update for 0.9.4

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Changelog

@@ -1,8 +1,11 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
-version next:
+version 0.9:
 
+- Indeo 4 decoder
+- SMJPEG demuxer
+- y41p Brooktree Uncompressed 4:1:1 12-bit encoder and decoder
 - openal input device added
 - boxblur filter added
 - BWF muxer
@@ -134,7 +137,7 @@ easier to use. The changes are:
 - new option: -report
 - Dxtory capture format decoder
 - cellauto source
-
+- v410 Quicktime Uncompressed 4:4:4 10-bit encoder and decoder
 
 version 0.8:
 

Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER         =
+PROJECT_NUMBER         = 0.9.4
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
 # base path where the generated documentation will be put.

MAINTAINERS

@@ -218,6 +218,7 @@ Codecs:
   tta.c                                 Alex Beregszaszi, Jaikrishnan Menon
   txd.c                                 Ivo van Poorten
   ulti*                                 Kostya Shishkov
+  v410*.c                               Derek Buitenhuis
   vb.c                                  Kostya Shishkov
   vble.c                                Derek Buitenhuis
   vc1*                                  Kostya Shishkov
@@ -388,6 +389,7 @@ Releases
 0.6                                     *Deprecated/Unmaintained*
 0.7                                     Michael Niedermayer
 0.8                                     Michael Niedermayer
+0.9                                     Michael Niedermayer
 
 
 

Makefile

@@ -47,7 +47,7 @@ include $(SRC_PATH)/common.mak
 FF_EXTRALIBS := $(FFEXTRALIBS)
 FF_DEP_LIBS  := $(DEP_LIBS)
 
-all: $(filter-out avconv, $(PROGS))
+all: $(PROGS)
 
 $(PROGS): %$(EXESUF): %$(PROGSSUF)_g$(EXESUF)
 	$(CP) $< $@$(PROGSSUF)

RELEASE

@@ -1 +1 @@
-0.8.7.git
+0.9.4

VERSION

@@ -0,0 +1 @@
+0.9.4

avconv.c

@@ -4361,7 +4361,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     /* parse options */
     parse_options(&o, argc, argv, options, opt_output_file);

cmdutils.c

@@ -53,7 +53,7 @@
 struct SwsContext *sws_opts;
 AVDictionary *format_opts, *codec_opts;
 
-static const int this_year = 2011;
+static const int this_year = 2014;
 
 static FILE *report_file;
 
@@ -582,8 +582,12 @@ static void print_all_libs_info(int flags, int level)
     PRINT_LIB_INFO(postproc, POSTPROC, flags, level);
 }
 
-void show_banner(void)
+void show_banner(int argc, char **argv, const OptionDef *options)
 {
+    int idx = locate_option(argc, argv, options, "version");
+    if (idx)
+        return;
+
     av_log(NULL, AV_LOG_INFO, "%s version " FFMPEG_VERSION ", Copyright (c) %d-%d the FFmpeg developers\n",
            program_name, program_birth_year, this_year);
     av_log(NULL, AV_LOG_INFO, "  built on %s %s with %s %s\n",

cmdutils.h

@@ -245,7 +245,7 @@ void print_error(const char *filename, int err);
  * current version of the repository and of the libav* libraries used by
  * the program.
  */
-void show_banner(void);
+void show_banner(int argc, char **argv, const OptionDef *options);
 
 /**
  * Print the version of the program to stdout. The version message

configure

@@ -81,7 +81,7 @@ Configuration options:
                            and binaries will be unredistributable [no]
   --disable-doc            do not build documentation
   --disable-ffmpeg         disable ffmpeg build
-  --disable-avconv         disable avconv build
+  --enable-avconv          enable  avconv build
   --disable-ffplay         disable ffplay build
   --disable-ffprobe        disable ffprobe build
   --disable-ffserver       disable ffserver build
@@ -116,6 +116,9 @@ Configuration options:
   --disable-vda            disable VDA code
   --enable-runtime-cpudetect detect cpu capabilities at runtime (bigger binary)
   --enable-hardcoded-tables use hardcoded tables instead of runtime generation
+  --disable-safe-bitstream-reader
+                           disable buffer boundary checking in bitreaders
+                           (faster, but may crash)
   --enable-memalign-hack   emulate memalign, interferes with memory debuggers
   --disable-everything     disable all components listed below
   --disable-encoder=NAME   disable encoder NAME
@@ -1055,6 +1058,7 @@ CONFIG_LIST="
     rdft
     rtpdec
     runtime_cpudetect
+    safe_bitstream_reader
     shared
     sinewin
     small
@@ -1137,6 +1141,7 @@ HAVE_LIST="
     altivec_h
     arpa_inet_h
     asm_mod_y
+    asm_types_h
     attribute_may_alias
     attribute_packed
     bswap
@@ -1152,6 +1157,7 @@ HAVE_LIST="
     dlfcn_h
     dlopen
     dos_paths
+    dxva_h
     ebp_available
     ebx_available
     exp2
@@ -1799,7 +1805,6 @@ enable debug
 enable doc
 enable fastdiv
 enable ffmpeg
-enable avconv
 enable ffplay
 enable ffprobe
 enable ffserver
@@ -1807,6 +1812,7 @@ enable network
 enable optimizations
 enable postproc
 enable protocols
+enable safe_bitstream_reader
 enable static
 enable stripping
 enable swresample
@@ -2294,7 +2300,7 @@ fi
 
 # Deal with common $arch aliases
 case "$arch" in
-    arm*)
+    arm*|iPad*)
         arch="arm"
     ;;
     mips|mipsel|IP*)
@@ -2986,6 +2992,7 @@ check_func_headers windows.h MapViewOfFile
 check_func_headers windows.h VirtualAlloc
 
 check_header dlfcn.h
+check_header dxva.h
 check_header dxva2api.h -D_WIN32_WINNT=0x0600
 check_header libcrystalhd/libcrystalhd_if.h
 check_header malloc.h
@@ -2997,6 +3004,7 @@ check_header termios.h
 check_header vdpau/vdpau.h
 check_header vdpau/vdpau_x11.h
 check_header X11/extensions/XvMClib.h
+check_header asm/types.h
 
 disabled  zlib || check_lib   zlib.h      zlibVersion -lz   || disable  zlib
 disabled bzlib || check_lib2 bzlib.h BZ2_bzlibVersion -lbz2 || disable bzlib
@@ -3285,11 +3293,13 @@ elif enabled gcc; then
     check_cflags -fno-tree-vectorize
     check_cflags -Werror=implicit-function-declaration
     check_cflags -Werror=missing-prototypes
+    check_cflags -Werror=return-type
 elif enabled llvm_gcc; then
     check_cflags -mllvm -stack-alignment=16
 elif enabled clang; then
     check_cflags -mllvm -stack-alignment=16
     check_cflags -Qunused-arguments
+    check_cflags -Werror=return-type
 elif enabled armcc; then
     # 2523: use of inline assembler is deprecated
     add_cflags -W${armcc_opt},--diag_suppress=2523
@@ -3394,6 +3404,7 @@ echo "postprocessing support    ${postproc-no}"
 echo "new filter support        ${avfilter-no}"
 echo "network support           ${network-no}"
 echo "threading support         ${thread_type-no}"
+echo "safe bitstream reader     ${safe_bitstream_reader-no}"
 echo "SDL support               ${sdl-no}"
 echo "Sun medialib support      ${mlib-no}"
 echo "libdxva2 enabled          ${dxva2-no}"

doc/APIchanges

@@ -31,6 +31,10 @@ API changes, most recent first:
 2011-10-20 - b35e9e1 - lavu 51.22.0
   Add av_strtok() to avstring.h.
 
+2011-xx-xx - xxxxxxx - lavf 53.17.0
+  Add avformat_open_input().
+  Deprecate av_close_input_file() and av_close_input_stream().
+
 2011-xx-xx - xxxxxxx - lavc 53.25.0
   Add nb_samples and extended_data fields to AVFrame.
   Deprecate AVCODEC_MAX_AUDIO_FRAME_SIZE.
@@ -44,14 +48,14 @@ API changes, most recent first:
   Change AVCodecContext.error[4] to [8] at next major bump.
   Add AV_NUM_DATA_POINTERS to simplify the bump transition.
 
-2011-11-23 - bbb46f3 - lavu 51.18.0
+2011-11-23 - 8e576d5 / bbb46f3 - lavu 51.27.0 / 51.18.0
   Add av_samples_get_buffer_size(), av_samples_fill_arrays(), and
   av_samples_alloc(), to samplefmt.h.
 
-2011-11-23 - 8889cc4 - lavu 51.17.0
+2011-11-23 - 8e576d5 / 8889cc4 - lavu 51.27.0 / 51.17.0
   Add planar sample formats and av_sample_fmt_is_planar() to samplefmt.h.
 
-2011-11-19 - f3a29b7 - lavc 53.21.0
+2011-11-19 - dbb38bc / f3a29b7 - lavc 53.36.0 / 53.21.0
   Move some AVCodecContext fields to a new private struct, AVCodecInternal,
   which is accessed from a new field, AVCodecContext.internal.
   - fields moved:
@@ -59,55 +63,55 @@ API changes, most recent first:
       AVCodecContext.internal_buffer_count --> AVCodecInternal.buffer_count
       AVCodecContext.is_copy               --> AVCodecInternal.is_copy
 
-2011-11-16 - 6270671 - lavu 51.16.0
+2011-11-16 - 8709ba9 / 6270671 - lavu 51.26.0 / 51.16.0
   Add av_timegm()
 
-2011-11-13 - lavf 53.15.0
+2011-11-13 - lavf 53.21.0 / 53.15.0
   New interrupt callback API, allowing per-AVFormatContext/AVIOContext
   interrupt callbacks.
-  6aa0b98 Add AVIOInterruptCB struct and the interrupt_callback field to
+  5f268ca / 6aa0b98 Add AVIOInterruptCB struct and the interrupt_callback field to
           AVFormatContext.
-  1dee0ac Add avio_open2() with additional parameters. Those are
+  5f268ca / 1dee0ac Add avio_open2() with additional parameters. Those are
           an interrupt callback and an options AVDictionary.
           This will allow passing AVOptions to protocols after lavf
           54.0.
 
-2011-11-06 - ba04ecf - lavu 51.14.0
+2011-11-06 - 13b7781 / ba04ecf - lavu 51.24.0 / 51.14.0
   Add av_strcasecmp() and av_strncasecmp() to avstring.h.
 
-2011-11-06 - 07b172f - lavu 51.13.0
+2011-11-06 - 13b7781 / 07b172f - lavu 51.24.0 / 51.13.0
   Add av_toupper()/av_tolower()
 
-2011-11-05 - b6d08f4 - lavf 53.13.0
+2011-11-05 - d8cab5c / b6d08f4 - lavf 53.19.0 / 53.13.0
   Add avformat_network_init()/avformat_network_uninit()
 
-2011-10-27 - 512557b - lavc 53.15.0
+2011-10-27 - 6faf0a2 / 512557b - lavc 53.24.0 / 53.15.0
   Remove avcodec_parse_frame.
   Deprecate AVCodecContext.parse_only and CODEC_CAP_PARSE_ONLY.
 
-2011-10-19 - 569129a - lavf 53.10.0
+2011-10-19 - d049257 / 569129a - lavf 53.17.0 / 53.10.0
   Add avformat_new_stream(). Deprecate av_new_stream().
 
-2011-10-13 - b631fba - lavf 53.9.0
+2011-10-13 - 91eb1b1 / b631fba - lavf 53.16.0 / 53.9.0
   Add AVFMT_NO_BYTE_SEEK AVInputFormat flag.
 
-2011-10-12 - lavu 51.12.0
+2011-10-12 - lavu 51.21.0 / 51.12.0
   AVOptions API rewrite.
 
-  - 145f741 FF_OPT_TYPE* renamed to AV_OPT_TYPE_*
+  - f884ef0 / 145f741 FF_OPT_TYPE* renamed to AV_OPT_TYPE_*
   - new setting/getting functions with slightly different semantics:
-        dac66da av_set_string3 -> av_opt_set
+        f884ef0 / dac66da av_set_string3 -> av_opt_set
                 av_set_double  -> av_opt_set_double
                 av_set_q       -> av_opt_set_q
                 av_set_int     -> av_opt_set_int
 
-        41d9d51 av_get_string  -> av_opt_get
+        f884ef0 / 41d9d51 av_get_string  -> av_opt_get
                 av_get_double  -> av_opt_get_double
                 av_get_q       -> av_opt_get_q
                 av_get_int     -> av_opt_get_int
 
-  - 8c5dcaa trivial rename av_next_option -> av_opt_next
-  - 641c7af new functions - av_opt_child_next, av_opt_child_class_next
+  - f884ef0 / 8c5dcaa trivial rename av_next_option -> av_opt_next
+  - f884ef0 / 641c7af new functions - av_opt_child_next, av_opt_child_class_next
     and av_opt_find2()
 
 2011-09-22 - a70e787 - lavu 51.17.0
@@ -153,27 +157,27 @@ API changes, most recent first:
 2011-08-20 - 69e2c1a - lavu 51.13.0
   Add av_get_media_type_string().
 
-2011-09-03 - fb4ca26 - lavc 53.13.0
+2011-09-03 - 1889c67 / fb4ca26 - lavc 53.13.0
                        lavf 53.11.0
                        lsws  2.1.0
   Add {avcodec,avformat,sws}_get_class().
 
-2011-08-03 - c11fb82 - lavu 51.15.0
+2011-08-03 - 1889c67 / c11fb82 - lavu 51.15.0
   Add AV_OPT_SEARCH_FAKE_OBJ flag for av_opt_find() function.
 
 2011-08-14 - 323b930 - lavu 51.12.0
   Add av_fifo_peek2(), deprecate av_fifo_peek().
 
-2011-08-16 - 48f9e45 - lavf 53.8.0
+2011-08-16 - 27fbe31 / 48f9e45 - lavf 53.11.0 / 53.8.0
   Add avformat_query_codec().
 
-2011-08-16 - bca06e7 - lavc 53.11.0
+2011-08-16 - 27fbe31 / bca06e7 - lavc 53.11.0
   Add avcodec_get_type().
 
-2011-08-06 - 2f63440 - lavf 53.7.0
+2011-08-06 - 0cb233c / 2f63440 - lavf 53.7.0
   Add error_recognition to AVFormatContext.
 
-2011-08-02 - 9d39cbf - lavc 53.9.1
+2011-08-02 - 1d186e9 / 9d39cbf - lavc 53.9.1
   Add AV_PKT_FLAG_CORRUPT AVPacket flag.
 
 2011-07-16 - b57df29 - lavfi 2.27.0
@@ -184,10 +188,10 @@ API changes, most recent first:
   avfilter_set_common_packing_formats()
   avfilter_all_packing_formats()
 
-2011-07-10 - a67c061 - lavf 53.6.0
+2011-07-10 - 3602ad7 / a67c061 - lavf 53.6.0
   Add avformat_find_stream_info(), deprecate av_find_stream_info().
 
-2011-07-10 - 0b950fe - lavc 53.8.0
+2011-07-10 - 3602ad7 / 0b950fe - lavc 53.8.0
   Add avcodec_open2(), deprecate avcodec_open().
 
 2011-07-01 - b442ca6 - lavf 53.5.0 - avformat.h
@@ -226,35 +230,35 @@ API changes, most recent first:
 2011-06-12 - 6119b23 - lavfi 2.16.0 - avfilter_graph_parse()
   Change avfilter_graph_parse() signature.
 
-2011-06-23 - 67e9ae1 - lavu 51.8.0 - attributes.h
+2011-06-23 - 686959e / 67e9ae1 - lavu 51.10.0 / 51.8.0 - attributes.h
   Add av_printf_format().
 
-2011-06-16 - 05e84c9, 25de595 - lavf 53.2.0 - avformat.h
+2011-06-16 - 2905e3f / 05e84c9, 2905e3f / 25de595 - lavf 53.4.0 / 53.2.0 - avformat.h
   Add avformat_open_input and avformat_write_header().
   Deprecate av_open_input_stream, av_open_input_file,
   AVFormatParameters and av_write_header.
 
-2011-06-16 - 7e83e1c, dc59ec5 - lavu 51.7.0 - opt.h
+2011-06-16 - 2905e3f / 7e83e1c, 2905e3f / dc59ec5 - lavu 51.9.0 / 51.7.0 - opt.h
   Add av_opt_set_dict() and av_opt_find().
   Deprecate av_find_opt().
   Add AV_DICT_APPEND flag.
 
-2011-06-10 - cb7c11c - lavu 51.6.0 - opt.h
+2011-06-10 - 45fb647 / cb7c11c - lavu 51.6.0 - opt.h
   Add av_opt_flag_is_set().
 
 2011-06-10 - c381960 - lavfi 2.15.0 - avfilter_get_audio_buffer_ref_from_arrays
   Add avfilter_get_audio_buffer_ref_from_arrays() to avfilter.h.
 
-2011-06-09 - d9f80ea - lavu 51.8.0 - AVMetadata
+2011-06-09 - f9ecb84 / d9f80ea - lavu 51.8.0 - AVMetadata
   Move AVMetadata from lavf to lavu and rename it to
   AVDictionary -- new installed header dict.h.
   All av_metadata_* functions renamed to av_dict_*.
 
-2011-06-07 - a6703fa - lavu 51.8.0 - av_get_bytes_per_sample()
+2011-06-07 - d552f61 / a6703fa - lavu 51.8.0 - av_get_bytes_per_sample()
   Add av_get_bytes_per_sample() in libavutil/samplefmt.h.
   Deprecate av_get_bits_per_sample_fmt().
 
-2011-06-05 - b39b062 - lavu 51.8.0 - opt.h
+2011-06-05 - f956924 / b39b062 - lavu 51.8.0 - opt.h
   Add av_opt_free convenience function.
 
 2011-06-06 - 95a0242 - lavfi 2.14.0 - AVFilterBufferRefAudioProps
@@ -284,7 +288,7 @@ API changes, most recent first:
   Add av_get_pix_fmt_name() in libavutil/pixdesc.h, and deprecate
   avcodec_get_pix_fmt_name() in libavcodec/avcodec.h in its favor.
 
-2011-05-25 - 30315a8 - lavf 53.3.0 - avformat.h
+2011-05-25 - 39e4206 / 30315a8 - lavf 53.3.0 - avformat.h
   Add fps_probe_size to AVFormatContext.
 
 2011-05-22 - 5ecdfd0 - lavf 53.2.0 - avformat.h
@@ -300,10 +304,10 @@ API changes, most recent first:
 2011-05-14 - 9fdf772 - lavfi 2.6.0 - avcodec.h
   Add avfilter_get_video_buffer_ref_from_frame() to libavfilter/avcodec.h.
 
-2011-05-18 - 64150ff - lavc 53.7.0 - AVCodecContext.request_sample_fmt
+2011-05-18 - 75a37b5 / 64150ff - lavc 53.7.0 - AVCodecContext.request_sample_fmt
   Add request_sample_fmt field to AVCodecContext.
 
-2011-05-10 - 188dea1 - lavc 53.6.0 - avcodec.h
+2011-05-10 - 59eb12f / 188dea1 - lavc 53.6.0 - avcodec.h
   Deprecate AVLPCType and the following fields in
   AVCodecContext: lpc_coeff_precision, prediction_order_method,
   min_partition_order, max_partition_order, lpc_type, lpc_passes.
@@ -333,81 +337,81 @@ API changes, most recent first:
   Add av_dynarray_add function for adding
   an element to a dynamic array.
 
-2011-04-26 - bebe72f - lavu 51.1.0 - avutil.h
+2011-04-26 - d7e5aeb / bebe72f - lavu 51.1.0 - avutil.h
   Add AVPictureType enum and av_get_picture_type_char(), deprecate
   FF_*_TYPE defines and av_get_pict_type_char() defined in
   libavcodec/avcodec.h.
 
-2011-04-26 - 10d3940 - lavfi 2.3.0 - avfilter.h
+2011-04-26 - d7e5aeb / 10d3940 - lavfi 2.3.0 - avfilter.h
   Add pict_type and key_frame fields to AVFilterBufferRefVideo.
 
-2011-04-26 - 7a11c82 - lavfi 2.2.0 - vsrc_buffer
+2011-04-26 - d7e5aeb / 7a11c82 - lavfi 2.2.0 - vsrc_buffer
   Add sample_aspect_ratio fields to vsrc_buffer arguments
 
-2011-04-21 - 94f7451 - lavc 53.1.0 - avcodec.h
+2011-04-21 - 8772156 / 94f7451 - lavc 53.1.0 - avcodec.h
   Add CODEC_CAP_SLICE_THREADS for codecs supporting sliced threading.
 
 2011-04-15 - lavc 52.120.0 - avcodec.h
   AVPacket structure got additional members for passing side information:
-    4de339e introduce side information for AVPacket
-    2d8591c make containers pass palette change in AVPacket
+    c407984 / 4de339e introduce side information for AVPacket
+    c407984 / 2d8591c make containers pass palette change in AVPacket
 
 2011-04-12 - lavf 52.107.0 - avio.h
   Avio cleanup, part II - deprecate the entire URLContext API:
-    175389c add avio_check as a replacement for url_exist
-    ff1ec0c add avio_pause and avio_seek_time as replacements
+    c55780d / 175389c add avio_check as a replacement for url_exist
+    9891004 / ff1ec0c add avio_pause and avio_seek_time as replacements
             for _av_url_read_fseek/fpause
-    cdc6a87 deprecate av_protocol_next(), avio_enum_protocols
+    d4d0932 / cdc6a87 deprecate av_protocol_next(), avio_enum_protocols
             should be used instead.
-    80c6e23 rename url_set_interrupt_cb->avio_set_interrupt_cb.
-    f87b1b3 rename open flags: URL_* -> AVIO_*
-    f8270bb add avio_enum_protocols.
-    5593f03 deprecate URLProtocol.
-    c486dad deprecate URLContext.
-    026e175 deprecate the typedef for URLInterruptCB
-    8e76a19 deprecate av_register_protocol2.
-    b840484 deprecate URL_PROTOCOL_FLAG_NESTED_SCHEME
-    1305d93 deprecate av_url_read_seek
-    fa104e1 deprecate av_url_read_pause
-    727c7aa deprecate url_get_filename().
-    5958df3 deprecate url_max_packet_size().
-    1869ea0 deprecate url_get_file_handle().
-    32a97d4 deprecate url_filesize().
-    e52a914 deprecate url_close().
-    58a48c6 deprecate url_seek().
-    925e908 deprecate url_write().
-    dce3756 deprecate url_read_complete().
-    bc371ac deprecate url_read().
-    0589da0 deprecate url_open().
-    62eaaea deprecate url_connect.
-    5652bb9 deprecate url_alloc.
-    333e894 deprecate url_open_protocol
-    e230705 deprecate url_poll and URLPollEntry
+    c88caa5 / 80c6e23 rename url_set_interrupt_cb->avio_set_interrupt_cb.
+    c88caa5 / f87b1b3 rename open flags: URL_* -> AVIO_*
+    d4d0932 / f8270bb add avio_enum_protocols.
+    d4d0932 / 5593f03 deprecate URLProtocol.
+    d4d0932 / c486dad deprecate URLContext.
+    d4d0932 / 026e175 deprecate the typedef for URLInterruptCB
+    c88caa5 / 8e76a19 deprecate av_register_protocol2.
+    11d7841 / b840484 deprecate URL_PROTOCOL_FLAG_NESTED_SCHEME
+    11d7841 / 1305d93 deprecate av_url_read_seek
+    11d7841 / fa104e1 deprecate av_url_read_pause
+    434f248 / 727c7aa deprecate url_get_filename().
+    434f248 / 5958df3 deprecate url_max_packet_size().
+    434f248 / 1869ea0 deprecate url_get_file_handle().
+    434f248 / 32a97d4 deprecate url_filesize().
+    434f248 / e52a914 deprecate url_close().
+    434f248 / 58a48c6 deprecate url_seek().
+    434f248 / 925e908 deprecate url_write().
+    434f248 / dce3756 deprecate url_read_complete().
+    434f248 / bc371ac deprecate url_read().
+    434f248 / 0589da0 deprecate url_open().
+    434f248 / 62eaaea deprecate url_connect.
+    434f248 / 5652bb9 deprecate url_alloc.
+    434f248 / 333e894 deprecate url_open_protocol
+    434f248 / e230705 deprecate url_poll and URLPollEntry
 
 2011-04-08 - lavf 52.106.0 - avformat.h
   Minor avformat.h cleanup:
-    a9bf9d8 deprecate av_guess_image2_codec
-    c3675df rename avf_sdp_create->av_sdp_create
+    d4d0932 / a9bf9d8 deprecate av_guess_image2_codec
+    d4d0932 / c3675df rename avf_sdp_create->av_sdp_create
 
 2011-04-03 - lavf 52.105.0 - avio.h
   Large-scale renaming/deprecating of AVIOContext-related functions:
-    724f6a0 deprecate url_fdopen
-    403ee83 deprecate url_open_dyn_packet_buf
-    6dc7d80 rename url_close_dyn_buf       -> avio_close_dyn_buf
-    b92c545 rename url_open_dyn_buf        -> avio_open_dyn_buf
-    8978fed introduce an AVIOContext.seekable field as a replacement for
+    2cae980 / 724f6a0 deprecate url_fdopen
+    2cae980 / 403ee83 deprecate url_open_dyn_packet_buf
+    2cae980 / 6dc7d80 rename url_close_dyn_buf       -> avio_close_dyn_buf
+    2cae980 / b92c545 rename url_open_dyn_buf        -> avio_open_dyn_buf
+    2cae980 / 8978fed introduce an AVIOContext.seekable field as a replacement for
             AVIOContext.is_streamed and url_is_streamed()
-    b64030f deprecate get_checksum()
-    4c4427a deprecate init_checksum()
-    4ec153b deprecate udp_set_remote_url/get_local_port
-    933e90a deprecate av_url_read_fseek/fpause
-    8d9769a deprecate url_fileno
-    b7f2fdd rename put_flush_packet -> avio_flush
-    35f1023 deprecate url_close_buf
-    83fddae deprecate url_open_buf
-    d9d86e0 rename url_fprintf -> avio_printf
-    59f65d9 deprecate url_setbufsize
-    3e68b3b deprecate url_ferror
+    1caa412 / b64030f deprecate get_checksum()
+    1caa412 / 4c4427a deprecate init_checksum()
+    2fd41c9 / 4ec153b deprecate udp_set_remote_url/get_local_port
+    4fa0e24 / 933e90a deprecate av_url_read_fseek/fpause
+    4fa0e24 / 8d9769a deprecate url_fileno
+    0fecf26 / b7f2fdd rename put_flush_packet -> avio_flush
+    0fecf26 / 35f1023 deprecate url_close_buf
+    0fecf26 / 83fddae deprecate url_open_buf
+    0fecf26 / d9d86e0 rename url_fprintf -> avio_printf
+    0fecf26 / 59f65d9 deprecate url_setbufsize
+    6947b0c / 3e68b3b deprecate url_ferror
     e8bb2e2 deprecate url_fget_max_packet_size
     76aa876 rename url_fsize -> avio_size
     e519753 deprecate url_fgetc
@@ -428,7 +432,7 @@ API changes, most recent first:
     b3db9ce deprecate get_partial_buffer
     8d9ac96 rename av_alloc_put_byte -> avio_alloc_context
 
-2011-03-25 - 34b47d7 - lavc 52.115.0 - AVCodecContext.audio_service_type
+2011-03-25 - 27ef7b1 / 34b47d7 - lavc 52.115.0 - AVCodecContext.audio_service_type
   Add audio_service_type field to AVCodecContext.
 
