NULL;
-        *poutbuf_size = 0;
-        return buf_size;
+        pc->state64= state;
     }
 
-    if (pc->index - s->buf_pos >= s->block_size) {
-        *poutbuf      = &pc->buffer[s->buf_pos];
-        *poutbuf_size = s->block_size;
-        s->buf_pos   += s->block_size;
-        return 0;
+    if (s->header_size) {
+        if (!s->remaining) {
+            s->remaining = s->block_size;
+        }
+        if (s->remaining<=buf_size) {
+            next= s->remaining;
+            s->remaining = 0;
+        } else
+            s->remaining -= buf_size;
     }
-    if (pc->index && s->buf_pos) {
-        memmove(pc->buffer, &pc->buffer[s->buf_pos], pc->index - s->buf_pos);
-        pc->index -= s->buf_pos;
-        s->buf_pos = 0;
-    }
-    if (buf_size + pc->index >= s->block_size)
-        next = s->block_size - pc->index;
 
     if (ff_combine_frame(pc, next, &buf, &buf_size) < 0 || !buf_size) {
         *poutbuf      = NULL;

libavcodec/adxdec.c

@@ -38,16 +38,15 @@ static av_cold int adx_decode_init(AVCodecContext *avctx)
     ADXContext *c = avctx->priv_data;
     int ret, header_size;
 
-    if (avctx->extradata_size < 24)
-        return AVERROR_INVALIDDATA;
-
-    if ((ret = avpriv_adx_decode_header(avctx, avctx->extradata,
-                                        avctx->extradata_size, &header_size,
-                                        c->coeff)) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
-        return AVERROR_INVALIDDATA;
+    if (avctx->extradata_size >= 24) {
+        if ((ret = avpriv_adx_decode_header(avctx, avctx->extradata,
+                                            avctx->extradata_size, &header_size,
+                                            c->coeff)) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
+            return AVERROR_INVALIDDATA;
+        }
+        c->channels = avctx->channels;
     }
-    c->channels = avctx->channels;
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
@@ -107,6 +106,23 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data,
         return buf_size;
     }
 
+    if(AV_RB16(buf) == 0x8000){
+        int header_size;
+        if ((ret = avpriv_adx_decode_header(avctx, buf,
+                                            buf_size, &header_size,
+                                            c->coeff)) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
+            return AVERROR_INVALIDDATA;
+        }
+        c->channels = avctx->channels;
+        if(buf_size < header_size)
+            return AVERROR_INVALIDDATA;
+        buf += header_size;
+        buf_size -= header_size;
+    }
+    if(c->channels <= 0)
+        return AVERROR_INVALIDDATA;
+
     /* calculate number of blocks in the packet */
     num_blocks = buf_size / (BLOCK_SIZE * c->channels);
 

libavcodec/alac.c

@@ -112,7 +112,7 @@ static inline int decode_scalar(GetBitContext *gb, int k, int limit, int readsam
     return x;
 }
 
-static void bastardized_rice_decompress(ALACContext *alac,
+static int bastardized_rice_decompress(ALACContext *alac,
                                  int32_t *output_buffer,
                                  int output_size,
                                  int readsamplesize, /* arg_10 */
@@ -134,6 +134,9 @@ static void bastardized_rice_decompress(ALACContext *alac,
         /* standard rice encoding */
         int k; /* size of extra bits */
 
+        if(get_bits_left(&alac->gb) <= 0)
+            return -1;
+
         /* read k, that is bits as is */
         k = av_log2((history >> 9) + 3);
         x= decode_scalar(&alac->gb, k, rice_kmodifier, readsamplesize);
@@ -179,6 +182,7 @@ static void bastardized_rice_decompress(ALACContext *alac,
             history = 0;
         }
     }
+    return 0;
 }
 
 static inline int sign_only(int v)
@@ -442,12 +446,14 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
 
         if (alac->extra_bits) {
             for (i = 0; i < outputsamples; i++) {
+                if(get_bits_left(&alac->gb) <= 0)
+                    return -1;
                 for (ch = 0; ch < channels; ch++)
                     alac->extra_bits_buffer[ch][i] = get_bits(&alac->gb, alac->extra_bits);
             }
         }
         for (ch = 0; ch < channels; ch++) {
-            bastardized_rice_decompress(alac,
+            int ret = bastardized_rice_decompress(alac,
                                         alac->predicterror_buffer[ch],
                                         outputsamples,
                                         readsamplesize,
@@ -455,6 +461,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
                                         alac->setinfo_rice_kmodifier,
                                         ricemodifier[ch] * alac->setinfo_rice_historymult / 4,
                                         (1 << alac->setinfo_rice_kmodifier) - 1);
+            if(ret<0)
+                return ret;
 
             if (prediction_type[ch] == 0) {
                 /* adaptive fir */
@@ -478,6 +486,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
     } else {
         /* not compressed, easy case */
         for (i = 0; i < outputsamples; i++) {
+            if(get_bits_left(&alac->gb) <= 0)
+                return -1;
             for (ch = 0; ch < channels; ch++) {
                 alac->outputsamples_buffer[ch][i] = get_sbits_long(&alac->gb,
                                                                    alac->setinfo_sample_size);

libavcodec/allcodecs.c

@@ -133,6 +133,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (IFF_ILBM, iff_ilbm);
     REGISTER_DECODER (INDEO2, indeo2);
     REGISTER_DECODER (INDEO3, indeo3);
+    REGISTER_DECODER (INDEO4, indeo4);
     REGISTER_DECODER (INDEO5, indeo5);
     REGISTER_DECODER (INTERPLAY_VIDEO, interplay_video);
     REGISTER_ENCDEC  (JPEG2000, jpeg2000);
@@ -215,6 +216,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (UTVIDEO, utvideo);
     REGISTER_ENCDEC  (V210,  v210);
     REGISTER_DECODER (V210X, v210x);
+    REGISTER_ENCDEC  (V410, v410);
     REGISTER_DECODER (VB, vb);
     REGISTER_DECODER (VBLE, vble);
     REGISTER_DECODER (VC1, vc1);
@@ -241,6 +243,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (XAN_WC3, xan_wc3);
     REGISTER_DECODER (XAN_WC4, xan_wc4);
     REGISTER_DECODER (XL, xl);
+    REGISTER_ENCDEC  (Y41P, y41p);
     REGISTER_DECODER (YOP, yop);
     REGISTER_ENCDEC  (ZLIB, zlib);
     REGISTER_ENCDEC  (ZMBV, zmbv);

libavcodec/alsdec.c

@@ -1012,7 +1012,7 @@ static void zero_remaining(unsigned int b, unsigned int b_max,
     unsigned int count = 0;
 
     while (b < b_max)
-        count += div_blocks[b];
+        count += div_blocks[b++];
 
     if (count)
         memset(buf, 0, sizeof(*buf) * count);

libavcodec/atrac3.c

@@ -402,6 +402,8 @@ static int decodeTonalComponents (GetBitContext *gb, tonal_component *pComponent
 
             for (k=0; k<coded_components; k++) {
                 sfIndx = get_bits(gb,6);
+                if(component_count>=64)
+                    return AVERROR_INVALIDDATA;
                 pComponent[component_count].pos = j * 64 + (get_bits(gb,6));
                 max_coded_values = SAMPLES_PER_FRAME - pComponent[component_count].pos;
                 coded_values = coded_values_per_component + 1;

libavcodec/avcodec.h

@@ -254,6 +254,8 @@ enum CodecID {
     CODEC_ID_BMV_VIDEO,
     CODEC_ID_VBLE,
     CODEC_ID_DXTORY,
+    CODEC_ID_V410,
+    CODEC_ID_Y41P       = MKBETAG('Y','4','1','P'),
     CODEC_ID_UTVIDEO = 0x800,
     CODEC_ID_ESCAPE130  = MKBETAG('E','1','3','0'),
 
@@ -789,6 +791,10 @@ typedef struct RcOverride{
  * Codec supports slice-based (or partition-based) multithreading.
  */
 #define CODEC_CAP_SLICE_THREADS    0x2000
+/**
+ * Codec supports changed parameters at any point.
+ */
+#define CODEC_CAP_PARAM_CHANGE     0x4000
 /**
  * Codec is lossless.
  */
@@ -875,6 +881,8 @@ typedef struct AVPanScan{
 
 enum AVPacketSideDataType {
     AV_PKT_DATA_PALETTE,
+    AV_PKT_DATA_NEW_EXTRADATA,
+    AV_PKT_DATA_PARAM_CHANGE,
 };
 
 typedef struct AVPacket {
@@ -943,6 +951,27 @@ typedef struct AVPacket {
 #define AV_PKT_FLAG_KEY     0x0001 ///< The packet contains a keyframe
 #define AV_PKT_FLAG_CORRUPT 0x0002 ///< The packet content is corrupted
 
+/**
+ * An AV_PKT_DATA_PARAM_CHANGE side data packet is laid out as follows:
+ * u32le param_flags
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT)
+ *     s32le channel_count
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT)
+ *     u64le channel_layout
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE)
+ *     s32le sample_rate
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS)
+ *     s32le width
+ *     s32le height
+ */
+
+enum AVSideDataParamChangeFlags {
+    AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT  = 0x0001,
+    AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT = 0x0002,
+    AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE    = 0x0004,
+    AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS     = 0x0008,
+};
+
 /**
  * Audio Video Frame.
  * New fields can be added to the end of AVFRAME with minor version

libavcodec/bmp.c

@@ -206,7 +206,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
     dsize = buf_size - hsize;
 
     /* Line size in file multiple of 4 */
-    n = ((avctx->width * depth) / 8 + 3) & ~3;
+    n = ((avctx->width * depth + 31) / 8) & ~3;
 
     if(n * avctx->height > dsize && comp != BMP_RLE4 && comp != BMP_RLE8){
         av_log(avctx, AV_LOG_ERROR, "not enough data (%d < %d)\n",

libavcodec/bmv.c

@@ -285,12 +285,17 @@ static av_cold int decode_end(AVCodecContext *avctx)
     return 0;
 }
 
+typedef struct BMVAudioDecContext {
+    AVFrame frame;
+} BMVAudioDecContext;
+
 static const int bmv_aud_mults[16] = {
     16512, 8256, 4128, 2064, 1032, 516, 258, 192, 129, 88, 64, 56, 48, 40, 36, 32
 };
 
 static av_cold int bmv_aud_decode_init(AVCodecContext *avctx)
 {
+    BMVAudioDecContext *c = avctx->priv_data;
 
     if (avctx->channels != 2) {
         av_log(avctx, AV_LOG_INFO, "invalid number of channels\n");
@@ -299,17 +304,21 @@ static av_cold int bmv_aud_decode_init(AVCodecContext *avctx)
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
+    avcodec_get_frame_defaults(&c->frame);
+    avctx->coded_frame = &c->frame;
+
     return 0;
 }
 
-static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
-                                AVPacket *avpkt)
+static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data,
+                                int *got_frame_ptr, AVPacket *avpkt)
 {
+    BMVAudioDecContext *c = avctx->priv_data;
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     int blocks = 0, total_blocks, i;
-    int out_size;
-    int16_t *output_samples = data;
+    int ret;
+    int16_t *output_samples;
     int scale[2];
 
     total_blocks = *buf++;
@@ -318,11 +327,14 @@ static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
                total_blocks * 65 + 1, buf_size);
         return AVERROR_INVALIDDATA;
     }
-    out_size = total_blocks * 64 * sizeof(*output_samples);
-    if (*data_size < out_size) {
-        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
-        return AVERROR(EINVAL);
+
+    /* get output buffer */
+    c->frame.nb_samples = total_blocks * 32;
+    if ((ret = avctx->get_buffer(avctx, &c->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return ret;
     }
+    output_samples = (int16_t *)c->frame.data[0];
 
     for (blocks = 0; blocks < total_blocks; blocks++) {
         uint8_t code = *buf++;
@@ -335,7 +347,9 @@ static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
         }
     }
 
-    *data_size = out_size;
+    *got_frame_ptr   = 1;
+    *(AVFrame *)data = c->frame;
+
     return buf_size;
 }
 
@@ -354,7 +368,9 @@ AVCodec ff_bmv_audio_decoder = {
     .name           = "bmv_audio",
     .type           = AVMEDIA_TYPE_AUDIO,
     .id             = CODEC_ID_BMV_AUDIO,
+    .priv_data_size = sizeof(BMVAudioDecContext),
     .init           = bmv_aud_decode_init,
     .decode         = bmv_aud_decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name      = NULL_IF_CONFIG_SMALL("Discworld II BMV audio"),
 };

libavcodec/bytestream.h

@@ -26,6 +26,10 @@
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 
+typedef struct {
+    const uint8_t *buffer, *buffer_end;
+} GetByteContext;
+
 #define DEF_T(type, name, bytes, read, write)                             \
 static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
     (*b) += bytes;\
@@ -34,6 +38,18 @@ static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
 static av_always_inline void bytestream_put_ ##name(uint8_t **b, const type value){\
     write(*b, value);\
     (*b) += bytes;\
+}\
+static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)\
+{\
+    if (g->buffer_end - g->buffer < bytes)\
+        return 0;\
+    return bytestream_get_ ## name(&g->buffer);\
+}\
+static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)\
+{\
+    if (g->buffer_end - g->buffer < bytes)\
+        return 0;\
+    return read(g->buffer);\
 }
 
 #define DEF(name, bytes, read, write) \
@@ -55,6 +71,34 @@ DEF  (byte, 1, AV_RB8 , AV_WB8 )
 #undef DEF64
 #undef DEF_T
 
+static av_always_inline void bytestream2_init(GetByteContext *g,
+                                              const uint8_t *buf, int buf_size)
+{
+    g->buffer =  buf;
+    g->buffer_end = buf + buf_size;
+}
+
+static av_always_inline unsigned int bytestream2_get_bytes_left(GetByteContext *g)
+{
+    return g->buffer_end - g->buffer;
+}
+
+static av_always_inline void bytestream2_skip(GetByteContext *g,
+                                              unsigned int size)
+{
+    g->buffer += FFMIN(g->buffer_end - g->buffer, size);
+}
+
+static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
+                                                            uint8_t *dst,
+                                                            unsigned int size)
+{
+    int size2 = FFMIN(g->buffer_end - g->buffer, size);
+    memcpy(dst, g->buffer, size2);
+    g->buffer += size2;
+    return size2;
+}
+
 static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b, uint8_t *dst, unsigned int size)
 {
     memcpy(dst, *b, size);

libavcodec/cljr.c

@@ -61,7 +61,12 @@ static int decode_frame(AVCodecContext *avctx,
     if (p->data[0])
         avctx->release_buffer(avctx, p);
 
-    if (buf_size / avctx->height < avctx->width) {
+    if (avctx->height <= 0 || avctx->width <= 0) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid width or height\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    if (buf_size < avctx->height * avctx->width) {
         av_log(avctx, AV_LOG_ERROR,
                "Resolution larger than buffer size. Invalid header?\n");
         return AVERROR_INVALIDDATA;
@@ -82,10 +87,10 @@ static int decode_frame(AVCodecContext *avctx,
         uint8_t *cb   = &a->picture.data[1][y * a->picture.linesize[1]];
         uint8_t *cr   = &a->picture.data[2][y * a->picture.linesize[2]];
         for (x = 0; x < avctx->width; x += 4) {
-            luma[3] = get_bits(&gb, 5) << 3;
-            luma[2] = get_bits(&gb, 5) << 3;
-            luma[1] = get_bits(&gb, 5) << 3;
-            luma[0] = get_bits(&gb, 5) << 3;
+            luma[3] = (get_bits(&gb, 5)*33) >> 2;
+            luma[2] = (get_bits(&gb, 5)*33) >> 2;
+            luma[1] = (get_bits(&gb, 5)*33) >> 2;
+            luma[0] = (get_bits(&gb, 5)*33) >> 2;
             luma += 4;
             *(cb++) = get_bits(&gb, 6) << 2;
             *(cr++) = get_bits(&gb, 6) << 2;
@@ -156,13 +161,13 @@ static int encode_frame(AVCodecContext *avctx, unsigned char *buf,
             case 1: dither = dither * 1664525 + 1013904223;    break;
             case 2: dither = ordered_dither[ y&1 ][ (x>>2)&1 ];break;
             }
-            put_bits(&pb, 5, (luma[3] +  (dither>>29)   ) >> 3);
-            put_bits(&pb, 5, (luma[2] + ((dither>>26)&7)) >> 3);
-            put_bits(&pb, 5, (luma[1] + ((dither>>23)&7)) >> 3);
-            put_bits(&pb, 5, (luma[0] + ((dither>>20)&7)) >> 3);
+            put_bits(&pb, 5, (249*(luma[3] +  (dither>>29)   )) >> 11);
+            put_bits(&pb, 5, (249*(luma[2] + ((dither>>26)&7))) >> 11);
+            put_bits(&pb, 5, (249*(luma[1] + ((dither>>23)&7))) >> 11);
+            put_bits(&pb, 5, (249*(luma[0] + ((dither>>20)&7))) >> 11);
             luma += 4;
-            put_bits(&pb, 6, (*(cb++) + ((dither>>18)&3)) >> 2);
-            put_bits(&pb, 6, (*(cr++) + ((dither>>16)&3)) >> 2);
+            put_bits(&pb, 6, (253*(*(cb++) + ((dither>>18)&3))) >> 10);
+            put_bits(&pb, 6, (253*(*(cr++) + ((dither>>16)&3))) >> 10);
         }
     }
 

libavcodec/dpcm.c

@@ -288,7 +288,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
     }
     case CODEC_ID_SOL_DPCM:
         if (avctx->codec_tag != 3) {
-            uint8_t *output_samples_u8 = data;
+            uint8_t *output_samples_u8 = output_samples;
             while (buf < buf_end) {
                 uint8_t n = *buf++;
 

libavcodec/dv.c

@@ -37,7 +37,7 @@
  * @file
  * DV codec.
  */
-#define ALT_BITSTREAM_READER
+
 #include "libavutil/pixdesc.h"
 #include "avcodec.h"
 #include "dsputil.h"

libavcodec/eamad.c

@@ -119,7 +119,7 @@ static inline void idct_put(MadContext *t, DCTELEM *block, int mb_x, int mb_y, i
     }
 }
 