 2011-03-17 - e309fdc - lavu 50.40.0 - pixfmt.h
@@ -466,11 +470,11 @@ API changes, most recent first:
 2011-02-10 - 12c14cd - lavf 52.99.0 - AVStream.disposition
   Add AV_DISPOSITION_HEARING_IMPAIRED and AV_DISPOSITION_VISUAL_IMPAIRED.
 
-2011-02-09 - 5592734 - lavc 52.112.0 - avcodec_thread_init()
+2011-02-09 - c0b102c - lavc 52.112.0 - avcodec_thread_init()
   Deprecate avcodec_thread_init()/avcodec_thread_free() use; instead
   set thread_count before calling avcodec_open.
 
-2011-02-09 - 778b08a - lavc 52.111.0 - threading API
+2011-02-09 - 37b00b4 - lavc 52.111.0 - threading API
   Add CODEC_CAP_FRAME_THREADS with new restrictions on get_buffer()/
   release_buffer()/draw_horiz_band() callbacks for appropriate codecs.
   Add thread_type and active_thread_type fields to AVCodecContext.

doc/RELEASE_NOTES

@@ -1,65 +1,17 @@
 Release Notes
 =============
 
-* 0.8 "Love"  June, 2011
-* 0.7 "Peace" June, 2011 (identical to 0.8 but using 0.6 ABI/API)
+* 0.9 "Harmony"  December, 2011
 
 
 General notes
 -------------
 
-This release enables frame-based multithreaded decoding for a number of codecs,
-including theora, huffyuv, VP8, H.263, mpeg4 and H.264. Additionally, there has
-been a major cleanup of
-both internal and external APIs. For this reason, the major versions of all
-libraries except libpostproc have been bumped. This means that 0.8 can be installed
-side-by-side with previous releases, on the other hand applications need to be
-recompiled to use 0.8.
-
-Other important changes are more than 200 bugfixes, known regressions were fixed
-w.r.t 0.5 and 0.6, additions of decoders including, but not limited to,
-AMR-WB, single stream LATM/LOAS, G.722 ADPCM, a native VP8 decoder
-and HE-AACv2. Additionally, many new de/muxers such as WebM in Matroska, Apple
-HTTP Live Streaming, SAP, IEC 61937 (S/PDIF) have been added.
-
-See the Changelog file for a list of significant changes.
+See the Changelog file for a list of significant changes. Note, there
+are many more new features and bugfixes than whats listed there.
 
 Bugreports against FFmpeg git master or the most recent FFmpeg release are
 accepted. If you are experiencing issues with any formally released version of
 FFmpeg, please try git master to check if the issue still exists. If it does,
 make your report against the development code following the usual bug reporting
 guidelines.
-
-Note, if you have difficulty building for mingw, try --disable-outdev=sdl
-
-
-API changes
------------
-
-Please see git log of the public headers or the file doc/APIchanges for
-programmer-centric information. Note that some long-time deprecated APIs have
-been removed. Also, a number of additional APIs have been deprecated and might
-be removed in the next release.
-
-
-Other notable changes
----------------------
-
-- high quality dithering in swscale to fix banding issues
-- ffmpeg is now interactive and various information can be turned on/off while its running
-- resolution changing support in ffmpeg
-- sdl output device
-- optimizations in libavfilter that make it much faster
-- split, buffer, select, lut, negate filters amongth others
-- more than 50 new video filters from mplayers libmpcodecs
-- many ARM NEON optimizations
-- nonfree libfaad support for AAC decoding removed
-- 4:4:4 H.264 decoding
-- 9/10bit H.264 decoding
-- Win64 Assembler support
-- native MMSH/MMST support
-- Windows TV demuxing
-- native AMR-WB decoding
-- native GSM-MS decoding
-- SMPTE 302M decoding
-- AVS encoding

doc/errno.txt

@@ -0,0 +1,174 @@
+The following table lists most error codes found in various operating
+systems supported by FFmpeg.
+
+                             OS
+Code             Std    F  LBMWwb Text (YMMV)
+
+E2BIG            POSIX     ++++++  Argument list too long
+EACCES           POSIX     ++++++  Permission denied
+EADDRINUSE       POSIX     +++..+  Address in use
+EADDRNOTAVAIL    POSIX     +++..+  Cannot assign requested address
+EADV                       +.....  Advertise error
+EAFNOSUPPORT     POSIX     +++..+  Address family not supported
+EAGAIN           POSIX  +  ++++++  Resource temporarily unavailable
+EALREADY         POSIX     +++..+  Operation already in progress
+EAUTH                      .++...  Authentication error
+EBADARCH                   ..+...  Bad CPU type in executable
+EBADE                      +.....  Invalid exchange
+EBADEXEC                   ..+...  Bad executable
+EBADF            POSIX     ++++++  Bad file descriptor
+EBADFD                     +.....  File descriptor in bad state
+EBADMACHO                  ..+...  Malformed Macho file
+EBADMSG          POSIX     ++4...  Bad message
+EBADR                      +.....  Invalid request descriptor
+EBADRPC                    .++...  RPC struct is bad
+EBADRQC                    +.....  Invalid request code
+EBADSLT                    +.....  Invalid slot
+EBFONT                     +.....  Bad font file format
+EBUSY            POSIX  -  ++++++  Device or resource busy
+ECANCELED        POSIX     +++...  Operation canceled
+ECHILD           POSIX     ++++++  No child processes
+ECHRNG                     +.....  Channel number out of range
+ECOMM                      +.....  Communication error on send
+ECONNABORTED     POSIX     +++..+  Software caused connection abort
+ECONNREFUSED     POSIX  -  +++ss+  Connection refused
+ECONNRESET       POSIX     +++..+  Connection reset
+EDEADLK          POSIX     ++++++  Resource deadlock avoided
+EDEADLOCK                  +..++.  File locking deadlock error
+EDESTADDRREQ     POSIX     +++...  Destination address required
+EDEVERR                    ..+...  Device error
+EDOM             C89    -  ++++++  Numerical argument out of domain
+EDOOFUS                    .F....  Programming error
+EDOTDOT                    +.....  RFS specific error
+EDQUOT           POSIX     +++...  Disc quota exceeded
+EEXIST           POSIX     ++++++  File exists
+EFAULT           POSIX  -  ++++++  Bad address
+EFBIG            POSIX  -  ++++++  File too large
+EFTYPE                     .++...  Inappropriate file type or format
+EHOSTDOWN                  +++...  Host is down
+EHOSTUNREACH     POSIX     +++..+  No route to host
+EHWPOISON                  +.....  Memory page has hardware error
+EIDRM            POSIX     +++...  Identifier removed
+EILSEQ           C99       ++++++  Illegal byte sequence
+EINPROGRESS      POSIX  -  +++ss+  Operation in progress
+EINTR            POSIX  -  ++++++  Interrupted system call
+EINVAL           POSIX  +  ++++++  Invalid argument
+EIO              POSIX  +  ++++++  I/O error
+EISCONN          POSIX     +++..+  Socket is already connected
+EISDIR           POSIX     ++++++  Is a directory
+EISNAM                     +.....  Is a named type file
+EKEYEXPIRED                +.....  Key has expired
+EKEYREJECTED               +.....  Key was rejected by service
+EKEYREVOKED                +.....  Key has been revoked
+EL2HLT                     +.....  Level 2 halted
+EL2NSYNC                   +.....  Level 2 not synchronized
+EL3HLT                     +.....  Level 3 halted
+EL3RST                     +.....  Level 3 reset
+ELIBACC                    +.....  Can not access a needed shared library
+ELIBBAD                    +.....  Accessing a corrupted shared library
+ELIBEXEC                   +.....  Cannot exec a shared library directly
+ELIBMAX                    +.....  Too many shared libraries
+ELIBSCN                    +.....  .lib section in a.out corrupted
+ELNRNG                     +.....  Link number out of range
+ELOOP            POSIX     +++..+  Too many levels of symbolic links
+EMEDIUMTYPE                +.....  Wrong medium type
+EMFILE           POSIX     ++++++  Too many open files
+EMLINK           POSIX     ++++++  Too many links
+EMSGSIZE         POSIX     +++..+  Message too long
+EMULTIHOP        POSIX     ++4...  Multihop attempted
+ENAMETOOLONG     POSIX  -  ++++++  Filen ame too long
+ENAVAIL                    +.....  No XENIX semaphores available
+ENEEDAUTH                  .++...  Need authenticator
+ENETDOWN         POSIX     +++..+  Network is down
+ENETRESET        SUSv3     +++..+  Network dropped connection on reset
+ENETUNREACH      POSIX     +++..+  Network unreachable
+ENFILE           POSIX     ++++++  Too many open files in system
+ENOANO                     +.....  No anode
+ENOATTR                    .++...  Attribute not found
+ENOBUFS          POSIX  -  +++..+  No buffer space available
+ENOCSI                     +.....  No CSI structure available
+ENODATA          XSR       +N4...  No message available
+ENODEV           POSIX  -  ++++++  No such device
+ENOENT           POSIX  -  ++++++  No such file or directory
+ENOEXEC          POSIX     ++++++  Exec format error
+ENOFILE                    ...++.  No such file or directory
+ENOKEY                     +.....  Required key not available
+ENOLCK           POSIX     ++++++  No locks available
+ENOLINK          POSIX     ++4...  Link has been severed
+ENOMEDIUM                  +.....  No medium found
+ENOMEM           POSIX     ++++++  Not enough space
+ENOMSG           POSIX     +++..+  No message of desired type
+ENONET                     +.....  Machine is not on the network
+ENOPKG                     +.....  Package not installed
+ENOPROTOOPT      POSIX     +++..+  Protocol not available
+ENOSPC           POSIX     ++++++  No space left on device
+ENOSR            XSR       +N4...  No STREAM resources
+ENOSTR           XSR       +N4...  Not a STREAM
+ENOSYS           POSIX  +  ++++++  Function not implemented
+ENOTBLK                    +++...  Block device required
+ENOTCONN         POSIX     +++..+  Socket is not connected
+ENOTDIR          POSIX     ++++++  Not a directory
+ENOTEMPTY        POSIX     ++++++  Directory not empty
+ENOTNAM                    +.....  Not a XENIX named type file
+ENOTRECOVERABLE  SUSv4  -  +.....  State not recoverable
+ENOTSOCK         POSIX     +++..+  Socket operation on non-socket
+ENOTSUP          POSIX     +++...  Operation not supported
+ENOTTY           POSIX     ++++++  Inappropriate I/O control operation
+ENOTUNIQ                   +.....  Name not unique on network
+ENXIO            POSIX     ++++++  No such device or address
+EOPNOTSUPP       POSIX     +++..+  Operation not supported (on socket)
+EOVERFLOW        POSIX     +++..+  Value too large to be stored in data type
+EOWNERDEAD       SUSv4     +.....  Owner died
+EPERM            POSIX  -  ++++++  Operation not permitted
+EPFNOSUPPORT               +++..+  Protocol family not supported
+EPIPE            POSIX  -  ++++++  Broken pipe
+EPROCLIM                   .++...  Too many processes
+EPROCUNAVAIL               .++...  Bad procedure for program
+EPROGMISMATCH              .++...  Program version wrong
+EPROGUNAVAIL               .++...  RPC prog. not avail
+EPROTO           POSIX     ++4...  Protocol error
+EPROTONOSUPPORT  POSIX  -  +++ss+  Protocol not supported
+EPROTOTYPE       POSIX     +++..+  Protocol wrong type for socket
+EPWROFF                    ..+...  Device power is off
+ERANGE           C89    -  ++++++  Result too large
+EREMCHG                    +.....  Remote address changed
+EREMOTE                    +++...  Object is remote
+EREMOTEIO                  +.....  Remote I/O error
+ERESTART                   +.....  Interrupted system call should be restarted
+ERFKILL                    +.....  Operation not possible due to RF-kill
+EROFS            POSIX     ++++++  Read-only file system
+ERPCMISMATCH               .++...  RPC version wrong
+ESHLIBVERS                 ..+...  Shared library version mismatch
+ESHUTDOWN                  +++..+  Cannot send after socket shutdown
+ESOCKTNOSUPPORT            +++...  Socket type not supported
+ESPIPE           POSIX     ++++++  Illegal seek
+ESRCH            POSIX     ++++++  No such process
+ESRMNT                     +.....  Srmount error
+ESTALE           POSIX     +++..+  Stale NFS file handle
+ESTRPIPE                   +.....  Streams pipe error
+ETIME            XSR       +N4...  Stream ioctl timeout
+ETIMEDOUT        POSIX  -  +++ss+  Connection timed out
+ETOOMANYREFS               +++...  Too many references: cannot splice
+ETXTBSY          POSIX     +++...  Text file busy
+EUCLEAN                    +.....  Structure needs cleaning
+EUNATCH                    +.....  Protocol driver not attached
+EUSERS                     +++...  Too many users
+EWOULDBLOCK      POSIX     +++..+  Operation would block
+EXDEV            POSIX     ++++++  Cross-device link
+EXFULL                     +.....  Exchange full
+
+Notations:
+
+F: used in FFmpeg (-: a few times, +: a lot)
+
+SUSv3: Single Unix Specification, version 3
+SUSv4: Single Unix Specification, version 4
+XSR: XSI STREAMS (obsolete)
+
+OS: availability on some supported operating systems
+L: GNU/Linux
+B: BSD (F: FreeBSD, N: NetBSD)
+M: MacOS X
+W: Microsoft Windows (s: emulated with winsock, see libavformat/network.h)
+w: Mingw32 (3.17) and Mingw64 (2.0.1)
+b: BeOS

doc/examples/decoding_encoding.c

@@ -180,6 +180,8 @@ static void audio_decode_example(const char *outfilename, const char *filename)
         }
         avpkt.size -= len;
         avpkt.data += len;
+        avpkt.dts =
+        avpkt.pts = AV_NOPTS_VALUE;
         if (avpkt.size < AUDIO_REFILL_THRESH) {
             /* Refill the input buffer, to avoid trying to decode
              * incomplete frames. Instead of this, one could also use

doc/ffmpeg.texi

@@ -407,6 +407,10 @@ prefix is ``ffmpeg2pass''. The complete file name will be
 @file{PREFIX-N.log}, where N is a number specific to the output
 stream
 
+Note that this option is overwritten by a local option of the same name
+when using @code{-vcodec libx264}. That option maps to the x264 option stats
+which has a different syntax.
+
 @item -vlang @var{code}
 Set the ISO 639 language code (3 letters) of the current video stream.
 

doc/ffplay.texi

@@ -168,6 +168,9 @@ Seek backward/forward 10 seconds.
 @item down/up
 Seek backward/forward 1 minute.
 
+@item page down/page up
+Seek backward/forward 10 minutes.
+
 @item mouse click
 Seek to percentage in file corresponding to fraction of width.
 

doc/general.texi

@@ -316,6 +316,7 @@ library:
     @tab Used in Sierra CD-ROM games.
 @item Smacker                   @tab   @tab X
     @tab Multimedia format used by many games.
+@item SMJPEG                    @tab   @tab X
 @item Sony OpenMG (OMA)         @tab   @tab X
     @tab Audio format used in Sony Sonic Stage and Sony Vegas.
 @item Sony PlayStation STR      @tab   @tab X
@@ -442,6 +443,7 @@ following image formats are supported:
     @tab Used in some games from Bethesda Softworks.
 @item Bink Video             @tab     @tab  X
 @item Bitmap Brothers JV video  @tab   @tab X
+@item y41p Brooktree uncompressed 4:1:1 12-bit     @tab  X  @tab  X
 @item Brute Force & Ignorance   @tab   @tab X
     @tab Used in the game Flash Traffic: City of Angels.
 @item C93 video              @tab     @tab  X
@@ -511,6 +513,7 @@ following image formats are supported:
 @item Intel H.263            @tab     @tab  X
 @item Intel Indeo 2          @tab     @tab  X
 @item Intel Indeo 3          @tab     @tab  X
+@item Intel Indeo 4          @tab     @tab  X
 @item Intel Indeo 5          @tab     @tab  X
 @item Interplay C93          @tab     @tab  X
     @tab Used in the game Cyberia from Interplay.
@@ -602,6 +605,7 @@ following image formats are supported:
     @tab Codec used in DOS CD-ROM FlashBack game.
 @item Ut Video               @tab     @tab  X
 @item V210 Quicktime Uncompressed 4:2:2 10-bit     @tab  X  @tab  X
+@item v410 Quicktime Uncompressed 4:4:4 10-bit     @tab  X  @tab  X
 @item VBLE Lossless Codec    @tab     @tab  X
 @item VMware Screen Codec / VMware Video  @tab     @tab  X
     @tab Codec used in videos captured by VMware.

doc/issue_tracker.txt

@@ -24,7 +24,7 @@ a mail for every change to every issue.
 The subscription URL for the ffmpeg-trac list is:
 http(s)://ffmpeg.org/mailman/listinfo/ffmpeg-trac
 The URL of the webinterface of the tracker is:
-http(s)://ffmpeg.org/trac/ffmpeg
+http(s)://trac.ffmpeg.org
 
 Type:
 -----

ffmpeg.c

@@ -549,6 +549,8 @@ static void sigterm_handler(int sig)
     received_sigterm = sig;
     received_nb_signals++;
     term_exit();
+    if(received_nb_signals > 3)
+        exit(123);
 }
 
 static void term_init(void)
@@ -1902,7 +1904,10 @@ static int transcode_video(InputStream *ist, AVPacket *pkt, int *got_output, int
                 *frame_sample_aspect = ist->st->sample_aspect_ratio;
             decoded_frame->pts = ist->pts;
 
-            av_vsrc_buffer_add_frame(ost->input_video_filter, decoded_frame, AV_VSRC_BUF_FLAG_OVERWRITE);
+            if((av_vsrc_buffer_add_frame(ost->input_video_filter, decoded_frame, AV_VSRC_BUF_FLAG_OVERWRITE)) < 0){
+                av_log(0, AV_LOG_FATAL, "Failed to inject frame into filter network\n");
+                exit_program(1);
+            }
         }
     }
 #endif
@@ -2047,6 +2052,10 @@ static int output_packet(InputStream *ist,
 
         if (ret < 0)
             return ret;
+
+        avpkt.dts=
+        avpkt.pts= AV_NOPTS_VALUE;
+
         // touch data and size only if not EOF
         if (pkt) {
             if(ist->st->codec->codec_type != AVMEDIA_TYPE_AUDIO)
@@ -3293,6 +3302,7 @@ static void assert_file_overwrite(const char *filename)
                 fprintf(stderr,"File '%s' already exists. Overwrite ? [y/N] ", filename);
                 fflush(stderr);
                 term_exit();
+                signal(SIGINT, SIG_DFL);
                 if (!read_yesno()) {
                     av_log(0, AV_LOG_FATAL, "Not overwriting - exiting\n");
                     exit_program(1);
@@ -3769,9 +3779,11 @@ static OutputStream *new_video_stream(OptionsContext *o, AVFormatContext *oc)
         if (do_pass) {
             if (do_pass & 1) {
                 video_enc->flags |= CODEC_FLAG_PASS1;
+                av_dict_set(&ost->opts, "flags", "+pass1", AV_DICT_APPEND);
             }
             if (do_pass & 2) {
                 video_enc->flags |= CODEC_FLAG_PASS2;
+                av_dict_set(&ost->opts, "flags", "+pass2", AV_DICT_APPEND);
             }
         }
 
@@ -3962,6 +3974,7 @@ static int read_ffserver_streams(OptionsContext *o, AVFormatContext *s, const ch
         ost   = new_output_stream(o, s, codec->type);
         st    = ost->st;
         avctx = st->codec;
+        ost->enc = codec;
 
         // FIXME: a more elegant solution is needed
         memcpy(st, ic->streams[i], sizeof(AVStream));
@@ -4826,7 +4839,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     term_init();
 

ffplay.c

@@ -922,7 +922,7 @@ static void do_exit(VideoState *is)
     exit(0);
 }
 
-static int video_open(VideoState *is){
+static int video_open(VideoState *is, int force_set_video_mode){
     int flags = SDL_HWSURFACE|SDL_ASYNCBLIT|SDL_HWACCEL;
     int w,h;
 
@@ -949,7 +949,7 @@ static int video_open(VideoState *is){
         h = 480;
     }
     if(screen && is->width == screen->w && screen->w == w
-       && is->height== screen->h && screen->h == h)
+       && is->height== screen->h && screen->h == h && !force_set_video_mode)
         return 0;
     screen = SDL_SetVideoMode(w, h, 0, flags);
     if (!screen) {
@@ -970,7 +970,7 @@ static int video_open(VideoState *is){
 static void video_display(VideoState *is)
 {
     if(!screen)
-        video_open(is);
+        video_open(is, 0);
     if (is->audio_st && is->show_mode != SHOW_MODE_VIDEO)
         video_audio_display(is);
     else if (is->video_st)
@@ -2043,7 +2043,8 @@ static int audio_decode_frame(VideoState *is, double *pts_ptr)
     AVPacket *pkt = &is->audio_pkt;
     AVCodecContext *dec= is->audio_st->codec;
     int len1, len2, data_size, resampled_data_size;
-    int64_t dec_channel_layout, got_frame;
+    int64_t dec_channel_layout;
+    int got_frame;
     double pts;
     int new_packet = 0;
     int flush_complete = 0;
@@ -2144,6 +2145,7 @@ static int audio_decode_frame(VideoState *is, double *pts_ptr)
         /* free the current packet */
         if (pkt->data)
             av_free_packet(pkt);
+        memset(pkt_temp, 0, sizeof(*pkt_temp));
 
         if (is->paused || is->audioq.abort_request) {
             return -1;
@@ -2776,14 +2778,15 @@ static void stream_cycle_channel(VideoState *is, int codec_type)
 
 static void toggle_full_screen(VideoState *is)
 {
+    int i;
     is_full_screen = !is_full_screen;
 #if defined(__APPLE__) && SDL_VERSION_ATLEAST(1, 2, 14)
     /* OS X needs to reallocate the SDL overlays */
-    for (int i = 0; i < VIDEO_PICTURE_QUEUE_SIZE; i++) {
+    for (i = 0; i < VIDEO_PICTURE_QUEUE_SIZE; i++) {
         is->pictq[i].reallocate = 1;
     }
 #endif
-    video_open(is);
+    video_open(is, 1);
 }
 
 static void toggle_pause(VideoState *is)
@@ -2852,6 +2855,12 @@ static void event_loop(VideoState *cur_stream)
             case SDLK_w:
                 toggle_audio_display(cur_stream);
                 break;
+            case SDLK_PAGEUP:
+                incr = 600.0;
+                goto do_seek;
+            case SDLK_PAGEDOWN:
+                incr = -600.0;
+                goto do_seek;
             case SDLK_LEFT:
                 incr = -10.0;
                 goto do_seek;
@@ -2935,7 +2944,7 @@ static void event_loop(VideoState *cur_stream)
             do_exit(cur_stream);
             break;
         case FF_ALLOC_EVENT:
-            video_open(event.user.data1);
+            video_open(event.user.data1, 0);
             alloc_picture(event.user.data1);
             break;
         case FF_REFRESH_EVENT:
@@ -3121,6 +3130,7 @@ static int opt_help(const char *opt, const char *arg)
            "s                   activate frame-step mode\n"
            "left/right          seek backward/forward 10 seconds\n"
            "down/up             seek backward/forward 1 minute\n"
+           "page down/page up   seek backward/forward 10 minutes\n"
            "mouse click         seek to percentage in file corresponding to fraction of width\n"
            );
     return 0;
@@ -3167,7 +3177,7 @@ int main(int argc, char **argv)
 
     init_opts();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     parse_options(NULL, argc, argv, options, opt_input_file);
 

ffprobe.c

@@ -1252,7 +1252,7 @@ int main(int argc, char **argv)
     avdevice_register_all();
 #endif
 
-    show_banner();
+    show_banner(argc, argv, options);
     parse_options(NULL, argc, argv, options, opt_input_file);
 
     if (!input_filename) {

ffserver.c

@@ -4674,7 +4674,7 @@ int main(int argc, char **argv)
     av_register_all();
     avformat_network_init();
 
-    show_banner();
+    show_banner(argc, argv, options);
 
     my_program_name = argv[0];
     my_program_dir = getcwd(0, 0);

libavcodec/4xm.c

@@ -459,6 +459,11 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
 static int decode_i_block(FourXContext *f, DCTELEM *block){
     int code, i, j, level, val;
 