-static inline void decode_block_intra(MadContext * t, DCTELEM * block)
+static inline int decode_block_intra(MadContext * t, DCTELEM * block)
 {
     MpegEncContext *s = &t->s;
     int level, i, j, run;
@@ -170,13 +170,14 @@ static inline void decode_block_intra(MadContext * t, DCTELEM * block)
             }
             if (i > 63) {
                 av_log(s->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
-                return;
+                return -1;
             }
 
             block[j] = level;
         }
         CLOSE_READER(re, &s->gb);
     }
+    return 0;
 }
 
 static int decode_motion(GetBitContext *gb)
@@ -190,7 +191,7 @@ static int decode_motion(GetBitContext *gb)
     return value;
 }
 
-static void decode_mb(MadContext *t, int inter)
+static int decode_mb(MadContext *t, int inter)
 {
     MpegEncContext *s = &t->s;
     int mv_map = 0;
@@ -215,10 +216,12 @@ static void decode_mb(MadContext *t, int inter)
                 comp_block(t, s->mb_x, s->mb_y, j, mv_x, mv_y, add);
         } else {
             s->dsp.clear_block(t->block);
-            decode_block_intra(t, t->block);
+            if(decode_block_intra(t, t->block) < 0)
+                return -1;
             idct_put(t, t->block, s->mb_x, s->mb_y, j);
         }
     }
+    return 0;
 }
 
 static void calc_intra_matrix(MadContext *t, int qscale)
@@ -268,6 +271,8 @@ static int decode_frame(AVCodecContext *avctx,
     buf += 16;
 
     if (avctx->width != s->width || avctx->height != s->height) {
+        if((s->width * s->height)/2048*7 > buf_end-buf)
+            return -1;
         if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
             return -1;
         avcodec_set_dimensions(avctx, s->width, s->height);
@@ -294,7 +299,8 @@ static int decode_frame(AVCodecContext *avctx,
 
     for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)
         for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)
-            decode_mb(t, inter);
+            if(decode_mb(t, inter) < 0)
+                return -1;
 
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = t->frame;

libavcodec/eatqi.c

@@ -57,12 +57,15 @@ static av_cold int tqi_decode_init(AVCodecContext *avctx)
     return 0;
 }
 
-static void tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
+static int tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
 {
     int n;
     s->dsp.clear_blocks(block[0]);
     for (n=0; n<6; n++)
-        ff_mpeg1_decode_block_intra(s, block[n], n);
+        if(ff_mpeg1_decode_block_intra(s, block[n], n)<0)
+            return -1;
+
+    return 0;
 }
 
 static inline void tqi_idct_put(TqiContext *t, DCTELEM (*block)[64])
@@ -134,7 +137,8 @@ static int tqi_decode_frame(AVCodecContext *avctx,
     for (s->mb_y=0; s->mb_y<(avctx->height+15)/16; s->mb_y++)
     for (s->mb_x=0; s->mb_x<(avctx->width+15)/16; s->mb_x++)
     {
-        tqi_decode_mb(s, t->block);
+        if(tqi_decode_mb(s, t->block) < 0)
+            break;
         tqi_idct_put(t, t->block);
     }
 

libavcodec/flicvideo.c

@@ -319,12 +319,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                 pixel_ptr = y_ptr;
                 CHECK_PIXEL_PTR(0);
                 pixel_countdown = s->avctx->width;
-                line_packets = buf[stream_ptr++];
-                if (stream_ptr + 2 * line_packets > stream_ptr_after_chunk)
+                if (stream_ptr + 1 > stream_ptr_after_chunk)
                     break;
+                line_packets = buf[stream_ptr++];
                 if (line_packets > 0) {
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
+                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                            break;
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
@@ -497,16 +499,27 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     stream_ptr += 6;  /* skip the magic number */
     num_chunks = AV_RL16(&buf[stream_ptr]);
     stream_ptr += 10;  /* skip padding */
+    if (frame_size > buf_size)
+        frame_size = buf_size;
 
     frame_size -= 16;
 
     /* iterate through the chunks */
     while ((frame_size > 0) && (num_chunks > 0)) {
+        int stream_ptr_after_chunk;
         chunk_size = AV_RL32(&buf[stream_ptr]);
+        if (chunk_size > frame_size) {
+            av_log(avctx, AV_LOG_WARNING,
+                   "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
+            chunk_size = frame_size;
+        }
+        stream_ptr_after_chunk = stream_ptr + chunk_size;
+
         stream_ptr += 4;
         chunk_type = AV_RL16(&buf[stream_ptr]);
         stream_ptr += 2;
 
+
         switch (chunk_type) {
         case FLI_256_COLOR:
         case FLI_COLOR:
@@ -523,6 +536,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
             compressed_lines = AV_RL16(&buf[stream_ptr]);
             stream_ptr += 2;
             while (compressed_lines > 0) {
+                if (stream_ptr + 2 > stream_ptr_after_chunk)
+                    break;
                 line_packets = AV_RL16(&buf[stream_ptr]);
                 stream_ptr += 2;
                 if (line_packets < 0) {
@@ -535,6 +550,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
+                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                            break;
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
                         pixel_countdown -= pixel_skip;
@@ -549,6 +566,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                                 pixel_ptr += 2;
                             }
                         } else {
+                            if (stream_ptr + 2*byte_run > stream_ptr_after_chunk)
+                                break;
                             CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                 *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
@@ -584,6 +603,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_countdown = (s->avctx->width * 2);
 
                 while (pixel_countdown > 0) {
+                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                        break;
                     byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         palette_idx1 = buf[stream_ptr++];
@@ -597,6 +618,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy bytes if byte_run < 0 */
                         byte_run = -byte_run;
+                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
+                            break;
                         CHECK_PIXEL_PTR(byte_run);
                         for (j = 0; j < byte_run; j++) {
                             palette_idx1 = buf[stream_ptr++];
@@ -636,6 +659,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
 
                 while (pixel_countdown > 0) {
+                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                        break;
                     byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         pixel    = AV_RL16(&buf[stream_ptr]);
@@ -651,6 +676,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy pixels if byte_run < 0 */
                         byte_run = -byte_run;
+                        if (stream_ptr + 2 * byte_run > stream_ptr_after_chunk)
+                            break;
                         CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
                             *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);

libavcodec/get_bits.h

@@ -35,32 +35,30 @@
 #include "libavutil/log.h"
 #include "mathops.h"
 
-#if defined(ALT_BITSTREAM_READER_LE) && !defined(ALT_BITSTREAM_READER)
-#   define ALT_BITSTREAM_READER
-#endif
-
-#if !defined(A32_BITSTREAM_READER) && !defined(ALT_BITSTREAM_READER)
-#   if ARCH_ARM && !HAVE_FAST_UNALIGNED
-#       define A32_BITSTREAM_READER
-#   else
-#       define ALT_BITSTREAM_READER
-//#define A32_BITSTREAM_READER
-#   endif
+/*
+ * Safe bitstream reading:
+ * optionally, the get_bits API can check to ensure that we
+ * don't read past input buffer boundaries. This is protected
+ * with CONFIG_SAFE_BITSTREAM_READER at the global level, and
+ * then below that with UNCHECKED_BITSTREAM_READER at the per-
+ * decoder level. This means that decoders that check internally
+ * can "#define UNCHECKED_BITSTREAM_READER 1" to disable
+ * overread checks.
+ * Boundary checking causes a minor performance penalty so for
+ * applications that won't want/need this, it can be disabled
+ * globally using "#define CONFIG_SAFE_BITSTREAM_READER 0".
+ */
+#ifndef UNCHECKED_BITSTREAM_READER
+#define UNCHECKED_BITSTREAM_READER !CONFIG_SAFE_BITSTREAM_READER
 #endif
 
 /* bit input */
 /* buffer, buffer_end and size_in_bits must be present and used by every reader */
 typedef struct GetBitContext {
     const uint8_t *buffer, *buffer_end;
-#ifdef ALT_BITSTREAM_READER
     int index;
-#elif defined A32_BITSTREAM_READER
-    uint32_t *buffer_ptr;
-    uint32_t cache0;
-    uint32_t cache1;
-    int bit_count;
-#endif
     int size_in_bits;
+    int size_in_bits_plus8;
 } GetBitContext;
 
 #define VLC_TYPE int16_t
@@ -122,8 +120,11 @@ LAST_SKIP_BITS(name, gb, num)
 for examples see get_bits, show_bits, skip_bits, get_vlc
 */
 
-#ifdef ALT_BITSTREAM_READER
+#ifdef LONG_BITSTREAM_READER
+#   define MIN_CACHE_BITS 32
+#else
 #   define MIN_CACHE_BITS 25
+#endif
 
 #   define OPEN_READER(name, gb)                \
     unsigned int name##_index = (gb)->index;    \
@@ -132,19 +133,34 @@ for examples see get_bits, show_bits, skip_bits, get_vlc
 #   define CLOSE_READER(name, gb) (gb)->index = name##_index
 
 # ifdef ALT_BITSTREAM_READER_LE
+# ifdef LONG_BITSTREAM_READER
+#   define UPDATE_CACHE(name, gb) \
+    name##_cache = AV_RL64((gb)->buffer+(name##_index>>3)) >> (name##_index&0x07)
+# else
 #   define UPDATE_CACHE(name, gb) \
     name##_cache = AV_RL32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) >> (name##_index&0x07)
+# endif
 
 #   define SKIP_CACHE(name, gb, num) name##_cache >>= (num)
 # else
+# ifdef LONG_BITSTREAM_READER
+#   define UPDATE_CACHE(name, gb) \
+    name##_cache = AV_RB64((gb)->buffer+(name##_index >> 3)) >> (32 - (name##_index & 0x07))
+# else
 #   define UPDATE_CACHE(name, gb) \
     name##_cache = AV_RB32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) << (name##_index&0x07)
+# endif
 
 #   define SKIP_CACHE(name, gb, num) name##_cache <<= (num)
 # endif
 
 // FIXME name?
+#if UNCHECKED_BITSTREAM_READER
 #   define SKIP_COUNTER(name, gb, num) name##_index += (num)
+#else
+#   define SKIP_COUNTER(name, gb, num) \
+    name##_index = FFMIN((gb)->size_in_bits_plus8, name##_index + (num))
+#endif
 
 #   define SKIP_BITS(name, gb, num) do {        \
         SKIP_CACHE(name, gb, num);              \
@@ -171,83 +187,13 @@ static inline int get_bits_count(const GetBitContext *s){
 }
 
 static inline void skip_bits_long(GetBitContext *s, int n){
+#if UNCHECKED_BITSTREAM_READER
     s->index += n;
-}
-
-#elif defined A32_BITSTREAM_READER
-
-#   define MIN_CACHE_BITS 32
-
-#   define OPEN_READER(name, gb)                        \
-    int name##_bit_count        = (gb)->bit_count;      \
-    uint32_t name##_cache0      = (gb)->cache0;         \
-    uint32_t name##_cache1      = (gb)->cache1;         \
-    uint32_t *name##_buffer_ptr = (gb)->buffer_ptr
-
-#   define CLOSE_READER(name, gb) do {          \
-        (gb)->bit_count  = name##_bit_count;    \
-        (gb)->cache0     = name##_cache0;       \
-        (gb)->cache1     = name##_cache1;       \
-        (gb)->buffer_ptr = name##_buffer_ptr;   \
-    } while (0)
-
-#   define UPDATE_CACHE(name, gb) do {                                  \
-        if(name##_bit_count > 0){                                       \
-            const uint32_t next = av_be2ne32(*name##_buffer_ptr);       \
-            name##_cache0 |= NEG_USR32(next, name##_bit_count);         \
-            name##_cache1 |= next << name##_bit_count;                  \
-            name##_buffer_ptr++;                                        \
-            name##_bit_count -= 32;                                     \
-        }                                                               \
-    } while (0)
-
-#if ARCH_X86
-#   define SKIP_CACHE(name, gb, num)                            \
-    __asm__("shldl %2, %1, %0          \n\t"                    \
-            "shll  %2, %1              \n\t"                    \
-            : "+r" (name##_cache0), "+r" (name##_cache1)        \
-            : "Ic" ((uint8_t)(num)))
 #else
-#   define SKIP_CACHE(name, gb, num) do {               \
-        name##_cache0 <<= (num);                        \
-        name##_cache0 |= NEG_USR32(name##_cache1,num);  \
-        name##_cache1 <<= (num);                        \
-    } while (0)
+    s->index += av_clip(n, -s->index, s->size_in_bits_plus8 - s->index);
 #endif
-
-#   define SKIP_COUNTER(name, gb, num) name##_bit_count += (num)
-
-#   define SKIP_BITS(name, gb, num) do {        \
-        SKIP_CACHE(name, gb, num);              \
-        SKIP_COUNTER(name, gb, num);            \
-    } while (0)
-
-#   define LAST_SKIP_BITS(name, gb, num)  SKIP_BITS(name, gb, num)
-#   define LAST_SKIP_CACHE(name, gb, num) SKIP_CACHE(name, gb, num)
-
-#   define SHOW_UBITS(name, gb, num) NEG_USR32(name##_cache0, num)
-
-#   define SHOW_SBITS(name, gb, num) NEG_SSR32(name##_cache0, num)
-
-#   define GET_CACHE(name, gb) name##_cache0
-
-static inline int get_bits_count(const GetBitContext *s) {
-    return ((uint8_t*)s->buffer_ptr - s->buffer)*8 - 32 + s->bit_count;
 }
 
-static inline void skip_bits_long(GetBitContext *s, int n){
-    OPEN_READER(re, s);
-    re_bit_count += n;
-    re_buffer_ptr += re_bit_count>>5;
-    re_bit_count &= 31;
-    re_cache0 = av_be2ne32(re_buffer_ptr[-1]) << re_bit_count;
-    re_cache1 = 0;
-    UPDATE_CACHE(re, s);
-    CLOSE_READER(re, s);
-}
-
-#endif
-
 /**
  * read mpeg1 dc style vlc (sign bit + mantisse with no MSB).
  * if MSB not set it is negative
@@ -309,7 +255,6 @@ static inline void skip_bits(GetBitContext *s, int n){
 }
 
 static inline unsigned int get_bits1(GetBitContext *s){
-#ifdef ALT_BITSTREAM_READER
     unsigned int index = s->index;
     uint8_t result = s->buffer[index>>3];
 #ifdef ALT_BITSTREAM_READER_LE
@@ -319,13 +264,13 @@ static inline unsigned int get_bits1(GetBitContext *s){
     result <<= index & 7;
     result >>= 8 - 1;
 #endif
-    index++;
+#if !UNCHECKED_BITSTREAM_READER
+    if (s->index < s->size_in_bits_plus8)
+#endif
+        index++;
     s->index = index;
 
     return result;
-#else
-    return get_bits(s, 1);
-#endif
 }
 
 static inline unsigned int show_bits1(GetBitContext *s){
@@ -399,14 +344,9 @@ static inline void init_get_bits(GetBitContext *s,
 
     s->buffer       = buffer;
     s->size_in_bits = bit_size;
+    s->size_in_bits_plus8 = bit_size + 8;
     s->buffer_end   = buffer + buffer_size;
-#ifdef ALT_BITSTREAM_READER
     s->index        = 0;
-#elif defined A32_BITSTREAM_READER
-    s->buffer_ptr   = (uint32_t*)((intptr_t)buffer & ~3);
-    s->bit_count    = 32 +     8*((intptr_t)buffer &  3);
-    skip_bits_long(s, 0);
-#endif
 }
 
 static inline void align_get_bits(GetBitContext *s)

libavcodec/golomb.h

@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
     }else{
         int ret = 1;
 
-        while (1) {
+        do {
             buf >>= 32 - 8;
             LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8));
 
@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
             ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf];
             UPDATE_CACHE(re, gb);
             buf = GET_CACHE(re, gb);
-        }
+        } while(ret<0x8000000U);
 
         CLOSE_READER(re, gb);
         return ret - 1;
@@ -302,7 +302,7 @@ static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, int
     }else{
         int i;
         for(i=0; SHOW_UBITS(re, gb, 1) == 0; i++){
-            if (get_bits_left(gb)<=0)
+            if (gb->size_in_bits <= re_index)
                 return -1;
             LAST_SKIP_BITS(re, gb, 1);
             UPDATE_CACHE(re, gb);

libavcodec/h263dec.c

@@ -25,6 +25,8 @@
  * H.263 decoder.
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/cpu.h"
 #include "internal.h"
 #include "avcodec.h"

libavcodec/h264.c

@@ -25,6 +25,8 @@
  * @author Michael Niedermayer <michaelni@gmx.at>
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 #include "internal.h"
@@ -1324,6 +1326,7 @@ int ff_h264_frame_start(H264Context *h){
      * See decode_nal_units().
      */
     s->current_picture_ptr->f.key_frame = 0;
+    s->current_picture_ptr->sync = 0;
     s->current_picture_ptr->mmco_reset= 0;
 
     assert(s->linesize && s->uvlinesize);
@@ -1815,7 +1818,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                                     idct_dc_add(ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
                                 else
                                     idct_add   (ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
-                            }else
+                            }else if(CONFIG_SVQ3_DECODER)
                                 ff_svq3_add_idct_c(ptr, h->mb + i*16+p*256, linesize, qscale, 0);
                         }
                     }
@@ -1835,7 +1838,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                         dctcoef_set(h->mb+(p*256 << pixel_shift), pixel_shift, dc_mapping[i], dctcoef_get(h->mb_luma_dc[p], pixel_shift, i));
                 }
             }
-        }else
+        }else if(CONFIG_SVQ3_DECODER)
             ff_svq3_luma_dc_dequant_idct_c(h->mb+p*256, h->mb_luma_dc[p], qscale);
     }
 }
@@ -1879,7 +1882,7 @@ static av_always_inline void hl_decode_mb_idct_luma(H264Context *h, int mb_type,
                     }
                 }
             }
-        }else{
+        }else if(CONFIG_SVQ3_DECODER) {
             for(i=0; i<16; i++){
                 if(h->non_zero_count_cache[ scan8[i+p*16] ] || h->mb[i*16+p*256]){ //FIXME benchmark weird rule, & below
                     uint8_t * const ptr= dest_y + block_offset[i];
@@ -3776,6 +3779,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
     int nals_needed=0; ///< number of NALs that need decoding before the next frame thread starts
     int nal_index;
 
+    h->nal_unit_type= 0;
+
     h->max_contexts = (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_SLICE)) ? avctx->thread_count : 1;
     if(!(s->flags2 & CODEC_FLAG2_CHUNKS)){
         h->current_slice = 0;
@@ -3798,7 +3803,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         int err;
 
         if(buf_index >= next_avc) {
-            if(buf_index >= buf_size) break;
+            if (buf_index >= buf_size - h->nal_length_size) break;
             nalsize = 0;
             for(i = 0; i < h->nal_length_size; i++)
                 nalsize = (nalsize << 8) | buf[buf_index++];
@@ -3839,7 +3844,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         bit_length= !dst_length ? 0 : (8*dst_length - ff_h264_decode_rbsp_trailing(h, ptr + dst_length - 1));
 
         if(s->avctx->debug&FF_DEBUG_STARTCODE){
-            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d/%d at %d/%d length %d\n", hx->nal_unit_type, hx->nal_ref_idc, buf_index, buf_size, dst_length);
+            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d/%d at %d/%d length %d pass %d\n", hx->nal_unit_type, hx->nal_ref_idc, buf_index, buf_size, dst_length, pass);
         }
 
         if (h->is_avc && (nalsize != consumed) && nalsize){
@@ -3876,7 +3881,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         switch(hx->nal_unit_type){
         case NAL_IDR_SLICE:
             if (h->nal_unit_type != NAL_IDR_SLICE) {
-                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices");
+                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices\n");
                 return -1;
             }
             idr(h); //FIXME ensure we don't loose some frames if there is reordering
@@ -3890,7 +3895,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
                break;
 
             if (   h->sei_recovery_frame_cnt >= 0
-                && ((h->recovery_frame - h->frame_num) & ((1 << h->sps.log2_max_frame_num)-1)) > h->sei_recovery_frame_cnt) {
+                && (   h->recovery_frame<0
+                    || ((h->recovery_frame - h->frame_num) & ((1 << h->sps.log2_max_frame_num)-1)) > h->sei_recovery_frame_cnt)) {
                 h->recovery_frame = (h->frame_num + h->sei_recovery_frame_cnt) %
                                     (1 << h->sps.log2_max_frame_num);
             }
@@ -3899,13 +3905,13 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
                     (hx->nal_unit_type == NAL_IDR_SLICE);
 
             if (h->recovery_frame == h->frame_num) {
-                h->sync |= 1;
+                s->current_picture_ptr->sync |= 1;
                 h->recovery_frame = -1;
             }
 
             h->sync |= !!s->current_picture_ptr->f.key_frame;
             h->sync |= 3*!!(s->flags2 & CODEC_FLAG2_SHOW_ALL);
-            s->current_picture_ptr->sync = h->sync;
+            s->current_picture_ptr->sync |= h->sync;
 
             if (h->current_slice == 1) {
                 if(!(s->flags2 & CODEC_FLAG2_CHUNKS)) {
@@ -4043,15 +4049,15 @@ static int decode_frame(AVCodecContext *avctx,
     MpegEncContext *s = &h->s;
     AVFrame *pict = data;
     int buf_index;
+    Picture *out;
+    int i, out_idx;
 
     s->flags= avctx->flags;
     s->flags2= avctx->flags2;
 
    /* end of stream, output what is still in the buffers */
- out:
     if (buf_size == 0) {
-        Picture *out;
-        int i, out_idx;
+ out:
 
         s->current_picture_ptr = NULL;
 
@@ -4072,24 +4078,45 @@ static int decode_frame(AVCodecContext *avctx,
             *pict= *(AVFrame*)out;
         }
 
-        return 0;
+        return buf_size;
     }
-    if(h->is_avc && buf_size >= 9 && AV_RB32(buf)==0x0164001F && buf[5] && buf[8]==0x67)
+    if(h->is_avc && buf_size >= 9 && buf[0]==1 && buf[2]==0 && (buf[4]&0xFC)==0xFC && (buf[5]&0x1F) && buf[8]==0x67){
+        int cnt= buf[5]&0x1f;
+        uint8_t *p= buf+6;
+        while(cnt--){
+            int nalsize= AV_RB16(p) + 2;
+            if(nalsize > buf_size - (p-buf) || p[2]!=0x67)
+                goto not_extra;
+            p += nalsize;
+        }
+        cnt = *(p++);
+        if(!cnt)
+            goto not_extra;
+        while(cnt--){
+            int nalsize= AV_RB16(p) + 2;
+            if(nalsize > buf_size - (p-buf) || p[2]!=0x68)
+                goto not_extra;
+            p += nalsize;
+        }
+
         return ff_h264_decode_extradata(h, buf, buf_size);
+    }
+not_extra:
 
     buf_index=decode_nal_units(h, buf, buf_size);
     if(buf_index < 0)
         return -1;
 
     if (!s->current_picture_ptr && h->nal_unit_type == NAL_END_SEQUENCE) {
-        buf_size = 0;
+        av_assert0(buf_index <= buf_size);
+        buf_size = buf_index;
         goto out;
     }
 
     if(!(s->flags2 & CODEC_FLAG2_CHUNKS) && !s->current_picture_ptr){
         if (avctx->skip_frame >= AVDISCARD_NONREF ||
             buf_size >= 4 && !memcmp("Q264", buf, 4))
-            return 0;
+            return buf_size;
         av_log(avctx, AV_LOG_ERROR, "no frame!\n");
         return -1;
     }
@@ -4101,11 +4128,9 @@ static int decode_frame(AVCodecContext *avctx,
         field_end(h, 0);
 
         *data_size = 0; /* Wait for second field. */
-        if (h->next_output_pic && h->next_output_pic->sync) {
-            if(h->sync>1 || h->next_output_pic->f.pict_type != AV_PICTURE_TYPE_B){
+        if (h->next_output_pic && (h->next_output_pic->sync || h->sync>1)) {
                 *data_size = sizeof(AVFrame);
                 *pict = *(AVFrame*)h->next_output_pic;
-            }
         }
     }
 

libavcodec/h264_cabac.c

@@ -26,6 +26,7 @@
  */
 
 #define CABAC 1
+#define UNCHECKED_BITSTREAM_READER 1
 
 #include "internal.h"
 #include "dsputil.h"

libavcodec/h264_cavlc.c

@@ -26,6 +26,7 @@
  */
 
 #define CABAC 0
+#define UNCHECKED_BITSTREAM_READER 1
 
 #include "internal.h"
 #include "avcodec.h"

libavcodec/h264_mp4toannexb_bsf.c

@@ -63,6 +63,7 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
     int32_t nal_size;
     uint32_t cumul_size = 0;
     const uint8_t *buf_end = buf + buf_size;
+    int ret = AVERROR(EINVAL);
 
     /* nothing to filter */
     if (!avctx->extradata || avctx->extradata_size < 6) {
@@ -137,6 +138,7 @@ pps:
     *poutbuf_size = 0;
     *poutbuf = NULL;
     do {
+        ret= AVERROR(EINVAL);
         if (buf + ctx->length_size > buf_end)
             goto fail;
 
@@ -155,15 +157,15 @@ pps:
 
         /* prepend only to the first type 5 NAL unit of an IDR picture */
         if (ctx->first_idr && unit_type == 5) {
-            if (alloc_and_copy(poutbuf, poutbuf_size,
+            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                                avctx->extradata, avctx->extradata_size,
-                               buf, nal_size) < 0)
+                               buf, nal_size)) < 0)
                 goto fail;
             ctx->first_idr = 0;
         } else {
-            if (alloc_and_copy(poutbuf, poutbuf_size,
+            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                                NULL, 0,
-                               buf, nal_size) < 0)
+                               buf, nal_size)) < 0)
                 goto fail;
             if (!ctx->first_idr && unit_type == 1)
                 ctx->first_idr = 1;
@@ -178,7 +180,7 @@ pps:
 fail:
     av_freep(poutbuf);
     *poutbuf_size = 0;
-    return AVERROR(EINVAL);
+    return ret;
 }
 
 AVBitStreamFilter ff_h264_mp4toannexb_bsf = {

libavcodec/h264_mvpred.h

@@ -633,7 +633,7 @@ static void fill_decode_caches(H264Context *h, int mb_type){
                 AV_ZERO32(mv_cache[4 - 1*8]);
                 ref_cache[4 - 1*8]= topright_type ? LIST_NOT_USED : PART_NOT_AVAILABLE;
             }
-            if(ref_cache[4 - 1*8] < 0){
+            if(ref_cache[2 - 1*8] < 0 || ref_cache[4 - 1*8] < 0){
                 if(USES_LIST(topleft_type, list)){
                     const int b_xy = h->mb2b_xy[topleft_xy] + 3 + b_stride + (h->topleft_partition & 2*b_stride);
                     const int b8_xy= 4*topleft_xy + 1 + (h->topleft_partition & 2);

libavcodec/h264_parser.c

@@ -25,6 +25,8 @@
  * @author Michael Niedermayer <michaelni@gmx.at>
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "parser.h"
 #include "h264data.h"
 #include "golomb.h"

libavcodec/h264_ps.c

@@ -229,7 +229,8 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
     if(sps->nal_hrd_parameters_present_flag || sps->vcl_hrd_parameters_present_flag)
         get_bits1(&s->gb);     /* low_delay_hrd_flag */
     sps->pic_struct_present_flag = get_bits1(&s->gb);
-
+    if(!get_bits_left(&s->gb))
+        return 0;
     sps->bitstream_restriction_flag = get_bits1(&s->gb);
     if(sps->bitstream_restriction_flag){
         get_bits1(&s->gb);     /* motion_vectors_over_pic_boundaries_flag */
@@ -347,6 +348,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
 
     if(sps->profile_idc >= 100){ //high profile
         sps->chroma_format_idc= get_ue_golomb_31(&s->gb);
+        if (sps->chroma_format_idc > 3U) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc);
+            goto fail;
+        }
         if(sps->chroma_format_idc == 3)
             sps->residual_color_transform_flag = get_bits1(&s->gb);
         sps->bit_depth_luma   = get_ue_golomb(&s->gb) + 8;

libavcodec/h264_refs.c

@@ -653,9 +653,10 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
     print_short_term(h);
     print_long_term(h);
 
-    if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count[0]<=1 && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
-        h->sync |= 1;
-        s->current_picture_ptr->sync |= h->sync;
+    if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count[0]<=1 + (s->picture_structure != PICT_FRAME) && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
+        s->current_picture_ptr->sync |= 1;
+        if(!h->s.avctx->has_b_frames)
+            h->sync = 2;
     }
 
     return (h->s.avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;

libavcodec/imc.c

@@ -35,7 +35,6 @@
 #include <stddef.h>
 #include <stdio.h>
 
-#define ALT_BITSTREAM_READER
 #include "avcodec.h"
 #include "get_bits.h"
 #include "dsputil.h"

libavcodec/indeo3.c

@@ -770,7 +770,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                 /* get motion vector index and setup the pointer to the mv set */
                 if (!ctx->need_resync)
                     ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3];
-                curr_cell.mv_ptr = &ctx->mc_vectors[*(ctx->next_cell_data++) << 1];
+                if(ctx->mc_vectors)
+                    curr_cell.mv_ptr = &ctx->mc_vectors[*(ctx->next_cell_data++) << 1];
                 curr_cell.tree   = 1; /* enter the VQ tree */
                 UPDATE_BITPOS(8);
             } else { /* VQ tree DATA code */
@@ -884,7 +885,8 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         ctx->height = height;
 
         free_frame_buffers(ctx);
-        allocate_frame_buffers(ctx, avctx);
+        if(allocate_frame_buffers(ctx, avctx) < 0)
+            return AVERROR_INVALIDDATA;
         avcodec_set_dimensions(avctx, width, height);
     }
 
@@ -984,9 +986,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
 
     dsputil_init(&ctx->dsp, avctx);
 
-    allocate_frame_buffers(ctx, avctx);
-
-    return 0;
+    return allocate_frame_buffers(ctx, avctx);
 }
 
 