+    if(get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
+        return -1;
+    }
+
     /* DC coef */
     val = get_vlc2(&f->pre_gb, f->pre_vlc.table, ACDC_VLC_BITS, 3);
     if (val>>4){

libavcodec/Makefile

@@ -207,6 +207,7 @@ OBJS-$(CONFIG_IFF_ILBM_DECODER)        += iff.o
 OBJS-$(CONFIG_IMC_DECODER)             += imc.o
 OBJS-$(CONFIG_INDEO2_DECODER)          += indeo2.o
 OBJS-$(CONFIG_INDEO3_DECODER)          += indeo3.o
+OBJS-$(CONFIG_INDEO4_DECODER)          += indeo4.o ivi_common.o ivi_dsp.o
 OBJS-$(CONFIG_INDEO5_DECODER)          += indeo5.o ivi_common.o ivi_dsp.o
 OBJS-$(CONFIG_INTERPLAY_DPCM_DECODER)  += dpcm.o
 OBJS-$(CONFIG_INTERPLAY_VIDEO_DECODER) += interplayvideo.o
@@ -413,6 +414,8 @@ OBJS-$(CONFIG_ULTI_DECODER)            += ulti.o
 OBJS-$(CONFIG_UTVIDEO_DECODER)         += utvideo.o
 OBJS-$(CONFIG_V210_DECODER)            += v210dec.o
 OBJS-$(CONFIG_V210_ENCODER)            += v210enc.o
+OBJS-$(CONFIG_V410_DECODER)            += v410dec.o
+OBJS-$(CONFIG_V410_ENCODER)            += v410enc.o
 OBJS-$(CONFIG_V210X_DECODER)           += v210x.o
 OBJS-$(CONFIG_VB_DECODER)              += vb.o
 OBJS-$(CONFIG_VBLE_DECODER)            += vble.o
@@ -463,6 +466,8 @@ OBJS-$(CONFIG_XBIN_DECODER)            += bintext.o cga_data.o
 OBJS-$(CONFIG_XL_DECODER)              += xl.o
 OBJS-$(CONFIG_XSUB_DECODER)            += xsubdec.o
 OBJS-$(CONFIG_XSUB_ENCODER)            += xsubenc.o
+OBJS-$(CONFIG_Y41P_DECODER)            += y41pdec.o
+OBJS-$(CONFIG_Y41P_ENCODER)            += y41penc.o
 OBJS-$(CONFIG_YOP_DECODER)             += yop.o
 OBJS-$(CONFIG_ZLIB_DECODER)            += lcldec.o
 OBJS-$(CONFIG_ZLIB_ENCODER)            += lclenc.o

libavcodec/aac.h

@@ -300,6 +300,7 @@ typedef struct {
     DECLARE_ALIGNED(32, float, temp)[128];
 
     enum OCStatus output_configured;
+    int warned_num_aac_frames;
 } AACContext;
 
 #endif /* AVCODEC_AAC_H */

libavcodec/aacdec.c

@@ -819,10 +819,10 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120],
                 av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n");
                 return -1;
             }
-            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
+            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1 && get_bits_left(gb) >= bits)
                 sect_end += sect_len_incr;
             sect_end += sect_len_incr;
-            if (get_bits_left(gb) < 0) {
+            if (get_bits_left(gb) < 0 || sect_len_incr == (1 << bits) - 1) {
                 av_log(ac->avctx, AV_LOG_ERROR, overread_err);
                 return -1;
             }
@@ -2125,13 +2125,14 @@ static int parse_adts_frame_header(AACContext *ac, GetBitContext *gb)
         }
         if (!ac->avctx->sample_rate)
             ac->avctx->sample_rate = hdr_info.sample_rate;
-        if (hdr_info.num_aac_frames == 1) {
-            if (!hdr_info.crc_absent)
-                skip_bits(gb, 16);
-        } else {
+        if (!ac->warned_num_aac_frames && hdr_info.num_aac_frames != 1) {
+            // This is 2 for "VLB " audio in NSV files.
+            // See samples/nsv/vlb_audio.
             av_log_missing_feature(ac->avctx, "More than one AAC RDB per ADTS frame is", 0);
-            return -1;
+            ac->warned_num_aac_frames = 1;
         }
+        if (!hdr_info.crc_absent)
+            skip_bits(gb, 16);
     }
     return size;
 }

libavcodec/aacsbr.c

@@ -1187,7 +1187,7 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct,
     const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us;
     float *v;
     for (i = 0; i < 32; i++) {
-        if (*v_off == 0) {
+        if (*v_off < 128 >> div) {
             int saved_samples = (1280 - 128) >> div;
             memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float));
             *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div);

libavcodec/aasc.c

@@ -79,8 +79,13 @@ static int aasc_decode_frame(AVCodecContext *avctx,
     case 0:
         stride = (avctx->width * 3 + 3) & ~3;
         for(i = avctx->height - 1; i >= 0; i--){
+            if(avctx->width*3 > buf_size){
+                av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n");
+                break;
+            }
             memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3);
             buf += stride;
+            buf_size -= stride;
         }
         break;
     case 1:

libavcodec/ac3dec.c

@@ -1371,7 +1371,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data,
         if (s->frame_size > buf_size) {
             av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
             err = AAC_AC3_PARSE_ERROR_FRAME_SIZE;
-        } else if (avctx->err_recognition & AV_EF_CRCCHECK) {
+        } else if (avctx->err_recognition & (AV_EF_CRCCHECK|AV_EF_CAREFUL)) {
             /* check for crc mismatch */
             if (av_crc(av_crc_get_table(AV_CRC_16_ANSI), 0, &buf[2],
                        s->frame_size - 2)) {

libavcodec/acelp_vectors.c

@@ -237,6 +237,7 @@ void ff_set_fixed_vector(float *out, const AMRFixed *in, float scale, int size)
         int x   = in->x[i], repeats = !((in->no_repeat_mask >> i) & 1);
         float y = in->y[i] * scale;
 
+        if (in->pitch_lag > 0)
         do {
             out[x] += y;
             y *= in->pitch_fac;
@@ -252,6 +253,7 @@ void ff_clear_fixed_vector(float *out, const AMRFixed *in, int size)
     for (i=0; i < in->n; i++) {
         int x  = in->x[i], repeats = !((in->no_repeat_mask >> i) & 1);
 
+        if (in->pitch_lag > 0)
         do {
             out[x] = 0.0;
             x += in->pitch_lag;

libavcodec/adpcm.c

@@ -101,8 +101,9 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
         max_channels = 6;
         break;
     }
-    if(avctx->channels > max_channels){
-        return -1;
+    if (avctx->channels <= 0 || avctx->channels > max_channels) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
+        return AVERROR(EINVAL);
     }
 
     switch(avctx->codec->id) {
@@ -817,6 +818,9 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         /* Each EA ADPCM frame has a 12-byte header followed by 30-byte pieces,
            each coding 28 stereo samples. */
 
+        if(avctx->channels != 2)
+            return AVERROR_INVALIDDATA;
+
         src += 4; // skip sample count (already read)
 
         current_left_sample   = (int16_t)bytestream_get_le16(&src);
@@ -1003,11 +1007,15 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
         break;
     case CODEC_ID_ADPCM_IMA_AMV:
     case CODEC_ID_ADPCM_IMA_SMJPEG:
-        c->status[0].predictor = (int16_t)bytestream_get_le16(&src);
-        c->status[0].step_index = bytestream_get_le16(&src);
-
-        if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV)
-            src+=4;
+        if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) {
+            c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16);
+            c->status[0].step_index = bytestream_get_le16(&src);
+            src += 4;
+        } else {
+            c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16);
+            c->status[0].step_index = bytestream_get_byte(&src);
+            src += 1;
+        }
 
         for (n = nb_samples >> (1 - st); n > 0; n--, src++) {
             char hi, lo;

libavcodec/adx_parser.c

@@ -22,7 +22,7 @@
  * @file
  * ADX audio parser
  *
- * Reads header to extradata and splits packets into individual blocks.
+ * Splits packets into individual blocks.
  */
 
 #include "libavutil/intreadwrite.h"
@@ -33,11 +33,9 @@ typedef struct ADXParseContext {
     ParseContext pc;
     int header_size;
     int block_size;
-    int buf_pos;
+    int remaining;
 } ADXParseContext;
 
-#define MIN_HEADER_SIZE 24
-
 static int adx_parse(AVCodecParserContext *s1,
                            AVCodecContext *avctx,
                            const uint8_t **poutbuf, int *poutbuf_size,
@@ -46,45 +44,32 @@ static int adx_parse(AVCodecParserContext *s1,
     ADXParseContext *s = s1->priv_data;
     ParseContext *pc = &s->pc;
     int next = END_NOT_FOUND;
+    int i;
+    uint64_t state= pc->state64;
 
-    if (!avctx->extradata_size) {
-        int ret;
-
-        ff_combine_frame(pc, END_NOT_FOUND, &buf, &buf_size);
-
-        if (!s->header_size && pc->index >= MIN_HEADER_SIZE) {
-            if (ret = avpriv_adx_decode_header(avctx, pc->buffer, pc->index,
-                                               &s->header_size, NULL))
-                return AVERROR_INVALIDDATA;
-            s->block_size = BLOCK_SIZE * avctx->channels;
+    if(!s->header_size){
+        for(i=0; i<buf_size; i++){
+            state= (state<<8) | buf[i];
+            if((state&0xFFFF0000FFFFFF00) == 0x8000000003120400ULL && (state&0xFF) && ((state>>32)&0xFFFF)>=4){
+                s->header_size= ((state>>32)&0xFFFF) + 4;
+                s->block_size = BLOCK_SIZE * (state&0xFF);
+                s->remaining  = i - 7 + s->header_size + s->block_size;
+                break;
+            }
         }
-        if (s->header_size && s->header_size <= pc->index) {
-            avctx->extradata = av_mallocz(s->header_size + FF_INPUT_BUFFER_PADDING_SIZE);
-            if (!avctx->extradata)
-                return AVERROR(ENOMEM);
-            avctx->extradata_size = s->header_size;
-            memcpy(avctx->extradata, pc->buffer, s->header_size);
-            memmove(pc->buffer, pc->buffer + s->header_size, s->header_size);
-            pc->index -= s->header_size;
-        }
-        *poutbuf      = NULL;
-        *poutbuf_size = 0;
-        return buf_size;
+        pc->state64= state;
     }
 
-    if (pc->index - s->buf_pos >= s->block_size) {
-        *poutbuf      = &pc->buffer[s->buf_pos];
-        *poutbuf_size = s->block_size;
-        s->buf_pos   += s->block_size;
-        return 0;
+    if (s->header_size) {
+        if (!s->remaining) {
+            s->remaining = s->block_size;
+        }
+        if (s->remaining<=buf_size) {
+            next= s->remaining;
+            s->remaining = 0;
+        } else
+            s->remaining -= buf_size;
     }
-    if (pc->index && s->buf_pos) {
-        memmove(pc->buffer, &pc->buffer[s->buf_pos], pc->index - s->buf_pos);
-        pc->index -= s->buf_pos;
-        s->buf_pos = 0;
-    }
-    if (buf_size + pc->index >= s->block_size)
-        next = s->block_size - pc->index;
 
     if (ff_combine_frame(pc, next, &buf, &buf_size) < 0 || !buf_size) {
         *poutbuf      = NULL;

libavcodec/adxdec.c

@@ -38,16 +38,15 @@ static av_cold int adx_decode_init(AVCodecContext *avctx)
     ADXContext *c = avctx->priv_data;
     int ret, header_size;
 
-    if (avctx->extradata_size < 24)
-        return AVERROR_INVALIDDATA;
-
-    if ((ret = avpriv_adx_decode_header(avctx, avctx->extradata,
-                                        avctx->extradata_size, &header_size,
-                                        c->coeff)) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
-        return AVERROR_INVALIDDATA;
+    if (avctx->extradata_size >= 24) {
+        if ((ret = avpriv_adx_decode_header(avctx, avctx->extradata,
+                                            avctx->extradata_size, &header_size,
+                                            c->coeff)) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
+            return AVERROR_INVALIDDATA;
+        }
+        c->channels = avctx->channels;
     }
-    c->channels = avctx->channels;
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
@@ -107,6 +106,23 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data,
         return buf_size;
     }
 
+    if(AV_RB16(buf) == 0x8000){
+        int header_size;
+        if ((ret = avpriv_adx_decode_header(avctx, buf,
+                                            buf_size, &header_size,
+                                            c->coeff)) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "error parsing ADX header\n");
+            return AVERROR_INVALIDDATA;
+        }
+        c->channels = avctx->channels;
+        if(buf_size < header_size)
+            return AVERROR_INVALIDDATA;
+        buf += header_size;
+        buf_size -= header_size;
+    }
+    if(c->channels <= 0)
+        return AVERROR_INVALIDDATA;
+
     /* calculate number of blocks in the packet */
     num_blocks = buf_size / (BLOCK_SIZE * c->channels);
 

libavcodec/alac.c

@@ -112,7 +112,7 @@ static inline int decode_scalar(GetBitContext *gb, int k, int limit, int readsam
     return x;
 }
 
-static void bastardized_rice_decompress(ALACContext *alac,
+static int bastardized_rice_decompress(ALACContext *alac,
                                  int32_t *output_buffer,
                                  int output_size,
                                  int readsamplesize, /* arg_10 */
@@ -134,6 +134,9 @@ static void bastardized_rice_decompress(ALACContext *alac,
         /* standard rice encoding */
         int k; /* size of extra bits */
 
+        if(get_bits_left(&alac->gb) <= 0)
+            return -1;
+
         /* read k, that is bits as is */
         k = av_log2((history >> 9) + 3);
         x= decode_scalar(&alac->gb, k, rice_kmodifier, readsamplesize);
@@ -179,6 +182,7 @@ static void bastardized_rice_decompress(ALACContext *alac,
             history = 0;
         }
     }
+    return 0;
 }
 
 static inline int sign_only(int v)
@@ -442,12 +446,14 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
 
         if (alac->extra_bits) {
             for (i = 0; i < outputsamples; i++) {
+                if(get_bits_left(&alac->gb) <= 0)
+                    return -1;
                 for (ch = 0; ch < channels; ch++)
                     alac->extra_bits_buffer[ch][i] = get_bits(&alac->gb, alac->extra_bits);
             }
         }
         for (ch = 0; ch < channels; ch++) {
-            bastardized_rice_decompress(alac,
+            int ret = bastardized_rice_decompress(alac,
                                         alac->predicterror_buffer[ch],
                                         outputsamples,
                                         readsamplesize,
@@ -455,6 +461,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
                                         alac->setinfo_rice_kmodifier,
                                         ricemodifier[ch] * alac->setinfo_rice_historymult / 4,
                                         (1 << alac->setinfo_rice_kmodifier) - 1);
+            if(ret<0)
+                return ret;
 
             if (prediction_type[ch] == 0) {
                 /* adaptive fir */
@@ -478,6 +486,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
     } else {
         /* not compressed, easy case */
         for (i = 0; i < outputsamples; i++) {
+            if(get_bits_left(&alac->gb) <= 0)
+                return -1;
             for (ch = 0; ch < channels; ch++) {
                 alac->outputsamples_buffer[ch][i] = get_sbits_long(&alac->gb,
                                                                    alac->setinfo_sample_size);

libavcodec/alacenc.c

@@ -259,7 +259,7 @@ static void alac_linear_predictor(AlacEncodeContext *s, int ch)
         // generate warm-up samples
         residual[0] = samples[0];
         for (i = 1; i <= lpc.lpc_order; i++)
-            residual[i] = samples[i] - samples[i-1];
+            residual[i] = sign_extend(samples[i] - samples[i-1], s->write_sample_size);
 
         // perform lpc on remaining samples
         for (i = lpc.lpc_order + 1; i < s->avctx->frame_size; i++) {

libavcodec/allcodecs.c

@@ -133,6 +133,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (IFF_ILBM, iff_ilbm);
     REGISTER_DECODER (INDEO2, indeo2);
     REGISTER_DECODER (INDEO3, indeo3);
+    REGISTER_DECODER (INDEO4, indeo4);
     REGISTER_DECODER (INDEO5, indeo5);
     REGISTER_DECODER (INTERPLAY_VIDEO, interplay_video);
     REGISTER_ENCDEC  (JPEG2000, jpeg2000);
@@ -215,6 +216,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (UTVIDEO, utvideo);
     REGISTER_ENCDEC  (V210,  v210);
     REGISTER_DECODER (V210X, v210x);
+    REGISTER_ENCDEC  (V410, v410);
     REGISTER_DECODER (VB, vb);
     REGISTER_DECODER (VBLE, vble);
     REGISTER_DECODER (VC1, vc1);
@@ -241,6 +243,7 @@ void avcodec_register_all(void)
     REGISTER_DECODER (XAN_WC3, xan_wc3);
     REGISTER_DECODER (XAN_WC4, xan_wc4);
     REGISTER_DECODER (XL, xl);
+    REGISTER_ENCDEC  (Y41P, y41p);
     REGISTER_DECODER (YOP, yop);
     REGISTER_ENCDEC  (ZLIB, zlib);
     REGISTER_ENCDEC  (ZMBV, zmbv);

libavcodec/alsdec.c

@@ -1012,7 +1012,7 @@ static void zero_remaining(unsigned int b, unsigned int b_max,
     unsigned int count = 0;
 
     while (b < b_max)
-        count += div_blocks[b];
+        count += div_blocks[b++];
 
     if (count)
         memset(buf, 0, sizeof(*buf) * count);

libavcodec/arm/int_neon.S

@@ -66,10 +66,10 @@ function ff_scalarproduct_int16_neon, export=1
 
 3:      vpadd.s32       d16, d0,   d1
         vpadd.s32       d17, d2,   d3
-        vpadd.s32       d10, d4,   d5
-        vpadd.s32       d11, d6,   d7
+        vpadd.s32       d18, d4,   d5
+        vpadd.s32       d19, d6,   d7
         vpadd.s32       d0,  d16,  d17
-        vpadd.s32       d1,  d10,  d11
+        vpadd.s32       d1,  d18,  d19
         vpadd.s32       d2,  d0,   d1
         vpaddl.s32      d3,  d2
         vmov.32         r0,  d3[0]
@@ -106,10 +106,10 @@ function ff_scalarproduct_and_madd_int16_neon, export=1
 
         vpadd.s32       d16, d0,   d1
         vpadd.s32       d17, d2,   d3
-        vpadd.s32       d10, d4,   d5
-        vpadd.s32       d11, d6,   d7
+        vpadd.s32       d18, d4,   d5
+        vpadd.s32       d19, d6,   d7
         vpadd.s32       d0,  d16,  d17
-        vpadd.s32       d1,  d10,  d11
+        vpadd.s32       d1,  d18,  d19
         vpadd.s32       d2,  d0,   d1
         vpaddl.s32      d3,  d2
         vmov.32         r0,  d3[0]

libavcodec/ass_split.c

@@ -366,7 +366,7 @@ int ff_ass_split_override_codes(const ASSCodesCallbacks *callbacks, void *priv,
     char new_line[2];
     int text_len = 0;
 
-    while (*buf) {
+    while (buf && *buf) {
         if (text && callbacks->text &&
             (sscanf(buf, "\\%1[nN]", new_line) == 1 ||
              !strncmp(buf, "{\\", 2))) {

libavcodec/atrac3.c

@@ -402,6 +402,8 @@ static int decodeTonalComponents (GetBitContext *gb, tonal_component *pComponent
 
             for (k=0; k<coded_components; k++) {
                 sfIndx = get_bits(gb,6);
+                if(component_count>=64)
+                    return AVERROR_INVALIDDATA;
                 pComponent[component_count].pos = j * 64 + (get_bits(gb,6));
                 max_coded_values = SAMPLES_PER_FRAME - pComponent[component_count].pos;
                 coded_values = coded_values_per_component + 1;

libavcodec/avcodec.h

@@ -254,6 +254,8 @@ enum CodecID {
     CODEC_ID_BMV_VIDEO,
     CODEC_ID_VBLE,
     CODEC_ID_DXTORY,
+    CODEC_ID_V410,
+    CODEC_ID_Y41P       = MKBETAG('Y','4','1','P'),
     CODEC_ID_UTVIDEO = 0x800,
     CODEC_ID_ESCAPE130  = MKBETAG('E','1','3','0'),
 
@@ -789,6 +791,10 @@ typedef struct RcOverride{
  * Codec supports slice-based (or partition-based) multithreading.
  */
 #define CODEC_CAP_SLICE_THREADS    0x2000
+/**
+ * Codec supports changed parameters at any point.
+ */
+#define CODEC_CAP_PARAM_CHANGE     0x4000
 /**
  * Codec is lossless.
  */
@@ -875,6 +881,8 @@ typedef struct AVPanScan{
 
 enum AVPacketSideDataType {
     AV_PKT_DATA_PALETTE,
+    AV_PKT_DATA_NEW_EXTRADATA,
+    AV_PKT_DATA_PARAM_CHANGE,
 };
 
 typedef struct AVPacket {
@@ -943,6 +951,27 @@ typedef struct AVPacket {
 #define AV_PKT_FLAG_KEY     0x0001 ///< The packet contains a keyframe
 #define AV_PKT_FLAG_CORRUPT 0x0002 ///< The packet content is corrupted
 
+/**
+ * An AV_PKT_DATA_PARAM_CHANGE side data packet is laid out as follows:
+ * u32le param_flags
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT)
+ *     s32le channel_count
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT)
+ *     u64le channel_layout
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE)
+ *     s32le sample_rate
+ * if (param_flags & AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS)
+ *     s32le width
+ *     s32le height
+ */
+
+enum AVSideDataParamChangeFlags {
+    AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT  = 0x0001,
+    AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT = 0x0002,
+    AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE    = 0x0004,
+    AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS     = 0x0008,
+};
+
 /**
  * Audio Video Frame.
  * New fields can be added to the end of AVFRAME with minor version

libavcodec/bmp.c

@@ -206,7 +206,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
     dsize = buf_size - hsize;
 
     /* Line size in file multiple of 4 */
-    n = ((avctx->width * depth) / 8 + 3) & ~3;
+    n = ((avctx->width * depth + 31) / 8) & ~3;
 
     if(n * avctx->height > dsize && comp != BMP_RLE4 && comp != BMP_RLE8){
         av_log(avctx, AV_LOG_ERROR, "not enough data (%d < %d)\n",

libavcodec/bmv.c

@@ -285,12 +285,17 @@ static av_cold int decode_end(AVCodecContext *avctx)
     return 0;
 }
 
+typedef struct BMVAudioDecContext {
+    AVFrame frame;
+} BMVAudioDecContext;
+
 static const int bmv_aud_mults[16] = {
     16512, 8256, 4128, 2064, 1032, 516, 258, 192, 129, 88, 64, 56, 48, 40, 36, 32
 };
 
 static av_cold int bmv_aud_decode_init(AVCodecContext *avctx)
 {
+    BMVAudioDecContext *c = avctx->priv_data;
 
     if (avctx->channels != 2) {
         av_log(avctx, AV_LOG_INFO, "invalid number of channels\n");
@@ -299,17 +304,21 @@ static av_cold int bmv_aud_decode_init(AVCodecContext *avctx)
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
+    avcodec_get_frame_defaults(&c->frame);
+    avctx->coded_frame = &c->frame;
+
     return 0;
 }
 
-static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
-                                AVPacket *avpkt)
+static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data,
+                                int *got_frame_ptr, AVPacket *avpkt)
 {
+    BMVAudioDecContext *c = avctx->priv_data;
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     int blocks = 0, total_blocks, i;
-    int out_size;
-    int16_t *output_samples = data;
+    int ret;
+    int16_t *output_samples;
     int scale[2];
 
     total_blocks = *buf++;
@@ -318,11 +327,14 @@ static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
                total_blocks * 65 + 1, buf_size);
         return AVERROR_INVALIDDATA;
     }
-    out_size = total_blocks * 64 * sizeof(*output_samples);
-    if (*data_size < out_size) {
-        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
-        return AVERROR(EINVAL);
+
+    /* get output buffer */
+    c->frame.nb_samples = total_blocks * 32;
+    if ((ret = avctx->get_buffer(avctx, &c->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return ret;
     }
+    output_samples = (int16_t *)c->frame.data[0];
 
     for (blocks = 0; blocks < total_blocks; blocks++) {
         uint8_t code = *buf++;
@@ -335,7 +347,9 @@ static int bmv_aud_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
         }
     }
 
-    *data_size = out_size;
+    *got_frame_ptr   = 1;
+    *(AVFrame *)data = c->frame;
+
     return buf_size;
 }
 
@@ -354,7 +368,9 @@ AVCodec ff_bmv_audio_decoder = {
     .name           = "bmv_audio",
     .type           = AVMEDIA_TYPE_AUDIO,
     .id             = CODEC_ID_BMV_AUDIO,
+    .priv_data_size = sizeof(BMVAudioDecContext),
     .init           = bmv_aud_decode_init,
     .decode         = bmv_aud_decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name      = NULL_IF_CONFIG_SMALL("Discworld II BMV audio"),
 };

libavcodec/bytestream.h

@@ -26,6 +26,10 @@
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 
+typedef struct {
+    const uint8_t *buffer, *buffer_end;
+} GetByteContext;
+
 #define DEF_T(type, name, bytes, read, write)                             \
 static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
     (*b) += bytes;\
@@ -34,6 +38,18 @@ static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
 static av_always_inline void bytestream_put_ ##name(uint8_t **b, const type value){\
     write(*b, value);\
     (*b) += bytes;\
+}\
+static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)\
+{\
+    if (g->buffer_end - g->buffer < bytes)\
+        return 0;\
+    return bytestream_get_ ## name(&g->buffer);\
+}\
+static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)\
+{\
+    if (g->buffer_end - g->buffer < bytes)\
+        return 0;\
+    return read(g->buffer);\
 }
 
 #define DEF(name, bytes, read, write) \
@@ -55,6 +71,34 @@ DEF  (byte, 1, AV_RB8 , AV_WB8 )
 #undef DEF64
 #undef DEF_T
 
+static av_always_inline void bytestream2_init(GetByteContext *g,
+                                              const uint8_t *buf, int buf_size)
+{
+    g->buffer =  buf;
+    g->buffer_end = buf + buf_size;
+}
+
+static av_always_inline unsigned int bytestream2_get_bytes_left(GetByteContext *g)
+{
+    return g->buffer_end - g->buffer;
+}
+
+static av_always_inline void bytestream2_skip(GetByteContext *g,
+                                              unsigned int size)
+{
+    g->buffer += FFMIN(g->buffer_end - g->buffer, size);
+}
+
+static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
+                                                            uint8_t *dst,
+                                                            unsigned int size)
+{
+    int size2 = FFMIN(g->buffer_end - g->buffer, size);
+    memcpy(dst, g->buffer, size2);
+    g->buffer += size2;
+    return size2;
+}
+
 static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b, uint8_t *dst, unsigned int size)
 {
     memcpy(dst, *b, size);

libavcodec/cljr.c

@@ -61,7 +61,12 @@ static int decode_frame(AVCodecContext *avctx,
     if (p->data[0])
         avctx->release_buffer(avctx, p);
 
-    if (buf_size / avctx->height < avctx->width) {
+    if (avctx->height <= 0 || avctx->width <= 0) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid width or height\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    if (buf_size < avctx->height * avctx->width) {
         av_log(avctx, AV_LOG_ERROR,
                "Resolution larger than buffer size. Invalid header?\n");
         return AVERROR_INVALIDDATA;
@@ -82,10 +87,10 @@ static int decode_frame(AVCodecContext *avctx,
         uint8_t *cb   = &a->picture.data[1][y * a->picture.linesize[1]];
         uint8_t *cr   = &a->picture.data[2][y * a->picture.linesize[2]];
         for (x = 0; x < avctx->width; x += 4) {
-            luma[3] = get_bits(&gb, 5) << 3;
-            luma[2] = get_bits(&gb, 5) << 3;
-            luma[1] = get_bits(&gb, 5) << 3;
-            luma[0] = get_bits(&gb, 5) << 3;
+            luma[3] = (get_bits(&gb, 5)*33) >> 2;
+            luma[2] = (get_bits(&gb, 5)*33) >> 2;
+            luma[1] = (get_bits(&gb, 5)*33) >> 2;
+            luma[0] = (get_bits(&gb, 5)*33) >> 2;
             luma += 4;
             *(cb++) = get_bits(&gb, 6) << 2;
             *(cr++) = get_bits(&gb, 6) << 2;
@@ -156,13 +161,13 @@ static int encode_frame(AVCodecContext *avctx, unsigned char *buf,
             case 1: dither = dither * 1664525 + 1013904223;    break;
             case 2: dither = ordered_dither[ y&1 ][ (x>>2)&1 ];break;
             }
-            put_bits(&pb, 5, (luma[3] +  (dither>>29)   ) >> 3);
-            put_bits(&pb, 5, (luma[2] + ((dither>>26)&7)) >> 3);
-            put_bits(&pb, 5, (luma[1] + ((dither>>23)&7)) >> 3);
-            put_bits(&pb, 5, (luma[0] + ((dither>>20)&7)) >> 3);
+            put_bits(&pb, 5, (249*(luma[3] +  (dither>>29)   )) >> 11);
+            put_bits(&pb, 5, (249*(luma[2] + ((dither>>26)&7))) >> 11);
+            put_bits(&pb, 5, (249*(luma[1] + ((dither>>23)&7))) >> 11);
+            put_bits(&pb, 5, (249*(luma[0] + ((dither>>20)&7))) >> 11);
             luma += 4;
-            put_bits(&pb, 6, (*(cb++) + ((dither>>18)&3)) >> 2);
-            put_bits(&pb, 6, (*(cr++) + ((dither>>16)&3)) >> 2);
+            put_bits(&pb, 6, (253*(*(cb++) + ((dither>>18)&3))) >> 10);
+            put_bits(&pb, 6, (253*(*(cr++) + ((dither>>16)&3))) >> 10);
         }
     }
 

libavcodec/dnxhdenc.c

@@ -220,7 +220,7 @@ static int dnxhd_init_qmat(DNXHDEncContext *ctx, int lbias, int cbias)
 
 static int dnxhd_init_rc(DNXHDEncContext *ctx)
 {
-    FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_rc, 8160*ctx->m.avctx->qmax*sizeof(RCEntry), fail);
+    FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_rc, 8160*(ctx->m.avctx->qmax + 1)*sizeof(RCEntry), fail);
     if (ctx->m.avctx->mb_decision != FF_MB_DECISION_RD)
         FF_ALLOCZ_OR_GOTO(ctx->m.avctx, ctx->mb_cmp, ctx->m.mb_num*sizeof(RCCMPEntry), fail);
 

libavcodec/dpcm.c

@@ -288,7 +288,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
     }
     case CODEC_ID_SOL_DPCM:
         if (avctx->codec_tag != 3) {
-            uint8_t *output_samples_u8 = data;
+            uint8_t *output_samples_u8 = output_samples;
             while (buf < buf_end) {
                 uint8_t n = *buf++;
 

libavcodec/dsputil.c

@@ -1918,7 +1918,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){
 
 static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
     long i;
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src+i);
         long b = *(long*)(dst+i);
         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
@@ -1943,7 +1943,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
         }
     }else
 #endif
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src1+i);
         long b = *(long*)(src2+i);
         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);

libavcodec/dv.c

@@ -37,7 +37,7 @@
  * @file
  * DV codec.
  */
-#define ALT_BITSTREAM_READER
+
 #include "libavutil/pixdesc.h"
 #include "avcodec.h"
 #include "dsputil.h"

libavcodec/dxva2_internal.h

@@ -25,7 +25,14 @@
 
 #define _WIN32_WINNT 0x0600
 #define COBJMACROS
+
+#include "config.h"
+
 #include "dxva2.h"
+#if HAVE_DXVA_H
+#include <dxva.h>
+#endif
+
 #include "avcodec.h"
 #include "mpegvideo.h"
 

libavcodec/eamad.c

@@ -119,7 +119,7 @@ static inline void idct_put(MadContext *t, DCTELEM *block, int mb_x, int mb_y, i
     }
 }
 
-static inline void decode_block_intra(MadContext * t, DCTELEM * block)
+static inline int decode_block_intra(MadContext * t, DCTELEM * block)
 {
     MpegEncContext *s = &t->s;
     int level, i, j, run;
@@ -170,13 +170,14 @@ static inline void decode_block_intra(MadContext * t, DCTELEM * block)
             }
             if (i > 63) {
                 av_log(s->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
-                return;
+                return -1;
             }
 
             block[j] = level;
         }
         CLOSE_READER(re, &s->gb);
     }
+    return 0;
 }
 
 static int decode_motion(GetBitContext *gb)
@@ -190,7 +191,7 @@ static int decode_motion(GetBitContext *gb)
     return value;
 }
 
-static void decode_mb(MadContext *t, int inter)
+static int decode_mb(MadContext *t, int inter)
 {
     MpegEncContext *s = &t->s;
     int mv_map = 0;
@@ -215,10 +216,12 @@ static void decode_mb(MadContext *t, int inter)
                 comp_block(t, s->mb_x, s->mb_y, j, mv_x, mv_y, add);
         } else {
             s->dsp.clear_block(t->block);
-            decode_block_intra(t, t->block);
+            if(decode_block_intra(t, t->block) < 0)
+                return -1;
             idct_put(t, t->block, s->mb_x, s->mb_y, j);
         }
     }
+    return 0;
 }
 
 static void calc_intra_matrix(MadContext *t, int qscale)
@@ -268,6 +271,8 @@ static int decode_frame(AVCodecContext *avctx,
     buf += 16;
 
     if (avctx->width != s->width || avctx->height != s->height) {
+        if((s->width * s->height)/2048*7 > buf_end-buf)
+            return -1;
         if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
             return -1;
         avcodec_set_dimensions(avctx, s->width, s->height);
@@ -294,7 +299,8 @@ static int decode_frame(AVCodecContext *avctx,
 
     for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)
         for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)
-            decode_mb(t, inter);
+            if(decode_mb(t, inter) < 0)
+                return -1;
 
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = t->frame;

libavcodec/eatqi.c

@@ -57,12 +57,15 @@ static av_cold int tqi_decode_init(AVCodecContext *avctx)
     return 0;
 }
 
-static void tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
+static int tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64])
 {
     int n;
     s->dsp.clear_blocks(block[0]);
     for (n=0; n<6; n++)
-        ff_mpeg1_decode_block_intra(s, block[n], n);
+        if(ff_mpeg1_decode_block_intra(s, block[n], n)<0)
+            return -1;
+
+    return 0;
 }
 
 static inline void tqi_idct_put(TqiContext *t, DCTELEM (*block)[64])
@@ -134,7 +137,8 @@ static int tqi_decode_frame(AVCodecContext *avctx,
     for (s->mb_y=0; s->mb_y<(avctx->height+15)/16; s->mb_y++)
     for (s->mb_x=0; s->mb_x<(avctx->width+15)/16; s->mb_x++)
     {
-        tqi_decode_mb(s, t->block);
+        if(tqi_decode_mb(s, t->block) < 0)
+            break;
         tqi_idct_put(t, t->block);
     }
 

libavcodec/ffv1.c

@@ -451,7 +451,7 @@ static av_always_inline int encode_line(FFV1Context *s, int w,
     int run_mode=0;
 
     if(s->ac){
-        if(c->bytestream_end - c->bytestream < w*20){
+        if(c->bytestream_end - c->bytestream < w*35){
             av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\n");
             return -1;
         }

libavcodec/flacdata.c

@@ -27,7 +27,7 @@ const int ff_flac_sample_rate_table[16] =
   8000, 16000, 22050, 24000, 32000, 44100, 48000, 96000,
   0, 0, 0, 0 };
 
-const int16_t ff_flac_blocksize_table[16] = {
+const int32_t ff_flac_blocksize_table[16] = {
      0,    192, 576<<0, 576<<1, 576<<2, 576<<3,      0,      0,
 256<<0, 256<<1, 256<<2, 256<<3, 256<<4, 256<<5, 256<<6, 256<<7
 };

libavcodec/flacdata.h

@@ -26,6 +26,6 @@
 
 extern const int ff_flac_sample_rate_table[16];
 
-extern const int16_t ff_flac_blocksize_table[16];
+extern const int32_t ff_flac_blocksize_table[16];
 
 #endif /* AVCODEC_FLACDATA_H */

libavcodec/flashsv.c

@@ -373,6 +373,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                 if (has_diff) {
                     s->diff_start  = get_bits(&gb, 8);
                     s->diff_height = get_bits(&gb, 8);
+                    if (s->diff_start + s->diff_height > cur_blk_height) {
+                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     av_log(avctx, AV_LOG_DEBUG,
                            "%dx%d diff start %d height %d\n",
                            i, j, s->diff_start, s->diff_height);

libavcodec/flicvideo.c

@@ -319,12 +319,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                 pixel_ptr = y_ptr;
                 CHECK_PIXEL_PTR(0);
                 pixel_countdown = s->avctx->width;
-                line_packets = buf[stream_ptr++];
-                if (stream_ptr + 2 * line_packets > stream_ptr_after_chunk)
+                if (stream_ptr + 1 > stream_ptr_after_chunk)
                     break;
+                line_packets = buf[stream_ptr++];
                 if (line_packets > 0) {
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
+                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                            break;
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
@@ -497,16 +499,27 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     stream_ptr += 6;  /* skip the magic number */
     num_chunks = AV_RL16(&buf[stream_ptr]);
     stream_ptr += 10;  /* skip padding */
+    if (frame_size > buf_size)
+        frame_size = buf_size;
 
     frame_size -= 16;
 
     /* iterate through the chunks */
     while ((frame_size > 0) && (num_chunks > 0)) {
+        int stream_ptr_after_chunk;
         chunk_size = AV_RL32(&buf[stream_ptr]);
+        if (chunk_size > frame_size) {
+            av_log(avctx, AV_LOG_WARNING,
+                   "Invalid chunk_size = %u > frame_size = %u\n", chunk_size, frame_size);
+            chunk_size = frame_size;
+        }
+        stream_ptr_after_chunk = stream_ptr + chunk_size;
+
         stream_ptr += 4;
         chunk_type = AV_RL16(&buf[stream_ptr]);
         stream_ptr += 2;
 
+
         switch (chunk_type) {
         case FLI_256_COLOR:
         case FLI_COLOR:
@@ -523,6 +536,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
             compressed_lines = AV_RL16(&buf[stream_ptr]);
             stream_ptr += 2;
             while (compressed_lines > 0) {
+                if (stream_ptr + 2 > stream_ptr_after_chunk)
+                    break;
                 line_packets = AV_RL16(&buf[stream_ptr]);
                 stream_ptr += 2;
                 if (line_packets < 0) {
@@ -535,6 +550,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                     pixel_countdown = s->avctx->width;
                     for (i = 0; i < line_packets; i++) {
                         /* account for the skip bytes */
+                        if (stream_ptr + 2 > stream_ptr_after_chunk)
+                            break;
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
                         pixel_countdown -= pixel_skip;
@@ -549,6 +566,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                                 pixel_ptr += 2;
                             }
                         } else {
+                            if (stream_ptr + 2*byte_run > stream_ptr_after_chunk)
+                                break;
                             CHECK_PIXEL_PTR(2 * byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                 *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);
@@ -584,6 +603,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_countdown = (s->avctx->width * 2);
 
                 while (pixel_countdown > 0) {
+                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                        break;
                     byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         palette_idx1 = buf[stream_ptr++];
@@ -597,6 +618,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy bytes if byte_run < 0 */
                         byte_run = -byte_run;
+                        if (stream_ptr + byte_run > stream_ptr_after_chunk)
+                            break;
                         CHECK_PIXEL_PTR(byte_run);
                         for (j = 0; j < byte_run; j++) {
                             palette_idx1 = buf[stream_ptr++];
@@ -636,6 +659,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
 
                 while (pixel_countdown > 0) {
+                    if (stream_ptr + 1 > stream_ptr_after_chunk)
+                        break;
                     byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         pixel    = AV_RL16(&buf[stream_ptr]);
@@ -651,6 +676,8 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                         }
                     } else {  /* copy pixels if byte_run < 0 */
                         byte_run = -byte_run;
+                        if (stream_ptr + 2 * byte_run > stream_ptr_after_chunk)
+                            break;
                         CHECK_PIXEL_PTR(2 * byte_run);
                         for (j = 0; j < byte_run; j++) {
                             *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[stream_ptr]);

libavcodec/get_bits.h

@@ -35,32 +35,30 @@
 #include "libavutil/log.h"
 #include "mathops.h"
 
-#if defined(ALT_BITSTREAM_READER_LE) && !defined(ALT_BITSTREAM_READER)
-#   define ALT_BITSTREAM_READER
-#endif
-
-#if !defined(A32_BITSTREAM_READER) && !defined(ALT_BITSTREAM_READER)
-#   if ARCH_ARM && !HAVE_FAST_UNALIGNED
-#       define A32_BITSTREAM_READER
-#   else
-#       define ALT_BITSTREAM_READER
-//#define A32_BITSTREAM_READER
-#   endif
+/*
+ * Safe bitstream reading:
+ * optionally, the get_bits API can check to ensure that we
+ * don't read past input buffer boundaries. This is protected
+ * with CONFIG_SAFE_BITSTREAM_READER at the global level, and
+ * then below that with UNCHECKED_BITSTREAM_READER at the per-
+ * decoder level. This means that decoders that check internally
+ * can "#define UNCHECKED_BITSTREAM_READER 1" to disable
+ * overread checks.
+ * Boundary checking causes a minor performance penalty so for
+ * applications that won't want/need this, it can be disabled
+ * globally using "#define CONFIG_SAFE_BITSTREAM_READER 0".
+ */
+#ifndef UNCHECKED_BITSTREAM_READER
+#define UNCHECKED_BITSTREAM_READER !CONFIG_SAFE_BITSTREAM_READER
 #endif
 
 /* bit input */
 /* buffer, buffer_end and size_in_bits must be present and used by every reader */
 typedef struct GetBitContext {
     const uint8_t *buffer, *buffer_end;
-#ifdef ALT_BITSTREAM_READER
     int index;
-#elif defined A32_BITSTREAM_READER
-    uint32_t *buffer_ptr;
-    uint32_t cache0;
-    uint32_t cache1;
-    int bit_count;
-#endif
     int size_in_bits;
+    int size_in_bits_plus8;
 } GetBitContext;
 
 #define VLC_TYPE int16_t
@@ -122,8 +120,11 @@ LAST_SKIP_BITS(name, gb, num)
 for examples see get_bits, show_bits, skip_bits, get_vlc
 */
 
-#ifdef ALT_BITSTREAM_READER
+#ifdef LONG_BITSTREAM_READER
+#   define MIN_CACHE_BITS 32
+#else
 #   define MIN_CACHE_BITS 25
+#endif
 
 #   define OPEN_READER(name, gb)                \
     unsigned int name##_index = (gb)->index;    \
@@ -132,19 +133,34 @@ for examples see get_bits, show_bits, skip_bits, get_vlc
 #   define CLOSE_READER(name, gb) (gb)->index = name##_index
 
 # ifdef ALT_BITSTREAM_READER_LE
+# ifdef LONG_BITSTREAM_READER
+#   define UPDATE_CACHE(name, gb) \
+    name##_cache = AV_RL64((gb)->buffer+(name##_index>>3)) >> (name##_index&0x07)
+# else
 #   define UPDATE_CACHE(name, gb) \
     name##_cache = AV_RL32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) >> (name##_index&0x07)
+# endif
 
 #   define SKIP_CACHE(name, gb, num) name##_cache >>= (num)
 # else
+# ifdef LONG_BITSTREAM_READER
+#   define UPDATE_CACHE(name, gb) \
+    name##_cache = AV_RB64((gb)->buffer+(name##_index >> 3)) >> (32 - (name##_index & 0x07))
+# else
 #   define UPDATE_CACHE(name, gb) \
     name##_cache = AV_RB32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) << (name##_index&0x07)
+# endif
 
 #   define SKIP_CACHE(name, gb, num) name##_cache <<= (num)
 # endif
 
 // FIXME name?
+#if UNCHECKED_BITSTREAM_READER
 #   define SKIP_COUNTER(name, gb, num) name##_index += (num)
+#else
+#   define SKIP_COUNTER(name, gb, num) \
+    name##_index = FFMIN((gb)->size_in_bits_plus8, name##_index + (num))
+#endif
 
 #   define SKIP_BITS(name, gb, num) do {        \
         SKIP_CACHE(name, gb, num);              \
@@ -171,83 +187,13 @@ static inline int get_bits_count(const GetBitContext *s){
 }
 
 static inline void skip_bits_long(GetBitContext *s, int n){
+#if UNCHECKED_BITSTREAM_READER
     s->index += n;
-}
-
-#elif defined A32_BITSTREAM_READER
-
-#   define MIN_CACHE_BITS 32
-
-#   define OPEN_READER(name, gb)                        \
-    int name##_bit_count        = (gb)->bit_count;      \
-    uint32_t name##_cache0      = (gb)->cache0;         \
-    uint32_t name##_cache1      = (gb)->cache1;         \
-    uint32_t *name##_buffer_ptr = (gb)->buffer_ptr
-
-#   define CLOSE_READER(name, gb) do {          \
-        (gb)->bit_count  = name##_bit_count;    \
-        (gb)->cache0     = name##_cache0;       \
-        (gb)->cache1     = name##_cache1;       \
-        (gb)->buffer_ptr = name##_buffer_ptr;   \
-    } while (0)
-
-#   define UPDATE_CACHE(name, gb) do {                                  \
-        if(name##_bit_count > 0){                                       \
-            const uint32_t next = av_be2ne32(*name##_buffer_ptr);       \
-            name##_cache0 |= NEG_USR32(next, name##_bit_count);         \
-            name##_cache1 |= next << name##_bit_count;                  \
-            name##_buffer_ptr++;                                        \
-            name##_bit_count -= 32;                                     \
-        }                                                               \
-    } while (0)
-
-#if ARCH_X86
-#   define SKIP_CACHE(name, gb, num)                            \
-    __asm__("shldl %2, %1, %0          \n\t"                    \
-            "shll  %2, %1              \n\t"                    \
-            : "+r" (name##_cache0), "+r" (name##_cache1)        \
-            : "Ic" ((uint8_t)(num)))
 #else
-#   define SKIP_CACHE(name, gb, num) do {               \
-        name##_cache0 <<= (num);                        \
-        name##_cache0 |= NEG_USR32(name##_cache1,num);  \
-        name##_cache1 <<= (num);                        \
-    } while (0)
+    s->index += av_clip(n, -s->index, s->size_in_bits_plus8 - s->index);
 #endif
-
-#   define SKIP_COUNTER(name, gb, num) name##_bit_count += (num)
-
-#   define SKIP_BITS(name, gb, num) do {        \
-        SKIP_CACHE(name, gb, num);              \
-        SKIP_COUNTER(name, gb, num);            \
-    } while (0)
-
-#   define LAST_SKIP_BITS(name, gb, num)  SKIP_BITS(name, gb, num)
-#   define LAST_SKIP_CACHE(name, gb, num) SKIP_CACHE(name, gb, num)
-
-#   define SHOW_UBITS(name, gb, num) NEG_USR32(name##_cache0, num)
-
-#   define SHOW_SBITS(name, gb, num) NEG_SSR32(name##_cache0, num)
-
-#   define GET_CACHE(name, gb) name##_cache0
-
-static inline int get_bits_count(const GetBitContext *s) {
-    return ((uint8_t*)s->buffer_ptr - s->buffer)*8 - 32 + s->bit_count;
 }
 
-static inline void skip_bits_long(GetBitContext *s, int n){
-    OPEN_READER(re, s);
-    re_bit_count += n;
-    re_buffer_ptr += re_bit_count>>5;
-    re_bit_count &= 31;
-    re_cache0 = av_be2ne32(re_buffer_ptr[-1]) << re_bit_count;
-    re_cache1 = 0;
-    UPDATE_CACHE(re, s);
-    CLOSE_READER(re, s);
-}
-
-#endif
-
 /**
  * read mpeg1 dc style vlc (sign bit + mantisse with no MSB).
  * if MSB not set it is negative
@@ -309,7 +255,6 @@ static inline void skip_bits(GetBitContext *s, int n){
 }
 
 static inline unsigned int get_bits1(GetBitContext *s){
-#ifdef ALT_BITSTREAM_READER
     unsigned int index = s->index;
     uint8_t result = s->buffer[index>>3];
 #ifdef ALT_BITSTREAM_READER_LE
@@ -319,13 +264,13 @@ static inline unsigned int get_bits1(GetBitContext *s){
     result <<= index & 7;
     result >>= 8 - 1;
 #endif
-    index++;
+#if !UNCHECKED_BITSTREAM_READER
+    if (s->index < s->size_in_bits_plus8)
+#endif
+        index++;
     s->index = index;
 
     return result;
-#else
-    return get_bits(s, 1);
-#endif
 }
 
 static inline unsigned int show_bits1(GetBitContext *s){
@@ -399,14 +344,9 @@ static inline void init_get_bits(GetBitContext *s,
 
     s->buffer       = buffer;
     s->size_in_bits = bit_size;
+    s->size_in_bits_plus8 = bit_size + 8;
     s->buffer_end   = buffer + buffer_size;
-#ifdef ALT_BITSTREAM_READER
     s->index        = 0;
-#elif defined A32_BITSTREAM_READER
-    s->buffer_ptr   = (uint32_t*)((intptr_t)buffer & ~3);
-    s->bit_count    = 32 +     8*((intptr_t)buffer &  3);
-    skip_bits_long(s, 0);
-#endif
 }
 
 static inline void align_get_bits(GetBitContext *s)

libavcodec/golomb.h

@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
     }else{
         int ret = 1;
 
-        while (1) {
+        do {
             buf >>= 32 - 8;
             LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8));
 
@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
             ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf];
             UPDATE_CACHE(re, gb);
             buf = GET_CACHE(re, gb);
-        }
+        } while(ret<0x8000000U);
 
         CLOSE_READER(re, gb);
         return ret - 1;
@@ -302,7 +302,7 @@ static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, int
     }else{
         int i;
         for(i=0; SHOW_UBITS(re, gb, 1) == 0; i++){
-            if (get_bits_left(gb)<=0)
+            if (gb->size_in_bits <= re_index)
                 return -1;
             LAST_SKIP_BITS(re, gb, 1);
             UPDATE_CACHE(re, gb);

libavcodec/h263dec.c

@@ -25,6 +25,8 @@
  * H.263 decoder.
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/cpu.h"
 #include "internal.h"
 #include "avcodec.h"

libavcodec/h264.c

@@ -25,6 +25,8 @@
  * @author Michael Niedermayer <michaelni@gmx.at>
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 #include "internal.h"
@@ -1324,6 +1326,7 @@ int ff_h264_frame_start(H264Context *h){
      * See decode_nal_units().
      */
     s->current_picture_ptr->f.key_frame = 0;
+    s->current_picture_ptr->sync = 0;
     s->current_picture_ptr->mmco_reset= 0;
 
     assert(s->linesize && s->uvlinesize);
@@ -1815,7 +1818,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                                     idct_dc_add(ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
                                 else
                                     idct_add   (ptr, h->mb + (i*16+p*256 << pixel_shift), linesize);
-                            }else
+                            }else if(CONFIG_SVQ3_DECODER)
                                 ff_svq3_add_idct_c(ptr, h->mb + i*16+p*256, linesize, qscale, 0);
                         }
                     }
@@ -1835,7 +1838,7 @@ static av_always_inline void hl_decode_mb_predict_luma(H264Context *h, int mb_ty
                         dctcoef_set(h->mb+(p*256 << pixel_shift), pixel_shift, dc_mapping[i], dctcoef_get(h->mb_luma_dc[p], pixel_shift, i));
                 }
             }
-        }else
+        }else if(CONFIG_SVQ3_DECODER)
             ff_svq3_luma_dc_dequant_idct_c(h->mb+p*256, h->mb_luma_dc[p], qscale);
     }
 }
@@ -1879,7 +1882,7 @@ static av_always_inline void hl_decode_mb_idct_luma(H264Context *h, int mb_type,
                     }
                 }
             }
-        }else{
+        }else if(CONFIG_SVQ3_DECODER) {
             for(i=0; i<16; i++){
                 if(h->non_zero_count_cache[ scan8[i+p*16] ] || h->mb[i*16+p*256]){ //FIXME benchmark weird rule, & below
                     uint8_t * const ptr= dest_y + block_offset[i];
@@ -3776,6 +3779,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
     int nals_needed=0; ///< number of NALs that need decoding before the next frame thread starts
     int nal_index;
 