libavcodec/indeo4.c

@@ -0,0 +1,828 @@
+/*
+ * Indeo Video Interactive v4 compatible decoder
+ * Copyright (c) 2009-2011 Maxim Poliakovski
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * Indeo Video Interactive version 4 decoder
+ *
+ * Indeo 4 data is usually transported within .avi or .mov files.
+ * Known FOURCCs: 'IV41'
+ */
+
+#define ALT_BITSTREAM_READER_LE
+#include "avcodec.h"
+#include "get_bits.h"
+#include "dsputil.h"
+#include "ivi_dsp.h"
+#include "ivi_common.h"
+#include "indeo4data.h"
+
+#define IVI4_STREAM_ANALYSER    0
+#define IVI4_DEBUG_CHECKSUM     0
+
+/**
+ *  Indeo 4 frame types.
+ */
+enum {
+    FRAMETYPE_INTRA       = 0,
+    FRAMETYPE_BIDIR1      = 1,  ///< bidirectional frame
+    FRAMETYPE_INTER       = 2,  ///< non-droppable P-frame
+    FRAMETYPE_BIDIR       = 3,  ///< bidirectional frame
+    FRAMETYPE_INTER_NOREF = 4,  ///< droppable P-frame
+    FRAMETYPE_NULL_FIRST  = 5,  ///< empty frame with no data
+    FRAMETYPE_NULL_LAST   = 6   ///< empty frame with no data
+};
+
+#define IVI4_PIC_SIZE_ESC   7
+
+
+typedef struct {
+    GetBitContext   gb;
+    AVFrame         frame;
+    RVMapDesc       rvmap_tabs[9];   ///< local corrected copy of the static rvmap tables
+
+    uint32_t        frame_num;
+    int             frame_type;
+    int             prev_frame_type; ///< frame type of the previous frame
+    uint32_t        data_size;       ///< size of the frame data in bytes from picture header
+    int             is_scalable;
+    int             transp_status;   ///< transparency mode status: 1 - enabled
+
+    IVIPicConfig    pic_conf;
+    IVIPlaneDesc    planes[3];       ///< color planes
+
+    int             buf_switch;      ///< used to switch between three buffers
+    int             dst_buf;         ///< buffer index for the currently decoded frame
+    int             ref_buf;         ///< inter frame reference buffer index
+
+    IVIHuffTab      mb_vlc;          ///< current macroblock table descriptor
+    IVIHuffTab      blk_vlc;         ///< current block table descriptor
+
+    uint16_t        checksum;        ///< frame checksum
+
+    uint8_t         rvmap_sel;
+    uint8_t         in_imf;
+    uint8_t         in_q;            ///< flag for explicitly stored quantiser delta
+    uint8_t         pic_glob_quant;
+    uint8_t         unknown1;
+
+#if IVI4_STREAM_ANALYSER
+    uint8_t         has_b_frames;
+    uint8_t         has_transp;
+    uint8_t         uses_tiling;
+    uint8_t         uses_haar;
+    uint8_t         uses_fullpel;
+#endif
+} IVI4DecContext;
+
+
+struct {
+    InvTransformPtr *inv_trans;
+    DCTransformPtr  *dc_trans;
+    int             is_2d_trans;
+} transforms[18] = {
+    { ff_ivi_inverse_haar_8x8,  ff_ivi_dc_haar_2d,       1 },
+    { NULL, NULL, 0 }, /* inverse Haar 8x1 */
+    { NULL, NULL, 0 }, /* inverse Haar 1x8 */
+    { ff_ivi_put_pixels_8x8,    ff_ivi_put_dc_pixel_8x8, 1 },
+    { ff_ivi_inverse_slant_8x8, ff_ivi_dc_slant_2d,      1 },
+    { ff_ivi_row_slant8,        ff_ivi_dc_row_slant,     1 },
+    { ff_ivi_col_slant8,        ff_ivi_dc_col_slant,     1 },
+    { NULL, NULL, 0 }, /* inverse DCT 8x8 */
+    { NULL, NULL, 0 }, /* inverse DCT 8x1 */
+    { NULL, NULL, 0 }, /* inverse DCT 1x8 */
+    { NULL, NULL, 0 }, /* inverse Haar 4x4 */
+    { ff_ivi_inverse_slant_4x4, ff_ivi_dc_slant_2d,      1 },
+    { NULL, NULL, 0 }, /* no transform 4x4 */
+    { NULL, NULL, 0 }, /* inverse Haar 1x4 */
+    { NULL, NULL, 0 }, /* inverse Haar 4x1 */
+    { NULL, NULL, 0 }, /* inverse slant 1x4 */
+    { NULL, NULL, 0 }, /* inverse slant 4x1 */
+    { NULL, NULL, 0 }, /* inverse DCT 4x4 */
+};
+
+/**
+ *  Decode subdivision of a plane.
+ *  This is a simplified version that checks for two supported subdivisions:
+ *  - 1 wavelet band  per plane, size factor 1:1, code pattern: 3
+ *  - 4 wavelet bands per plane, size factor 1:4, code pattern: 2,3,3,3,3
+ *  Anything else is either unsupported or corrupt.
+ *
+ *  @param[in,out] gb    the GetBit context
+ *  @return        number of wavelet bands or 0 on error
+ */
+static int decode_plane_subdivision(GetBitContext *gb)
+{
+    int i;
+
+    switch (get_bits(gb, 2)) {
+    case 3:
+        return 1;
+    case 2:
+        for (i = 0; i < 4; i++)
+            if (get_bits(gb, 2) != 3)
+                return 0;
+        return 4;
+    default:
+        return 0;
+    }
+}
+
+static inline int scale_tile_size(int def_size, int size_factor)
+{
+    return (size_factor == 15 ? def_size : (size_factor + 1) << 5);
+}
+
+/**
+ *  Decode Indeo 4 picture header.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_pic_hdr(IVI4DecContext *ctx, AVCodecContext *avctx)
+{
+    int             pic_size_indx, val, i, p;
+    IVIPicConfig    pic_conf;
+
+    if (get_bits(&ctx->gb, 18) != 0x3FFF8) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid picture start code!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    ctx->prev_frame_type = ctx->frame_type;
+    ctx->frame_type      = get_bits(&ctx->gb, 3);
+    if (ctx->frame_type == 7) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d\n", ctx->frame_type);
+        return AVERROR_INVALIDDATA;
+    }
+
+#if IVI4_STREAM_ANALYSER
+    if (   ctx->frame_type == FRAMETYPE_BIDIR1
+        || ctx->frame_type == FRAMETYPE_BIDIR)
+        ctx->has_b_frames = 1;
+#endif
+
+    ctx->transp_status = get_bits1(&ctx->gb);
+#if IVI4_STREAM_ANALYSER
+    if (ctx->transp_status) {
+        ctx->has_transp = 1;
+    }
+#endif
+
+    /* unknown bit: Mac decoder ignores this bit, XANIM returns error */
+    if (get_bits1(&ctx->gb)) {
+        av_log(avctx, AV_LOG_ERROR, "Sync bit is set!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    ctx->data_size = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 24) : 0;
+
+    /* null frames don't contain anything else so we just return */
+    if (ctx->frame_type >= FRAMETYPE_NULL_FIRST) {
+        av_dlog(avctx, "Null frame encountered!\n");
+        return 0;
+    }
+
+    /* Check key lock status. If enabled - ignore lock word.         */
+    /* Usually we have to prompt the user for the password, but      */
+    /* we don't do that because Indeo 4 videos can be decoded anyway */
+    if (get_bits1(&ctx->gb)) {
+        skip_bits_long(&ctx->gb, 32);
+        av_dlog(avctx, "Password-protected clip!\n");
+    }
+
+    pic_size_indx = get_bits(&ctx->gb, 3);
+    if (pic_size_indx == IVI4_PIC_SIZE_ESC) {
+        pic_conf.pic_height = get_bits(&ctx->gb, 16);
+        pic_conf.pic_width  = get_bits(&ctx->gb, 16);
+    } else {
+        pic_conf.pic_height = ivi4_common_pic_sizes[pic_size_indx * 2 + 1];
+        pic_conf.pic_width  = ivi4_common_pic_sizes[pic_size_indx * 2    ];
+    }
+
+    /* Decode tile dimensions. */
+    if (get_bits1(&ctx->gb)) {
+        pic_conf.tile_height = scale_tile_size(pic_conf.pic_height, get_bits(&ctx->gb, 4));
+        pic_conf.tile_width  = scale_tile_size(pic_conf.pic_width,  get_bits(&ctx->gb, 4));
+#if IVI4_STREAM_ANALYSER
+        ctx->uses_tiling = 1;
+#endif
+    } else {
+        pic_conf.tile_height = pic_conf.pic_height;
+        pic_conf.tile_width  = pic_conf.pic_width;
+    }
+
+    /* Decode chroma subsampling. We support only 4:4 aka YVU9. */
+    if (get_bits(&ctx->gb, 2)) {
+        av_log(avctx, AV_LOG_ERROR, "Only YVU9 picture format is supported!\n");
+        return AVERROR_INVALIDDATA;
+    }
+    pic_conf.chroma_height = (pic_conf.pic_height + 3) >> 2;
+    pic_conf.chroma_width  = (pic_conf.pic_width  + 3) >> 2;
+
+    /* decode subdivision of the planes */
+    pic_conf.luma_bands = decode_plane_subdivision(&ctx->gb);
+    if (pic_conf.luma_bands)
+        pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
+    ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
+    if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
+        av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
+               pic_conf.luma_bands, pic_conf.chroma_bands);
+        return AVERROR_INVALIDDATA;
+    }
+
+    /* check if picture layout was changed and reallocate buffers */
+    if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
+        if (ff_ivi_init_planes(ctx->planes, &pic_conf)) {
+            av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
+            return AVERROR(ENOMEM);
+        }
+
+        ctx->pic_conf = pic_conf;
+
+        /* set default macroblock/block dimensions */
+        for (p = 0; p <= 2; p++) {
+            for (i = 0; i < (!p ? pic_conf.luma_bands : pic_conf.chroma_bands); i++) {
+                ctx->planes[p].bands[i].mb_size  = !p ? (!ctx->is_scalable ? 16 : 8) : 4;
+                ctx->planes[p].bands[i].blk_size = !p ? 8 : 4;
+            }
+        }
+
+        if (ff_ivi_init_tiles(ctx->planes, ctx->pic_conf.tile_width,
+                              ctx->pic_conf.tile_height)) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Couldn't reallocate internal structures!\n");
+            return AVERROR(ENOMEM);
+        }
+    }
+
+    ctx->frame_num = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 20) : 0;
+
+    /* skip decTimeEst field if present */
+    if (get_bits1(&ctx->gb))
+        skip_bits(&ctx->gb, 8);
+
+    /* decode macroblock and block huffman codebooks */
+    if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_MB_HUFF,  &ctx->mb_vlc,  avctx) ||
+        ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF, &ctx->blk_vlc, avctx))
+        return AVERROR_INVALIDDATA;
+
+    ctx->rvmap_sel = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 8;
+
+    ctx->in_imf = get_bits1(&ctx->gb);
+    ctx->in_q   = get_bits1(&ctx->gb);
+
+    ctx->pic_glob_quant = get_bits(&ctx->gb, 5);
+
+    /* TODO: ignore this parameter if unused */
+    ctx->unknown1 = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 0;
+
+    ctx->checksum = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 16) : 0;
+
+    /* skip picture header extension if any */
+    while (get_bits1(&ctx->gb)) {
+        av_dlog(avctx, "Pic hdr extension encountered!\n");
+        val = get_bits(&ctx->gb, 8);
+    }
+
+    if (get_bits1(&ctx->gb)) {
+        av_log(avctx, AV_LOG_ERROR, "Bad blocks bits encountered!\n");
+    }
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode Indeo 4 band header.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band,
+                           AVCodecContext *avctx)
+{
+    int plane, band_num, hdr_size, indx, transform_id, scan_indx;
+    int i;
+
+    plane    = get_bits(&ctx->gb, 2);
+    band_num = get_bits(&ctx->gb, 4);
+    if (band->plane != plane || band->band_num != band_num) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid band header sequence!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    band->is_empty = get_bits1(&ctx->gb);
+    if (!band->is_empty) {
+        hdr_size = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 16) : 4;
+
+        band->is_halfpel = get_bits(&ctx->gb, 2);
+        if (band->is_halfpel >= 2) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid/unsupported mv resolution: %d!\n",
+                   band->is_halfpel);
+            return AVERROR_INVALIDDATA;
+        }
+#if IVI4_STREAM_ANALYSER
+        if (!band->is_halfpel)
+            ctx->uses_fullpel = 1;
+#endif
+
+        band->checksum_present = get_bits1(&ctx->gb);
+        if (band->checksum_present)
+            band->checksum = get_bits(&ctx->gb, 16);
+
+        indx = get_bits(&ctx->gb, 2);
+        if (indx == 3) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid block size!\n");
+            return AVERROR_INVALIDDATA;
+        }
+        band->mb_size  = 16 >> indx;
+        band->blk_size = 8 >> (indx >> 1);
+
+        band->inherit_mv     = get_bits1(&ctx->gb);
+        band->inherit_qdelta = get_bits1(&ctx->gb);
+
+        band->glob_quant = get_bits(&ctx->gb, 5);
+
+        if (!get_bits1(&ctx->gb) || ctx->frame_type == FRAMETYPE_INTRA) {
+            transform_id = get_bits(&ctx->gb, 5);
+            if (!transforms[transform_id].inv_trans) {
+                av_log_ask_for_sample(avctx, "Unimplemented transform: %d!\n", transform_id);
+                return AVERROR_PATCHWELCOME;
+            }
+            if ((transform_id >= 7 && transform_id <= 9) ||
+                 transform_id == 17) {
+                av_log_ask_for_sample(avctx, "DCT transform not supported yet!\n");
+                return AVERROR_PATCHWELCOME;
+            }
+
+#if IVI4_STREAM_ANALYSER
+            if ((transform_id >= 0 && transform_id <= 2) || transform_id == 10)
+                ctx->uses_haar = 1;
+#endif
+
+            band->inv_transform = transforms[transform_id].inv_trans;
+            band->dc_transform  = transforms[transform_id].dc_trans;
+            band->is_2d_trans   = transforms[transform_id].is_2d_trans;
+
+            scan_indx = get_bits(&ctx->gb, 4);
+            if (scan_indx == 15) {
+                av_log(avctx, AV_LOG_ERROR, "Custom scan pattern encountered!\n");
+                return AVERROR_INVALIDDATA;
+            }
+            band->scan = scan_index_to_tab[scan_indx];
+
+            band->quant_mat = get_bits(&ctx->gb, 5);
+            if (band->quant_mat == 31) {
+                av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n");
+                return AVERROR_INVALIDDATA;
+            }
+        }
+
+        /* decode block huffman codebook */
+        if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF,
+                                 &band->blk_vlc, avctx))
+            return AVERROR_INVALIDDATA;
+
+        /* select appropriate rvmap table for this band */
+        band->rvmap_sel = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 8;
+
+        /* decode rvmap probability corrections if any */
+        band->num_corr = 0; /* there is no corrections */
+        if (get_bits1(&ctx->gb)) {
+            band->num_corr = get_bits(&ctx->gb, 8); /* get number of correction pairs */
+            if (band->num_corr > 61) {
+                av_log(avctx, AV_LOG_ERROR, "Too many corrections: %d\n",
+                       band->num_corr);
+                return AVERROR_INVALIDDATA;
+            }
+
+            /* read correction pairs */
+            for (i = 0; i < band->num_corr * 2; i++)
+                band->corr[i] = get_bits(&ctx->gb, 8);
+        }
+    }
+
+    if (band->blk_size == 8) {
+        band->intra_base = &ivi4_quant_8x8_intra[quant_index_to_tab[band->quant_mat]][0];
+        band->inter_base = &ivi4_quant_8x8_inter[quant_index_to_tab[band->quant_mat]][0];
+    } else {
+        band->intra_base = &ivi4_quant_4x4_intra[quant_index_to_tab[band->quant_mat]][0];
+        band->inter_base = &ivi4_quant_4x4_inter[quant_index_to_tab[band->quant_mat]][0];
+    }
+
+    /* Indeo 4 doesn't use scale tables */
+    band->intra_scale = NULL;
+    band->inter_scale = NULL;
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode information (block type, cbp, quant delta, motion vector)
+ *  for all macroblocks in the current tile.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in,out] tile      pointer to the tile descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
+                          IVITile *tile, AVCodecContext *avctx)
+{
+    int         x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb,
+                mv_scale, mb_type_bits;
+    IVIMbInfo   *mb, *ref_mb;
+    int         row_offset = band->mb_size * band->pitch;
+
+    mb     = tile->mbs;
+    ref_mb = tile->ref_mbs;
+    offs   = tile->ypos * band->pitch + tile->xpos;
+
+    blks_per_mb  = band->mb_size   != band->blk_size  ? 4 : 1;
+    mb_type_bits = ctx->frame_type == FRAMETYPE_BIDIR ? 2 : 1;
+
+    /* scale factor for motion vectors */
+    mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
+    mv_x = mv_y = 0;
+
+    if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) {
+        av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs);
+        return -1;
+    }
+
+    for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) {
+        mb_offset = offs;
+
+        for (x = tile->xpos; x < tile->xpos + tile->width; x += band->mb_size) {
+            mb->xpos     = x;
+            mb->ypos     = y;
+            mb->buf_offs = mb_offset;
+
+            if (get_bits1(&ctx->gb)) {
+                if (ctx->frame_type == FRAMETYPE_INTRA) {
+                    av_log(avctx, AV_LOG_ERROR, "Empty macroblock in an INTRA picture!\n");
+                    return AVERROR_INVALIDDATA;
+                }
+                mb->type = 1; /* empty macroblocks are always INTER */
+                mb->cbp  = 0; /* all blocks are empty */
+
+                mb->q_delta = 0;
+                if (!band->plane && !band->band_num && ctx->in_q) {
+                    mb->q_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                           IVI_VLC_BITS, 1);
+                    mb->q_delta = IVI_TOSIGNED(mb->q_delta);
+                }
+
+                mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
+                if (band->inherit_mv) {
+                    /* motion vector inheritance */
+                    if (mv_scale) {
+                        mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
+                        mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
+                    } else {
+                        mb->mv_x = ref_mb->mv_x;
+                        mb->mv_y = ref_mb->mv_y;
+                    }
+                }
+            } else {
+                if (band->inherit_mv) {
+                    mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
+                } else if (ctx->frame_type == FRAMETYPE_INTRA) {
+                    mb->type = 0; /* mb_type is always INTRA for intra-frames */
+                } else {
+                    mb->type = get_bits(&ctx->gb, mb_type_bits);
+                }
+
+                mb->cbp = get_bits(&ctx->gb, blks_per_mb);
+
+                mb->q_delta = 0;
+                if (band->inherit_qdelta) {
+                    if (ref_mb) mb->q_delta = ref_mb->q_delta;
+                } else if (mb->cbp || (!band->plane && !band->band_num &&
+                           ctx->in_q)) {
+                    mb->q_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                           IVI_VLC_BITS, 1);
+                    mb->q_delta = IVI_TOSIGNED(mb->q_delta);
+                }
+
+                if (!mb->type) {
+                    mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
+                } else {
+                    if (band->inherit_mv) {
+                        /* motion vector inheritance */
+                        if (mv_scale) {
+                            mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
+                            mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
+                        } else {
+                            mb->mv_x = ref_mb->mv_x;
+                            mb->mv_y = ref_mb->mv_y;
+                        }
+                    } else {
+                        /* decode motion vector deltas */
+                        mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                            IVI_VLC_BITS, 1);
+                        mv_y += IVI_TOSIGNED(mv_delta);
+                        mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                            IVI_VLC_BITS, 1);
+                        mv_x += IVI_TOSIGNED(mv_delta);
+                        mb->mv_x = mv_x;
+                        mb->mv_y = mv_y;
+                    }
+                }
+            }
+
+            mb++;
+            if (ref_mb)
+                ref_mb++;
+            mb_offset += band->mb_size;
+        }
+
+        offs += row_offset;
+    }
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode an Indeo 4 band.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_band(IVI4DecContext *ctx, int plane_num,
+                       IVIBandDesc *band, AVCodecContext *avctx)
+{
+    int         result, i, t, pos, idx1, idx2;
+    IVITile     *tile;
+
+    band->buf     = band->bufs[ctx->dst_buf];
+    band->ref_buf = band->bufs[ctx->ref_buf];
+
+    result = decode_band_hdr(ctx, band, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR, "Error decoding band header\n");
+        return result;
+    }
+
+    if (band->is_empty) {
+        av_log(avctx, AV_LOG_ERROR, "Empty band encountered!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    band->rv_map = &ctx->rvmap_tabs[band->rvmap_sel];
+
+    /* apply corrections to the selected rvmap table if present */
+    for (i = 0; i < band->num_corr; i++) {
+        idx1 = band->corr[i * 2];
+        idx2 = band->corr[i * 2 + 1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+    pos = get_bits_count(&ctx->gb);
+
+    for (t = 0; t < band->num_tiles; t++) {
+        tile = &band->tiles[t];
+
+        tile->is_empty = get_bits1(&ctx->gb);
+        if (tile->is_empty) {
+            ff_ivi_process_empty_tile(avctx, band, tile,
+                                      (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
+            av_dlog(avctx, "Empty tile encountered!\n");
+        } else {
+            tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
+            if (!tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Tile data size is zero!\n");
+                return AVERROR_INVALIDDATA;
+            }
+
+            result = decode_mb_info(ctx, band, tile, avctx);
+            if (result < 0)
+                break;
+
+            result = ff_ivi_decode_blocks(&ctx->gb, band, tile);
+            if (result < 0 || ((get_bits_count(&ctx->gb) - pos) >> 3) != tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Corrupted tile data encountered!\n");
+                break;
+            }
+
+            pos += tile->data_size << 3; // skip to next tile
+        }
+    }
+
+    /* restore the selected rvmap table by applying its corrections in reverse order */
+    for (i = band->num_corr - 1; i >= 0; i--) {
+        idx1 = band->corr[i * 2];
+        idx2 = band->corr[i * 2 + 1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+#if defined(DEBUG) && IVI4_DEBUG_CHECKSUM
+    if (band->checksum_present) {
+        uint16_t chksum = ivi_calc_band_checksum(band);
+        if (chksum != band->checksum) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Band checksum mismatch! Plane %d, band %d, received: %x, calculated: %x\n",
+                   band->plane, band->band_num, band->checksum, chksum);
+        }
+    }
+#endif
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+static av_cold int decode_init(AVCodecContext *avctx)
+{
+    IVI4DecContext *ctx = avctx->priv_data;
+
+    ff_ivi_init_static_vlc();
+
+    /* copy rvmap tables in our context so we can apply changes to them */
+    memcpy(ctx->rvmap_tabs, ff_ivi_rvmap_tabs, sizeof(ff_ivi_rvmap_tabs));
+
+    /* Force allocation of the internal buffers */
+    /* during picture header decoding.          */
+    ctx->pic_conf.pic_width  = 0;
+    ctx->pic_conf.pic_height = 0;
+
+    avctx->pix_fmt = PIX_FMT_YUV410P;
+
+    return 0;
+}
+
+
+/**
+ *  Rearrange decoding and reference buffers.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ */
+static void switch_buffers(IVI4DecContext *ctx)
+{
+    switch (ctx->prev_frame_type) {
+    case FRAMETYPE_INTRA:
+    case FRAMETYPE_INTER:
+        ctx->buf_switch ^= 1;
+        ctx->dst_buf     = ctx->buf_switch;
+        ctx->ref_buf     = ctx->buf_switch ^ 1;
+        break;
+    case FRAMETYPE_INTER_NOREF:
+        break;
+    }
+
+    switch (ctx->frame_type) {
+    case FRAMETYPE_INTRA:
+        ctx->buf_switch = 0;
+        /* FALLTHROUGH */
+    case FRAMETYPE_INTER:
+        ctx->dst_buf = ctx->buf_switch;
+        ctx->ref_buf = ctx->buf_switch ^ 1;
+        break;
+    case FRAMETYPE_INTER_NOREF:
+    case FRAMETYPE_NULL_FIRST:
+    case FRAMETYPE_NULL_LAST:
+        break;
+    }
+}
+
+
+static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
+                        AVPacket *avpkt)
+{
+    IVI4DecContext  *ctx = avctx->priv_data;
+    const uint8_t   *buf = avpkt->data;
+    int             buf_size = avpkt->size;
+    int             result, p, b;
+
+    init_get_bits(&ctx->gb, buf, buf_size * 8);
+
+    result = decode_pic_hdr(ctx, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR, "Error decoding picture header\n");
+        return result;
+    }
+
+    switch_buffers(ctx);
+
+    if (ctx->frame_type < FRAMETYPE_NULL_FIRST) {
+        for (p = 0; p < 3; p++) {
+            for (b = 0; b < ctx->planes[p].num_bands; b++) {
+                result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
+                if (result) {
+                    av_log(avctx, AV_LOG_ERROR,
+                           "Error decoding band: %d, plane: %d\n", b, p);
+                    return result;
+                }
+            }
+        }
+    }
+
+    /* If the bidirectional mode is enabled, next I and the following P frame will */
+    /* be sent together. Unfortunately the approach below seems to be the only way */
+    /* to handle the B-frames mode. That's exactly the same Intel decoders do.     */
+    if (ctx->frame_type == FRAMETYPE_INTRA) {
+        while (get_bits(&ctx->gb, 8)); // skip version string
+        skip_bits_long(&ctx->gb, 64);  // skip padding, TODO: implement correct 8-bytes alignment
+        if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8)
+            av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n");
+    }
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+    ctx->frame.reference = 0;
+    if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return result;
+    }
+
+    if (ctx->is_scalable) {
+        ff_ivi_recompose_haar(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
+    } else {
+        ff_ivi_output_plane(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0]);
+    }
+
+    ff_ivi_output_plane(&ctx->planes[2], ctx->frame.data[1], ctx->frame.linesize[1]);
+    ff_ivi_output_plane(&ctx->planes[1], ctx->frame.data[2], ctx->frame.linesize[2]);
+
+    *data_size = sizeof(AVFrame);
+    *(AVFrame*)data = ctx->frame;
+
+    return buf_size;
+}
+
+
+static av_cold int decode_close(AVCodecContext *avctx)
+{
+    IVI4DecContext *ctx = avctx->priv_data;
+
+    ff_ivi_free_buffers(&ctx->planes[0]);
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+#if IVI4_STREAM_ANALYSER
+    if (ctx->is_scalable)
+        av_log(avctx, AV_LOG_ERROR, "This video uses scalability mode!\n");
+    if (ctx->uses_tiling)
+        av_log(avctx, AV_LOG_ERROR, "This video uses local decoding!\n");
+    if (ctx->has_b_frames)
+        av_log(avctx, AV_LOG_ERROR, "This video contains B-frames!\n");
+    if (ctx->has_transp)
+        av_log(avctx, AV_LOG_ERROR, "Transparency mode is enabled!\n");
+    if (ctx->uses_haar)
+        av_log(avctx, AV_LOG_ERROR, "This video uses Haar transform!\n");
+    if (ctx->uses_fullpel)
+        av_log(avctx, AV_LOG_ERROR, "This video uses fullpel motion vectors!\n");
+#endif
+
+    return 0;
+}
+
+
+AVCodec ff_indeo4_decoder = {
+    .name           = "indeo4",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_INDEO4,
+    .priv_data_size = sizeof(IVI4DecContext),
+    .init           = decode_init,
+    .close          = decode_close,
+    .decode         = decode_frame,
+    .long_name      = NULL_IF_CONFIG_SMALL("Intel Indeo Video Interactive 4"),
+};