+    h->nal_unit_type= 0;
+
     h->max_contexts = (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_SLICE)) ? avctx->thread_count : 1;
     if(!(s->flags2 & CODEC_FLAG2_CHUNKS)){
         h->current_slice = 0;
@@ -3798,7 +3803,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         int err;
 
         if(buf_index >= next_avc) {
-            if(buf_index >= buf_size) break;
+            if (buf_index >= buf_size - h->nal_length_size) break;
             nalsize = 0;
             for(i = 0; i < h->nal_length_size; i++)
                 nalsize = (nalsize << 8) | buf[buf_index++];
@@ -3839,7 +3844,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         bit_length= !dst_length ? 0 : (8*dst_length - ff_h264_decode_rbsp_trailing(h, ptr + dst_length - 1));
 
         if(s->avctx->debug&FF_DEBUG_STARTCODE){
-            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d/%d at %d/%d length %d\n", hx->nal_unit_type, hx->nal_ref_idc, buf_index, buf_size, dst_length);
+            av_log(h->s.avctx, AV_LOG_DEBUG, "NAL %d/%d at %d/%d length %d pass %d\n", hx->nal_unit_type, hx->nal_ref_idc, buf_index, buf_size, dst_length, pass);
         }
 
         if (h->is_avc && (nalsize != consumed) && nalsize){
@@ -3876,7 +3881,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
         switch(hx->nal_unit_type){
         case NAL_IDR_SLICE:
             if (h->nal_unit_type != NAL_IDR_SLICE) {
-                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices");
+                av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices\n");
                 return -1;
             }
             idr(h); //FIXME ensure we don't loose some frames if there is reordering
@@ -3890,7 +3895,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
                break;
 
             if (   h->sei_recovery_frame_cnt >= 0
-                && ((h->recovery_frame - h->frame_num) & ((1 << h->sps.log2_max_frame_num)-1)) > h->sei_recovery_frame_cnt) {
+                && (   h->recovery_frame<0
+                    || ((h->recovery_frame - h->frame_num) & ((1 << h->sps.log2_max_frame_num)-1)) > h->sei_recovery_frame_cnt)) {
                 h->recovery_frame = (h->frame_num + h->sei_recovery_frame_cnt) %
                                     (1 << h->sps.log2_max_frame_num);
             }
@@ -3899,13 +3905,13 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
                     (hx->nal_unit_type == NAL_IDR_SLICE);
 
             if (h->recovery_frame == h->frame_num) {
-                h->sync |= 1;
+                s->current_picture_ptr->sync |= 1;
                 h->recovery_frame = -1;
             }
 
             h->sync |= !!s->current_picture_ptr->f.key_frame;
             h->sync |= 3*!!(s->flags2 & CODEC_FLAG2_SHOW_ALL);
-            s->current_picture_ptr->sync = h->sync;
+            s->current_picture_ptr->sync |= h->sync;
 
             if (h->current_slice == 1) {
                 if(!(s->flags2 & CODEC_FLAG2_CHUNKS)) {
@@ -4043,15 +4049,15 @@ static int decode_frame(AVCodecContext *avctx,
     MpegEncContext *s = &h->s;
     AVFrame *pict = data;
     int buf_index;
+    Picture *out;
+    int i, out_idx;
 
     s->flags= avctx->flags;
     s->flags2= avctx->flags2;
 
    /* end of stream, output what is still in the buffers */
- out:
     if (buf_size == 0) {
-        Picture *out;
-        int i, out_idx;
+ out:
 
         s->current_picture_ptr = NULL;
 
@@ -4072,24 +4078,45 @@ static int decode_frame(AVCodecContext *avctx,
             *pict= *(AVFrame*)out;
         }
 
-        return 0;
+        return buf_size;
     }
-    if(h->is_avc && buf_size >= 9 && AV_RB32(buf)==0x0164001F && buf[5] && buf[8]==0x67)
+    if(h->is_avc && buf_size >= 9 && buf[0]==1 && buf[2]==0 && (buf[4]&0xFC)==0xFC && (buf[5]&0x1F) && buf[8]==0x67){
+        int cnt= buf[5]&0x1f;
+        uint8_t *p= buf+6;
+        while(cnt--){
+            int nalsize= AV_RB16(p) + 2;
+            if(nalsize > buf_size - (p-buf) || p[2]!=0x67)
+                goto not_extra;
+            p += nalsize;
+        }
+        cnt = *(p++);
+        if(!cnt)
+            goto not_extra;
+        while(cnt--){
+            int nalsize= AV_RB16(p) + 2;
+            if(nalsize > buf_size - (p-buf) || p[2]!=0x68)
+                goto not_extra;
+            p += nalsize;
+        }
+
         return ff_h264_decode_extradata(h, buf, buf_size);
+    }
+not_extra:
 
     buf_index=decode_nal_units(h, buf, buf_size);
     if(buf_index < 0)
         return -1;
 
     if (!s->current_picture_ptr && h->nal_unit_type == NAL_END_SEQUENCE) {
-        buf_size = 0;
+        av_assert0(buf_index <= buf_size);
+        buf_size = buf_index;
         goto out;
     }
 
     if(!(s->flags2 & CODEC_FLAG2_CHUNKS) && !s->current_picture_ptr){
         if (avctx->skip_frame >= AVDISCARD_NONREF ||
             buf_size >= 4 && !memcmp("Q264", buf, 4))
-            return 0;
+            return buf_size;
         av_log(avctx, AV_LOG_ERROR, "no frame!\n");
         return -1;
     }
@@ -4101,11 +4128,9 @@ static int decode_frame(AVCodecContext *avctx,
         field_end(h, 0);
 
         *data_size = 0; /* Wait for second field. */
-        if (h->next_output_pic && h->next_output_pic->sync) {
-            if(h->sync>1 || h->next_output_pic->f.pict_type != AV_PICTURE_TYPE_B){
+        if (h->next_output_pic && (h->next_output_pic->sync || h->sync>1)) {
                 *data_size = sizeof(AVFrame);
                 *pict = *(AVFrame*)h->next_output_pic;
-            }
         }
     }
 

libavcodec/h264_cabac.c

@@ -26,6 +26,7 @@
  */
 
 #define CABAC 1
+#define UNCHECKED_BITSTREAM_READER 1
 
 #include "internal.h"
 #include "dsputil.h"

libavcodec/h264_cavlc.c

@@ -26,6 +26,7 @@
  */
 
 #define CABAC 0
+#define UNCHECKED_BITSTREAM_READER 1
 
 #include "internal.h"
 #include "avcodec.h"
@@ -707,7 +708,7 @@ int ff_h264_decode_mb_cavlc(H264Context *h){
                 down the code */
     if(h->slice_type_nos != AV_PICTURE_TYPE_I){
         if(s->mb_skip_run==-1)
-            s->mb_skip_run= get_ue_golomb(&s->gb);
+            s->mb_skip_run= get_ue_golomb_long(&s->gb);
 
         if (s->mb_skip_run--) {
             if(FRAME_MBAFF && (s->mb_y&1) == 0){

libavcodec/h264_mp4toannexb_bsf.c

@@ -63,6 +63,7 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc,
     int32_t nal_size;
     uint32_t cumul_size = 0;
     const uint8_t *buf_end = buf + buf_size;
+    int ret = AVERROR(EINVAL);
 
     /* nothing to filter */
     if (!avctx->extradata || avctx->extradata_size < 6) {
@@ -137,6 +138,7 @@ pps:
     *poutbuf_size = 0;
     *poutbuf = NULL;
     do {
+        ret= AVERROR(EINVAL);
         if (buf + ctx->length_size > buf_end)
             goto fail;
 
@@ -155,15 +157,15 @@ pps:
 
         /* prepend only to the first type 5 NAL unit of an IDR picture */
         if (ctx->first_idr && unit_type == 5) {
-            if (alloc_and_copy(poutbuf, poutbuf_size,
+            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                                avctx->extradata, avctx->extradata_size,
-                               buf, nal_size) < 0)
+                               buf, nal_size)) < 0)
                 goto fail;
             ctx->first_idr = 0;
         } else {
-            if (alloc_and_copy(poutbuf, poutbuf_size,
+            if ((ret=alloc_and_copy(poutbuf, poutbuf_size,
                                NULL, 0,
-                               buf, nal_size) < 0)
+                               buf, nal_size)) < 0)
                 goto fail;
             if (!ctx->first_idr && unit_type == 1)
                 ctx->first_idr = 1;
@@ -178,7 +180,7 @@ pps:
 fail:
     av_freep(poutbuf);
     *poutbuf_size = 0;
-    return AVERROR(EINVAL);
+    return ret;
 }
 
 AVBitStreamFilter ff_h264_mp4toannexb_bsf = {

libavcodec/h264_mvpred.h

@@ -633,7 +633,7 @@ static void fill_decode_caches(H264Context *h, int mb_type){
                 AV_ZERO32(mv_cache[4 - 1*8]);
                 ref_cache[4 - 1*8]= topright_type ? LIST_NOT_USED : PART_NOT_AVAILABLE;
             }
-            if(ref_cache[4 - 1*8] < 0){
+            if(ref_cache[2 - 1*8] < 0 || ref_cache[4 - 1*8] < 0){
                 if(USES_LIST(topleft_type, list)){
                     const int b_xy = h->mb2b_xy[topleft_xy] + 3 + b_stride + (h->topleft_partition & 2*b_stride);
                     const int b8_xy= 4*topleft_xy + 1 + (h->topleft_partition & 2);

libavcodec/h264_parser.c

@@ -25,6 +25,8 @@
  * @author Michael Niedermayer <michaelni@gmx.at>
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "parser.h"
 #include "h264data.h"
 #include "golomb.h"

libavcodec/h264_ps.c

@@ -229,7 +229,8 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
     if(sps->nal_hrd_parameters_present_flag || sps->vcl_hrd_parameters_present_flag)
         get_bits1(&s->gb);     /* low_delay_hrd_flag */
     sps->pic_struct_present_flag = get_bits1(&s->gb);
-
+    if(!get_bits_left(&s->gb))
+        return 0;
     sps->bitstream_restriction_flag = get_bits1(&s->gb);
     if(sps->bitstream_restriction_flag){
         get_bits1(&s->gb);     /* motion_vectors_over_pic_boundaries_flag */
@@ -347,6 +348,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
 
     if(sps->profile_idc >= 100){ //high profile
         sps->chroma_format_idc= get_ue_golomb_31(&s->gb);
+        if (sps->chroma_format_idc > 3U) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc);
+            goto fail;
+        }
         if(sps->chroma_format_idc == 3)
             sps->residual_color_transform_flag = get_bits1(&s->gb);
         sps->bit_depth_luma   = get_ue_golomb(&s->gb) + 8;

libavcodec/h264_refs.c

@@ -516,7 +516,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
             if(!pic){
                 if(mmco[i].opcode != MMCO_SHORT2LONG || !h->long_ref[mmco[i].long_arg]
                    || h->long_ref[mmco[i].long_arg]->frame_num != frame_num) {
-                    av_log(h->s.avctx, AV_LOG_ERROR, "mmco: unref short failure\n");
+                    av_log(h->s.avctx, h->short_ref_count ? AV_LOG_ERROR : AV_LOG_DEBUG, "mmco: unref short failure\n");
                     err = AVERROR_INVALIDDATA;
                 }
                 continue;
@@ -653,9 +653,10 @@ int ff_h264_execute_ref_pic_marking(H264Context *h, MMCO *mmco, int mmco_count){
     print_short_term(h);
     print_long_term(h);
 
-    if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count[0]<=1 && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
-        h->sync |= 1;
-        s->current_picture_ptr->sync |= h->sync;
+    if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count[0]<=2 + (s->picture_structure != PICT_FRAME) && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
+        s->current_picture_ptr->sync |= 1;
+        if(!h->s.avctx->has_b_frames)
+            h->sync = 2;
     }
 
     return (h->s.avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;

libavcodec/huffyuv.c

@@ -33,6 +33,7 @@
 #include "put_bits.h"
 #include "dsputil.h"
 #include "thread.h"
+#include "libavutil/avassert.h"
 
 #define VLC_BITS 11
 
@@ -309,12 +310,13 @@ static void generate_joint_tables(HYuvContext *s){
             for(i=y=0; y<256; y++){
                 int len0 = s->len[0][y];
                 int limit = VLC_BITS - len0;
-                if(limit <= 0)
+                if(limit <= 0 || !len0)
                     continue;
                 for(u=0; u<256; u++){
                     int len1 = s->len[p][u];
-                    if(len1 > limit)
+                    if (len1 > limit || !len1)
                         continue;
+                    av_assert0(i < (1 << VLC_BITS));
                     len[i] = len0 + len1;
                     bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
                     symbols[i] = (y<<8) + u;
@@ -336,18 +338,19 @@ static void generate_joint_tables(HYuvContext *s){
         for(i=0, g=-16; g<16; g++){
             int len0 = s->len[p0][g&255];
             int limit0 = VLC_BITS - len0;
-            if(limit0 < 2)
+            if (limit0 < 2 || !len0)
                 continue;
             for(b=-16; b<16; b++){
                 int len1 = s->len[p1][b&255];
                 int limit1 = limit0 - len1;
-                if(limit1 < 1)
+                if (limit1 < 1 || !len1)
                     continue;
                 code = (s->bits[p0][g&255] << len1) + s->bits[p1][b&255];
                 for(r=-16; r<16; r++){
                     int len2 = s->len[2][r&255];
-                    if(len2 > limit1)
+                    if (len2 > limit1 || !len2)
                         continue;
+                    av_assert0(i < (1 << VLC_BITS));
                     len[i] = len0 + len1 + len2;
                     bits[i] = (code << len2) + s->bits[2][r&255];
                     if(s->decorrelate){
@@ -371,6 +374,7 @@ static void generate_joint_tables(HYuvContext *s){
 static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
     GetBitContext gb;
     int i;
+    int ret;
 
     init_get_bits(&gb, src, length*8);
 
@@ -381,7 +385,8 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
             return -1;
         }
         free_vlc(&s->vlc[i]);
-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+            return ret;
     }
 
     generate_joint_tables(s);
@@ -393,6 +398,7 @@ static int read_old_huffman_tables(HYuvContext *s){
 #if 1
     GetBitContext gb;
     int i;
+    int ret;
 
     init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8);
     if(read_len_table(s->len[0], &gb)<0)
@@ -413,7 +419,8 @@ static int read_old_huffman_tables(HYuvContext *s){
 
     for(i=0; i<3; i++){
         free_vlc(&s->vlc[i]);
-        init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+        if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+            return ret;
     }
 
     generate_joint_tables(s);

libavcodec/imc.c

@@ -35,7 +35,6 @@
 #include <stddef.h>
 #include <stdio.h>
 
-#define ALT_BITSTREAM_READER
 #include "avcodec.h"
 #include "get_bits.h"
 #include "dsputil.h"

libavcodec/indeo3.c

@@ -770,7 +770,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                 /* get motion vector index and setup the pointer to the mv set */
                 if (!ctx->need_resync)
                     ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3];
-                curr_cell.mv_ptr = &ctx->mc_vectors[*(ctx->next_cell_data++) << 1];
+                if(ctx->mc_vectors)
+                    curr_cell.mv_ptr = &ctx->mc_vectors[*(ctx->next_cell_data++) << 1];
                 curr_cell.tree   = 1; /* enter the VQ tree */
                 UPDATE_BITPOS(8);
             } else { /* VQ tree DATA code */
@@ -884,7 +885,8 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         ctx->height = height;
 
         free_frame_buffers(ctx);
-        allocate_frame_buffers(ctx, avctx);
+        if(allocate_frame_buffers(ctx, avctx) < 0)
+            return AVERROR_INVALIDDATA;
         avcodec_set_dimensions(avctx, width, height);
     }
 
@@ -984,9 +986,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
 
     dsputil_init(&ctx->dsp, avctx);
 
-    allocate_frame_buffers(ctx, avctx);
-
-    return 0;
+    return allocate_frame_buffers(ctx, avctx);
 }
 
 