libavcodec/indeo4data.h

@@ -0,0 +1,350 @@
+/*
+ * Indeo Video Interactive 4 compatible decoder
+ * Copyright (c) 2009-2010 Maxim Poliakovski
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * This file contains data needed for the Indeo 4 decoder.
+ */
+
+#ifndef AVCODEC_INDEO4DATA_H
+#define AVCODEC_INDEO4DATA_H
+
+#include <stdint.h>
+#include "dsputil.h"
+#include "ivi_common.h"
+
+/**
+ *  standard picture dimensions
+ */
+static const uint16_t ivi4_common_pic_sizes[14] = {
+    640, 480, 320, 240, 160, 120, 704, 480, 352, 240, 352, 288, 176, 144
+};
+
+/**
+ *  Indeo 4 8x8 scan (zigzag) patterns
+ */
+static const uint8_t ivi4_alternate_scan_8x8[64] = {
+     0,  8,  1,  9, 16, 24,  2,  3, 17, 25, 10, 11, 32, 40, 48, 56,
+     4,  5,  6,  7, 33, 41, 49, 57, 18, 19, 26, 27, 12, 13, 14, 15,
+    34, 35, 43, 42, 50, 51, 59, 58, 20, 21, 22, 23, 31, 30, 29, 28,
+    36, 37, 38, 39, 47, 46, 45, 44, 52, 53, 54, 55, 63, 62, 61, 60
+};
+
+static const uint8_t ivi4_alternate_scan_4x4[16] = {
+    0, 1, 4, 5, 8, 12, 2, 3, 9, 13, 6, 7, 10, 11, 14, 15
+};
+
+static const uint8_t ivi4_vertical_scan_4x4[16] = {
+    0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15
+};
+
+static const uint8_t ivi4_horizontal_scan_4x4[16] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+};
+
+static const uint8_t *scan_index_to_tab[15] = {
+    // for 8x8 transforms
+    ff_zigzag_direct,
+    ivi4_alternate_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_vertical_scan_8x8,
+    ff_zigzag_direct,
+
+    // for 4x4 transforms
+    ff_ivi_direct_scan_4x4,
+    ivi4_alternate_scan_4x4,
+    ivi4_vertical_scan_4x4,
+    ivi4_horizontal_scan_4x4,
+    ff_ivi_direct_scan_4x4,
+
+    // TODO: check if those are needed
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8
+};
+
+/**
+ *  Indeo 4 dequant tables
+ */
+static uint16_t ivi4_quant_8x8_intra[9][64] = {
+  {
+      43,  342,  385,  470,  555,  555,  598,  726,
+     342,  342,  470,  513,  555,  598,  726,  769,
+     385,  470,  555,  555,  598,  726,  726,  811,
+     470,  470,  555,  555,  598,  726,  769,  854,
+     470,  555,  555,  598,  683,  726,  854, 1025,
+     555,  555,  598,  683,  726,  854, 1025, 1153,
+     555,  555,  598,  726,  811,  982, 1195, 1451,
+     555,  598,  726,  811,  982, 1195, 1451, 1793
+  },
+  {
+      86, 1195, 2390, 2390, 4865, 4865, 4865, 4865,
+    1195, 1195, 2390, 2390, 4865, 4865, 4865, 4865,
+    2390, 2390, 4865, 4865, 6827, 6827, 6827, 6827,
+    2390, 2390, 4865, 4865, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827
+  },
+  {
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835
+  },
+  {
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414
+  },
+  {
+     897,  897,  897,  897,  897,  897,  897,  897,
+    1067, 1067, 1067, 1067, 1067, 1067, 1067, 1067,
+    1238, 1238, 1238, 1238, 1238, 1238, 1238, 1238,
+    1409, 1409, 1409, 1409, 1409, 1409, 1409, 1409,
+    1579, 1579, 1579, 1579, 1579, 1579, 1579, 1579,
+    1750, 1750, 1750, 1750, 1750, 1750, 1750, 1750,
+    1921, 1921, 1921, 1921, 1921, 1921, 1921, 1921,
+    2091, 2091, 2091, 2091, 2091, 2091, 2091, 2091
+  },
+  {
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414
+  },
+  {
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390
+  },
+  {
+      22,  171,  214,  257,  257,  299,  299,  342,
+     171,  171,  257,  257,  299,  299,  342,  385,
+     214,  257,  257,  299,  299,  342,  342,  385,
+     257,  257,  257,  299,  299,  342,  385,  427,
+     257,  257,  299,  299,  342,  385,  427,  513,
+     257,  299,  299,  342,  385,  427,  513,  598,
+     299,  299,  299,  385,  385,  470,  598,  726,
+     299,  299,  385,  385,  470,  598,  726,  897
+  },
+  {
+      86,  598, 1195, 1195, 2390, 2390, 2390, 2390,
+     598,  598, 1195, 1195, 2390, 2390, 2390, 2390,
+    1195, 1195, 2390, 2390, 3414, 3414, 3414, 3414,
+    1195, 1195, 2390, 2390, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414
+  }
+};
+
+static uint16_t ivi4_quant_8x8_inter[9][64] = {
+  {
+     427,  427,  470,  427,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470,
+     427,  427,  470,  470,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470
+  },
+  {
+    1707, 1707, 2433, 2433, 3414, 3414, 3414, 3414,
+    1707, 1707, 2433, 2433, 3414, 3414, 3414, 3414,
+    2433, 2433, 3414, 3414, 4822, 4822, 4822, 4822,
+    2433, 2433, 3414, 3414, 4822, 4822, 4822, 4822,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414
+  },
+  {
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281
+  },
+  {
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433
+  },
+  {
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281,
+    1238, 1238, 1238, 1238, 1238, 1238, 1238, 1238,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281
+  },
+  {
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433
+  },
+  {
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707
+  },
+  {
+      86,  171,  171,  214,  214,  214,  214,  257,
+     171,  171,  214,  214,  214,  214,  257,  257,
+     171,  214,  214,  214,  214,  257,  257,  257,
+     214,  214,  214,  214,  257,  257,  257,  299,
+     214,  214,  214,  257,  257,  257,  299,  299,
+     214,  214,  257,  257,  257,  299,  299,  299,
+     214,  257,  257,  257,  299,  299,  299,  342,
+     257,  257,  257,  299,  299,  299,  342,  342
+  },
+  {
+     854,  854, 1195, 1195, 1707, 1707, 1707, 1707,
+     854,  854, 1195, 1195, 1707, 1707, 1707, 1707,
+    1195, 1195, 1707, 1707, 2390, 2390, 2390, 2390,
+    1195, 1195, 1707, 1707, 2390, 2390, 2390, 2390,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707
+  }
+};
+
+static uint16_t ivi4_quant_4x4_intra[5][16] = {
+  {
+      22,  214,  257,  299,
+     214,  257,  299,  342,
+     257,  299,  342,  427,
+     299,  342,  427,  513
+  },
+  {
+     129, 1025, 1451, 1451,
+    1025, 1025, 1451, 1451,
+    1451, 1451, 2049, 2049,
+    1451, 1451, 2049, 2049
+  },
+  {
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+     171,  171,  171,  171,
+     171,  171,  171,  171,
+     171,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43
+  }
+};
+
+static uint16_t ivi4_quant_4x4_inter[5][16] = {
+  {
+     107,  214,  257,  299,
+     214,  257,  299,  299,
+     257,  299,  299,  342,
+     299,  299,  342,  342
+  },
+  {
+     513, 1025, 1238, 1238,
+    1025, 1025, 1238, 1238,
+    1238, 1238, 1451, 1451,
+    1238, 1238, 1451, 1451
+  },
+  {
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+     171,  171,  171,  171,
+     171,  171,  171,  171,
+     171,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43
+  }
+};
+
+/**
+ *  Table for mapping quant matrix index from the bitstream
+ *  into internal quant table number.
+ */
+static uint8_t  quant_index_to_tab[22] = {
+    0, 1, 0, 2, 1, 3, 0, 4, 1, 5, 0, 1, 6, 7, 8, // for 8x8 quant matrixes
+    0, 1, 2, 2, 3, 3, 4                          // for 4x4 quant matrixes
+};
+
+#endif /* AVCODEC_INDEO4DATA_H */

libavcodec/indeo5.c

@@ -90,7 +90,7 @@ typedef struct {
  */
 static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
 {
-    int             result, i, p, tile_size, pic_size_indx, mb_size, blk_size;
+    int             result, i, p, tile_size, pic_size_indx, mb_size, blk_size, is_scalable;
     int             quant_mat, blk_size_changed = 0;
     IVIBandDesc     *band, *band1, *band2;
     IVIPicConfig    pic_conf;
@@ -112,8 +112,8 @@ static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
     /* num_levels * 3 + 1 */
     pic_conf.luma_bands   = get_bits(&ctx->gb, 2) * 3 + 1;
     pic_conf.chroma_bands = get_bits1(&ctx->gb)   * 3 + 1;
-    ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
-    if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
+    is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
+    if (is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
         av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
                pic_conf.luma_bands, pic_conf.chroma_bands);
         return -1;
@@ -151,6 +151,7 @@ static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
             return -1;
         }
         ctx->pic_conf = pic_conf;
+        ctx->is_scalable = is_scalable;
         blk_size_changed = 1; /* force reallocation of the internal structures */
     }
 
@@ -481,7 +482,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                 }
 
                 mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
-                if (band->inherit_mv){
+                if (band->inherit_mv && ref_mb){
                     /* motion vector inheritance */
                     if (mv_scale) {
                         mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
@@ -492,7 +493,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                     }
                 }
             } else {
-                if (band->inherit_mv) {
+                if (band->inherit_mv && ref_mb) {
                     mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
                 } else if (ctx->frame_type == FRAMETYPE_INTRA) {
                     mb->type = 0; /* mb_type is always INTRA for intra-frames */
@@ -518,7 +519,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                 if (!mb->type) {
                     mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
                 } else {
-                    if (band->inherit_mv){
+                    if (band->inherit_mv && ref_mb){
                         /* motion vector inheritance */
                         if (mv_scale) {
                             mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);

libavcodec/ituh263dec.c

@@ -27,6 +27,8 @@
  * h263 decoder.
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 //#define DEBUG
 #include <limits.h>
 

libavcodec/ivi_common.c

@@ -260,6 +260,8 @@ int av_cold ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei
             t_width  >>= 1;
             t_height >>= 1;
         }
+        if(t_width<=0 || t_height<=0)
+            return AVERROR(EINVAL);
 
         for (b = 0; b < planes[p].num_bands; b++) {
             band = &planes[p].bands[b];
@@ -506,7 +508,7 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
             if (band->inherit_qdelta && ref_mb)
                 mb->q_delta = ref_mb->q_delta;
 
-            if (band->inherit_mv) {
+            if (band->inherit_mv && ref_mb) {
                 /* motion vector inheritance */
                 if (mv_scale) {
                     mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
@@ -611,6 +613,9 @@ void ff_ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, int dst_pitch)
     const int16_t   *src  = plane->bands[0].buf;
     uint32_t        pitch = plane->bands[0].pitch;
 
+    if(!src)
+        return;
+
     for (y = 0; y < plane->height; y++) {
         for (x = 0; x < plane->width; x++)
             dst[x] = av_clip_uint8(src[x] + 128);

libavcodec/ivi_dsp.c

@@ -1,7 +1,7 @@
 /*
  * DSP functions for Indeo Video Interactive codecs (Indeo4 and Indeo5)
  *
- * Copyright (c) 2009 Maxim Poliakovski
+ * Copyright (c) 2009-2011 Maxim Poliakovski
  *
  * This file is part of FFmpeg.
  *
@@ -178,6 +178,153 @@ void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst,
     }
 }
 
+void ff_ivi_recompose_haar(const IVIPlaneDesc *plane, uint8_t *dst,
+                           const int dst_pitch, const int num_bands)
+{
+    int             x, y, indx, b0, b1, b2, b3, p0, p1, p2, p3;
+    const IDWTELEM *b0_ptr, *b1_ptr, *b2_ptr, *b3_ptr;
+    int32_t         pitch;
+
+    /* all bands should have the same pitch */
+    pitch = plane->bands[0].pitch;
+
+    /* get pointers to the wavelet bands */
+    b0_ptr = plane->bands[0].buf;
+    b1_ptr = plane->bands[1].buf;
+    b2_ptr = plane->bands[2].buf;
+    b3_ptr = plane->bands[3].buf;
+
+    for (y = 0; y < plane->height; y += 2) {
+        for (x = 0, indx = 0; x < plane->width; x += 2, indx++) {
+            /* load coefficients */
+            b0 = b0_ptr[indx]; //should be: b0 = (num_bands > 0) ? b0_ptr[indx] : 0;
+            b1 = b1_ptr[indx]; //should be: b1 = (num_bands > 1) ? b1_ptr[indx] : 0;
+            b2 = b2_ptr[indx]; //should be: b2 = (num_bands > 2) ? b2_ptr[indx] : 0;
+            b3 = b3_ptr[indx]; //should be: b3 = (num_bands > 3) ? b3_ptr[indx] : 0;
+
+            /* haar wavelet recomposition */
+            p0 = (b0 + b1 + b2 + b3 + 2) >> 2;
+            p1 = (b0 + b1 - b2 - b3 + 2) >> 2;
+            p2 = (b0 - b1 + b2 - b3 + 2) >> 2;
+            p3 = (b0 - b1 - b2 + b3 + 2) >> 2;
+
+            /* bias, convert and output four pixels */
+            dst[x]                 = av_clip_uint8(p0 + 128);
+            dst[x + 1]             = av_clip_uint8(p1 + 128);
+            dst[dst_pitch + x]     = av_clip_uint8(p2 + 128);
+            dst[dst_pitch + x + 1] = av_clip_uint8(p3 + 128);
+        }// for x
+
+        dst += dst_pitch << 1;
+
+        b0_ptr += pitch;
+        b1_ptr += pitch;
+        b2_ptr += pitch;
+        b3_ptr += pitch;
+    }// for y
+}
+
+/** butterfly operation for the inverse Haar transform */
+#define IVI_HAAR_BFLY(s1, s2, o1, o2, t) \
+    t  = (s1 - s2) >> 1;\
+    o1 = (s1 + s2) >> 1;\
+    o2 = t;\
+
+/** inverse 8-point Haar transform */
+#define INV_HAAR8(s1, s5, s3, s7, s2, s4, s6, s8,\
+                  d1, d2, d3, d4, d5, d6, d7, d8,\
+                  t0, t1, t2, t3, t4, t5, t6, t7, t8) {\
+    t1 = s1 << 1; t5 = s5 << 1;\
+    IVI_HAAR_BFLY(t1, t5, t1, t5, t0); IVI_HAAR_BFLY(t1, s3, t1, t3, t0);\
+    IVI_HAAR_BFLY(t5, s7, t5, t7, t0); IVI_HAAR_BFLY(t1, s2, t1, t2, t0);\
+    IVI_HAAR_BFLY(t3, s4, t3, t4, t0); IVI_HAAR_BFLY(t5, s6, t5, t6, t0);\
+    IVI_HAAR_BFLY(t7, s8, t7, t8, t0);\
+    d1 = COMPENSATE(t1);\
+    d2 = COMPENSATE(t2);\
+    d3 = COMPENSATE(t3);\
+    d4 = COMPENSATE(t4);\
+    d5 = COMPENSATE(t5);\
+    d6 = COMPENSATE(t6);\
+    d7 = COMPENSATE(t7);\
+    d8 = COMPENSATE(t8); }
+
+/** inverse 4-point Haar transform */
+#define INV_HAAR4(s1, s3, s5, s7) {\
+    HAAR_BFLY(s1, s5);  HAAR_BFLY(s1, s3);  HAAR_BFLY(s5, s7);\
+    s1 = COMPENSATE(s1);\
+    s3 = COMPENSATE(s3);\
+    s5 = COMPENSATE(s5);\
+    s7 = COMPENSATE(s7); }
+
+void ff_ivi_inverse_haar_8x8(const int32_t *in, int16_t *out, uint32_t pitch,
+                             const uint8_t *flags)
+{
+    int     i, shift, sp1, sp2, sp3, sp4;
+    const int32_t *src;
+    int32_t *dst;
+    int     tmp[64];
+    int     t0, t1, t2, t3, t4, t5, t6, t7, t8;
+
+    /* apply the InvHaar8 to all columns */
+#define COMPENSATE(x) (x)
+    src = in;
+    dst = tmp;
+    for (i = 0; i < 8; i++) {
+        if (flags[i]) {
+            /* pre-scaling */
+            shift = !(i & 4);
+            sp1 = src[ 0] << shift;
+            sp2 = src[ 8] << shift;
+            sp3 = src[16] << shift;
+            sp4 = src[24] << shift;
+            INV_HAAR8(    sp1,     sp2,     sp3,     sp4,
+                      src[32], src[40], src[48], src[56],
+                      dst[ 0], dst[ 8], dst[16], dst[24],
+                      dst[32], dst[40], dst[48], dst[56],
+                      t0, t1, t2, t3, t4, t5, t6, t7, t8);
+        } else
+            dst[ 0] = dst[ 8] = dst[16] = dst[24] =
+            dst[32] = dst[40] = dst[48] = dst[56] = 0;
+
+        src++;
+        dst++;
+    }
+#undef  COMPENSATE
+
+    /* apply the InvHaar8 to all rows */
+#define COMPENSATE(x) (x)
+    src = tmp;
+    for (i = 0; i < 8; i++) {
+        if (   !src[0] && !src[1] && !src[2] && !src[3]
+            && !src[4] && !src[5] && !src[6] && !src[7]) {
+            memset(out, 0, 8 * sizeof(out[0]));
+        } else {
+            INV_HAAR8(src[0], src[1], src[2], src[3],
+                      src[4], src[5], src[6], src[7],
+                      out[0], out[1], out[2], out[3],
+                      out[4], out[5], out[6], out[7],
+                      t0, t1, t2, t3, t4, t5, t6, t7, t8);
+        }
+        src += 8;
+        out += pitch;
+    }
+#undef  COMPENSATE
+}
+
+void ff_ivi_dc_haar_2d(const int32_t *in, int16_t *out, uint32_t pitch,
+                       int blk_size)
+{
+    int     x, y;
+    int16_t dc_coeff;
+
+    dc_coeff = (*in + 0) >> 3;
+
+    for (y = 0; y < blk_size; out += pitch, y++) {
+        for (x = 0; x < blk_size; x++)
+            out[x] = dc_coeff;
+    }
+}
+
 /** butterfly operation for the inverse slant transform */
 #define IVI_SLANT_BFLY(s1, s2, o1, o2, t) \
     t  = s1 - s2;\

libavcodec/ivi_dsp.h

@@ -1,7 +1,7 @@
 /*
  * DSP functions for Indeo Video Interactive codecs (Indeo4 and Indeo5)
  *
- * Copyright (c) 2009 Maxim Poliakovski
+ * Copyright (c) 2009-2011 Maxim Poliakovski
  *
  * This file is part of FFmpeg.
  *
@@ -43,6 +43,43 @@
 void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst,
                         const int dst_pitch, const int num_bands);
 
+/**
+ *  Haar wavelet recomposition filter for Indeo 4
+ *
+ *  @param[in]  plane        pointer to the descriptor of the plane being processed
+ *  @param[out] dst          pointer to the destination buffer
+ *  @param[in]  dst_pitch    pitch of the destination buffer
+ *  @param[in]  num_bands    number of wavelet bands to be processed
+ */
+void ff_ivi_recompose_haar(const IVIPlaneDesc *plane, uint8_t *dst,
+                           const int dst_pitch, const int num_bands);
+
+/**
+ *  two-dimensional inverse Haar 8x8 transform for Indeo 4
+ *
+ *  @param[in]  in        pointer to the vector of transform coefficients
+ *  @param[out] out       pointer to the output buffer (frame)
+ *  @param[in]  pitch     pitch to move to the next y line
+ *  @param[in]  flags     pointer to the array of column flags:
+ *                        != 0 - non_empty column, 0 - empty one
+ *                        (this array must be filled by caller)
+ */
+void ff_ivi_inverse_haar_8x8(const int32_t *in, int16_t *out, uint32_t pitch,
+                             const uint8_t *flags);
+
+/**
+ *  DC-only two-dimensional inverse Haar transform for Indeo 4.
+ *  Performing the inverse transform in this case is equivalent to
+ *  spreading DC_coeff >> 3 over the whole block.
+ *
+ *  @param[in]  in          pointer to the dc coefficient
+ *  @param[out] out         pointer to the output buffer (frame)
+ *  @param[in]  pitch       pitch to move to the next y line
+ *  @param[in]  blk_size    transform block size
+ */
+void ff_ivi_dc_haar_2d(const int32_t *in, int16_t *out, uint32_t pitch,
+                       int blk_size);
+
 /**
  *  two-dimensional inverse slant 8x8 transform
  *

libavcodec/j2k_dwt.c

@@ -321,7 +321,7 @@ int ff_j2k_dwt_init(DWTContext *s, uint16_t border[2][2], int decomp_levels, int
     int i, j, lev = decomp_levels, maxlen,
         b[2][2];
 
-    if (decomp_levels >= FF_DWT_MAX_DECLVLS)
+    if ((unsigned)decomp_levels >= FF_DWT_MAX_DECLVLS)
         return AVERROR_INVALIDDATA;
     s->ndeclevels = decomp_levels;
     s->type = type;

libavcodec/j2kdec.c

@@ -220,6 +220,9 @@ static int get_siz(J2kDecoderContext *s)
      s->tile_offset_y = bytestream_get_be32(&s->buf); // YT0Siz
        s->ncomponents = bytestream_get_be16(&s->buf); // CSiz
 
+    if(s->tile_width<=0 || s->tile_height<=0)
+        return AVERROR(EINVAL);
+
     if (s->buf_end - s->buf < 2 * s->ncomponents)
         return AVERROR(EINVAL);
 
@@ -235,6 +238,9 @@ static int get_siz(J2kDecoderContext *s)
     s->numXtiles = ff_j2k_ceildiv(s->width - s->tile_offset_x, s->tile_width);
     s->numYtiles = ff_j2k_ceildiv(s->height - s->tile_offset_y, s->tile_height);
 
+    if(s->numXtiles * (uint64_t)s->numYtiles > INT_MAX/sizeof(J2kTile))
+        return AVERROR(EINVAL);
+
     s->tile = av_mallocz(s->numXtiles * s->numYtiles * sizeof(J2kTile));
     if (!s->tile)
         return AVERROR(ENOMEM);
@@ -359,7 +365,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
 
     if (q->quantsty == J2K_QSTY_NONE){
         n -= 3;
-        if (s->buf_end - s->buf < n)
+        if (s->buf_end - s->buf < n || 32*3 < n)
             return AVERROR(EINVAL);
         for (i = 0; i < n; i++)
             q->expn[i] = bytestream_get_byte(&s->buf) >> 3;
@@ -376,7 +382,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
         }
     } else{
         n = (n - 3) >> 1;
-        if (s->buf_end - s->buf < n)
+        if (s->buf_end - s->buf < n || 32*3 < n)
             return AVERROR(EINVAL);
         for (i = 0; i < n; i++){
             x = bytestream_get_be16(&s->buf);
@@ -421,6 +427,10 @@ static uint8_t get_sot(J2kDecoderContext *s)
         return AVERROR(EINVAL);
 
     s->curtileno = bytestream_get_be16(&s->buf); ///< Isot
+    if((unsigned)s->curtileno >= s->numXtiles * s->numYtiles){
+        s->curtileno=0;
+        return AVERROR(EINVAL);
+    }
 
     s->buf += 4; ///< Psot (ignored)
 
@@ -911,7 +921,7 @@ static int decode_codestream(J2kDecoderContext *s)
 
         marker = bytestream_get_be16(&s->buf);
         if(s->avctx->debug & FF_DEBUG_STARTCODE)
-            av_log(s->avctx, AV_LOG_DEBUG, "marker 0x%.4X at pos 0x%x\n", marker, s->buf - s->buf_start - 4);
+            av_log(s->avctx, AV_LOG_DEBUG, "marker 0x%.4X at pos 0x%tx\n", marker, s->buf - s->buf_start - 4);
         oldbuf = s->buf;
 
         if (marker == J2K_SOD){

libavcodec/kmvc.c

@@ -57,17 +57,21 @@ typedef struct BitBuf {
 
 #define kmvc_init_getbits(bb, src)  bb.bits = 7; bb.bitbuf = *src++;
 
-#define kmvc_getbit(bb, src, res) {\
+#define kmvc_getbit(bb, src, src_end, res) {\
     res = 0; \
     if (bb.bitbuf & (1 << bb.bits)) res = 1; \
     bb.bits--; \
     if(bb.bits == -1) { \
+        if (src >= src_end) { \
+            av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n"); \
+            return AVERROR_INVALIDDATA; \
+        } \
         bb.bitbuf = *src++; \
         bb.bits = 7; \
     } \
 }
 
-static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w, int h)
+static int kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int src_size, int w, int h)
 {
     BitBuf bb;
     int res, val;
@@ -75,13 +79,18 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
     int bx, by;
     int l0x, l1x, l0y, l1y;
     int mx, my;
+    const uint8_t *src_end = src + src_size;
 
     kmvc_init_getbits(bb, src);
 
     for (by = 0; by < h; by += 8)
         for (bx = 0; bx < w; bx += 8) {
-            kmvc_getbit(bb, src, res);
+            kmvc_getbit(bb, src, src_end, res);
             if (!res) {         // fill whole 8x8 block
+                if (src >= src_end) {
+                    av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 val = *src++;
                 for (i = 0; i < 64; i++)
                     BLK(ctx->cur, bx + (i & 0x7), by + (i >> 3)) = val;
@@ -89,14 +98,22 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 for (i = 0; i < 4; i++) {
                     l0x = bx + (i & 1) * 4;
                     l0y = by + (i & 2) * 2;
-                    kmvc_getbit(bb, src, res);
+                    kmvc_getbit(bb, src, src_end, res);
                     if (!res) {
-                        kmvc_getbit(bb, src, res);
+                        kmvc_getbit(bb, src, src_end, res);
                         if (!res) {     // fill whole 4x4 block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             for (j = 0; j < 16; j++)
                                 BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = val;
                         } else {        // copy block from already decoded place
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             mx = val & 0xF;
                             my = val >> 4;
@@ -108,16 +125,24 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                         for (j = 0; j < 4; j++) {
                             l1x = l0x + (j & 1) * 2;
                             l1y = l0y + (j & 2);
-                            kmvc_getbit(bb, src, res);
+                            kmvc_getbit(bb, src, src_end, res);
                             if (!res) {
-                                kmvc_getbit(bb, src, res);
+                                kmvc_getbit(bb, src, src_end, res);
                                 if (!res) {     // fill whole 2x2 block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     BLK(ctx->cur, l1x, l1y) = val;
                                     BLK(ctx->cur, l1x + 1, l1y) = val;
                                     BLK(ctx->cur, l1x, l1y + 1) = val;
                                     BLK(ctx->cur, l1x + 1, l1y + 1) = val;
                                 } else {        // copy block from already decoded place
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     mx = val & 0xF;
                                     my = val >> 4;
@@ -140,9 +165,11 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 }
             }
         }
+
+    return 0;
 }
 
-static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w, int h)
+static int kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int src_size, int w, int h)
 {
     BitBuf bb;
     int res, val;
@@ -150,15 +177,20 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
     int bx, by;
     int l0x, l1x, l0y, l1y;
     int mx, my;
+    const uint8_t *src_end = src + src_size;
 
     kmvc_init_getbits(bb, src);
 
     for (by = 0; by < h; by += 8)
         for (bx = 0; bx < w; bx += 8) {
-            kmvc_getbit(bb, src, res);
+            kmvc_getbit(bb, src, src_end, res);
             if (!res) {
-                kmvc_getbit(bb, src, res);
+                kmvc_getbit(bb, src, src_end, res);
                 if (!res) {     // fill whole 8x8 block
+                    if (src >= src_end) {
+                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     val = *src++;
                     for (i = 0; i < 64; i++)
                         BLK(ctx->cur, bx + (i & 0x7), by + (i >> 3)) = val;
@@ -171,14 +203,22 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 for (i = 0; i < 4; i++) {
                     l0x = bx + (i & 1) * 4;
                     l0y = by + (i & 2) * 2;
-                    kmvc_getbit(bb, src, res);
+                    kmvc_getbit(bb, src, src_end, res);
                     if (!res) {
-                        kmvc_getbit(bb, src, res);
+                        kmvc_getbit(bb, src, src_end, res);
                         if (!res) {     // fill whole 4x4 block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             for (j = 0; j < 16; j++)
                                 BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = val;
                         } else {        // copy block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             mx = (val & 0xF) - 8;
                             my = (val >> 4) - 8;
@@ -190,16 +230,24 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                         for (j = 0; j < 4; j++) {
                             l1x = l0x + (j & 1) * 2;
                             l1y = l0y + (j & 2);
-                            kmvc_getbit(bb, src, res);
+                            kmvc_getbit(bb, src, src_end, res);
                             if (!res) {
-                                kmvc_getbit(bb, src, res);
+                                kmvc_getbit(bb, src, src_end, res);
                                 if (!res) {     // fill whole 2x2 block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     BLK(ctx->cur, l1x, l1y) = val;
                                     BLK(ctx->cur, l1x + 1, l1y) = val;
                                     BLK(ctx->cur, l1x, l1y + 1) = val;
                                     BLK(ctx->cur, l1x + 1, l1y + 1) = val;
                                 } else {        // copy block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     mx = (val & 0xF) - 8;
                                     my = (val >> 4) - 8;
@@ -222,6 +270,8 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 }
             }
         }
+
+    return 0;
 }
 
 static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPacket *avpkt)
@@ -299,10 +349,10 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPa
         memcpy(ctx->cur, ctx->prev, 320 * 200);
         break;
     case 3:
-        kmvc_decode_intra_8x8(ctx, buf, avctx->width, avctx->height);
+        kmvc_decode_intra_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
         break;
     case 4:
-        kmvc_decode_inter_8x8(ctx, buf, avctx->width, avctx->height);
+        kmvc_decode_inter_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
         break;
     default:
         av_log(avctx, AV_LOG_ERROR, "Unknown compression method %i\n", header & KMVC_METHOD);

libavcodec/lagarith.c

@@ -524,6 +524,50 @@ static int lag_decode_frame(AVCodecContext *avctx,
                 srcs[i] += l->rgb_stride;
         }
         break;
+    case FRAME_ARITH_RGB24:
+        avctx->pix_fmt = PIX_FMT_RGB24;
+
+        if (avctx->get_buffer(avctx, p) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+            return -1;
+        }
+        offs[0] = offset_bv;
+        offs[1] = offset_gu;
+        offs[2] = 9;
+
+        if (!l->rgb_planes) {
+            l->rgb_stride = FFALIGN(avctx->width, 16);
+            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * 3);
+            if (!l->rgb_planes) {
+                av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
+                return AVERROR(ENOMEM);
+            }
+        }
+        for (i = 0; i < 3; i++)
+            srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
+        for (i = 0; i < 3; i++)
+            lag_decode_arith_plane(l, srcs[i],
+                                   avctx->width, avctx->height,
+                                   -l->rgb_stride, buf + offs[i],
+                                   buf_size);
+        dst = p->data[0];
+        for (i = 0; i < 3; i++)
+            srcs[i] = l->rgb_planes + i * l->rgb_stride * avctx->height;
+        for (j = 0; j < avctx->height; j++) {
+            for (i = 0; i < avctx->width; i++) {
+                uint8_t r, g, b;
+                r = srcs[0][i];
+                g = srcs[1][i];
+                b = srcs[2][i];
+                dst[3*i+0] = r+g;
+                dst[3*i+1] = g;
+                dst[3*i+2] = b+g;
+            }
+            dst += p->linesize[0];
+            for (i = 0; i < 3; i++)
+                srcs[i] += l->rgb_stride;
+        }
+        break;
     case FRAME_ARITH_YV12:
         avctx->pix_fmt = PIX_FMT_YUV420P;
 

libavcodec/lcldec.c

@@ -96,7 +96,13 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign
             ofs = FFMIN(ofs, destptr - destptr_bak);
             cnt *= 4;
             cnt = FFMIN(cnt, destptr_end - destptr);
-            av_memcpy_backptr(destptr, ofs, cnt);
+            if (ofs) {
+                av_memcpy_backptr(destptr, ofs, cnt);
+            } else {
+                // Not known what the correct behaviour is, but
+                // this at least avoids uninitialized data.
+                memset(destptr, 0, cnt);
+            }
             destptr += cnt;
         }
         maskbit >>= 1;

libavcodec/libavcodec.v

@@ -25,5 +25,7 @@ LIBAVCODEC_$MAJOR {
                 ff_mmxext_idct;
                 ff_idct_xvid*;
                 ff_jpeg_fdct*;
+                #XBMC's configure checks for ff_vdpau_vc1_decode_picture()
+                ff_vdpau_vc1_decode_picture;
         local:  *;
 };

libavcodec/libgsm.c

@@ -155,7 +155,7 @@ static av_cold int libgsm_decode_init(AVCodecContext *avctx) {
         break;
     case CODEC_ID_GSM_MS: {
         int one = 1;
-        gsm_option(avctx->priv_data, GSM_OPT_WAV49, &one);
+        gsm_option(s->state, GSM_OPT_WAV49, &one);
         avctx->frame_size  = 2 * GSM_FRAME_SIZE;
         avctx->block_align = GSM_MS_BLOCK_SIZE;
         }
@@ -212,9 +212,12 @@ static int libgsm_decode_frame(AVCodecContext *avctx, void *data,
 
 static void libgsm_flush(AVCodecContext *avctx) {
     LibGSMDecodeContext *s = avctx->priv_data;
+    int one = 1;
 
     gsm_destroy(s->state);
     s->state = gsm_create();
+    if (avctx->codec_id == CODEC_ID_GSM_MS)
+        gsm_option(s->state, GSM_OPT_WAV49, &one);
 }
 
 AVCodec ff_libgsm_decoder = {

libavcodec/libopenjpegdec.c

@@ -52,9 +52,10 @@ static enum PixelFormat check_image_attributes(AVCodecContext *avctx, opj_image_
 
     switch (compRatio) {
     case 0111111: goto libopenjpeg_yuv444_rgb;
+    case 0111212: return PIX_FMT_YUV440P;
     case 0112121: goto libopenjpeg_yuv422;
     case 0112222: goto libopenjpeg_yuv420;
-    default: return PIX_FMT_RGB24;
+    default: goto libopenjpeg_rgb;
     }
 
 libopenjpeg_yuv420:
@@ -80,9 +81,25 @@ libopenjpeg_yuv444_rgb:
     case 10: return PIX_FMT_YUV444P10;
     case 16: return PIX_FMT_YUV444P16;
     }
+
+libopenjpeg_rgb:
+    switch (c0.prec) {
+    case 8: return PIX_FMT_RGB24;
+    default: return PIX_FMT_RGB48;
+    }
+
     return PIX_FMT_RGB24;
 }
 