libavcodec/indeo4.c

@@ -0,0 +1,828 @@
+/*
+ * Indeo Video Interactive v4 compatible decoder
+ * Copyright (c) 2009-2011 Maxim Poliakovski
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * Indeo Video Interactive version 4 decoder
+ *
+ * Indeo 4 data is usually transported within .avi or .mov files.
+ * Known FOURCCs: 'IV41'
+ */
+
+#define ALT_BITSTREAM_READER_LE
+#include "avcodec.h"
+#include "get_bits.h"
+#include "dsputil.h"
+#include "ivi_dsp.h"
+#include "ivi_common.h"
+#include "indeo4data.h"
+
+#define IVI4_STREAM_ANALYSER    0
+#define IVI4_DEBUG_CHECKSUM     0
+
+/**
+ *  Indeo 4 frame types.
+ */
+enum {
+    FRAMETYPE_INTRA       = 0,
+    FRAMETYPE_BIDIR1      = 1,  ///< bidirectional frame
+    FRAMETYPE_INTER       = 2,  ///< non-droppable P-frame
+    FRAMETYPE_BIDIR       = 3,  ///< bidirectional frame
+    FRAMETYPE_INTER_NOREF = 4,  ///< droppable P-frame
+    FRAMETYPE_NULL_FIRST  = 5,  ///< empty frame with no data
+    FRAMETYPE_NULL_LAST   = 6   ///< empty frame with no data
+};
+
+#define IVI4_PIC_SIZE_ESC   7
+
+
+typedef struct {
+    GetBitContext   gb;
+    AVFrame         frame;
+    RVMapDesc       rvmap_tabs[9];   ///< local corrected copy of the static rvmap tables
+
+    uint32_t        frame_num;
+    int             frame_type;
+    int             prev_frame_type; ///< frame type of the previous frame
+    uint32_t        data_size;       ///< size of the frame data in bytes from picture header
+    int             is_scalable;
+    int             transp_status;   ///< transparency mode status: 1 - enabled
+
+    IVIPicConfig    pic_conf;
+    IVIPlaneDesc    planes[3];       ///< color planes
+
+    int             buf_switch;      ///< used to switch between three buffers
+    int             dst_buf;         ///< buffer index for the currently decoded frame
+    int             ref_buf;         ///< inter frame reference buffer index
+
+    IVIHuffTab      mb_vlc;          ///< current macroblock table descriptor
+    IVIHuffTab      blk_vlc;         ///< current block table descriptor
+
+    uint16_t        checksum;        ///< frame checksum
+
+    uint8_t         rvmap_sel;
+    uint8_t         in_imf;
+    uint8_t         in_q;            ///< flag for explicitly stored quantiser delta
+    uint8_t         pic_glob_quant;
+    uint8_t         unknown1;
+
+#if IVI4_STREAM_ANALYSER
+    uint8_t         has_b_frames;
+    uint8_t         has_transp;
+    uint8_t         uses_tiling;
+    uint8_t         uses_haar;
+    uint8_t         uses_fullpel;
+#endif
+} IVI4DecContext;
+
+
+struct {
+    InvTransformPtr *inv_trans;
+    DCTransformPtr  *dc_trans;
+    int             is_2d_trans;
+} transforms[18] = {
+    { ff_ivi_inverse_haar_8x8,  ff_ivi_dc_haar_2d,       1 },
+    { NULL, NULL, 0 }, /* inverse Haar 8x1 */
+    { NULL, NULL, 0 }, /* inverse Haar 1x8 */
+    { ff_ivi_put_pixels_8x8,    ff_ivi_put_dc_pixel_8x8, 1 },
+    { ff_ivi_inverse_slant_8x8, ff_ivi_dc_slant_2d,      1 },
+    { ff_ivi_row_slant8,        ff_ivi_dc_row_slant,     1 },
+    { ff_ivi_col_slant8,        ff_ivi_dc_col_slant,     1 },
+    { NULL, NULL, 0 }, /* inverse DCT 8x8 */
+    { NULL, NULL, 0 }, /* inverse DCT 8x1 */
+    { NULL, NULL, 0 }, /* inverse DCT 1x8 */
+    { NULL, NULL, 0 }, /* inverse Haar 4x4 */
+    { ff_ivi_inverse_slant_4x4, ff_ivi_dc_slant_2d,      1 },
+    { NULL, NULL, 0 }, /* no transform 4x4 */
+    { NULL, NULL, 0 }, /* inverse Haar 1x4 */
+    { NULL, NULL, 0 }, /* inverse Haar 4x1 */
+    { NULL, NULL, 0 }, /* inverse slant 1x4 */
+    { NULL, NULL, 0 }, /* inverse slant 4x1 */
+    { NULL, NULL, 0 }, /* inverse DCT 4x4 */
+};
+
+/**
+ *  Decode subdivision of a plane.
+ *  This is a simplified version that checks for two supported subdivisions:
+ *  - 1 wavelet band  per plane, size factor 1:1, code pattern: 3
+ *  - 4 wavelet bands per plane, size factor 1:4, code pattern: 2,3,3,3,3
+ *  Anything else is either unsupported or corrupt.
+ *
+ *  @param[in,out] gb    the GetBit context
+ *  @return        number of wavelet bands or 0 on error
+ */
+static int decode_plane_subdivision(GetBitContext *gb)
+{
+    int i;
+
+    switch (get_bits(gb, 2)) {
+    case 3:
+        return 1;
+    case 2:
+        for (i = 0; i < 4; i++)
+            if (get_bits(gb, 2) != 3)
+                return 0;
+        return 4;
+    default:
+        return 0;
+    }
+}
+
+static inline int scale_tile_size(int def_size, int size_factor)
+{
+    return (size_factor == 15 ? def_size : (size_factor + 1) << 5);
+}
+
+/**
+ *  Decode Indeo 4 picture header.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_pic_hdr(IVI4DecContext *ctx, AVCodecContext *avctx)
+{
+    int             pic_size_indx, val, i, p;
+    IVIPicConfig    pic_conf;
+
+    if (get_bits(&ctx->gb, 18) != 0x3FFF8) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid picture start code!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    ctx->prev_frame_type = ctx->frame_type;
+    ctx->frame_type      = get_bits(&ctx->gb, 3);
+    if (ctx->frame_type == 7) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d\n", ctx->frame_type);
+        return AVERROR_INVALIDDATA;
+    }
+
+#if IVI4_STREAM_ANALYSER
+    if (   ctx->frame_type == FRAMETYPE_BIDIR1
+        || ctx->frame_type == FRAMETYPE_BIDIR)
+        ctx->has_b_frames = 1;
+#endif
+
+    ctx->transp_status = get_bits1(&ctx->gb);
+#if IVI4_STREAM_ANALYSER
+    if (ctx->transp_status) {
+        ctx->has_transp = 1;
+    }
+#endif
+
+    /* unknown bit: Mac decoder ignores this bit, XANIM returns error */
+    if (get_bits1(&ctx->gb)) {
+        av_log(avctx, AV_LOG_ERROR, "Sync bit is set!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    ctx->data_size = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 24) : 0;
+
+    /* null frames don't contain anything else so we just return */
+    if (ctx->frame_type >= FRAMETYPE_NULL_FIRST) {
+        av_dlog(avctx, "Null frame encountered!\n");
+        return 0;
+    }
+
+    /* Check key lock status. If enabled - ignore lock word.         */
+    /* Usually we have to prompt the user for the password, but      */
+    /* we don't do that because Indeo 4 videos can be decoded anyway */
+    if (get_bits1(&ctx->gb)) {
+        skip_bits_long(&ctx->gb, 32);
+        av_dlog(avctx, "Password-protected clip!\n");
+    }
+
+    pic_size_indx = get_bits(&ctx->gb, 3);
+    if (pic_size_indx == IVI4_PIC_SIZE_ESC) {
+        pic_conf.pic_height = get_bits(&ctx->gb, 16);
+        pic_conf.pic_width  = get_bits(&ctx->gb, 16);
+    } else {
+        pic_conf.pic_height = ivi4_common_pic_sizes[pic_size_indx * 2 + 1];
+        pic_conf.pic_width  = ivi4_common_pic_sizes[pic_size_indx * 2    ];
+    }
+
+    /* Decode tile dimensions. */
+    if (get_bits1(&ctx->gb)) {
+        pic_conf.tile_height = scale_tile_size(pic_conf.pic_height, get_bits(&ctx->gb, 4));
+        pic_conf.tile_width  = scale_tile_size(pic_conf.pic_width,  get_bits(&ctx->gb, 4));
+#if IVI4_STREAM_ANALYSER
+        ctx->uses_tiling = 1;
+#endif
+    } else {
+        pic_conf.tile_height = pic_conf.pic_height;
+        pic_conf.tile_width  = pic_conf.pic_width;
+    }
+
+    /* Decode chroma subsampling. We support only 4:4 aka YVU9. */
+    if (get_bits(&ctx->gb, 2)) {
+        av_log(avctx, AV_LOG_ERROR, "Only YVU9 picture format is supported!\n");
+        return AVERROR_INVALIDDATA;
+    }
+    pic_conf.chroma_height = (pic_conf.pic_height + 3) >> 2;
+    pic_conf.chroma_width  = (pic_conf.pic_width  + 3) >> 2;
+
+    /* decode subdivision of the planes */
+    pic_conf.luma_bands = decode_plane_subdivision(&ctx->gb);
+    if (pic_conf.luma_bands)
+        pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
+    ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
+    if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
+        av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
+               pic_conf.luma_bands, pic_conf.chroma_bands);
+        return AVERROR_INVALIDDATA;
+    }
+
+    /* check if picture layout was changed and reallocate buffers */
+    if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
+        if (ff_ivi_init_planes(ctx->planes, &pic_conf)) {
+            av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
+            return AVERROR(ENOMEM);
+        }
+
+        ctx->pic_conf = pic_conf;
+
+        /* set default macroblock/block dimensions */
+        for (p = 0; p <= 2; p++) {
+            for (i = 0; i < (!p ? pic_conf.luma_bands : pic_conf.chroma_bands); i++) {
+                ctx->planes[p].bands[i].mb_size  = !p ? (!ctx->is_scalable ? 16 : 8) : 4;
+                ctx->planes[p].bands[i].blk_size = !p ? 8 : 4;
+            }
+        }
+
+        if (ff_ivi_init_tiles(ctx->planes, ctx->pic_conf.tile_width,
+                              ctx->pic_conf.tile_height)) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Couldn't reallocate internal structures!\n");
+            return AVERROR(ENOMEM);
+        }
+    }
+
+    ctx->frame_num = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 20) : 0;
+
+    /* skip decTimeEst field if present */
+    if (get_bits1(&ctx->gb))
+        skip_bits(&ctx->gb, 8);
+
+    /* decode macroblock and block huffman codebooks */
+    if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_MB_HUFF,  &ctx->mb_vlc,  avctx) ||
+        ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF, &ctx->blk_vlc, avctx))
+        return AVERROR_INVALIDDATA;
+
+    ctx->rvmap_sel = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 8;
+
+    ctx->in_imf = get_bits1(&ctx->gb);
+    ctx->in_q   = get_bits1(&ctx->gb);
+
+    ctx->pic_glob_quant = get_bits(&ctx->gb, 5);
+
+    /* TODO: ignore this parameter if unused */
+    ctx->unknown1 = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 0;
+
+    ctx->checksum = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 16) : 0;
+
+    /* skip picture header extension if any */
+    while (get_bits1(&ctx->gb)) {
+        av_dlog(avctx, "Pic hdr extension encountered!\n");
+        val = get_bits(&ctx->gb, 8);
+    }
+
+    if (get_bits1(&ctx->gb)) {
+        av_log(avctx, AV_LOG_ERROR, "Bad blocks bits encountered!\n");
+    }
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode Indeo 4 band header.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band,
+                           AVCodecContext *avctx)
+{
+    int plane, band_num, hdr_size, indx, transform_id, scan_indx;
+    int i;
+
+    plane    = get_bits(&ctx->gb, 2);
+    band_num = get_bits(&ctx->gb, 4);
+    if (band->plane != plane || band->band_num != band_num) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid band header sequence!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    band->is_empty = get_bits1(&ctx->gb);
+    if (!band->is_empty) {
+        hdr_size = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 16) : 4;
+
+        band->is_halfpel = get_bits(&ctx->gb, 2);
+        if (band->is_halfpel >= 2) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid/unsupported mv resolution: %d!\n",
+                   band->is_halfpel);
+            return AVERROR_INVALIDDATA;
+        }
+#if IVI4_STREAM_ANALYSER
+        if (!band->is_halfpel)
+            ctx->uses_fullpel = 1;
+#endif
+
+        band->checksum_present = get_bits1(&ctx->gb);
+        if (band->checksum_present)
+            band->checksum = get_bits(&ctx->gb, 16);
+
+        indx = get_bits(&ctx->gb, 2);
+        if (indx == 3) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid block size!\n");
+            return AVERROR_INVALIDDATA;
+        }
+        band->mb_size  = 16 >> indx;
+        band->blk_size = 8 >> (indx >> 1);
+
+        band->inherit_mv     = get_bits1(&ctx->gb);
+        band->inherit_qdelta = get_bits1(&ctx->gb);
+
+        band->glob_quant = get_bits(&ctx->gb, 5);
+
+        if (!get_bits1(&ctx->gb) || ctx->frame_type == FRAMETYPE_INTRA) {
+            transform_id = get_bits(&ctx->gb, 5);
+            if (!transforms[transform_id].inv_trans) {
+                av_log_ask_for_sample(avctx, "Unimplemented transform: %d!\n", transform_id);
+                return AVERROR_PATCHWELCOME;
+            }
+            if ((transform_id >= 7 && transform_id <= 9) ||
+                 transform_id == 17) {
+                av_log_ask_for_sample(avctx, "DCT transform not supported yet!\n");
+                return AVERROR_PATCHWELCOME;
+            }
+
+#if IVI4_STREAM_ANALYSER
+            if ((transform_id >= 0 && transform_id <= 2) || transform_id == 10)
+                ctx->uses_haar = 1;
+#endif
+
+            band->inv_transform = transforms[transform_id].inv_trans;
+            band->dc_transform  = transforms[transform_id].dc_trans;
+            band->is_2d_trans   = transforms[transform_id].is_2d_trans;
+
+            scan_indx = get_bits(&ctx->gb, 4);
+            if (scan_indx == 15) {
+                av_log(avctx, AV_LOG_ERROR, "Custom scan pattern encountered!\n");
+                return AVERROR_INVALIDDATA;
+            }
+            band->scan = scan_index_to_tab[scan_indx];
+
+            band->quant_mat = get_bits(&ctx->gb, 5);
+            if (band->quant_mat == 31) {
+                av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n");
+                return AVERROR_INVALIDDATA;
+            }
+        }
+
+        /* decode block huffman codebook */
+        if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF,
+                                 &band->blk_vlc, avctx))
+            return AVERROR_INVALIDDATA;
+
+        /* select appropriate rvmap table for this band */
+        band->rvmap_sel = get_bits1(&ctx->gb) ? get_bits(&ctx->gb, 3) : 8;
+
+        /* decode rvmap probability corrections if any */
+        band->num_corr = 0; /* there is no corrections */
+        if (get_bits1(&ctx->gb)) {
+            band->num_corr = get_bits(&ctx->gb, 8); /* get number of correction pairs */
+            if (band->num_corr > 61) {
+                av_log(avctx, AV_LOG_ERROR, "Too many corrections: %d\n",
+                       band->num_corr);
+                return AVERROR_INVALIDDATA;
+            }
+
+            /* read correction pairs */
+            for (i = 0; i < band->num_corr * 2; i++)
+                band->corr[i] = get_bits(&ctx->gb, 8);
+        }
+    }
+
+    if (band->blk_size == 8) {
+        band->intra_base = &ivi4_quant_8x8_intra[quant_index_to_tab[band->quant_mat]][0];
+        band->inter_base = &ivi4_quant_8x8_inter[quant_index_to_tab[band->quant_mat]][0];
+    } else {
+        band->intra_base = &ivi4_quant_4x4_intra[quant_index_to_tab[band->quant_mat]][0];
+        band->inter_base = &ivi4_quant_4x4_inter[quant_index_to_tab[band->quant_mat]][0];
+    }
+
+    /* Indeo 4 doesn't use scale tables */
+    band->intra_scale = NULL;
+    band->inter_scale = NULL;
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode information (block type, cbp, quant delta, motion vector)
+ *  for all macroblocks in the current tile.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in,out] tile      pointer to the tile descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
+                          IVITile *tile, AVCodecContext *avctx)
+{
+    int         x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb,
+                mv_scale, mb_type_bits;
+    IVIMbInfo   *mb, *ref_mb;
+    int         row_offset = band->mb_size * band->pitch;
+
+    mb     = tile->mbs;
+    ref_mb = tile->ref_mbs;
+    offs   = tile->ypos * band->pitch + tile->xpos;
+
+    blks_per_mb  = band->mb_size   != band->blk_size  ? 4 : 1;
+    mb_type_bits = ctx->frame_type == FRAMETYPE_BIDIR ? 2 : 1;
+
+    /* scale factor for motion vectors */
+    mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
+    mv_x = mv_y = 0;
+
+    if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) {
+        av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs);
+        return -1;
+    }
+
+    for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) {
+        mb_offset = offs;
+
+        for (x = tile->xpos; x < tile->xpos + tile->width; x += band->mb_size) {
+            mb->xpos     = x;
+            mb->ypos     = y;
+            mb->buf_offs = mb_offset;
+
+            if (get_bits1(&ctx->gb)) {
+                if (ctx->frame_type == FRAMETYPE_INTRA) {
+                    av_log(avctx, AV_LOG_ERROR, "Empty macroblock in an INTRA picture!\n");
+                    return AVERROR_INVALIDDATA;
+                }
+                mb->type = 1; /* empty macroblocks are always INTER */
+                mb->cbp  = 0; /* all blocks are empty */
+
+                mb->q_delta = 0;
+                if (!band->plane && !band->band_num && ctx->in_q) {
+                    mb->q_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                           IVI_VLC_BITS, 1);
+                    mb->q_delta = IVI_TOSIGNED(mb->q_delta);
+                }
+
+                mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
+                if (band->inherit_mv) {
+                    /* motion vector inheritance */
+                    if (mv_scale) {
+                        mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
+                        mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
+                    } else {
+                        mb->mv_x = ref_mb->mv_x;
+                        mb->mv_y = ref_mb->mv_y;
+                    }
+                }
+            } else {
+                if (band->inherit_mv) {
+                    mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
+                } else if (ctx->frame_type == FRAMETYPE_INTRA) {
+                    mb->type = 0; /* mb_type is always INTRA for intra-frames */
+                } else {
+                    mb->type = get_bits(&ctx->gb, mb_type_bits);
+                }
+
+                mb->cbp = get_bits(&ctx->gb, blks_per_mb);
+
+                mb->q_delta = 0;
+                if (band->inherit_qdelta) {
+                    if (ref_mb) mb->q_delta = ref_mb->q_delta;
+                } else if (mb->cbp || (!band->plane && !band->band_num &&
+                           ctx->in_q)) {
+                    mb->q_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                           IVI_VLC_BITS, 1);
+                    mb->q_delta = IVI_TOSIGNED(mb->q_delta);
+                }
+
+                if (!mb->type) {
+                    mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
+                } else {
+                    if (band->inherit_mv) {
+                        /* motion vector inheritance */
+                        if (mv_scale) {
+                            mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
+                            mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale);
+                        } else {
+                            mb->mv_x = ref_mb->mv_x;
+                            mb->mv_y = ref_mb->mv_y;
+                        }
+                    } else {
+                        /* decode motion vector deltas */
+                        mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                            IVI_VLC_BITS, 1);
+                        mv_y += IVI_TOSIGNED(mv_delta);
+                        mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table,
+                                            IVI_VLC_BITS, 1);
+                        mv_x += IVI_TOSIGNED(mv_delta);
+                        mb->mv_x = mv_x;
+                        mb->mv_y = mv_y;
+                    }
+                }
+            }
+
+            mb++;
+            if (ref_mb)
+                ref_mb++;
+            mb_offset += band->mb_size;
+        }
+
+        offs += row_offset;
+    }
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+/**
+ *  Decode an Indeo 4 band.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ *  @param[in,out] band      pointer to the band descriptor
+ *  @param[in]     avctx     pointer to the AVCodecContext
+ *  @return        result code: 0 = OK, negative number = error
+ */
+static int decode_band(IVI4DecContext *ctx, int plane_num,
+                       IVIBandDesc *band, AVCodecContext *avctx)
+{
+    int         result, i, t, pos, idx1, idx2;
+    IVITile     *tile;
+
+    band->buf     = band->bufs[ctx->dst_buf];
+    band->ref_buf = band->bufs[ctx->ref_buf];
+
+    result = decode_band_hdr(ctx, band, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR, "Error decoding band header\n");
+        return result;
+    }
+
+    if (band->is_empty) {
+        av_log(avctx, AV_LOG_ERROR, "Empty band encountered!\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    band->rv_map = &ctx->rvmap_tabs[band->rvmap_sel];
+
+    /* apply corrections to the selected rvmap table if present */
+    for (i = 0; i < band->num_corr; i++) {
+        idx1 = band->corr[i * 2];
+        idx2 = band->corr[i * 2 + 1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+    pos = get_bits_count(&ctx->gb);
+
+    for (t = 0; t < band->num_tiles; t++) {
+        tile = &band->tiles[t];
+
+        tile->is_empty = get_bits1(&ctx->gb);
+        if (tile->is_empty) {
+            ff_ivi_process_empty_tile(avctx, band, tile,
+                                      (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
+            av_dlog(avctx, "Empty tile encountered!\n");
+        } else {
+            tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
+            if (!tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Tile data size is zero!\n");
+                return AVERROR_INVALIDDATA;
+            }
+
+            result = decode_mb_info(ctx, band, tile, avctx);
+            if (result < 0)
+                break;
+
+            result = ff_ivi_decode_blocks(&ctx->gb, band, tile);
+            if (result < 0 || ((get_bits_count(&ctx->gb) - pos) >> 3) != tile->data_size) {
+                av_log(avctx, AV_LOG_ERROR, "Corrupted tile data encountered!\n");
+                break;
+            }
+
+            pos += tile->data_size << 3; // skip to next tile
+        }
+    }
+
+    /* restore the selected rvmap table by applying its corrections in reverse order */
+    for (i = band->num_corr - 1; i >= 0; i--) {
+        idx1 = band->corr[i * 2];
+        idx2 = band->corr[i * 2 + 1];
+        FFSWAP(uint8_t, band->rv_map->runtab[idx1], band->rv_map->runtab[idx2]);
+        FFSWAP(int16_t, band->rv_map->valtab[idx1], band->rv_map->valtab[idx2]);
+    }
+
+#if defined(DEBUG) && IVI4_DEBUG_CHECKSUM
+    if (band->checksum_present) {
+        uint16_t chksum = ivi_calc_band_checksum(band);
+        if (chksum != band->checksum) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Band checksum mismatch! Plane %d, band %d, received: %x, calculated: %x\n",
+                   band->plane, band->band_num, band->checksum, chksum);
+        }
+    }
+#endif
+
+    align_get_bits(&ctx->gb);
+
+    return 0;
+}
+
+
+static av_cold int decode_init(AVCodecContext *avctx)
+{
+    IVI4DecContext *ctx = avctx->priv_data;
+
+    ff_ivi_init_static_vlc();
+
+    /* copy rvmap tables in our context so we can apply changes to them */
+    memcpy(ctx->rvmap_tabs, ff_ivi_rvmap_tabs, sizeof(ff_ivi_rvmap_tabs));
+
+    /* Force allocation of the internal buffers */
+    /* during picture header decoding.          */
+    ctx->pic_conf.pic_width  = 0;
+    ctx->pic_conf.pic_height = 0;
+
+    avctx->pix_fmt = PIX_FMT_YUV410P;
+
+    return 0;
+}
+
+
+/**
+ *  Rearrange decoding and reference buffers.
+ *
+ *  @param[in,out] ctx       pointer to the decoder context
+ */
+static void switch_buffers(IVI4DecContext *ctx)
+{
+    switch (ctx->prev_frame_type) {
+    case FRAMETYPE_INTRA:
+    case FRAMETYPE_INTER:
+        ctx->buf_switch ^= 1;
+        ctx->dst_buf     = ctx->buf_switch;
+        ctx->ref_buf     = ctx->buf_switch ^ 1;
+        break;
+    case FRAMETYPE_INTER_NOREF:
+        break;
+    }
+
+    switch (ctx->frame_type) {
+    case FRAMETYPE_INTRA:
+        ctx->buf_switch = 0;
+        /* FALLTHROUGH */
+    case FRAMETYPE_INTER:
+        ctx->dst_buf = ctx->buf_switch;
+        ctx->ref_buf = ctx->buf_switch ^ 1;
+        break;
+    case FRAMETYPE_INTER_NOREF:
+    case FRAMETYPE_NULL_FIRST:
+    case FRAMETYPE_NULL_LAST:
+        break;
+    }
+}
+
+
+static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
+                        AVPacket *avpkt)
+{
+    IVI4DecContext  *ctx = avctx->priv_data;
+    const uint8_t   *buf = avpkt->data;
+    int             buf_size = avpkt->size;
+    int             result, p, b;
+
+    init_get_bits(&ctx->gb, buf, buf_size * 8);
+
+    result = decode_pic_hdr(ctx, avctx);
+    if (result) {
+        av_log(avctx, AV_LOG_ERROR, "Error decoding picture header\n");
+        return result;
+    }
+
+    switch_buffers(ctx);
+
+    if (ctx->frame_type < FRAMETYPE_NULL_FIRST) {
+        for (p = 0; p < 3; p++) {
+            for (b = 0; b < ctx->planes[p].num_bands; b++) {
+                result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
+                if (result) {
+                    av_log(avctx, AV_LOG_ERROR,
+                           "Error decoding band: %d, plane: %d\n", b, p);
+                    return result;
+                }
+            }
+        }
+    }
+
+    /* If the bidirectional mode is enabled, next I and the following P frame will */
+    /* be sent together. Unfortunately the approach below seems to be the only way */
+    /* to handle the B-frames mode. That's exactly the same Intel decoders do.     */
+    if (ctx->frame_type == FRAMETYPE_INTRA) {
+        while (get_bits(&ctx->gb, 8)); // skip version string
+        skip_bits_long(&ctx->gb, 64);  // skip padding, TODO: implement correct 8-bytes alignment
+        if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8)
+            av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n");
+    }
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+    ctx->frame.reference = 0;
+    if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+        return result;
+    }
+
+    if (ctx->is_scalable) {
+        ff_ivi_recompose_haar(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0], 4);
+    } else {
+        ff_ivi_output_plane(&ctx->planes[0], ctx->frame.data[0], ctx->frame.linesize[0]);
+    }
+
+    ff_ivi_output_plane(&ctx->planes[2], ctx->frame.data[1], ctx->frame.linesize[1]);
+    ff_ivi_output_plane(&ctx->planes[1], ctx->frame.data[2], ctx->frame.linesize[2]);
+
+    *data_size = sizeof(AVFrame);
+    *(AVFrame*)data = ctx->frame;
+
+    return buf_size;
+}
+
+
+static av_cold int decode_close(AVCodecContext *avctx)
+{
+    IVI4DecContext *ctx = avctx->priv_data;
+
+    ff_ivi_free_buffers(&ctx->planes[0]);
+
+    if (ctx->frame.data[0])
+        avctx->release_buffer(avctx, &ctx->frame);
+
+#if IVI4_STREAM_ANALYSER
+    if (ctx->is_scalable)
+        av_log(avctx, AV_LOG_ERROR, "This video uses scalability mode!\n");
+    if (ctx->uses_tiling)
+        av_log(avctx, AV_LOG_ERROR, "This video uses local decoding!\n");
+    if (ctx->has_b_frames)
+        av_log(avctx, AV_LOG_ERROR, "This video contains B-frames!\n");
+    if (ctx->has_transp)
+        av_log(avctx, AV_LOG_ERROR, "Transparency mode is enabled!\n");
+    if (ctx->uses_haar)
+        av_log(avctx, AV_LOG_ERROR, "This video uses Haar transform!\n");
+    if (ctx->uses_fullpel)
+        av_log(avctx, AV_LOG_ERROR, "This video uses fullpel motion vectors!\n");
+#endif
+
+    return 0;
+}
+
+
+AVCodec ff_indeo4_decoder = {
+    .name           = "indeo4",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_INDEO4,
+    .priv_data_size = sizeof(IVI4DecContext),
+    .init           = decode_init,
+    .close          = decode_close,
+    .decode         = decode_frame,
+    .long_name      = NULL_IF_CONFIG_SMALL("Intel Indeo Video Interactive 4"),
+};

libavcodec/indeo4data.h

@@ -0,0 +1,350 @@
+/*
+ * Indeo Video Interactive 4 compatible decoder
+ * Copyright (c) 2009-2010 Maxim Poliakovski
+ *
+ * This file is part of Libav.
+ *
+ * Libav is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * Libav is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Libav; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file
+ * This file contains data needed for the Indeo 4 decoder.
+ */
+
+#ifndef AVCODEC_INDEO4DATA_H
+#define AVCODEC_INDEO4DATA_H
+
+#include <stdint.h>
+#include "dsputil.h"
+#include "ivi_common.h"
+
+/**
+ *  standard picture dimensions
+ */
+static const uint16_t ivi4_common_pic_sizes[14] = {
+    640, 480, 320, 240, 160, 120, 704, 480, 352, 240, 352, 288, 176, 144
+};
+
+/**
+ *  Indeo 4 8x8 scan (zigzag) patterns
+ */
+static const uint8_t ivi4_alternate_scan_8x8[64] = {
+     0,  8,  1,  9, 16, 24,  2,  3, 17, 25, 10, 11, 32, 40, 48, 56,
+     4,  5,  6,  7, 33, 41, 49, 57, 18, 19, 26, 27, 12, 13, 14, 15,
+    34, 35, 43, 42, 50, 51, 59, 58, 20, 21, 22, 23, 31, 30, 29, 28,
+    36, 37, 38, 39, 47, 46, 45, 44, 52, 53, 54, 55, 63, 62, 61, 60
+};
+
+static const uint8_t ivi4_alternate_scan_4x4[16] = {
+    0, 1, 4, 5, 8, 12, 2, 3, 9, 13, 6, 7, 10, 11, 14, 15
+};
+
+static const uint8_t ivi4_vertical_scan_4x4[16] = {
+    0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15
+};
+
+static const uint8_t ivi4_horizontal_scan_4x4[16] = {
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
+};
+
+static const uint8_t *scan_index_to_tab[15] = {
+    // for 8x8 transforms
+    ff_zigzag_direct,
+    ivi4_alternate_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_vertical_scan_8x8,
+    ff_zigzag_direct,
+
+    // for 4x4 transforms
+    ff_ivi_direct_scan_4x4,
+    ivi4_alternate_scan_4x4,
+    ivi4_vertical_scan_4x4,
+    ivi4_horizontal_scan_4x4,
+    ff_ivi_direct_scan_4x4,
+
+    // TODO: check if those are needed
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8,
+    ff_ivi_horizontal_scan_8x8
+};
+
+/**
+ *  Indeo 4 dequant tables
+ */
+static uint16_t ivi4_quant_8x8_intra[9][64] = {
+  {
+      43,  342,  385,  470,  555,  555,  598,  726,
+     342,  342,  470,  513,  555,  598,  726,  769,
+     385,  470,  555,  555,  598,  726,  726,  811,
+     470,  470,  555,  555,  598,  726,  769,  854,
+     470,  555,  555,  598,  683,  726,  854, 1025,
+     555,  555,  598,  683,  726,  854, 1025, 1153,
+     555,  555,  598,  726,  811,  982, 1195, 1451,
+     555,  598,  726,  811,  982, 1195, 1451, 1793
+  },
+  {
+      86, 1195, 2390, 2390, 4865, 4865, 4865, 4865,
+    1195, 1195, 2390, 2390, 4865, 4865, 4865, 4865,
+    2390, 2390, 4865, 4865, 6827, 6827, 6827, 6827,
+    2390, 2390, 4865, 4865, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827,
+    4865, 4865, 6827, 6827, 6827, 6827, 6827, 6827
+  },
+  {
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835,
+     235, 1067, 1195, 1323, 1451, 1579, 1707, 1835
+  },
+  {
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414,
+    1707, 1707, 3414, 3414, 3414, 3414, 3414, 3414
+  },
+  {
+     897,  897,  897,  897,  897,  897,  897,  897,
+    1067, 1067, 1067, 1067, 1067, 1067, 1067, 1067,
+    1238, 1238, 1238, 1238, 1238, 1238, 1238, 1238,
+    1409, 1409, 1409, 1409, 1409, 1409, 1409, 1409,
+    1579, 1579, 1579, 1579, 1579, 1579, 1579, 1579,
+    1750, 1750, 1750, 1750, 1750, 1750, 1750, 1750,
+    1921, 1921, 1921, 1921, 1921, 1921, 1921, 1921,
+    2091, 2091, 2091, 2091, 2091, 2091, 2091, 2091
+  },
+  {
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414
+  },
+  {
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390,
+    2390, 2390, 2390, 2390, 2390, 2390, 2390, 2390
+  },
+  {
+      22,  171,  214,  257,  257,  299,  299,  342,
+     171,  171,  257,  257,  299,  299,  342,  385,
+     214,  257,  257,  299,  299,  342,  342,  385,
+     257,  257,  257,  299,  299,  342,  385,  427,
+     257,  257,  299,  299,  342,  385,  427,  513,
+     257,  299,  299,  342,  385,  427,  513,  598,
+     299,  299,  299,  385,  385,  470,  598,  726,
+     299,  299,  385,  385,  470,  598,  726,  897
+  },
+  {
+      86,  598, 1195, 1195, 2390, 2390, 2390, 2390,
+     598,  598, 1195, 1195, 2390, 2390, 2390, 2390,
+    1195, 1195, 2390, 2390, 3414, 3414, 3414, 3414,
+    1195, 1195, 2390, 2390, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414,
+    2390, 2390, 3414, 3414, 3414, 3414, 3414, 3414
+  }
+};
+
+static uint16_t ivi4_quant_8x8_inter[9][64] = {
+  {
+     427,  427,  470,  427,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470,
+     427,  427,  470,  470,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     427,  427,  470,  427,  427,  427,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470,
+     470,  470,  470,  470,  470,  470,  470,  470
+  },
+  {
+    1707, 1707, 2433, 2433, 3414, 3414, 3414, 3414,
+    1707, 1707, 2433, 2433, 3414, 3414, 3414, 3414,
+    2433, 2433, 3414, 3414, 4822, 4822, 4822, 4822,
+    2433, 2433, 3414, 3414, 4822, 4822, 4822, 4822,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414,
+    3414, 3414, 4822, 4822, 3414, 3414, 3414, 3414
+  },
+  {
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281,
+    1195, 1195, 1281, 1238, 1195, 1195, 1281, 1281
+  },
+  {
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433,
+    2433, 2433, 3414, 3414, 2433, 2433, 2433, 2433
+  },
+  {
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281,
+    1238, 1238, 1238, 1238, 1238, 1238, 1238, 1238,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1195, 1195, 1195, 1195, 1195, 1195, 1195, 1195,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281,
+    1281, 1281, 1281, 1281, 1281, 1281, 1281, 1281
+  },
+  {
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    3414, 3414, 3414, 3414, 3414, 3414, 3414, 3414,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433,
+    2433, 2433, 2433, 2433, 2433, 2433, 2433, 2433
+  },
+  {
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707,
+    1707, 1707, 1707, 1707, 1707, 1707, 1707, 1707
+  },
+  {
+      86,  171,  171,  214,  214,  214,  214,  257,
+     171,  171,  214,  214,  214,  214,  257,  257,
+     171,  214,  214,  214,  214,  257,  257,  257,
+     214,  214,  214,  214,  257,  257,  257,  299,
+     214,  214,  214,  257,  257,  257,  299,  299,
+     214,  214,  257,  257,  257,  299,  299,  299,
+     214,  257,  257,  257,  299,  299,  299,  342,
+     257,  257,  257,  299,  299,  299,  342,  342
+  },
+  {
+     854,  854, 1195, 1195, 1707, 1707, 1707, 1707,
+     854,  854, 1195, 1195, 1707, 1707, 1707, 1707,
+    1195, 1195, 1707, 1707, 2390, 2390, 2390, 2390,
+    1195, 1195, 1707, 1707, 2390, 2390, 2390, 2390,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707,
+    1707, 1707, 2390, 2390, 1707, 1707, 1707, 1707
+  }
+};
+
+static uint16_t ivi4_quant_4x4_intra[5][16] = {
+  {
+      22,  214,  257,  299,
+     214,  257,  299,  342,
+     257,  299,  342,  427,
+     299,  342,  427,  513
+  },
+  {
+     129, 1025, 1451, 1451,
+    1025, 1025, 1451, 1451,
+    1451, 1451, 2049, 2049,
+    1451, 1451, 2049, 2049
+  },
+  {
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+     171,  171,  171,  171,
+     171,  171,  171,  171,
+     171,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43
+  }
+};
+
+static uint16_t ivi4_quant_4x4_inter[5][16] = {
+  {
+     107,  214,  257,  299,
+     214,  257,  299,  299,
+     257,  299,  299,  342,
+     299,  299,  342,  342
+  },
+  {
+     513, 1025, 1238, 1238,
+    1025, 1025, 1238, 1238,
+    1238, 1238, 1451, 1451,
+    1238, 1238, 1451, 1451
+  },
+  {
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171,
+      43,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+     171,  171,  171,  171,
+     171,  171,  171,  171,
+     171,  171,  171,  171
+  },
+  {
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43,
+      43,   43,   43,   43
+  }
+};
+
+/**
+ *  Table for mapping quant matrix index from the bitstream
+ *  into internal quant table number.
+ */
+static uint8_t  quant_index_to_tab[22] = {
+    0, 1, 0, 2, 1, 3, 0, 4, 1, 5, 0, 1, 6, 7, 8, // for 8x8 quant matrixes
+    0, 1, 2, 2, 3, 3, 4                          // for 4x4 quant matrixes
+};
+
+#endif /* AVCODEC_INDEO4DATA_H */

libavcodec/indeo5.c

@@ -90,7 +90,7 @@ typedef struct {
  */
 static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
 {
-    int             result, i, p, tile_size, pic_size_indx, mb_size, blk_size;
+    int             result, i, p, tile_size, pic_size_indx, mb_size, blk_size, is_scalable;
     int             quant_mat, blk_size_changed = 0;
     IVIBandDesc     *band, *band1, *band2;
     IVIPicConfig    pic_conf;
@@ -112,8 +112,8 @@ static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
     /* num_levels * 3 + 1 */
     pic_conf.luma_bands   = get_bits(&ctx->gb, 2) * 3 + 1;
     pic_conf.chroma_bands = get_bits1(&ctx->gb)   * 3 + 1;
-    ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
-    if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
+    is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
+    if (is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) {
         av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n",
                pic_conf.luma_bands, pic_conf.chroma_bands);
         return -1;
@@ -151,6 +151,7 @@ static int decode_gop_header(IVI5DecContext *ctx, AVCodecContext *avctx)
             return -1;
         }
         ctx->pic_conf = pic_conf;
+        ctx->is_scalable = is_scalable;
         blk_size_changed = 1; /* force reallocation of the internal structures */
     }
 