+static int is_yuva420(opj_image_t *image)
+{
+    return image->numcomps == 4 &&
+           image->comps[0].dx == 1 && image->comps[0].dy == 1 &&
+           image->comps[1].dx == 2 && image->comps[1].dy == 2 &&
+           image->comps[2].dx == 2 && image->comps[2].dy == 2 &&
+           image->comps[3].dx == 1 && image->comps[3].dy == 1;
+}
+
 static inline int libopenjpeg_ispacked(enum PixelFormat pix_fmt) {
     int i, component_plane;
     component_plane = av_pix_fmt_descriptors[pix_fmt].comp[0].plane;
@@ -107,6 +124,24 @@ static inline void libopenjpeg_copy_to_packed8(AVFrame *picture, opj_image_t *im
     }
 }
 
+static inline void libopenjpeg_copy_to_packed16(AVFrame *picture, opj_image_t *image) {
+    uint16_t *img_ptr;
+    int index, x, y, c;
+    int adjust[4];
+    for (x = 0; x < image->numcomps; x++) {
+        adjust[x] = FFMAX(FFMIN(16 - image->comps[x].prec, 8), 0);
+    }
+    for (y = 0; y < picture->height; y++) {
+        index = y*picture->width;
+        img_ptr = (uint16_t*) (picture->data[0] + y*picture->linesize[0]);
+        for (x = 0; x < picture->width; x++, index++) {
+            for (c = 0; c < image->numcomps; c++) {
+                *img_ptr++ = image->comps[c].data[index] << adjust[c];
+            }
+        }
+    }
+}
+
 static inline void libopenjpeg_copyto8(AVFrame *picture, opj_image_t *image) {
     int *comp_data;
     uint8_t *img_ptr;
@@ -114,8 +149,8 @@ static inline void libopenjpeg_copyto8(AVFrame *picture, opj_image_t *image) {
 
     for(index = 0; index < image->numcomps; index++) {
         comp_data = image->comps[index].data;
-        img_ptr = picture->data[index];
         for(y = 0; y < image->comps[index].h; y++) {
+            img_ptr = picture->data[index] + y * picture->linesize[index];
             for(x = 0; x < image->comps[index].w; x++) {
                 *img_ptr = (uint8_t) *comp_data;
                 img_ptr++;
@@ -131,8 +166,8 @@ static inline void libopenjpeg_copyto16(AVFrame *picture, opj_image_t *image) {
     int index, x, y;
     for(index = 0; index < image->numcomps; index++) {
         comp_data = image->comps[index].data;
-        img_ptr = (uint16_t*) picture->data[index];
         for(y = 0; y < image->comps[index].h; y++) {
+            img_ptr = (uint16_t*) (picture->data[index] + y * picture->linesize[index]);
             for(x = 0; x < image->comps[index].w; x++) {
                 *img_ptr = *comp_data;
                 img_ptr++;
@@ -227,7 +262,7 @@ static int libopenjpeg_decode_frame(AVCodecContext *avctx,
              break;
     case 3:  avctx->pix_fmt = check_image_attributes(avctx, image);
              break;
-    case 4:  avctx->pix_fmt = PIX_FMT_RGBA;
+    case 4:  avctx->pix_fmt = is_yuva420(image) ? PIX_FMT_YUVA420P : PIX_FMT_RGBA;
              break;
     default: av_log(avctx, AV_LOG_ERROR, "%d components unsupported.\n", image->numcomps);
              goto done;
@@ -271,10 +306,16 @@ static int libopenjpeg_decode_frame(AVCodecContext *avctx,
         libopenjpeg_copyto16(picture, image);
         break;
     case 3:
+    case 4:
         if (ispacked) {
             libopenjpeg_copy_to_packed8(picture, image);
         }
         break;
+    case 6:
+        if (ispacked) {
+            libopenjpeg_copy_to_packed16(picture, image);
+        }
+        break;
     default:
         av_log(avctx, AV_LOG_ERROR, "unsupported pixel size %d\n", pixel_size);
         goto done;

libavcodec/libopenjpegenc.c

@@ -372,6 +372,7 @@ AVCodec ff_libopenjpeg_encoder = {
                                            PIX_FMT_YUV440P,PIX_FMT_YUV444P,
                                            PIX_FMT_YUV420P9,PIX_FMT_YUV422P9,PIX_FMT_YUV444P9,
                                            PIX_FMT_YUV420P10,PIX_FMT_YUV422P10,PIX_FMT_YUV444P10,
-                                           PIX_FMT_YUV420P16,PIX_FMT_YUV422P16,PIX_FMT_YUV444P16},
+                                           PIX_FMT_YUV420P16,PIX_FMT_YUV422P16,PIX_FMT_YUV444P16,
+                                           PIX_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("OpenJPEG based JPEG 2000 encoder"),
 } ;

libavcodec/mjpegdec.c

@@ -233,6 +233,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         return -1;
     }
 
+    if(s->lossless && s->avctx->lowres){
+        av_log(s->avctx, AV_LOG_ERROR, "lowres is not possible with lossless jpeg\n");
+        return -1;
+    }
+
     height = get_bits(&s->gb, 16);
     width = get_bits(&s->gb, 16);
 
@@ -277,7 +282,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         return -1;
     }
 
-    if(s->v_max==1 && s->h_max==1 && s->lossless==1) s->rgb=1;
+    if(s->v_max==1 && s->h_max==1 && s->lossless==1 && nb_components==3) s->rgb=1;
 
     /* if different size, realloc/alloc picture */
     /* XXX: also check h_count and v_count */
@@ -336,7 +341,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         assert(s->nb_components==3);
         break;
     case 0x11000000:
-        s->avctx->pix_fmt = PIX_FMT_GRAY8;
+        if(s->bits <= 8)
+            s->avctx->pix_fmt = PIX_FMT_GRAY8;
+        else
+            s->avctx->pix_fmt = PIX_FMT_GRAY16;
         break;
     case 0x12111100:
         s->avctx->pix_fmt = s->cs_itu601 ? PIX_FMT_YUV440P : PIX_FMT_YUVJ440P;
@@ -640,7 +648,7 @@ static int decode_block_refinement(MJpegDecodeContext *s, DCTELEM *block, uint8_
 #undef REFINE_BIT
 #undef ZERO_RUN
 
-static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point_transform){
+static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int predictor, int point_transform){
     int i, mb_x, mb_y;
     uint16_t (*buffer)[4];
     int left[3], top[3], topleft[3];
@@ -651,7 +659,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
     buffer= s->ljpeg_buffer;
 
     for(i=0; i<3; i++){
-        buffer[0][i]= 1 << (s->bits + point_transform - 1);
+        buffer[0][i]= 1 << (s->bits - 1);
     }
     for(mb_y = 0; mb_y < s->mb_height; mb_y++) {
         const int modified_predictor= mb_y ? predictor : 1;
@@ -667,16 +675,20 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
             if (s->restart_interval && !s->restart_count)
                 s->restart_count = s->restart_interval;
 
-            for(i=0;i<3;i++) {
-                int pred;
+            for(i=0;i<nb_components;i++) {
+                int pred, dc;
 
                 topleft[i]= top[i];
                 top[i]= buffer[mb_x][i];
 
                 PREDICT(pred, topleft[i], top[i], left[i], modified_predictor);
 
+                dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                if(dc == 0xFFFF)
+                    return -1;
+
                 left[i]=
-                buffer[mb_x][i]= mask & (pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform));
+                buffer[mb_x][i]= mask & (pred + (dc << point_transform));
             }
 
             if (s->restart_interval && !--s->restart_count) {
@@ -698,10 +710,11 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
                 ptr[3*mb_x+2] = buffer[mb_x][2] + ptr[3*mb_x+1];
             }
         }else{
-            for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
-                ptr[3*mb_x+0] = buffer[mb_x][2];
-                ptr[3*mb_x+1] = buffer[mb_x][1];
-                ptr[3*mb_x+2] = buffer[mb_x][0];
+            for(i=0;i<nb_components;i++) {
+                int c= s->comp_index[i];
+                for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
+                    ptr[3*mb_x+2-c] = buffer[mb_x][i];
+                }
             }
         }
     }
@@ -710,7 +723,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
 
 static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point_transform){
     int i, mb_x, mb_y;
-    const int nb_components=3;
+    const int nb_components=s->nb_components;
+    int bits= (s->bits+7)&~7;
+
+    point_transform += bits - s->bits;
+
+    av_assert0(nb_components==1 || nb_components==3);
 
     for(mb_y = 0; mb_y < s->mb_height; mb_y++) {
         for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
@@ -720,6 +738,7 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
             if(mb_x==0 || mb_y==0 || s->interlaced){
                 for(i=0;i<nb_components;i++) {
                     uint8_t *ptr;
+                    uint16_t *ptr16;
                     int n, h, v, x, y, c, j, linesize;
                     n = s->nb_blocks[i];
                     c = s->comp_index[i];
@@ -729,13 +748,19 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
                     y = 0;
                     linesize= s->linesize[c];
 
-                    for(j=0; j<n; j++) {
-                        int pred;
+                    if(bits>8) linesize /= 2;
 
+                    for(j=0; j<n; j++) {
+                        int pred, dc;
+
+                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                        if(dc == 0xFFFF)
+                            return -1;
+                        if(bits<=8){
                         ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                         if(y==0 && mb_y==0){
                             if(x==0 && mb_x==0){
-                                pred= 128 << point_transform;
+                                pred= 1 << (bits - 1);
                             }else{
                                 pred= ptr[-1];
                             }
@@ -749,8 +774,27 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
 
                         if (s->interlaced && s->bottom_field)
                             ptr += linesize >> 1;
-                        *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform);
+                        *ptr= pred + (dc << point_transform);
+                        }else{
+                            ptr16 = s->picture.data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x); //FIXME optimize this crap
+                            if(y==0 && mb_y==0){
+                                if(x==0 && mb_x==0){
+                                    pred= 1 << (bits - 1);
+                                }else{
+                                    pred= ptr16[-1];
+                                }
+                            }else{
+                                if(x==0 && mb_x==0){
+                                    pred= ptr16[-linesize];
+                                }else{
+                                    PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor);
+                                }
+                            }
 
+                            if (s->interlaced && s->bottom_field)
+                                ptr16 += linesize >> 1;
+                            *ptr16= pred + (dc << point_transform);
+                        }
                         if (++x == h) {
                             x = 0;
                             y++;
@@ -760,7 +804,8 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
             }else{
                 for(i=0;i<nb_components;i++) {
                     uint8_t *ptr;
-                    int n, h, v, x, y, c, j, linesize;
+                    uint16_t *ptr16;
+                    int n, h, v, x, y, c, j, linesize, dc;
                     n = s->nb_blocks[i];
                     c = s->comp_index[i];
                     h = s->h_scount[i];
@@ -769,12 +814,25 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
                     y = 0;
                     linesize= s->linesize[c];
 
+                    if(bits>8) linesize /= 2;
+
                     for(j=0; j<n; j++) {
                         int pred;
 
+                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                        if(dc == 0xFFFF)
+                            return -1;
+                        if(bits<=8){
                         ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                         PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor);
-                        *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform);
+
+                        *ptr= pred + (dc << point_transform);
+                        }else{
+                            ptr16 = s->picture.data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x); //FIXME optimize this crap
+                            PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor);
+
+                            *ptr16= pred + (dc << point_transform);
+                        }
                         if (++x == h) {
                             x = 0;
                             y++;
@@ -1011,7 +1069,7 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
         if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
             s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
             goto out_of_range;
-        if (!s->vlcs[0][s->dc_index[i]].table || !s->vlcs[1][s->ac_index[i]].table)
+        if (!s->vlcs[0][s->dc_index[i]].table || !(s->progressive ? s->vlcs[2][s->ac_index[0]].table : s->vlcs[1][s->ac_index[i]].table))
             goto out_of_range;
     }
 
@@ -1060,7 +1118,7 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
                 return -1;
         }else{
             if(s->rgb){
-                if(ljpeg_decode_rgb_scan(s, predictor, point_transform) < 0)
+                if(ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform) < 0)
                     return -1;
             }else{
                 if(ljpeg_decode_yuv_scan(s, predictor, point_transform) < 0)

libavcodec/mlp_parser.c

@@ -263,6 +263,9 @@ static int mlp_parse(AVCodecParserContext *s,
         mp->bytes_left = ((mp->pc.index > 0 ? mp->pc.buffer[0] : buf[0]) << 8)
                        |  (mp->pc.index > 1 ? mp->pc.buffer[1] : buf[1-mp->pc.index]);
         mp->bytes_left = (mp->bytes_left & 0xfff) * 2;
+        if (mp->bytes_left <= 0) { // prevent infinite loop
+            goto lost_sync;
+        }
         mp->bytes_left -= mp->pc.index;
     }
 

libavcodec/mlpdec.c

@@ -476,9 +476,18 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
         }
     }
     if (m->avctx->codec_id == CODEC_ID_TRUEHD &&
-        m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1) {
+        (m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1 ||
+        m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1_WIDE)) {
         FFSWAP(int, s->ch_assign[4], s->ch_assign[6]);
         FFSWAP(int, s->ch_assign[5], s->ch_assign[7]);
+    } else if (m->avctx->codec_id == CODEC_ID_TRUEHD &&
+        (m->avctx->channel_layout == AV_CH_LAYOUT_6POINT1 ||
+        m->avctx->channel_layout == (AV_CH_LAYOUT_6POINT1 | AV_CH_TOP_CENTER) ||
+        m->avctx->channel_layout == (AV_CH_LAYOUT_6POINT1 | AV_CH_TOP_FRONT_CENTER))) {
+        int i = s->ch_assign[6];
+        s->ch_assign[6] = s->ch_assign[5];
+        s->ch_assign[5] = s->ch_assign[4];
+        s->ch_assign[4] = i;
     }
 
     checksum = ff_mlp_restart_checksum(buf, get_bits_count(gbp) - start_count);

libavcodec/motion_est.c

@@ -536,8 +536,8 @@ static inline void get_limits(MpegEncContext *s, int x, int y)
     if (s->unrestricted_mv) {
         c->xmin = - x - 16;
         c->ymin = - y - 16;
-        c->xmax = - x + s->mb_width *16;
-        c->ymax = - y + s->mb_height*16;
+        c->xmax = - x + s->width;
+        c->ymax = - y + s->height;
     } else if (s->out_format == FMT_H261){
         // Search range of H261 is different from other codec standards
         c->xmin = (x > 15) ? - 15 : 0;
@@ -576,10 +576,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
     const int h=8;
     int block;
     int P[10][2];
-    int dmin_sum=0, mx4_sum=0, my4_sum=0;
+    int dmin_sum=0, mx4_sum=0, my4_sum=0, i;
     int same=1;
     const int stride= c->stride;
     uint8_t *mv_penalty= c->current_mv_penalty;
+    int saftey_cliping= s->unrestricted_mv && (s->width&15) && (s->height&15);
 
     init_mv4_ref(c);
 
@@ -591,6 +592,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
         const int mot_stride = s->b8_stride;
         const int mot_xy = s->block_index[block];
 
+        if(saftey_cliping){
+            c->xmax = - 16*s->mb_x + s->width  - 8*(block &1);
+            c->ymax = - 16*s->mb_y + s->height - 8*(block>>1);
+        }
+
         P_LEFT[0] = s->current_picture.f.motion_val[0][mot_xy - 1][0];
         P_LEFT[1] = s->current_picture.f.motion_val[0][mot_xy - 1][1];
 
@@ -618,6 +624,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
         }
         P_MV1[0]= mx;
         P_MV1[1]= my;
+        if(saftey_cliping)
+            for(i=0; i<10; i++){
+                if(P[i][0] > (c->xmax<<shift)) P[i][0]= (c->xmax<<shift);
+                if(P[i][1] > (c->ymax<<shift)) P[i][1]= (c->ymax<<shift);
+            }
 
         dmin4 = epzs_motion_search4(s, &mx4, &my4, P, block, block, s->p_mv_table, (1<<16)>>shift);
 

libavcodec/mpeg12.c

@@ -25,6 +25,8 @@
  * MPEG-1/2 decoder
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 //#define DEBUG
 #include "internal.h"
 #include "avcodec.h"
@@ -2030,6 +2032,7 @@ static int mpeg1_decode_sequence(AVCodecContext *avctx,
     s->progressive_sequence = 1;
     s->progressive_frame    = 1;
     s->picture_structure    = PICT_FRAME;
+    s->first_field          = 0;
     s->frame_pred_frame_dct = 1;
     s->chroma_format        = 1;
     s->codec_id             = s->avctx->codec_id = CODEC_ID_MPEG1VIDEO;
@@ -2089,6 +2092,7 @@ static int vcr2_init_sequence(AVCodecContext *avctx)
     s->progressive_sequence  = 1;
     s->progressive_frame     = 1;
     s->picture_structure     = PICT_FRAME;
+    s->first_field           = 0;
     s->frame_pred_frame_dct  = 1;
     s->chroma_format         = 1;
     s->codec_id              = s->avctx->codec_id = CODEC_ID_MPEG2VIDEO;

libavcodec/mpeg12enc.c

@@ -184,6 +184,7 @@ static av_cold int encode_init(AVCodecContext *avctx)
         s->tc.rate = avpriv_frame_rate_tab[s->frame_rate_index];
         if (ff_init_smtpe_timecode(s, &s->tc) < 0)
             return -1;
+        s->drop_frame_timecode = s->tc.drop;
         s->avctx->timecode_frame_start = s->tc.start;
     } else {
         s->avctx->timecode_frame_start = 0; // default is -1

libavcodec/mpeg4audio.c

@@ -82,6 +82,9 @@ int avpriv_mpeg4audio_get_config(MPEG4AudioConfig *c, const uint8_t *buf,
     GetBitContext gb;
     int specific_config_bitindex;
 