@@ -481,7 +482,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                 }
 
                 mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
-                if (band->inherit_mv){
+                if (band->inherit_mv && ref_mb){
                     /* motion vector inheritance */
                     if (mv_scale) {
                         mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
@@ -492,7 +493,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                     }
                 }
             } else {
-                if (band->inherit_mv) {
+                if (band->inherit_mv && ref_mb) {
                     mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
                 } else if (ctx->frame_type == FRAMETYPE_INTRA) {
                     mb->type = 0; /* mb_type is always INTRA for intra-frames */
@@ -518,7 +519,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
                 if (!mb->type) {
                     mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
                 } else {
-                    if (band->inherit_mv){
+                    if (band->inherit_mv && ref_mb){
                         /* motion vector inheritance */
                         if (mv_scale) {
                             mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);

libavcodec/ituh263dec.c

@@ -27,6 +27,8 @@
  * h263 decoder.
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 //#define DEBUG
 #include <limits.h>
 

libavcodec/ivi_common.c

@@ -260,6 +260,8 @@ int av_cold ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei
             t_width  >>= 1;
             t_height >>= 1;
         }
+        if(t_width<=0 || t_height<=0)
+            return AVERROR(EINVAL);
 
         for (b = 0; b < planes[p].num_bands; b++) {
             band = &planes[p].bands[b];
@@ -506,7 +508,7 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
             if (band->inherit_qdelta && ref_mb)
                 mb->q_delta = ref_mb->q_delta;
 
-            if (band->inherit_mv) {
+            if (band->inherit_mv && ref_mb) {
                 /* motion vector inheritance */
                 if (mv_scale) {
                     mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
@@ -611,6 +613,9 @@ void ff_ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, int dst_pitch)
     const int16_t   *src  = plane->bands[0].buf;
     uint32_t        pitch = plane->bands[0].pitch;
 
+    if(!src)
+        return;
+
     for (y = 0; y < plane->height; y++) {
         for (x = 0; x < plane->width; x++)
             dst[x] = av_clip_uint8(src[x] + 128);

libavcodec/ivi_dsp.c

@@ -1,7 +1,7 @@
 /*
  * DSP functions for Indeo Video Interactive codecs (Indeo4 and Indeo5)
  *
- * Copyright (c) 2009 Maxim Poliakovski
+ * Copyright (c) 2009-2011 Maxim Poliakovski
  *
  * This file is part of FFmpeg.
  *
@@ -178,6 +178,153 @@ void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst,
     }
 }
 
+void ff_ivi_recompose_haar(const IVIPlaneDesc *plane, uint8_t *dst,
+                           const int dst_pitch, const int num_bands)
+{
+    int             x, y, indx, b0, b1, b2, b3, p0, p1, p2, p3;
+    const IDWTELEM *b0_ptr, *b1_ptr, *b2_ptr, *b3_ptr;
+    int32_t         pitch;
+
+    /* all bands should have the same pitch */
+    pitch = plane->bands[0].pitch;
+
+    /* get pointers to the wavelet bands */
+    b0_ptr = plane->bands[0].buf;
+    b1_ptr = plane->bands[1].buf;
+    b2_ptr = plane->bands[2].buf;
+    b3_ptr = plane->bands[3].buf;
+
+    for (y = 0; y < plane->height; y += 2) {
+        for (x = 0, indx = 0; x < plane->width; x += 2, indx++) {
+            /* load coefficients */
+            b0 = b0_ptr[indx]; //should be: b0 = (num_bands > 0) ? b0_ptr[indx] : 0;
+            b1 = b1_ptr[indx]; //should be: b1 = (num_bands > 1) ? b1_ptr[indx] : 0;
+            b2 = b2_ptr[indx]; //should be: b2 = (num_bands > 2) ? b2_ptr[indx] : 0;
+            b3 = b3_ptr[indx]; //should be: b3 = (num_bands > 3) ? b3_ptr[indx] : 0;
+
+            /* haar wavelet recomposition */
+            p0 = (b0 + b1 + b2 + b3 + 2) >> 2;
+            p1 = (b0 + b1 - b2 - b3 + 2) >> 2;
+            p2 = (b0 - b1 + b2 - b3 + 2) >> 2;
+            p3 = (b0 - b1 - b2 + b3 + 2) >> 2;
+
+            /* bias, convert and output four pixels */
+            dst[x]                 = av_clip_uint8(p0 + 128);
+            dst[x + 1]             = av_clip_uint8(p1 + 128);
+            dst[dst_pitch + x]     = av_clip_uint8(p2 + 128);
+            dst[dst_pitch + x + 1] = av_clip_uint8(p3 + 128);
+        }// for x
+
+        dst += dst_pitch << 1;
+
+        b0_ptr += pitch;
+        b1_ptr += pitch;
+        b2_ptr += pitch;
+        b3_ptr += pitch;
+    }// for y
+}
+
+/** butterfly operation for the inverse Haar transform */
+#define IVI_HAAR_BFLY(s1, s2, o1, o2, t) \
+    t  = (s1 - s2) >> 1;\
+    o1 = (s1 + s2) >> 1;\
+    o2 = t;\
+
+/** inverse 8-point Haar transform */
+#define INV_HAAR8(s1, s5, s3, s7, s2, s4, s6, s8,\
+                  d1, d2, d3, d4, d5, d6, d7, d8,\
+                  t0, t1, t2, t3, t4, t5, t6, t7, t8) {\
+    t1 = s1 << 1; t5 = s5 << 1;\
+    IVI_HAAR_BFLY(t1, t5, t1, t5, t0); IVI_HAAR_BFLY(t1, s3, t1, t3, t0);\
+    IVI_HAAR_BFLY(t5, s7, t5, t7, t0); IVI_HAAR_BFLY(t1, s2, t1, t2, t0);\
+    IVI_HAAR_BFLY(t3, s4, t3, t4, t0); IVI_HAAR_BFLY(t5, s6, t5, t6, t0);\
+    IVI_HAAR_BFLY(t7, s8, t7, t8, t0);\
+    d1 = COMPENSATE(t1);\
+    d2 = COMPENSATE(t2);\
+    d3 = COMPENSATE(t3);\
+    d4 = COMPENSATE(t4);\
+    d5 = COMPENSATE(t5);\
+    d6 = COMPENSATE(t6);\
+    d7 = COMPENSATE(t7);\
+    d8 = COMPENSATE(t8); }
+
+/** inverse 4-point Haar transform */
+#define INV_HAAR4(s1, s3, s5, s7) {\
+    HAAR_BFLY(s1, s5);  HAAR_BFLY(s1, s3);  HAAR_BFLY(s5, s7);\
+    s1 = COMPENSATE(s1);\
+    s3 = COMPENSATE(s3);\
+    s5 = COMPENSATE(s5);\
+    s7 = COMPENSATE(s7); }
+
+void ff_ivi_inverse_haar_8x8(const int32_t *in, int16_t *out, uint32_t pitch,
+                             const uint8_t *flags)
+{
+    int     i, shift, sp1, sp2, sp3, sp4;
+    const int32_t *src;
+    int32_t *dst;
+    int     tmp[64];
+    int     t0, t1, t2, t3, t4, t5, t6, t7, t8;
+
+    /* apply the InvHaar8 to all columns */
+#define COMPENSATE(x) (x)
+    src = in;
+    dst = tmp;
+    for (i = 0; i < 8; i++) {
+        if (flags[i]) {
+            /* pre-scaling */
+            shift = !(i & 4);
+            sp1 = src[ 0] << shift;
+            sp2 = src[ 8] << shift;
+            sp3 = src[16] << shift;
+            sp4 = src[24] << shift;
+            INV_HAAR8(    sp1,     sp2,     sp3,     sp4,
+                      src[32], src[40], src[48], src[56],
+                      dst[ 0], dst[ 8], dst[16], dst[24],
+                      dst[32], dst[40], dst[48], dst[56],
+                      t0, t1, t2, t3, t4, t5, t6, t7, t8);
+        } else
+            dst[ 0] = dst[ 8] = dst[16] = dst[24] =
+            dst[32] = dst[40] = dst[48] = dst[56] = 0;
+
+        src++;
+        dst++;
+    }
+#undef  COMPENSATE
+
+    /* apply the InvHaar8 to all rows */
+#define COMPENSATE(x) (x)
+    src = tmp;
+    for (i = 0; i < 8; i++) {
+        if (   !src[0] && !src[1] && !src[2] && !src[3]
+            && !src[4] && !src[5] && !src[6] && !src[7]) {
+            memset(out, 0, 8 * sizeof(out[0]));
+        } else {
+            INV_HAAR8(src[0], src[1], src[2], src[3],
+                      src[4], src[5], src[6], src[7],
+                      out[0], out[1], out[2], out[3],
+                      out[4], out[5], out[6], out[7],
+                      t0, t1, t2, t3, t4, t5, t6, t7, t8);
+        }
+        src += 8;
+        out += pitch;
+    }
+#undef  COMPENSATE
+}
+
+void ff_ivi_dc_haar_2d(const int32_t *in, int16_t *out, uint32_t pitch,
+                       int blk_size)
+{
+    int     x, y;
+    int16_t dc_coeff;
+
+    dc_coeff = (*in + 0) >> 3;
+
+    for (y = 0; y < blk_size; out += pitch, y++) {
+        for (x = 0; x < blk_size; x++)
+            out[x] = dc_coeff;
+    }
+}
+
 /** butterfly operation for the inverse slant transform */
 #define IVI_SLANT_BFLY(s1, s2, o1, o2, t) \
     t  = s1 - s2;\

libavcodec/ivi_dsp.h

@@ -1,7 +1,7 @@
 /*
  * DSP functions for Indeo Video Interactive codecs (Indeo4 and Indeo5)
  *
- * Copyright (c) 2009 Maxim Poliakovski
+ * Copyright (c) 2009-2011 Maxim Poliakovski
  *
  * This file is part of FFmpeg.
  *
@@ -43,6 +43,43 @@
 void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst,
                         const int dst_pitch, const int num_bands);
 
+/**
+ *  Haar wavelet recomposition filter for Indeo 4
+ *
+ *  @param[in]  plane        pointer to the descriptor of the plane being processed
+ *  @param[out] dst          pointer to the destination buffer
+ *  @param[in]  dst_pitch    pitch of the destination buffer
+ *  @param[in]  num_bands    number of wavelet bands to be processed
+ */
+void ff_ivi_recompose_haar(const IVIPlaneDesc *plane, uint8_t *dst,
+                           const int dst_pitch, const int num_bands);
+
+/**
+ *  two-dimensional inverse Haar 8x8 transform for Indeo 4
+ *
+ *  @param[in]  in        pointer to the vector of transform coefficients
+ *  @param[out] out       pointer to the output buffer (frame)
+ *  @param[in]  pitch     pitch to move to the next y line
+ *  @param[in]  flags     pointer to the array of column flags:
+ *                        != 0 - non_empty column, 0 - empty one
+ *                        (this array must be filled by caller)
+ */
+void ff_ivi_inverse_haar_8x8(const int32_t *in, int16_t *out, uint32_t pitch,
+                             const uint8_t *flags);
+
+/**
+ *  DC-only two-dimensional inverse Haar transform for Indeo 4.
+ *  Performing the inverse transform in this case is equivalent to
+ *  spreading DC_coeff >> 3 over the whole block.
+ *
+ *  @param[in]  in          pointer to the dc coefficient
+ *  @param[out] out         pointer to the output buffer (frame)
+ *  @param[in]  pitch       pitch to move to the next y line
+ *  @param[in]  blk_size    transform block size
+ */
+void ff_ivi_dc_haar_2d(const int32_t *in, int16_t *out, uint32_t pitch,
+                       int blk_size);
+
 /**
  *  two-dimensional inverse slant 8x8 transform
  *

libavcodec/j2k_dwt.c

@@ -321,7 +321,7 @@ int ff_j2k_dwt_init(DWTContext *s, uint16_t border[2][2], int decomp_levels, int
     int i, j, lev = decomp_levels, maxlen,
         b[2][2];
 
-    if (decomp_levels >= FF_DWT_MAX_DECLVLS)
+    if ((unsigned)decomp_levels >= FF_DWT_MAX_DECLVLS)
         return AVERROR_INVALIDDATA;
     s->ndeclevels = decomp_levels;
     s->type = type;

libavcodec/j2kdec.c

@@ -28,6 +28,7 @@
 #include "avcodec.h"
 #include "bytestream.h"
 #include "j2k.h"
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 
 #define JP2_SIG_TYPE    0x6A502020
@@ -220,6 +221,9 @@ static int get_siz(J2kDecoderContext *s)
      s->tile_offset_y = bytestream_get_be32(&s->buf); // YT0Siz
        s->ncomponents = bytestream_get_be16(&s->buf); // CSiz
 
+    if(s->tile_width<=0 || s->tile_height<=0)
+        return AVERROR(EINVAL);
+
     if (s->buf_end - s->buf < 2 * s->ncomponents)
         return AVERROR(EINVAL);
 
@@ -235,6 +239,9 @@ static int get_siz(J2kDecoderContext *s)
     s->numXtiles = ff_j2k_ceildiv(s->width - s->tile_offset_x, s->tile_width);
     s->numYtiles = ff_j2k_ceildiv(s->height - s->tile_offset_y, s->tile_height);
 
+    if(s->numXtiles * (uint64_t)s->numYtiles > INT_MAX/sizeof(J2kTile))
+        return AVERROR(EINVAL);
+
     s->tile = av_mallocz(s->numXtiles * s->numYtiles * sizeof(J2kTile));
     if (!s->tile)
         return AVERROR(ENOMEM);
@@ -283,6 +290,10 @@ static int get_cox(J2kDecoderContext *s, J2kCodingStyle *c)
      c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width
     c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height
 
+    if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
+        return AVERROR_PATCHWELCOME;
+    }
+
     c->cblk_style = bytestream_get_byte(&s->buf);
     if (c->cblk_style != 0){ // cblk style
         av_log(s->avctx, AV_LOG_WARNING, "extra cblk styles %X\n", c->cblk_style);
@@ -359,7 +370,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
 
     if (q->quantsty == J2K_QSTY_NONE){
         n -= 3;
-        if (s->buf_end - s->buf < n)
+        if (s->buf_end - s->buf < n || 32*3 < n)
             return AVERROR(EINVAL);
         for (i = 0; i < n; i++)
             q->expn[i] = bytestream_get_byte(&s->buf) >> 3;
@@ -376,7 +387,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
         }
     } else{
         n = (n - 3) >> 1;
-        if (s->buf_end - s->buf < n)
+        if (s->buf_end - s->buf < n || 32*3 < n)
             return AVERROR(EINVAL);
         for (i = 0; i < n; i++){
             x = bytestream_get_be16(&s->buf);
@@ -421,6 +432,10 @@ static uint8_t get_sot(J2kDecoderContext *s)
         return AVERROR(EINVAL);
 
     s->curtileno = bytestream_get_be16(&s->buf); ///< Isot
+    if((unsigned)s->curtileno >= s->numXtiles * s->numYtiles){
+        s->curtileno=0;
+        return AVERROR(EINVAL);
+    }
 
     s->buf += 4; ///< Psot (ignored)
 
@@ -695,6 +710,9 @@ static int decode_cblk(J2kDecoderContext *s, J2kCodingStyle *codsty, J2kT1Contex
     int bpass_csty_symbol = J2K_CBLK_BYPASS & codsty->cblk_style;
     int vert_causal_ctx_csty_symbol = J2K_CBLK_VSC & codsty->cblk_style;
 
+    av_assert0(width  <= J2K_MAX_CBLKW);
+    av_assert0(height <= J2K_MAX_CBLKH);
+
     for (y = 0; y < height+2; y++)
         memset(t1->flags[y], 0, (width+2)*sizeof(int));
 
@@ -911,7 +929,7 @@ static int decode_codestream(J2kDecoderContext *s)
 
         marker = bytestream_get_be16(&s->buf);
         if(s->avctx->debug & FF_DEBUG_STARTCODE)
-            av_log(s->avctx, AV_LOG_DEBUG, "marker 0x%.4X at pos 0x%x\n", marker, s->buf - s->buf_start - 4);
+            av_log(s->avctx, AV_LOG_DEBUG, "marker 0x%.4X at pos 0x%tx\n", marker, s->buf - s->buf_start - 4);
         oldbuf = s->buf;
 
         if (marker == J2K_SOD){

libavcodec/jpeglsdec.c

@@ -143,6 +143,8 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state, int RI
         ret = ret >> 1;
     }
 
+    if(FFABS(ret) > 0xFFFF)
+        return -0x10000;
     /* update state */
     state->A[Q] += FFABS(ret) - RItype;
     ret *= state->twonear;

libavcodec/kmvc.c

@@ -57,17 +57,21 @@ typedef struct BitBuf {
 
 #define kmvc_init_getbits(bb, src)  bb.bits = 7; bb.bitbuf = *src++;
 
-#define kmvc_getbit(bb, src, res) {\
+#define kmvc_getbit(bb, src, src_end, res) {\
     res = 0; \
     if (bb.bitbuf & (1 << bb.bits)) res = 1; \
     bb.bits--; \
     if(bb.bits == -1) { \
+        if (src >= src_end) { \
+            av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n"); \
+            return AVERROR_INVALIDDATA; \
+        } \
         bb.bitbuf = *src++; \
         bb.bits = 7; \
     } \
 }
 
-static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w, int h)
+static int kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int src_size, int w, int h)
 {
     BitBuf bb;
     int res, val;
@@ -75,13 +79,18 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
     int bx, by;
     int l0x, l1x, l0y, l1y;
     int mx, my;
+    const uint8_t *src_end = src + src_size;
 
     kmvc_init_getbits(bb, src);
 
     for (by = 0; by < h; by += 8)
         for (bx = 0; bx < w; bx += 8) {
-            kmvc_getbit(bb, src, res);
+            kmvc_getbit(bb, src, src_end, res);
             if (!res) {         // fill whole 8x8 block
+                if (src >= src_end) {
+                    av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 val = *src++;
                 for (i = 0; i < 64; i++)
                     BLK(ctx->cur, bx + (i & 0x7), by + (i >> 3)) = val;
@@ -89,14 +98,22 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 for (i = 0; i < 4; i++) {
                     l0x = bx + (i & 1) * 4;
                     l0y = by + (i & 2) * 2;
-                    kmvc_getbit(bb, src, res);
+                    kmvc_getbit(bb, src, src_end, res);
                     if (!res) {
-                        kmvc_getbit(bb, src, res);
+                        kmvc_getbit(bb, src, src_end, res);
                         if (!res) {     // fill whole 4x4 block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             for (j = 0; j < 16; j++)
                                 BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = val;
                         } else {        // copy block from already decoded place
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             mx = val & 0xF;
                             my = val >> 4;
@@ -108,16 +125,24 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                         for (j = 0; j < 4; j++) {
                             l1x = l0x + (j & 1) * 2;
                             l1y = l0y + (j & 2);
-                            kmvc_getbit(bb, src, res);
+                            kmvc_getbit(bb, src, src_end, res);
                             if (!res) {
-                                kmvc_getbit(bb, src, res);
+                                kmvc_getbit(bb, src, src_end, res);
                                 if (!res) {     // fill whole 2x2 block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     BLK(ctx->cur, l1x, l1y) = val;
                                     BLK(ctx->cur, l1x + 1, l1y) = val;
                                     BLK(ctx->cur, l1x, l1y + 1) = val;
                                     BLK(ctx->cur, l1x + 1, l1y + 1) = val;
                                 } else {        // copy block from already decoded place
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     mx = val & 0xF;
                                     my = val >> 4;
@@ -140,9 +165,11 @@ static void kmvc_decode_intra_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 }
             }
         }
+
+    return 0;
 }
 
-static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w, int h)
+static int kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int src_size, int w, int h)
 {
     BitBuf bb;
     int res, val;
@@ -150,15 +177,20 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
     int bx, by;
     int l0x, l1x, l0y, l1y;
     int mx, my;
+    const uint8_t *src_end = src + src_size;
 
     kmvc_init_getbits(bb, src);
 
     for (by = 0; by < h; by += 8)
         for (bx = 0; bx < w; bx += 8) {
-            kmvc_getbit(bb, src, res);
+            kmvc_getbit(bb, src, src_end, res);
             if (!res) {
-                kmvc_getbit(bb, src, res);
+                kmvc_getbit(bb, src, src_end, res);
                 if (!res) {     // fill whole 8x8 block
+                    if (src >= src_end) {
+                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     val = *src++;
                     for (i = 0; i < 64; i++)
                         BLK(ctx->cur, bx + (i & 0x7), by + (i >> 3)) = val;
@@ -171,14 +203,22 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 for (i = 0; i < 4; i++) {
                     l0x = bx + (i & 1) * 4;
                     l0y = by + (i & 2) * 2;
-                    kmvc_getbit(bb, src, res);
+                    kmvc_getbit(bb, src, src_end, res);
                     if (!res) {
-                        kmvc_getbit(bb, src, res);
+                        kmvc_getbit(bb, src, src_end, res);
                         if (!res) {     // fill whole 4x4 block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             for (j = 0; j < 16; j++)
                                 BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = val;
                         } else {        // copy block
+                            if (src >= src_end) {
+                                av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                return AVERROR_INVALIDDATA;
+                            }
                             val = *src++;
                             mx = (val & 0xF) - 8;
                             my = (val >> 4) - 8;
@@ -190,16 +230,24 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                         for (j = 0; j < 4; j++) {
                             l1x = l0x + (j & 1) * 2;
                             l1y = l0y + (j & 2);
-                            kmvc_getbit(bb, src, res);
+                            kmvc_getbit(bb, src, src_end, res);
                             if (!res) {
-                                kmvc_getbit(bb, src, res);
+                                kmvc_getbit(bb, src, src_end, res);
                                 if (!res) {     // fill whole 2x2 block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     BLK(ctx->cur, l1x, l1y) = val;
                                     BLK(ctx->cur, l1x + 1, l1y) = val;
                                     BLK(ctx->cur, l1x, l1y + 1) = val;
                                     BLK(ctx->cur, l1x + 1, l1y + 1) = val;
                                 } else {        // copy block
+                                    if (src >= src_end) {
+                                        av_log(ctx->avctx, AV_LOG_ERROR, "Data overrun\n");
+                                        return AVERROR_INVALIDDATA;
+                                    }
                                     val = *src++;
                                     mx = (val & 0xF) - 8;
                                     my = (val >> 4) - 8;
@@ -222,6 +270,8 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, const uint8_t * src, int w,
                 }
             }
         }
+
+    return 0;
 }
 
 static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPacket *avpkt)
@@ -299,10 +349,10 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPa
         memcpy(ctx->cur, ctx->prev, 320 * 200);
         break;
     case 3:
-        kmvc_decode_intra_8x8(ctx, buf, avctx->width, avctx->height);
+        kmvc_decode_intra_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
         break;
     case 4:
-        kmvc_decode_inter_8x8(ctx, buf, avctx->width, avctx->height);
+        kmvc_decode_inter_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
         break;
     default:
         av_log(avctx, AV_LOG_ERROR, "Unknown compression method %i\n", header & KMVC_METHOD);

libavcodec/lagarith.c

@@ -524,6 +524,50 @@ static int lag_decode_frame(AVCodecContext *avctx,
                 srcs[i] += l->rgb_stride;
         }
         break;
+    case FRAME_ARITH_RGB24:
+        avctx->pix_fmt = PIX_FMT_RGB24;
+
+        if (avctx->get_buffer(avctx, p) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+            return -1;
+        }
+        offs[0] = offset_bv;
+        offs[1] = offset_gu;
+        offs[2] = 9;
+
+        if (!l->rgb_planes) {
+            l->rgb_stride = FFALIGN(avctx->width, 16);
+            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * 3);
+            if (!l->rgb_planes) {
+                av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
+                return AVERROR(ENOMEM);
+            }
+        }
+        for (i = 0; i < 3; i++)
+            srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
+        for (i = 0; i < 3; i++)
+            lag_decode_arith_plane(l, srcs[i],
+                                   avctx->width, avctx->height,
+                                   -l->rgb_stride, buf + offs[i],
+                                   buf_size);
+        dst = p->data[0];
+        for (i = 0; i < 3; i++)
+            srcs[i] = l->rgb_planes + i * l->rgb_stride * avctx->height;
+        for (j = 0; j < avctx->height; j++) {
+            for (i = 0; i < avctx->width; i++) {
+                uint8_t r, g, b;
+                r = srcs[0][i];
+                g = srcs[1][i];
+                b = srcs[2][i];
+                dst[3*i+0] = r+g;
+                dst[3*i+1] = g;
+                dst[3*i+2] = b+g;
+            }
+            dst += p->linesize[0];
+            for (i = 0; i < 3; i++)
+                srcs[i] += l->rgb_stride;
+        }
+        break;
     case FRAME_ARITH_YV12:
         avctx->pix_fmt = PIX_FMT_YUV420P;
 

libavcodec/lcldec.c

@@ -96,7 +96,13 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign
             ofs = FFMIN(ofs, destptr - destptr_bak);
             cnt *= 4;
             cnt = FFMIN(cnt, destptr_end - destptr);
-            av_memcpy_backptr(destptr, ofs, cnt);
+            if (ofs) {
+                av_memcpy_backptr(destptr, ofs, cnt);
+            } else {
+                // Not known what the correct behaviour is, but
+                // this at least avoids uninitialized data.
+                memset(destptr, 0, cnt);
+            }
             destptr += cnt;
         }
         maskbit >>= 1;

libavcodec/libavcodec.v

@@ -25,5 +25,7 @@ LIBAVCODEC_$MAJOR {
                 ff_mmxext_idct;
                 ff_idct_xvid*;
                 ff_jpeg_fdct*;
+                #XBMC's configure checks for ff_vdpau_vc1_decode_picture()
+                ff_vdpau_vc1_decode_picture;
         local:  *;
 };

libavcodec/libgsm.c

@@ -155,7 +155,7 @@ static av_cold int libgsm_decode_init(AVCodecContext *avctx) {
         break;
     case CODEC_ID_GSM_MS: {
         int one = 1;
-        gsm_option(avctx->priv_data, GSM_OPT_WAV49, &one);
+        gsm_option(s->state, GSM_OPT_WAV49, &one);
         avctx->frame_size  = 2 * GSM_FRAME_SIZE;
         avctx->block_align = GSM_MS_BLOCK_SIZE;
         }
@@ -212,9 +212,12 @@ static int libgsm_decode_frame(AVCodecContext *avctx, void *data,
 
 static void libgsm_flush(AVCodecContext *avctx) {
     LibGSMDecodeContext *s = avctx->priv_data;
+    int one = 1;
 
     gsm_destroy(s->state);
     s->state = gsm_create();
+    if (avctx->codec_id == CODEC_ID_GSM_MS)
+        gsm_option(s->state, GSM_OPT_WAV49, &one);
 }
 
 AVCodec ff_libgsm_decoder = {

libavcodec/libopenjpegdec.c

@@ -52,9 +52,10 @@ static enum PixelFormat check_image_attributes(AVCodecContext *avctx, opj_image_
 
     switch (compRatio) {
     case 0111111: goto libopenjpeg_yuv444_rgb;
+    case 0111212: return PIX_FMT_YUV440P;
     case 0112121: goto libopenjpeg_yuv422;
     case 0112222: goto libopenjpeg_yuv420;
-    default: return PIX_FMT_RGB24;
+    default: goto libopenjpeg_rgb;
     }
 
 libopenjpeg_yuv420:
@@ -80,9 +81,25 @@ libopenjpeg_yuv444_rgb:
     case 10: return PIX_FMT_YUV444P10;
     case 16: return PIX_FMT_YUV444P16;
     }
+
+libopenjpeg_rgb:
+    switch (c0.prec) {
+    case 8: return PIX_FMT_RGB24;
+    default: return PIX_FMT_RGB48;
+    }
+
     return PIX_FMT_RGB24;
 }
 
+static int is_yuva420(opj_image_t *image)
+{
+    return image->numcomps == 4 &&
+           image->comps[0].dx == 1 && image->comps[0].dy == 1 &&
+           image->comps[1].dx == 2 && image->comps[1].dy == 2 &&
+           image->comps[2].dx == 2 && image->comps[2].dy == 2 &&
+           image->comps[3].dx == 1 && image->comps[3].dy == 1;
+}
+
 static inline int libopenjpeg_ispacked(enum PixelFormat pix_fmt) {
     int i, component_plane;
     component_plane = av_pix_fmt_descriptors[pix_fmt].comp[0].plane;
@@ -107,6 +124,24 @@ static inline void libopenjpeg_copy_to_packed8(AVFrame *picture, opj_image_t *im
     }
 }
 
+static inline void libopenjpeg_copy_to_packed16(AVFrame *picture, opj_image_t *image) {
+    uint16_t *img_ptr;
+    int index, x, y, c;
+    int adjust[4];
+    for (x = 0; x < image->numcomps; x++) {
+        adjust[x] = FFMAX(FFMIN(16 - image->comps[x].prec, 8), 0);
+    }
+    for (y = 0; y < picture->height; y++) {
+        index = y*picture->width;
+        img_ptr = (uint16_t*) (picture->data[0] + y*picture->linesize[0]);
+        for (x = 0; x < picture->width; x++, index++) {
+            for (c = 0; c < image->numcomps; c++) {
+                *img_ptr++ = image->comps[c].data[index] << adjust[c];
+            }
+        }
+    }
+}
+
 static inline void libopenjpeg_copyto8(AVFrame *picture, opj_image_t *image) {
     int *comp_data;
     uint8_t *img_ptr;
@@ -114,8 +149,8 @@ static inline void libopenjpeg_copyto8(AVFrame *picture, opj_image_t *image) {
 
     for(index = 0; index < image->numcomps; index++) {
         comp_data = image->comps[index].data;
-        img_ptr = picture->data[index];
         for(y = 0; y < image->comps[index].h; y++) {
+            img_ptr = picture->data[index] + y * picture->linesize[index];
             for(x = 0; x < image->comps[index].w; x++) {
                 *img_ptr = (uint8_t) *comp_data;
                 img_ptr++;
@@ -131,8 +166,8 @@ static inline void libopenjpeg_copyto16(AVFrame *picture, opj_image_t *image) {
     int index, x, y;
     for(index = 0; index < image->numcomps; index++) {
         comp_data = image->comps[index].data;
-        img_ptr = (uint16_t*) picture->data[index];
         for(y = 0; y < image->comps[index].h; y++) {
+            img_ptr = (uint16_t*) (picture->data[index] + y * picture->linesize[index]);
             for(x = 0; x < image->comps[index].w; x++) {
                 *img_ptr = *comp_data;
                 img_ptr++;
@@ -227,7 +262,7 @@ static int libopenjpeg_decode_frame(AVCodecContext *avctx,
              break;
     case 3:  avctx->pix_fmt = check_image_attributes(avctx, image);
              break;
-    case 4:  avctx->pix_fmt = PIX_FMT_RGBA;
+    case 4:  avctx->pix_fmt = is_yuva420(image) ? PIX_FMT_YUVA420P : PIX_FMT_RGBA;
              break;
     default: av_log(avctx, AV_LOG_ERROR, "%d components unsupported.\n", image->numcomps);
              goto done;
@@ -271,10 +306,16 @@ static int libopenjpeg_decode_frame(AVCodecContext *avctx,
         libopenjpeg_copyto16(picture, image);
         break;
     case 3:
+    case 4:
         if (ispacked) {
             libopenjpeg_copy_to_packed8(picture, image);
         }
         break;
+    case 6:
+        if (ispacked) {
+            libopenjpeg_copy_to_packed16(picture, image);
+        }
+        break;
     default:
         av_log(avctx, AV_LOG_ERROR, "unsupported pixel size %d\n", pixel_size);
         goto done;

libavcodec/libopenjpegenc.c

@@ -372,6 +372,7 @@ AVCodec ff_libopenjpeg_encoder = {
                                            PIX_FMT_YUV440P,PIX_FMT_YUV444P,
                                            PIX_FMT_YUV420P9,PIX_FMT_YUV422P9,PIX_FMT_YUV444P9,
                                            PIX_FMT_YUV420P10,PIX_FMT_YUV422P10,PIX_FMT_YUV444P10,
-                                           PIX_FMT_YUV420P16,PIX_FMT_YUV422P16,PIX_FMT_YUV444P16},
+                                           PIX_FMT_YUV420P16,PIX_FMT_YUV422P16,PIX_FMT_YUV444P16,
+                                           PIX_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("OpenJPEG based JPEG 2000 encoder"),
 } ;

libavcodec/libx264.c

@@ -174,7 +174,7 @@ static int X264_frame(AVCodecContext *ctx, uint8_t *buf,
             frame->pict_type == AV_PICTURE_TYPE_P ? X264_TYPE_P :
             frame->pict_type == AV_PICTURE_TYPE_B ? X264_TYPE_B :
                                             X264_TYPE_AUTO;
-        if (x4->params.b_tff != frame->top_field_first) {
+        if (x4->params.b_interlaced && x4->params.b_tff != frame->top_field_first) {
             x4->params.b_tff = frame->top_field_first;
             x264_encoder_reconfig(x4->enc, &x4->params);
         }

libavcodec/mjpegdec.c

@@ -233,6 +233,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         return -1;
     }
 
+    if(s->lossless && s->avctx->lowres){
+        av_log(s->avctx, AV_LOG_ERROR, "lowres is not possible with lossless jpeg\n");
+        return -1;
+    }
+
     height = get_bits(&s->gb, 16);
     width = get_bits(&s->gb, 16);
 
@@ -277,7 +282,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         return -1;
     }
 
-    if(s->v_max==1 && s->h_max==1 && s->lossless==1) s->rgb=1;
+    if(s->v_max==1 && s->h_max==1 && s->lossless==1 && nb_components==3) s->rgb=1;
 
     /* if different size, realloc/alloc picture */
     /* XXX: also check h_count and v_count */
@@ -336,7 +341,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
         assert(s->nb_components==3);
         break;
     case 0x11000000:
-        s->avctx->pix_fmt = PIX_FMT_GRAY8;
+        if(s->bits <= 8)
+            s->avctx->pix_fmt = PIX_FMT_GRAY8;
+        else
+            s->avctx->pix_fmt = PIX_FMT_GRAY16;
         break;
     case 0x12111100:
         s->avctx->pix_fmt = s->cs_itu601 ? PIX_FMT_YUV440P : PIX_FMT_YUVJ440P;
@@ -640,7 +648,7 @@ static int decode_block_refinement(MJpegDecodeContext *s, DCTELEM *block, uint8_
 #undef REFINE_BIT
 #undef ZERO_RUN
 
-static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point_transform){
+static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int predictor, int point_transform){
     int i, mb_x, mb_y;
     uint16_t (*buffer)[4];
     int left[3], top[3], topleft[3];
@@ -651,7 +659,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
     buffer= s->ljpeg_buffer;
 
     for(i=0; i<3; i++){
-        buffer[0][i]= 1 << (s->bits + point_transform - 1);
+        buffer[0][i]= 1 << (s->bits - 1);
     }
     for(mb_y = 0; mb_y < s->mb_height; mb_y++) {
         const int modified_predictor= mb_y ? predictor : 1;
@@ -667,16 +675,20 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
             if (s->restart_interval && !s->restart_count)
                 s->restart_count = s->restart_interval;
 
-            for(i=0;i<3;i++) {
-                int pred;
+            for(i=0;i<nb_components;i++) {
+                int pred, dc;
 
                 topleft[i]= top[i];
                 top[i]= buffer[mb_x][i];
 
                 PREDICT(pred, topleft[i], top[i], left[i], modified_predictor);
 
+                dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                if(dc == 0xFFFF)
+                    return -1;
+
                 left[i]=
-                buffer[mb_x][i]= mask & (pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform));
+                buffer[mb_x][i]= mask & (pred + (dc << point_transform));
             }
 
             if (s->restart_interval && !--s->restart_count) {
@@ -698,10 +710,11 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
                 ptr[3*mb_x+2] = buffer[mb_x][2] + ptr[3*mb_x+1];
             }
         }else{
-            for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
-                ptr[3*mb_x+0] = buffer[mb_x][2];
-                ptr[3*mb_x+1] = buffer[mb_x][1];
-                ptr[3*mb_x+2] = buffer[mb_x][0];
+            for(i=0;i<nb_components;i++) {
+                int c= s->comp_index[i];
+                for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
+                    ptr[3*mb_x+2-c] = buffer[mb_x][i];
+                }
             }
         }
     }
@@ -710,7 +723,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point
 
 static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point_transform){
     int i, mb_x, mb_y;
-    const int nb_components=3;
+    const int nb_components=s->nb_components;
+    int bits= (s->bits+7)&~7;
+
+    point_transform += bits - s->bits;
+
+    av_assert0(nb_components==1 || nb_components==3);
 
     for(mb_y = 0; mb_y < s->mb_height; mb_y++) {
         for(mb_x = 0; mb_x < s->mb_width; mb_x++) {
@@ -720,6 +738,7 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
             if(mb_x==0 || mb_y==0 || s->interlaced){
                 for(i=0;i<nb_components;i++) {
                     uint8_t *ptr;
+                    uint16_t *ptr16;
                     int n, h, v, x, y, c, j, linesize;
                     n = s->nb_blocks[i];
                     c = s->comp_index[i];
@@ -729,13 +748,19 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
                     y = 0;
                     linesize= s->linesize[c];
 
-                    for(j=0; j<n; j++) {
-                        int pred;
+                    if(bits>8) linesize /= 2;
 
+                    for(j=0; j<n; j++) {
+                        int pred, dc;
+
+                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                        if(dc == 0xFFFF)
+                            return -1;
+                        if(bits<=8){
                         ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                         if(y==0 && mb_y==0){
                             if(x==0 && mb_x==0){
-                                pred= 128 << point_transform;
+                                pred= 1 << (bits - 1);
                             }else{
                                 pred= ptr[-1];
                             }
@@ -749,8 +774,27 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
 
                         if (s->interlaced && s->bottom_field)
                             ptr += linesize >> 1;
-                        *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform);
+                        *ptr= pred + (dc << point_transform);
+                        }else{
+                            ptr16 = s->picture.data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x); //FIXME optimize this crap
+                            if(y==0 && mb_y==0){
+                                if(x==0 && mb_x==0){
+                                    pred= 1 << (bits - 1);
+                                }else{
+                                    pred= ptr16[-1];
+                                }
+                            }else{
+                                if(x==0 && mb_x==0){
+                                    pred= ptr16[-linesize];
+                                }else{
+                                    PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor);
+                                }
+                            }
 
+                            if (s->interlaced && s->bottom_field)
+                                ptr16 += linesize >> 1;
+                            *ptr16= pred + (dc << point_transform);
+                        }
                         if (++x == h) {
                             x = 0;
                             y++;
@@ -760,7 +804,8 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
             }else{
                 for(i=0;i<nb_components;i++) {
                     uint8_t *ptr;
-                    int n, h, v, x, y, c, j, linesize;
+                    uint16_t *ptr16;
+                    int n, h, v, x, y, c, j, linesize, dc;
                     n = s->nb_blocks[i];
                     c = s->comp_index[i];
                     h = s->h_scount[i];
@@ -769,12 +814,25 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point
                     y = 0;
                     linesize= s->linesize[c];
 
+                    if(bits>8) linesize /= 2;
+
                     for(j=0; j<n; j++) {
                         int pred;
 
+                        dc = mjpeg_decode_dc(s, s->dc_index[i]);
+                        if(dc == 0xFFFF)
+                            return -1;
+                        if(bits<=8){
                         ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap
                         PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor);
-                        *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform);
+
+                        *ptr= pred + (dc << point_transform);
+                        }else{
+                            ptr16 = s->picture.data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x); //FIXME optimize this crap
+                            PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor);
+
+                            *ptr16= pred + (dc << point_transform);
+                        }
                         if (++x == h) {
                             x = 0;
                             y++;
@@ -1011,7 +1069,7 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
         if (s->dc_index[i] <  0 || s->ac_index[i] < 0 ||
             s->dc_index[i] >= 4 || s->ac_index[i] >= 4)
             goto out_of_range;
-        if (!s->vlcs[0][s->dc_index[i]].table || !s->vlcs[1][s->ac_index[i]].table)
+        if (!s->vlcs[0][s->dc_index[i]].table || !(s->progressive ? s->vlcs[2][s->ac_index[0]].table : s->vlcs[1][s->ac_index[i]].table))
             goto out_of_range;
     }
 
@@ -1060,7 +1118,7 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s,
                 return -1;
         }else{
             if(s->rgb){
-                if(ljpeg_decode_rgb_scan(s, predictor, point_transform) < 0)
+                if(ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform) < 0)
                     return -1;
             }else{
                 if(ljpeg_decode_yuv_scan(s, predictor, point_transform) < 0)

libavcodec/mlp_parser.c

@@ -263,6 +263,9 @@ static int mlp_parse(AVCodecParserContext *s,
         mp->bytes_left = ((mp->pc.index > 0 ? mp->pc.buffer[0] : buf[0]) << 8)
                        |  (mp->pc.index > 1 ? mp->pc.buffer[1] : buf[1-mp->pc.index]);
         mp->bytes_left = (mp->bytes_left & 0xfff) * 2;
+        if (mp->bytes_left <= 0) { // prevent infinite loop
+            goto lost_sync;
+        }
         mp->bytes_left -= mp->pc.index;
     }
 

libavcodec/mlpdec.c

@@ -476,9 +476,18 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
         }
     }
     if (m->avctx->codec_id == CODEC_ID_TRUEHD &&
-        m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1) {
+        (m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1 ||
+        m->avctx->channel_layout == AV_CH_LAYOUT_7POINT1_WIDE)) {
         FFSWAP(int, s->ch_assign[4], s->ch_assign[6]);
         FFSWAP(int, s->ch_assign[5], s->ch_assign[7]);
+    } else if (m->avctx->codec_id == CODEC_ID_TRUEHD &&
+        (m->avctx->channel_layout == AV_CH_LAYOUT_6POINT1 ||
+        m->avctx->channel_layout == (AV_CH_LAYOUT_6POINT1 | AV_CH_TOP_CENTER) ||
+        m->avctx->channel_layout == (AV_CH_LAYOUT_6POINT1 | AV_CH_TOP_FRONT_CENTER))) {
+        int i = s->ch_assign[6];
+        s->ch_assign[6] = s->ch_assign[5];
+        s->ch_assign[5] = s->ch_assign[4];
+        s->ch_assign[4] = i;
     }
 
     checksum = ff_mlp_restart_checksum(buf, get_bits_count(gbp) - start_count);

libavcodec/motion_est.c

@@ -536,8 +536,8 @@ static inline void get_limits(MpegEncContext *s, int x, int y)
     if (s->unrestricted_mv) {
         c->xmin = - x - 16;
         c->ymin = - y - 16;
-        c->xmax = - x + s->mb_width *16;
-        c->ymax = - y + s->mb_height*16;
+        c->xmax = - x + s->width;
+        c->ymax = - y + s->height;
     } else if (s->out_format == FMT_H261){
         // Search range of H261 is different from other codec standards
         c->xmin = (x > 15) ? - 15 : 0;
@@ -576,10 +576,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
     const int h=8;
     int block;
     int P[10][2];
-    int dmin_sum=0, mx4_sum=0, my4_sum=0;
+    int dmin_sum=0, mx4_sum=0, my4_sum=0, i;
     int same=1;
     const int stride= c->stride;
     uint8_t *mv_penalty= c->current_mv_penalty;
+    int saftey_cliping= s->unrestricted_mv && (s->width&15) && (s->height&15);
 
     init_mv4_ref(c);
 
@@ -591,6 +592,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
         const int mot_stride = s->b8_stride;
         const int mot_xy = s->block_index[block];
 
+        if(saftey_cliping){
+            c->xmax = - 16*s->mb_x + s->width  - 8*(block &1);
+            c->ymax = - 16*s->mb_y + s->height - 8*(block>>1);
+        }
+
         P_LEFT[0] = s->current_picture.f.motion_val[0][mot_xy - 1][0];
         P_LEFT[1] = s->current_picture.f.motion_val[0][mot_xy - 1][1];
 
@@ -618,6 +624,11 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift)
         }
         P_MV1[0]= mx;
         P_MV1[1]= my;
+        if(saftey_cliping)
+            for(i=0; i<10; i++){
+                if(P[i][0] > (c->xmax<<shift)) P[i][0]= (c->xmax<<shift);
+                if(P[i][1] > (c->ymax<<shift)) P[i][1]= (c->ymax<<shift);
+            }
 
         dmin4 = epzs_motion_search4(s, &mx4, &my4, P, block, block, s->p_mv_table, (1<<16)>>shift);
 

libavcodec/mpeg12.c

@@ -25,6 +25,8 @@
  * MPEG-1/2 decoder
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 //#define DEBUG
 #include "internal.h"
 #include "avcodec.h"
@@ -1248,7 +1250,7 @@ static int mpeg_decode_postinit(AVCodecContext *avctx)
         s1->save_width           != s->width                ||
         s1->save_height          != s->height               ||
         s1->save_aspect_info     != s->aspect_ratio_info    ||
-        s1->save_progressive_seq != s->progressive_sequence ||
+        (s1->save_progressive_seq != s->progressive_sequence && (s->height&31)) ||
         0)
     {
 
@@ -2030,6 +2032,7 @@ static int mpeg1_decode_sequence(AVCodecContext *avctx,
     s->progressive_sequence = 1;
     s->progressive_frame    = 1;
     s->picture_structure    = PICT_FRAME;
+    s->first_field          = 0;
     s->frame_pred_frame_dct = 1;
     s->chroma_format        = 1;
     s->codec_id             = s->avctx->codec_id = CODEC_ID_MPEG1VIDEO;
@@ -2089,6 +2092,7 @@ static int vcr2_init_sequence(AVCodecContext *avctx)
     s->progressive_sequence  = 1;
     s->progressive_frame     = 1;
     s->picture_structure     = PICT_FRAME;
+    s->first_field           = 0;
     s->frame_pred_frame_dct  = 1;
     s->chroma_format         = 1;
     s->codec_id              = s->avctx->codec_id = CODEC_ID_MPEG2VIDEO;

libavcodec/mpeg12enc.c

@@ -184,6 +184,7 @@ static av_cold int encode_init(AVCodecContext *avctx)
         s->tc.rate = avpriv_frame_rate_tab[s->frame_rate_index];
         if (ff_init_smtpe_timecode(s, &s->tc) < 0)
             return -1;
+        s->drop_frame_timecode = s->tc.drop;
         s->avctx->timecode_frame_start = s->tc.start;
     } else {
         s->avctx->timecode_frame_start = 0; // default is -1

libavcodec/mpeg4audio.c

@@ -82,6 +82,9 @@ int avpriv_mpeg4audio_get_config(MPEG4AudioConfig *c, const uint8_t *buf,
     GetBitContext gb;
     int specific_config_bitindex;
 
+    if(bit_size<=0)
+        return AVERROR_INVALIDDATA;
+
     init_get_bits(&gb, buf, bit_size);
     c->object_type = get_object_type(&gb);
     c->sample_rate = get_sample_rate(&gb, &c->sampling_index);

libavcodec/mpeg4video_parser.c

@@ -20,6 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "parser.h"
 #include "mpegvideo.h"
 #include "mpeg4video.h"

libavcodec/mpeg4videodec.c

@@ -20,6 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/opt.h"
 #include "mpegvideo.h"
 #include "mpeg4video.h"
@@ -158,7 +160,7 @@ static inline int mpeg4_is_resync(MpegEncContext *s){
     return 0;
 }
 
-static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb)
+static int mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb)
 {
     int i;
     int a= 2<<s->sprite_warping_accuracy;
@@ -174,6 +176,9 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
     int h= s->height;
     int min_ab;
 
+    if(w<=0 || h<=0)
+        return -1;
+
     for(i=0; i<s->num_sprite_warping_points; i++){
         int length;
         int x=0, y=0;
@@ -346,6 +351,7 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
         }
         s->real_sprite_warping_points= s->num_sprite_warping_points;
     }
+    return 0;
 }
 
 /**
@@ -409,7 +415,8 @@ int mpeg4_decode_video_packet_header(MpegEncContext *s)
             skip_bits(&s->gb, 3); /* intra dc vlc threshold */
 //FIXME don't just ignore everything
             if(s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE){
-                mpeg4_decode_sprite_trajectory(s, &s->gb);
+                if(mpeg4_decode_sprite_trajectory(s, &s->gb) < 0)
+                    return -1;
                 av_log(s->avctx, AV_LOG_ERROR, "untested\n");
             }
 
@@ -2049,7 +2056,8 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){
      }
 
      if(s->pict_type == AV_PICTURE_TYPE_S && (s->vol_sprite_usage==STATIC_SPRITE || s->vol_sprite_usage==GMC_SPRITE)){
-         mpeg4_decode_sprite_trajectory(s, gb);
+         if(mpeg4_decode_sprite_trajectory(s, gb) < 0)
+             return -1;
          if(s->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, "sprite_brightness_change not supported\n");
          if(s->vol_sprite_usage==STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, "static sprite not supported\n");
      }

libavcodec/mpegaudiodec.c

@@ -24,6 +24,8 @@
  * MPEG Audio decoder
  */
 
+#define UNCHECKED_BITSTREAM_READER 1
+
 #include "libavutil/audioconvert.h"
 #include "avcodec.h"
 #include "get_bits.h"

libavcodec/mpegvideo.c

@@ -1228,8 +1228,8 @@ int MPV_frame_start(MpegEncContext *s, AVCodecContext *avctx)
                 return -1;
 
             if(s->codec_id == CODEC_ID_FLV1 || s->codec_id == CODEC_ID_H263){
-                for(i=0; i<s->height; i++)
-                    memset(s->last_picture_ptr->f.data[0] + s->last_picture_ptr->f.linesize[0]*i, 16, s->width);
+                for(i=0; i<avctx->height; i++)
+                    memset(s->last_picture_ptr->f.data[0] + s->last_picture_ptr->f.linesize[0]*i, 16, avctx->width);
             }
 
             ff_thread_report_progress((AVFrame*)s->last_picture_ptr, INT_MAX, 0);