+    if(bit_size<=0)
+        return AVERROR_INVALIDDATA;
+
     init_get_bits(&gb, buf, bit_size);
     c->object_type = get_object_type(&gb);
     c->sample_rate = get_sample_rate(&gb, &c->sampling_index);

libavcodec/mpeg4video_parser.c

@@ -20,6 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "parser.h"
 #include "mpegvideo.h"
 #include "mpeg4video.h"

libavcodec/mpeg4videodec.c

@@ -20,6 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/opt.h"
 #include "mpegvideo.h"
 #include "mpeg4video.h"
@@ -158,7 +160,7 @@ static inline int mpeg4_is_resync(MpegEncContext *s){
     return 0;
 }
 
-static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb)
+static int mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb)
 {
     int i;
     int a= 2<<s->sprite_warping_accuracy;
@@ -174,6 +176,9 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
     int h= s->height;
     int min_ab;
 
+    if(w<=0 || h<=0)
+        return -1;
+
     for(i=0; i<s->num_sprite_warping_points; i++){
         int length;
         int x=0, y=0;
@@ -346,6 +351,7 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
         }
         s->real_sprite_warping_points= s->num_sprite_warping_points;
     }
+    return 0;
 }
 
 /**
@@ -409,7 +415,8 @@ int mpeg4_decode_video_packet_header(MpegEncContext *s)
             skip_bits(&s->gb, 3); /* intra dc vlc threshold */
 //FIXME don't just ignore everything
             if(s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE){
-                mpeg4_decode_sprite_trajectory(s, &s->gb);
+                if(mpeg4_decode_sprite_trajectory(s, &s->gb) < 0)
+                    return -1;
                 av_log(s->avctx, AV_LOG_ERROR, "untested\n");
             }
 
@@ -2049,7 +2056,8 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){
      }
 
      if(s->pict_type == AV_PICTURE_TYPE_S && (s->vol_sprite_usage==STATIC_SPRITE || s->vol_sprite_usage==GMC_SPRITE)){
-         mpeg4_decode_sprite_trajectory(s, gb);
+         if(mpeg4_decode_sprite_trajectory(s, gb) < 0)
+             return -1;
          if(s->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, "sprite_brightness_change not supported\n");
          if(s->vol_sprite_usage==STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, "static sprite not supported\n");
      }

libavcodec/mpegaudiodec.c

@@ -24,6 +24,8 @@
  * MPEG Audio decoder
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/audioconvert.h"
 #include "avcodec.h"
 #include "get_bits.h"

libavcodec/mpegvideo.c

@@ -1228,8 +1228,8 @@ int MPV_frame_start(MpegEncContext *s, AVCodecContext *avctx)
                 return -1;
 
             if(s->codec_id == CODEC_ID_FLV1 || s->codec_id == CODEC_ID_H263){
-                for(i=0; i<s->height; i++)
-                    memset(s->last_picture_ptr->f.data[0] + s->last_picture_ptr->f.linesize[0]*i, 16, s->width);
+                for(i=0; i<avctx->height; i++)
+                    memset(s->last_picture_ptr->f.data[0] + s->last_picture_ptr->f.linesize[0]*i, 16, avctx->width);
             }
 
             ff_thread_report_progress((AVFrame*)s->last_picture_ptr, INT_MAX, 0);

libavcodec/msrledec.c

@@ -140,7 +140,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
 
     output     = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
     output_end = pic->data[0] +  avctx->height      * pic->linesize[0];
-    while(src < data + srcsize) {
+    while(src + 1 < data + srcsize) {
         p1 = *src++;
         if(p1 == 0) { //Escape code
             p2 = *src++;
@@ -172,6 +172,10 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
                 src += p2 * (depth >> 3);
                 continue;
             }
+            if(data + srcsize - src < p2 * (depth >> 3)){
+                av_log(avctx, AV_LOG_ERROR, "Copy beyond input buffer\n");
+                return -1;
+            }
             if ((depth == 8) || (depth == 24)) {
                 for(i = 0; i < p2 * (depth >> 3); i++) {
                     *output++ = *src++;

libavcodec/msvideo1enc.c

@@ -261,6 +261,10 @@ static av_cold int encode_init(AVCodecContext *avctx)
     if (av_image_check_size(avctx->width, avctx->height, 0, avctx) < 0) {
         return -1;
     }
+    if((avctx->width&3) || (avctx->height&3)){
+        av_log(avctx, AV_LOG_ERROR, "width and height must be multiplies of 4\n");
+        return -1;
+    }
 
     avcodec_get_frame_defaults(&c->pic);
     avctx->coded_frame = (AVFrame*)&c->pic;

libavcodec/pnm.c

@@ -107,6 +107,7 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
 
         avctx->width  = w;
         avctx->height = h;
+        s->maxval     = maxval;
         if (depth == 1) {
             if (maxval == 1)
                 avctx->pix_fmt = PIX_FMT_MONOWHITE;

libavcodec/proresdec2.c

@@ -26,7 +26,7 @@
 
 //#define DEBUG
 
-#define A32_BITSTREAM_READER
+#define LONG_BITSTREAM_READER
 
 #include "avcodec.h"
 #include "get_bits.h"
@@ -325,7 +325,7 @@ static av_always_inline void decode_ac_coeffs(AVCodecContext *avctx, GetBitConte
     int log2_block_count = av_log2(blocks_per_slice);
 
     OPEN_READER(re, gb);
-
+    UPDATE_CACHE(re, gb);                                           \
     run   = 4;
     level = 2;
 
@@ -333,7 +333,7 @@ static av_always_inline void decode_ac_coeffs(AVCodecContext *avctx, GetBitConte
     block_mask = blocks_per_slice - 1;
 
     for (pos = block_mask;;) {
-        bits_left = gb->size_in_bits - (((uint8_t*)re_buffer_ptr - gb->buffer)*8 - 32 + re_bit_count);
+        bits_left = gb->size_in_bits - re_index;
         if (!bits_left || (bits_left < 32 && !SHOW_UBITS(re, gb, bits_left)))
             break;
 
@@ -443,7 +443,8 @@ static int decode_slice_thread(AVCodecContext *avctx, void *arg, int jobnr, int
     v_data_size = slice->data_size - y_data_size - u_data_size - hdr_size;
     if (hdr_size > 7) v_data_size = AV_RB16(buf + 6);
 
-    if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0) {
+    if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0
+        || hdr_size+y_data_size+u_data_size+v_data_size > slice->data_size){
         av_log(avctx, AV_LOG_ERROR, "invalid plane data size\n");
         return -1;
     }

libavcodec/proresdec_lgpl.c

@@ -28,7 +28,7 @@
  * @see http://wiki.multimedia.cx/index.php?title=Apple_ProRes
  */
 
-#define A32_BITSTREAM_READER // some ProRes vlc codes require up to 28 bits to be read at once
+#define LONG_BITSTREAM_READER // some ProRes vlc codes require up to 28 bits to be read at once
 
 #include <stdint.h>
 

libavcodec/proresenc.c

@@ -234,10 +234,10 @@ static void encode_ac_coeffs(AVCodecContext *avctx, PutBitContext *pb,
     int prev_run = 4;
     int prev_level = 2;
 
-    int run = 0, level, code;
-    for (int i = 1; i < 64; i++) {
+    int run = 0, level, code, i, j;
+    for (i = 1; i < 64; i++) {
         int indp = progressive_scan[i];
-        for (int j = 0; j < blocks_per_slice; j++) {
+        for (j = 0; j < blocks_per_slice; j++) {
             int val = QSCALE(qmat, indp, in[(j << 6) + indp]);
             if (val) {
                 encode_codeword(pb, run, run_to_cb[FFMIN(prev_run, 15)]);
@@ -441,13 +441,13 @@ static int prores_encode_picture(AVCodecContext *avctx, AVFrame *pic,
 {
     int mb_width = (avctx->width + 15) >> 4;
     int mb_height = (avctx->height + 15) >> 4;
-    int hdr_size, sl_size;
+    int hdr_size, sl_size, i;
     int mb_y, sl_data_size, qp;
     int unsafe_bot, unsafe_right;
     uint8_t *sl_data, *sl_data_sizes;
     int slice_per_line = 0, rem = mb_width;
 
-    for (int i = av_log2(DEFAULT_SLICE_MB_WIDTH); i >= 0; --i) {
+    for (i = av_log2(DEFAULT_SLICE_MB_WIDTH); i >= 0; --i) {
         slice_per_line += rem >> i;
         rem &= (1 << i) - 1;
     }

libavcodec/pthread.c

@@ -239,8 +239,10 @@ static int thread_init(AVCodecContext *avctx)
     ThreadContext *c;
     int thread_count = avctx->thread_count;
 
-    if (thread_count <= 1)
+    if (thread_count <= 1) {
+        avctx->active_thread_type = 0;
         return 0;
+    }
 
     c = av_mallocz(sizeof(ThreadContext));
     if (!c)

libavcodec/qpeg.c

@@ -32,7 +32,7 @@ typedef struct QpegContext{
     uint32_t pal[256];
 } QpegContext;
 
-static void qpeg_decode_intra(const uint8_t *src, uint8_t *dst, int size,
+static int qpeg_decode_intra(const uint8_t *src, uint8_t *dst, int size,
                             int stride, int width, int height)
 {
     int i;
@@ -94,6 +94,8 @@ static void qpeg_decode_intra(const uint8_t *src, uint8_t *dst, int size,
             }
         } else {
             size -= copy;
+            if (size<0)
+                return AVERROR_INVALIDDATA;
             for(i = 0; i < copy; i++) {
                 dst[filled++] = *src++;
                 if (filled >= width) {
@@ -106,6 +108,7 @@ static void qpeg_decode_intra(const uint8_t *src, uint8_t *dst, int size,
             }
         }
     }
+    return 0;
 }
 
 static const int qpeg_table_h[16] =
@@ -200,6 +203,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if(height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -211,6 +216,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if(height < 0)
+                        break;
                 }
             }
             size -= code + 1;
@@ -259,7 +266,7 @@ static int decode_frame(AVCodecContext *avctx,
     AVFrame * p= (AVFrame*)&a->pic;
     AVFrame * ref= (AVFrame*)&a->ref;
     uint8_t* outdata;
-    int delta;
+    int delta, ret = 0;
     const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);
 
     if(ref->data[0])
@@ -273,12 +280,15 @@ static int decode_frame(AVCodecContext *avctx,
     }
     outdata = a->pic.data[0];
     if(buf[0x85] == 0x10) {
-        qpeg_decode_intra(buf+0x86, outdata, buf_size - 0x86, a->pic.linesize[0], avctx->width, avctx->height);
+        ret = qpeg_decode_intra(buf+0x86, outdata, buf_size - 0x86, a->pic.linesize[0], avctx->width, avctx->height);
     } else {
         delta = buf[0x85];
         qpeg_decode_inter(buf+0x86, outdata, buf_size - 0x86, a->pic.linesize[0], avctx->width, avctx->height, delta, buf + 4, a->ref.data[0]);
     }
 
+    if (ret<0)
+        return ret;
+
     /* make the palette available on the way out */
     if (pal) {
         a->pic.palette_has_changed = 1;

libavcodec/ra144enc.c

@@ -477,7 +477,10 @@ static int ra144_encode_frame(AVCodecContext *avctx, uint8_t *frame,
          * The filter is unstable: use the coefficients of the previous frame.
          */
         ff_int_to_int16(block_coefs[NBLOCKS - 1], ractx->lpc_coef[1]);
-        ff_eval_refl(lpc_refl, block_coefs[NBLOCKS - 1], avctx);
+        if (ff_eval_refl(lpc_refl, block_coefs[NBLOCKS - 1], avctx)) {
+            /* the filter is still unstable. set reflection coeffs to zero. */
+            memset(lpc_refl, 0, sizeof(lpc_refl));
+        }
     }
     init_put_bits(&pb, frame, buf_size);
     for (i = 0; i < LPC_ORDER; i++) {

libavcodec/ratecontrol.c

@@ -708,7 +708,7 @@ float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
             dts_pic= s->last_picture_ptr;
 
 //if(dts_pic)
-//            av_log(NULL, AV_LOG_ERROR, "%Ld %Ld %Ld %d\n", s->current_picture_ptr->pts, s->user_specified_pts, dts_pic->pts, picture_number);
+//            av_log(NULL, AV_LOG_ERROR, "%"PRId64" %"PRId64" %"PRId64" %d\n", s->current_picture_ptr->pts, s->user_specified_pts, dts_pic->pts, picture_number);
 
         if (!dts_pic || dts_pic->f.pts == AV_NOPTS_VALUE)
             wanted_bits= (uint64_t)(s->bit_rate*(double)picture_number/fps);

libavcodec/raw.c

@@ -108,6 +108,12 @@ const PixelFormatTag ff_raw_pix_fmt_tags[] = {
     { PIX_FMT_BGR48BE,  MKTAG( 48, 'B', 'G', 'R') },
     { PIX_FMT_GRAY16LE,    MKTAG('Y', '1',  0 , 16 ) },
     { PIX_FMT_GRAY16BE,    MKTAG(16 ,  0 , '1', 'Y') },
+    { PIX_FMT_YUV420P10LE, MKTAG('Y', '3', 11 , 10 ) },
+    { PIX_FMT_YUV420P10BE, MKTAG(10 , 11 , '3', 'Y') },
+    { PIX_FMT_YUV422P10LE, MKTAG('Y', '3', 10 , 10 ) },
+    { PIX_FMT_YUV422P10BE, MKTAG(10 , 10 , '3', 'Y') },
+    { PIX_FMT_YUV444P10LE, MKTAG('Y', '3',  0 , 10 ) },
+    { PIX_FMT_YUV444P10BE, MKTAG(10 ,  0 , '3', 'Y') },
     { PIX_FMT_YUV420P16LE, MKTAG('Y', '3', 11 , 16 ) },
     { PIX_FMT_YUV420P16BE, MKTAG(16 , 11 , '3', 'Y') },
     { PIX_FMT_YUV422P16LE, MKTAG('Y', '3', 10 , 16 ) },

libavcodec/rv34.c

@@ -690,8 +690,9 @@ static inline void rv34_mc(RV34DecContext *r, const int block_type,
     srcY += src_y * s->linesize + src_x;
     srcU += uvsrc_y * s->uvlinesize + uvsrc_x;
     srcV += uvsrc_y * s->uvlinesize + uvsrc_x;
-    if(   (unsigned)(src_x - !!lx*2) > s->h_edge_pos - !!lx*2 - (width <<3) - 4
-       || (unsigned)(src_y - !!ly*2) > s->v_edge_pos - !!ly*2 - (height<<3) - 4){
+    if(s->h_edge_pos - (width << 3) < 6 || s->v_edge_pos - (height << 3) < 6 ||
+       (unsigned)(src_x - !!lx*2) > s->h_edge_pos - !!lx*2 - (width <<3) - 4 ||
+       (unsigned)(src_y - !!ly*2) > s->v_edge_pos - !!ly*2 - (height<<3) - 4) {
         uint8_t *uvbuf = s->edge_emu_buffer + 22 * s->linesize;
 
         srcY -= 2 + 2*s->linesize;

libavcodec/rv34_parser.c

@@ -76,7 +76,7 @@ static int rv34_parse(AVCodecParserContext *s,
     return buf_size;
 }
 
-#ifdef CONFIG_RV30_PARSER
+#if CONFIG_RV30_PARSER
 AVCodecParser ff_rv30_parser = {
     .codec_ids      = { CODEC_ID_RV30 },
     .priv_data_size = sizeof(RV34ParseContext),
@@ -84,7 +84,7 @@ AVCodecParser ff_rv30_parser = {
 };
 #endif
 
-#ifdef CONFIG_RV40_PARSER
+#if CONFIG_RV40_PARSER
 AVCodecParser ff_rv40_parser = {
     .codec_ids      = { CODEC_ID_RV40 },
     .priv_data_size = sizeof(RV34ParseContext),

libavcodec/shorten.c

@@ -86,6 +86,7 @@ typedef struct ShortenContext {
     int channels;
 
     int32_t *decoded[MAX_CHANNELS];
+    int32_t *decoded_base[MAX_CHANNELS];
     int32_t *offset[MAX_CHANNELS];
     int *coeffs;
     uint8_t *bitstream;
@@ -140,13 +141,13 @@ static int allocate_buffers(ShortenContext *s)
             return AVERROR(ENOMEM);
         s->offset[chan] = tmp_ptr;
 
-        tmp_ptr = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
+        tmp_ptr = av_realloc(s->decoded_base[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
         if (!tmp_ptr)
             return AVERROR(ENOMEM);
-        s->decoded[chan] = tmp_ptr;
+        s->decoded_base[chan] = tmp_ptr;
         for (i=0; i<s->nwrap; i++)
-            s->decoded[chan][i] = 0;
-        s->decoded[chan] += s->nwrap;
+            s->decoded_base[chan][i] = 0;
+        s->decoded[chan] = s->decoded_base[chan] + s->nwrap;
     }
 
     coeffs = av_realloc(s->coeffs, s->nwrap * sizeof(*s->coeffs));
@@ -204,7 +205,7 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header,
 {
     int len;
     short wave_format;
-
+    const uint8_t *end= header + header_size;
 
     if (bytestream_get_le32(&header) != MKTAG('R','I','F','F')) {
         av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n");
@@ -220,6 +221,8 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header,
 
     while (bytestream_get_le32(&header) != MKTAG('f','m','t',' ')) {
         len = bytestream_get_le32(&header);
+        if(len<0 || end - header - 8 < len)
+            return AVERROR_INVALIDDATA;
         header += len;
     }
     len = bytestream_get_le32(&header);
@@ -615,8 +618,8 @@ static av_cold int shorten_decode_close(AVCodecContext *avctx)
     int i;
 
     for (i = 0; i < s->channels; i++) {
-        s->decoded[i] -= s->nwrap;
-        av_freep(&s->decoded[i]);
+        s->decoded[i] = NULL;
+        av_freep(&s->decoded_base[i]);
         av_freep(&s->offset[i]);
     }
     av_freep(&s->bitstream);

libavcodec/smacker.c

@@ -659,10 +659,12 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
     }
     if(bits) { //decode 16-bit data
         for(i = stereo; i >= 0; i--)
-            pred[i] = av_bswap16(get_bits(&gb, 16));
+            pred[i] = sign_extend(av_bswap16(get_bits(&gb, 16)), 16);
         for(i = 0; i <= stereo; i++)
             *samples++ = pred[i];
         for(; i < unp_size / 2; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo) {
                 if(vlc[2].table)
                     res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@@ -697,6 +699,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
         for(i = 0; i <= stereo; i++)
             *samples8++ = pred[i];
         for(; i < unp_size; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo){
                 if(vlc[1].table)
                     res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);